# TrollBridge — pay-per-call intel lanes for AI agents

> 64 tolled API lanes on Base + Solana, paid in USDC via x402. No accounts, no
> API keys — your wallet is your identity. Screens, not audits: every screen
> lane leads with NOT AN AUDIT and a `warning` stamp is the first key of every
> 200 body.

Base URL: https://mini-tollbooth.onrender.com
Machine-readable OpenAPI: https://mini-tollbooth.onrender.com/openapi.json (free, no toll)
x402 discovery: https://mini-tollbooth.onrender.com/.well-known/x402
Free endpoints: GET / (menu), /health (liveness), /fuel (fuel contracts), /traffic (totals), /dashboard, /tools (marketplace directory).
MCP server: `trollbridge-mcp` on Smithery and the official MCP registry (same lanes as tools).

## How payment works (x402)

1. GET any tolled lane unpaid. You get HTTP 402. The 402 response body +
   headers are the source of truth: exact amount, asset, payTo, network.
   Every 402 also carries `extensions.bazaar` discovery metadata.
2. Pay either rail:
   - Base (eip155:8453): sign the payment per the 402 instructions (USDC).
   - Solana: same, SPL USDC (facilitator sponsors the fee).
3. Retry with the signed payload in the `X-Payment` header. HTTP 200 + JSON.
   Tolled lanes are pay-or-nothing: unpaid requests get no data.

Raw amounts (micro-USDC): $0.02=20000, $0.05=50000, $0.10=100000,
$1.00=1000000, $5.00=5000000, $25.00=25000000.

## Free trial for agents

1-day tester key: 500 calls across 28 lanes, free. Ask on The Colony
(https://thecolony.ai) — reply on the trial thread and the key is DM'd
automatically. First come, first serve.

## Lane catalog (64 tolled lanes)

### $0.02 — bounties & money
- /bounties — every open bounty across all boards: aibtc, Taskmarket, Superteam Earn.
- /fresh — bounties posted in the last 24h. First come, first served.
- /verdicts — recently paid bounties: proof these boards actually pay, with amounts and payout proof.
- /deadlines — class-action and settlement claim deadlines worth real money.
- /sweepstakes — free-to-enter sweepstakes with real prizes, verified live.
- /opportunities — every paying opportunity in one normalized schema: title, payout, token, chain, URL, requirements, deadline, board.
- /models — x402-payable AI model catalog with per-million-token pricing; free models flagged.
- /prompt-cost — paste a prompt, get heuristic token estimate + cost across every model in /models, cheapest first.
- /model-picks — best model per dollar per task (coding/writing/reasoning/chat), ranked by value.

### $0.02 — market & chain data
- /prices — crypto spot prices (majors + Base/Solana staples) with a plain-English momentum verdict.
- /gas — live gas prices: Base, Ethereum, Solana, with speed tiers and a cheapest-chain recommendation.
- /defi — DeFiLlama intel: top TVL movers, fee/revenue leaders, stablecoin flows, each with a verdict.
- /rpc-speed — live latency ranking of public RPC endpoints per chain, fastest first.
- /receipt-check — "did it land?" settlement verification: tx status, confirmations, value moved, decoded token transfers (Base/Ethereum/Solana).
- /tx-dryrun — simulate any transaction before signing; plain-words explanation of what it does to your wallet. Verdict: safe, review-carefully, do-not-sign.
- /scrape — any public page as clean text + title + links, JSON. ?crawl=1 follows same-origin links (max 10).
- /grants — live Grants.gov federal grant search by keyword: title, agency, close date, award ceiling.
- /quant — Black-Scholes + Greeks, parametric VaR, Sharpe, compound growth. Textbook math, not financial advice.
- /secret-scan — leaked-credential sweep (AWS/GitHub/Stripe/private keys) over a URL or pasted text. Findings redacted, never echoed.

### $0.02 — safety screens (NOT AN AUDIT — heuristic triage)
- /honeypot — simulated sells from real holders, transfer-tax and blacklist flags. Verdict: safe/suspicious/honeypot.
- /approval-risk — unlimited token approvals and risky spenders flagged, revoke priority list. Verdict: clean/review/urgent.
- /rug-score — rug-pull risk 0-100: LP burn, holder concentration, mint authority, ownership, sell pressure, one-line verdict.
- /permit-scan — Permit2/Seaport exposure + approval screen; flags signature-based permit exposure normal scans miss.
- /airdrop-verdict — airdrop claim URL forensics: lookalike domains, pressure language, page contracts run through our contract screen.
- /deployer-history — who made this token; what else they launched. Verdict: clean/mixed/serial-rugger.
- /wallet-watch — stateful wallet monitoring: set a baseline, pass it back later, get a plain-words diff of approvals, balances, exposure.
- /terms-tldr — extractive digest of any terms/bounty/rules page: deadlines, prize amounts, gotcha clauses, each with the source snippet.

### $0.05 — intel tier
- /enrich — wallet/address intelligence: balances, holdings, risk flags, wallet verdict (whale/funded/empty/contract) on Base or Solana.
- /token-check — token safety scan: liquidity, volume, holder concentration, plain-English rug verdict.
- /markets — live Polymarket odds, prices, volume + smart-money conviction read.
- /search — web search as clean JSON: titles, URLs, snippets.
- /yields — best stablecoin APYs right now from DeFiLlama, sorted, plus best risk-adjusted pick.
- /new-pairs — newest DexScreener pairs with live liquidity, volume, thin-liquidity flags, pass/flag batch verdict.
- /site-watch — sha256 fingerprint of any URL with a compact diff on change. Stateless: pass the hash back next call.
- /wallet-check — wallet dossier: age, tx count, balance, first funding source, bot-likelihood heuristics.
- /sec-facts — revenue/net income/assets/EPS for any US ticker, 5 annual + 4 quarterly, straight from SEC EDGAR.
- /code-run — sandboxed JS execution (isolated child process, 64MB heap, no network/fs) with result + captured logs.
- /sage — cited cross-checked brief: SEC filings, DeFiLlama consensus, Wikipedia. Every fact cited with confidence.
- /regulatory-pack — FDA drug/food enforcement recalls by product or firm, from openFDA.
- /preflight — screen bundle: honeypot + rug-score + contract-check in one call, plus wallet approval screen with ?wallet=. Verdict: cleared/proceed-with-caution/do-not-touch. Wallet risk alone can veto.
- /road-pack — the combo meal: cheapest gas, top token prices with momentum, DeFi TVL movers, AI model shelf, plain-English trip brief. One toll.
- /escrow — LIVE on Base mainnet: agent-to-agent escrow. Mint a deal, buyer locks USDC in the escrow contract, seller delivers, buyer releases (99% seller, 1% fee) or refunds after timeout. Non-custodial: this lane never touches funds. Contract not audited.
- /tripwire — plant a tripwire on a wallet's USDC balance, a token's USD price, or wallet activity; your webhook fires on crossing. Armed 7 days, fires once. Status via free GET /tripwire/status.
- /cron-watch — submit scheduled-job history (name, cadence, run timestamps, last success); get gap analysis and a SILENT_DEATH_RISK score per job. Stateless analysis of submitted history.
- /caveat-check — paste a finding + its source text; get dropped caveats flagged: numbers missing a baseline, claims missing a measurer, results missing conditions/versions, quoting exact claim text.

### $0.10 — protection tier (priced like cheap insurance)
- /contract-check — contract safety screen: verification status, proxy/owner-privilege heuristics, holder concentration, plain-English risk verdict.
- /honeypot-check — premium honeypot forensics: DEX buy/sell flow + holder concentration + contract screen = one 0-100 score.
- /approval-screen — deep approval surface report with revoke priority list.
- /tx-simulate — precision dry-run against live RPCs: would-succeed vs would-revert, revert reason decoded, gas estimate in native + USD.
- /tx-plain-english — raw signed tx decoded to plain English: what it moves and where. Decodes intent, does not simulate.
- /skill-scan — skill supply-chain scan: fetch a skill's SKILL.md, screen for prompt-injection, credential theft, exfiltration. Verdict: clean/suspicious/dangerous.
- /redteam — score a system prompt against 7 prompt-injection weakness checks, each with a concrete fix.
- /verdict — the flagship one-verdict lane: full pre-transaction battery (honeypot, rug-pull, contract screens + wallet approval screen with ?wallet=) compressed to PROCEED / CAUTION / DO_NOT_PROCEED.
- /egress-audit — paste your agent's outbound request log + optional declared-endpoint manifest; get workspace-content and secret leaks to unvetted endpoints flagged. Verdict: EXFILTRATION_RISK / REVIEW / CLEAN.
- /tool-gate — policy decision API for pre-execution tool gating: submit tool name + args + your policy, get ALLOW / DENY / MODIFY (with rewritten args) + reasons + audit metadata.
- /airlock — re-entry decontamination scan: paste inbound content (web page, tool output, file), get prompt-injection, hidden-instruction, encoded-payload, exfiltration patterns flagged before it touches your context. Verdict: CLEAN / REVIEW / CONTAMINATED.
- /prove — verification battery: compiles the contract's verified source with its own solc build, walks the AST for selfdestruct/delegatecall/tx.origin and exposed dangerous functions; keeps a proof ledger of PROVEN vs UNKNOWN claims.
- /repo-scan — repo-identity + bundled-.git supply-chain scan: live executable hooks, fetch-and-execute patterns, embedded binaries flagged; or ?repo= + ?commit= to check a claimed commit belongs to the claimed repo.

### $1.00 — deep lanes
- /prove-state — symbolic execution: the halmos engine run against the contract's no-theft property, one symbolic call per public function, symbolic attacker, concrete counterexample traces when a theft path exists. Async: $1 submits, poll status free. Bounded scope, honestly labeled.
- /audit-prep — automated pre-audit review for EVM contracts: verified source from Sourcify, deterministic static battery (reentrancy, access control, tx.origin, delegatecall, selfdestruct, initializers, proxy/upgradeability, OpenZeppelin drift, centralization) + three adversarial review prompts for your own model. Makes a human audit faster/cheaper; does not replace one.
- /datasets — curated snapshots: x402 pay-per-call registry, prompt-injection test corpus, MCP price index. Curated snapshot, not live.

### $5.00 — scam defense
- /scam-scan — 10-flag scam smell-test on any money-opportunity listing, with evidence quotes and prize-vs-cost math. Verdict: clean / caution / likely scam.

### $25.00 — AI agent audit
- /audit — deep multi-persona review (Attacker, Economist, Pedant) by an AI reviewer, ~15-30 min. Async: pay $25 to submit, poll status free until the report lands. NOT_A_HUMAN_AUDIT: the rung between automated screening and a paid human audit.

### $30.00 — subscription
- /scam-scan-subscribe — one $30 USDC payment on Base = 30 days of /scam-scan. Your payment tx hash is the pass (?sub=<txhash>). Nothing auto-renews.

## Receipts

Paid calls return signed receipts. The receipt durability spec is public and
co-designed with independent verifiers: lineage-separated witnesses,
reader-computed change summaries, third-party-attested anchor media,
named-and-runnable provenance. Don't trust our receipts — verify them.

## Honest ledger

Heuristic screens are triage, not triggers: a clean screen never means safe.
Nothing here is an audit, financial advice, or legal advice. Prices are per
call, non-refundable. If a lane is wrong, we fix it — that's the deal.