@crestdeploymentsystems/verify

Verify any x402 endpoint. Get a signed Trust Receipt.

Install

npm i @crestdeploymentsystems/verify

CLI

npx @crestdeploymentsystems/verify https://api.exa.ai/search

Output

  crest verify https://api.exa.ai/search

  ┌─────────────────────────────────────────┐
  │         CREST TRUST RECEIPT              │
  └─────────────────────────────────────────┘

  subject:  https://api.exa.ai/search
  checked:  2026-05-25T23:11:52.545Z
  duration: 674ms

  CHECKS
  ✓  endpoint is reachable
  ✓  endpoint serves x402 payment challenge
  ✓  service has observed trust history
     score: 95 (low)
  ✓  service has a network passport
  -  endpoint publishes /.well-known/agent.json

  receipt: cc8f9e0e8f543735...
  4/5 verified | 0 no_data | 0 unverified

Programmatic

import { verify } from '@crestdeploymentsystems/verify';

const receipt = await verify('https://api.exa.ai/search');
console.log(receipt.summary);      // { verified: 4, no_data: 0, ... }
console.log(receipt.checks);       // detailed check results
console.log(receipt.refusals);     // what we refused to claim and why
console.log(receipt.integrity);    // { receipt_ref: "sha256:...", canon_method: "jcs-rfc8785" }

What it checks

1. Liveness -- is the endpoint reachable?
2. x402 challenge -- does it return HTTP 402 with payment headers?
3. Trust history -- is it in the 47K+ on-chain service index?
4. Network passport -- does it have observed payment history?
5. Discovery -- does it publish /.well-known/agent.json?

Honest nulls

When we don't know, we say so:

{
  "status": "no_data",
  "claim": "service has observed trust history",
  "null_reason": "unknown_service"
}

We never fabricate scores. 47,814 services indexed from on-chain USDC flows. Zero self-reported.

License

MIT

Author

Crest Deployment Systems LLC