{"x402Version":2,"type":"bazaar-listing","service":{"name":"HALOWERK sicherwerk","url":"https://sicher.halowerk.com","version":"1.0.0","icon":"https://sicher.halowerk.com/favicon.svg"},"items":[{"id":"sicherwerk.cve_check","name":"cve_check","title":"Check a package list against known vulnerabilities and get, per package, the severity breakdown and the lowest version that closes every finding.","description":"Queries OSV.dev for a list of packages with versions across npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist and the Linux distributions. For each package it returns the vulnerabilities found with their identifiers, severity and summary, and the single figure that decides what to do next: the lowest version that fixes all of them, derived from the fixed-version events in the affected ranges. Findings are counted by severity and the whole list gets one worst-case verdict so a pipeline can gate on it. Severity is read from several places because databases disagree on where they put it, and the source of the rating is reported. OSV records what is published — a package with no finding is not proven safe, only unreported, and an internal or vendored package is invisible here.","category":"sicherwerk","keywords":[],"resource":"https://sicher.halowerk.com/v1/cve-check","method":"POST","mimeType":"application/json","inputSchema":{"type":"object","required":["packages"],"additionalProperties":false,"properties":{"packages":{"type":"array","minItems":1,"maxItems":100,"description":"The packages to check.","items":{"type":"object","required":["name","version"],"additionalProperties":false,"properties":{"name":{"type":"string","minLength":1,"maxLength":200,"description":"Package name as the ecosystem spells it."},"version":{"type":"string","minLength":1,"maxLength":60,"description":"Exact installed version."},"ecosystem":{"type":"string","maxLength":30,"description":"Ecosystem, e.g. npm, PyPI, Go. Defaults to the top-level value."}}}},"ecosystem":{"type":"string","maxLength":30,"default":"npm","description":"Default ecosystem for entries that do not name one."},"min_severity":{"type":"string","enum":["low","medium","high","critical"],"description":"Only report findings at or above this severity."},"include_details":{"type":"boolean","default":true,"description":"Fetch summary and severity per finding. Off is faster but returns ids only."}}},"outputSchema":{"type":"object"},"price":{"amount":"5000","currency":"USDC","decimals":6,"human":"0.005 USDC"},"accepts":[{"scheme":"exact","network":"eip155:8453","payTo":"0x2880EdfFF13100677Bf97A3CBdF3Bc34771C4E5E","price":{"amount":"5000","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","extra":{"asset":"USDC","network_name":"Base Mainnet","name":"USD Coin","version":"2","assetTransferMethod":"eip3009","eip712Domain":{"name":"USD Coin","version":"2","chainId":8453,"verifyingContract":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"}}},"maxTimeoutSeconds":300}]},{"id":"sicherwerk.sbom_build","name":"sbom_build","title":"Build a CycloneDX or SPDX software bill of materials from package manifests or lockfiles, and say whether the versions are exact enough to be evidence.","description":"Parses package-lock.json, package.json, requirements.txt, go.mod and Cargo.lock and emits a bill of materials in CycloneDX 1.5 or SPDX 2.3, with a package URL per component. The distinction that decides whether the document is worth anything is made explicit: a lockfile names the versions actually installed, a manifest only names ranges, and a bill of materials built from ranges describes what might be installed rather than what is. Files parsed from ranges are marked and the components carry the range alongside the resolved value. Direct and transitive dependencies are separated where the format allows, development-only entries are flagged, and duplicate name-version pairs are collapsed. Everything runs locally on the text you pass — nothing is fetched and no registry is consulted, so the result reflects your files and not the current state of any registry.","category":"sicherwerk","keywords":[],"resource":"https://sicher.halowerk.com/v1/sbom","method":"POST","mimeType":"application/json","inputSchema":{"type":"object","required":["files"],"additionalProperties":false,"properties":{"files":{"type":"array","minItems":1,"maxItems":10,"description":"The manifest or lock files.","items":{"type":"object","required":["content"],"additionalProperties":false,"properties":{"filename":{"type":"string","maxLength":300,"description":"File name; the type is detected from content if absent."},"content":{"type":"string","maxLength":4194304,"description":"File contents as text."}}}},"format":{"type":"string","enum":["cyclonedx","spdx","plain"],"default":"cyclonedx","description":"Output format."},"include_dev":{"type":"boolean","default":false,"description":"Include development-only dependencies."},"project_name":{"type":"string","maxLength":200,"default":"unnamed-project","description":"Name for the document metadata."}}},"outputSchema":{"type":"object"},"price":{"amount":"5000","currency":"USDC","decimals":6,"human":"0.005 USDC"},"accepts":[{"scheme":"exact","network":"eip155:8453","payTo":"0x2880EdfFF13100677Bf97A3CBdF3Bc34771C4E5E","price":{"amount":"5000","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","extra":{"asset":"USDC","network_name":"Base Mainnet","name":"USD Coin","version":"2","assetTransferMethod":"eip3009","eip712Domain":{"name":"USD Coin","version":"2","chainId":8453,"verifyingContract":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"}}},"maxTimeoutSeconds":300}]},{"id":"sicherwerk.license_check","name":"license_check","title":"Resolve package licences and classify them for commercial use: which force disclosure, which only need attribution, and which are unknown.","description":"Looks up the declared licence of each package through deps.dev and sorts the result by the only question that matters for a closed, sold product: what does this licence demand. Permissive licences need attribution. Weak copyleft affects changes to the library itself. Strong copyleft can force disclosure of the whole work on distribution. Network copyleft such as AGPL and SSPL bites on operating the software as a service, which is the sharpest case for a paid API. Multi-licence expressions are handled by their operator — with OR the mildest applies because you may choose, with AND the strictest does. Packages whose licence is undeclared or outside the table are reported as unknown instead of assumed harmless. This is a classification to triage with, not legal advice, and the licence deps.dev records is what the package declared, which is not always what its files say.","category":"sicherwerk","keywords":[],"resource":"https://sicher.halowerk.com/v1/license-check","method":"POST","mimeType":"application/json","inputSchema":{"type":"object","required":["packages"],"additionalProperties":false,"properties":{"packages":{"type":"array","minItems":1,"maxItems":80,"description":"Packages to check.","items":{"type":"object","required":["name"],"additionalProperties":false,"properties":{"name":{"type":"string","minLength":1,"maxLength":200},"version":{"type":"string","maxLength":60,"description":"Exact version. The default version is used if omitted."},"ecosystem":{"type":"string","maxLength":30}}}},"ecosystem":{"type":"string","maxLength":30,"default":"npm","description":"Default ecosystem."},"usage":{"type":"string","enum":["saas","distributed","internal"],"default":"saas","description":"How you use the code. saas = operated as a network service, which is what triggers AGPL."}}},"outputSchema":{"type":"object"},"price":{"amount":"2000","currency":"USDC","decimals":6,"human":"0.002 USDC"},"accepts":[{"scheme":"exact","network":"eip155:8453","payTo":"0x2880EdfFF13100677Bf97A3CBdF3Bc34771C4E5E","price":{"amount":"2000","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","extra":{"asset":"USDC","network_name":"Base Mainnet","name":"USD Coin","version":"2","assetTransferMethod":"eip3009","eip712Domain":{"name":"USD Coin","version":"2","chainId":8453,"verifyingContract":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"}}},"maxTimeoutSeconds":300}]},{"id":"sicherwerk.container_inspect","name":"container_inspect","title":"Inspect a container image without pulling it: manifest, layers with sizes, architectures, entrypoint, user, exposed ports and image age.","description":"Reads the manifest and config of an OCI or Docker image straight from the registry — a few kilobytes, never the layers, and the image is never run. Returns the digest, the platforms a multi-arch index covers, every layer with its size and the command that produced it, and the runtime configuration: entrypoint, command, working directory, exposed ports, volumes and environment variable names. Security-relevant findings are called out: an image configured to run as root, an image whose build date is far in the past and therefore missing every base-image patch since, and a tag rather than a digest being used, which is mutable and can point somewhere else tomorrow. Works with Docker Hub, GitHub Container Registry, Quay and registry.k8s.io for public images. Environment values are not returned, only names — a build that baked a secret into a layer would otherwise leak it here.","category":"sicherwerk","keywords":[],"resource":"https://sicher.halowerk.com/v1/container-inspect","method":"POST","mimeType":"application/json","inputSchema":{"type":"object","required":["image"],"additionalProperties":false,"properties":{"image":{"type":"string","maxLength":400,"description":"Image reference, e.g. alpine:3.19, ghcr.io/owner/app:v1 or repo@sha256:…"},"platform":{"type":"string","maxLength":40,"default":"linux/amd64","description":"Which platform to resolve from a multi-arch index."},"stale_days":{"type":"integer","minimum":1,"maximum":3650,"default":180,"description":"Warn when the image was built more than this many days ago."}}},"outputSchema":{"type":"object"},"price":{"amount":"5000","currency":"USDC","decimals":6,"human":"0.005 USDC"},"accepts":[{"scheme":"exact","network":"eip155:8453","payTo":"0x2880EdfFF13100677Bf97A3CBdF3Bc34771C4E5E","price":{"amount":"5000","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","extra":{"asset":"USDC","network_name":"Base Mainnet","name":"USD Coin","version":"2","assetTransferMethod":"eip3009","eip712Domain":{"name":"USD Coin","version":"2","chainId":8453,"verifyingContract":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"}}},"maxTimeoutSeconds":300}]},{"id":"sicherwerk.tls_chain","name":"tls_chain","title":"Read the TLS certificate chain of a host: every certificate with its names, validity, key type and signature, plus expiry warnings and whether the hostname is actually covered.","description":"Opens a TLS connection and reports the chain the server presents. Per certificate: subject and issuer, validity window with days remaining, serial, SHA-256 fingerprint, key type and size, and the subject alternative names. Above that it answers the questions a monitor asks: is the requested hostname covered by the leaf certificate including wildcard rules, how many days until the nearest expiry, is any certificate self-signed or signed with a weak algorithm, does the server send its intermediates or leave the client to find them — a chain that validates in a browser can still fail in a language runtime that does not fetch missing intermediates. The negotiated protocol version and cipher are reported. It connects to the host itself, so there is no third-party dependency and no rate limit.","category":"sicherwerk","keywords":[],"resource":"https://sicher.halowerk.com/v1/tls-chain","method":"POST","mimeType":"application/json","inputSchema":{"type":"object","required":["host"],"additionalProperties":false,"properties":{"host":{"type":"string","maxLength":255,"description":"Hostname or https URL, e.g. example.com."},"port":{"type":"integer","minimum":1,"maximum":65535,"default":443,"description":"TLS port."},"servername":{"type":"string","maxLength":255,"description":"SNI name if it differs from host."},"warn_days":{"type":"integer","minimum":1,"maximum":365,"default":30,"description":"Warn when a certificate expires within this many days."}}},"outputSchema":{"type":"object"},"price":{"amount":"2000","currency":"USDC","decimals":6,"human":"0.002 USDC"},"accepts":[{"scheme":"exact","network":"eip155:8453","payTo":"0x2880EdfFF13100677Bf97A3CBdF3Bc34771C4E5E","price":{"amount":"2000","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","extra":{"asset":"USDC","network_name":"Base Mainnet","name":"USD Coin","version":"2","assetTransferMethod":"eip3009","eip712Domain":{"name":"USD Coin","version":"2","chainId":8453,"verifyingContract":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"}}},"maxTimeoutSeconds":300}]},{"id":"sicherwerk.jwt_verify","name":"jwt_verify","title":"Verify a JWT signature and claims, and name the classic token attacks explicitly: alg none, HMAC confusion, unbounded lifetime, missing audience.","description":"Decodes a JWT and checks it in two layers. Structure and claims: expiry, not-before and issued-at against the current time with the clock skew you allow, issuer and audience against the values you expect, and the token lifetime. Signature: HMAC with a shared secret, or RSA, RSA-PSS and ECDSA against a PEM key or a JWKS you point at, with the kid matched to the right key. On top of that it names the attacks that live in this exact spot: alg set to none, an HMAC algorithm where an asymmetric key is expected which is the classic key-confusion path, a token with no expiry at all, and an audience that does not name you. Without a key or secret the token is decoded and its claims judged, and the signature is reported as unverified rather than assumed good.","category":"sicherwerk","keywords":[],"resource":"https://sicher.halowerk.com/v1/jwt-verify","method":"POST","mimeType":"application/json","inputSchema":{"type":"object","required":["token"],"additionalProperties":false,"properties":{"token":{"type":"string","minLength":10,"maxLength":20000,"description":"The JWT in compact form."},"secret":{"type":"string","maxLength":2000,"description":"Shared secret for HS256/384/512."},"public_key_pem":{"type":"string","maxLength":8000,"description":"PEM public key for RS/PS/ES algorithms."},"jwks_url":{"type":"string","maxLength":2000,"description":"JWKS endpoint; the key is picked by kid."},"expected_issuer":{"type":"string","maxLength":500,"description":"Issuer the token must carry."},"expected_audience":{"type":"string","maxLength":500,"description":"Audience the token must name."},"clock_skew_seconds":{"type":"integer","minimum":0,"maximum":3600,"default":60,"description":"Tolerance for exp and nbf."},"max_lifetime_seconds":{"type":"integer","minimum":1,"description":"Flag tokens valid for longer than this."}}},"outputSchema":{"type":"object"},"price":{"amount":"2000","currency":"USDC","decimals":6,"human":"0.002 USDC"},"accepts":[{"scheme":"exact","network":"eip155:8453","payTo":"0x2880EdfFF13100677Bf97A3CBdF3Bc34771C4E5E","price":{"amount":"2000","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","extra":{"asset":"USDC","network_name":"Base Mainnet","name":"USD Coin","version":"2","assetTransferMethod":"eip3009","eip712Domain":{"name":"USD Coin","version":"2","chainId":8453,"verifyingContract":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"}}},"maxTimeoutSeconds":300}]},{"id":"sicherwerk.webhook_signature","name":"webhook_signature","title":"Verify a signed webhook from GitHub, Stripe, Shopify, Slack, Svix or a plain HMAC scheme, with the timestamp window checked where the provider signs one.","description":"Providers each build their signing string differently — some sign only the body, others prepend a timestamp, an id, or a version marker in a fixed order — and getting that order wrong produces a mismatch that looks exactly like an attack. This checks the signature the way the named provider actually specifies, with constant-time comparison, and returns the string that was signed so a mismatch can be debugged instead of guessed at. Where the provider signs a timestamp, it is checked against a tolerance window, because a signature valid forever lets any captured delivery be replayed. The body must be passed exactly as received, byte for byte: a re-serialised JSON payload has different bytes and will never match, which is the single most common cause of a failed check and is called out when the body looks reformatted.","category":"sicherwerk","keywords":[],"resource":"https://sicher.halowerk.com/v1/webhook-signature","method":"POST","mimeType":"application/json","inputSchema":{"type":"object","required":["provider","body","secret"],"additionalProperties":false,"properties":{"provider":{"type":"string","enum":["github","stripe","shopify","slack","svix","generic_hmac"],"description":"Which provider signed the request."},"body":{"type":"string","maxLength":200000,"description":"The raw request body exactly as received, not re-serialised."},"secret":{"type":"string","minLength":1,"maxLength":2000,"description":"The signing secret."},"signature":{"type":"string","maxLength":2000,"description":"The signature header value. Required unless headers is given."},"headers":{"type":"object","description":"All request headers; the right one is picked by provider."},"timestamp":{"type":"string","maxLength":40,"description":"Timestamp, if the provider signs one and it is not in the headers."},"message_id":{"type":"string","maxLength":200,"description":"Message id for schemes that sign one, e.g. Svix."},"tolerance_seconds":{"type":"integer","minimum":1,"maximum":86400,"default":300,"description":"How old a signed timestamp may be."}}},"outputSchema":{"type":"object"},"price":{"amount":"2000","currency":"USDC","decimals":6,"human":"0.002 USDC"},"accepts":[{"scheme":"exact","network":"eip155:8453","payTo":"0x2880EdfFF13100677Bf97A3CBdF3Bc34771C4E5E","price":{"amount":"2000","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","extra":{"asset":"USDC","network_name":"Base Mainnet","name":"USD Coin","version":"2","assetTransferMethod":"eip3009","eip712Domain":{"name":"USD Coin","version":"2","chainId":8453,"verifyingContract":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"}}},"maxTimeoutSeconds":300}]},{"id":"sicherwerk.provenance_verify","name":"provenance_verify","title":"Look up an artefact hash in the Sigstore transparency log and report who signed it, from which repository and workflow, and when.","description":"Searches the Sigstore Rekor log for entries matching an artefact hash and returns what a provenance claim is actually worth: the log index and inclusion time, the signing identity from the certificate, and where available the source repository and workflow reference that produced it. Several entries for one hash are all returned, because a rebuild or a second signer is a fact worth seeing rather than collapsing. The search is by hash only: the artefact itself is never uploaded, so a hash can be checked without handing the file to anyone. An entry in the log proves that someone signed this hash at that time and that the record is publicly auditable — it does not prove the artefact is safe, that the signer is who you want, or that the build was honest. Absence is likewise not evidence of tampering; most software is simply never signed.","category":"sicherwerk","keywords":[],"resource":"https://sicher.halowerk.com/v1/provenance-verify","method":"POST","mimeType":"application/json","inputSchema":{"type":"object","additionalProperties":false,"properties":{"sha256":{"type":"string","minLength":64,"maxLength":71,"description":"Artefact SHA-256, with or without the sha256: prefix."},"log_index":{"type":"integer","minimum":0,"description":"Fetch one specific log entry instead of searching."},"email":{"type":"string","maxLength":200,"description":"Search by signer email instead of by hash."},"limit":{"type":"integer","minimum":1,"maximum":20,"default":5,"description":"How many entries to detail."}}},"outputSchema":{"type":"object"},"price":{"amount":"5000","currency":"USDC","decimals":6,"human":"0.005 USDC"},"accepts":[{"scheme":"exact","network":"eip155:8453","payTo":"0x2880EdfFF13100677Bf97A3CBdF3Bc34771C4E5E","price":{"amount":"5000","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","extra":{"asset":"USDC","network_name":"Base Mainnet","name":"USD Coin","version":"2","assetTransferMethod":"eip3009","eip712Domain":{"name":"USD Coin","version":"2","chainId":8453,"verifyingContract":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"}}},"maxTimeoutSeconds":300}]}],"capability_request":{"url":"https://bedarf.halowerk.com/capabilities/request","method":"POST","cost":"free","description":"Missing a capability, or does the scope not fit? Report the need here - no payment required. Similar reports are bundled; the response returns an id you can check back on.","body_example":{"requested_capability":"short label","description":"what exactly is needed","max_price":0.01}},"updated_at":"2026-08-11T13:23:09.039Z"}