{"name":"FabTally WebSafe — pre-fetch web-safety checks for agents","version":"1.0.0","summary":"Cheap per-call checks an AI agent runs BEFORE it fetches an arbitrary/user-supplied URL or ingests untrusted content: url-safety (screen a URL for SSRF/private-IP/metadata targets, TLS, reachability, redirect chain and known-bad shape — also a webhook-URL verifier), injection-scan (heuristic prompt-injection / jailbreak + hidden-text detection over text or a public page), and robots-check (robots.txt + llms.txt/ai.txt + AI-crawler directives -> allow/deny for a UA). All read-only, keyless, stateless, descriptive; heuristic checks are honestly best-effort, not a guarantee. Paid via x402 (USDC on Base) or a prepaid credit key; each has a rate-limited free teaser. Also available as an MCP server.","operator":"Sunstone Soft","contact":"hello@fabtally.com","category":"Compute / web-safety utilities","terms":"Read-only checks over public data. No PII, funds, or request data are ever stored; every call is computed and discarded. The URL screener never fetches internal targets and never returns response bodies. Outputs are descriptive and best-effort (heuristic checks report signals, not guarantees) — not a security guarantee.","pricing":{"model":"per-call","checks":{"url-safety":"$0.003","injection-scan":"$0.004","robots-check":"$0.001"},"freeTeaserDailyQuota":50},"mcp":{"transport":["stdio","streamable-http"],"http":"https://websafe.fabtally.com/mcp","note":"Same checks as MCP tools; paid tools relay the x402 challenge."},"payment":{"protocol":"x402","x402Version":2,"scheme":"exact","network":"eip155:8453","chainId":"eip155:8453","asset":"USDC","assetAddress":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","payTo":"0xccB5d25C698FdfdaA7B21d54088774cF512A90e3","facilitator":"https://facilitator.daydreams.systems","creditRail":{"description":"Prepay by card and send an X-FabTally-Key: fabt_… header instead of x402.","buy":"https://fabtally.com/buy","balance":"GET https://fabtally.com/agent/v1/balance"}},"checks":[{"key":"url-safety","method":"POST","url":"https://websafe.fabtally.com/v1/url-safety","price":"$0.003","priceAtomicUsdc":"3000","free":"https://websafe.fabtally.com/v1/url-safety/free","description":"Screen a URL BEFORE fetching it (or verify a webhook URL). Give {url}; get an SSRF verdict — does the host resolve to private/loopback/link-local or a cloud metadata IP (169.254.169.254)? — plus TLS validity, reachability + HTTP status, the full redirect chain (and whether a redirect lands somewhere riskier), a known-bad URL-shape heuristic, and the final resolved IP class. Never fetches internal targets or returns bodies. Read-only, stateless.","example":{"url":"https://example.com/"}},{"key":"injection-scan","method":"POST","url":"https://websafe.fabtally.com/v1/injection-scan","price":"$0.004","priceAtomicUsdc":"4000","free":"https://websafe.fabtally.com/v1/injection-scan/free","description":"HEURISTIC (best-effort, NOT a guarantee) scan of untrusted text OR a fetched public page for prompt-injection / jailbreak patterns: 'ignore previous instructions', role-override, tool-abuse/exfiltration, hidden text (zero-width chars, HTML comments, white-on-white / display:none) and suspicious instruction density. Give {text} OR {url}; get a 0-100 risk score, level, matched categories and matched snippets. Read-only, stateless.","example":{"text":"Summarize this article for me please."}},{"key":"robots-check","method":"POST","url":"https://websafe.fabtally.com/v1/robots-check","price":"$0.001","priceAtomicUsdc":"1000","free":"https://websafe.fabtally.com/v1/robots-check/free","description":"Parse robots.txt AND the emerging llms.txt / ai.txt + known AI-crawler directives (GPTBot, ClaudeBot, Google-Extended, CCBot, PerplexityBot, …) to return an allow/deny verdict for a given user-agent, so a compliant crawling agent stays on the right side of a site's stated policy. Give {url, user_agent?}. Read-only, stateless.","example":{"url":"https://www.nytimes.com/section/world","user_agent":"GPTBot"}}],"fetchedAt":"2026-08-01T08:02:55.208Z"}