LIVE MERCHANT API · BASE MAINNET · AI-ASSISTED

Catch risky workflows before they ship.

Paste an authorized GitHub Actions YAML file. Explore a free browser-local checker first, or request an optional machine-readable JSON + SARIF report from the existing VM5 merchant for exactly 0.20 native Circle USDC.

Open free local checker ↗ Inspect paid report steps ↓

No newsletter, user registration or hidden plan. Viewing this page and inspecting a 402 quote costs $0. Price inspection uploads only a fixed, public synthetic example, NEVER your YAML. Only an explicit paid wallet authorization can send your file.

workflow-guard / evidence-first

$ preflight workflow.yml

01 Static checks ✓ local tool

02 Machine report optional

03 x402 payment Base USDC

quote != authorization

authorization != settled payment

payment != a security audit

1 paid request · 0.20 USDC

A TWO-TIER PRODUCT, NOT TWO DIFFERENT SELLERS

Free where you can. Pay when structured output helps.

01 · $0

Local-first inspection

Use the existing free Workflow Risk Check. It analyzes browser-local YAML without sending it to a merchant, flags risky events, broad workflow permissions and mutable actions, and suggests places to investigate.

02 · 0.20 Base USDC

Hosted JSON/SARIF report

The existing VM5 API creates a structured static YAML report for a nonsecret file you deliberately send. Useful for agents, CI bots and teams integrating heuristic findings into their own workflows. Bounded input: 48KB.

See the free, fictional report sample ↗

03 · NO SUBSCRIPTION

Explicit x402 checkout

First validate the live unsigned payment challenge. Then, with a compatible injected EVM wallet on Base, sign exactly one USDC authorization. A 402 response is not a purchase or delivery receipt.

LIVE QUOTE · OPTIONAL CHECKOUT

Get a workflow risk report

Only paste public or otherwise explicitly authorized nonsecret workflows. The unsigned price check sends a fixed public synthetic example, not your YAML. Actual YAML is sent to VM5 only after you explicitly authorize a paid request. For private work, use the free local checker instead.

per authorized request0.20 USDCCircle · Base 8453

File name

GitHub Actions YAML (nonsecret)

Limit: 48,000 UTF-8 bytesWorkflow source is not executed by this page.

Include SARIF output when supported I own or may submit this NONSECRET YAML. I agree it may be uploaded to VM5 ONLY if I separately authorize the 0.20 USDC paid request.

PAYMENT PROCESS

Preview a free fictional report — no wallet

See the real merchant's public example JSON. No workflow upload, signature, or charge. The example is not a report on your file.

Check live price — free

Sends a fixed, public synthetic YAML example to get an unsigned 402 price challenge. Your YAML is not uploaded during this step.

Connect your wallet

No recovery phrase or private key entry. Your injected wallet stays in control. Switch to Base mainnet within the wallet if required.

No wallet connected.

Approve precisely one paid request

Click only if you want to buy. Inspect 0.20 USDC and the merchant address in your wallet. Do not repeat after an ambiguous timeout.

Report response

No report yet. You can inspect the price without paying.

TRANSPARENT PAYMENT DETAILS

Know what you are signing.

Existing merchant origin: VM5 OpenAPI x402 · docs ↗
Endpoint: POST /v1/workflow-risk
Network: eip155:8453 — Base mainnet
Token: Native Circle USDC 0x833589fCD6eDb6E08f4C7C32D4f71b54bdA02913
Payee pinned by this page: 0x6b01efA0705E91a7aca54271510bf9e594717f34
Maximum this page will sign: Exactly 200,000 atomic USDC units = 0.20 USDC — no unlimited allowance.
What is not required: Account signup, wallet recovery phrase, private key upload, ERC-20 unlimited approve, or prepayment to list.

An EIP-3009 typed-data signature can authorize an actual transfer. Once submitted, a browser error is not proof that settlement failed. This page deliberately does not retry signed requests. Wallet extensions, network and merchant availability vary. The payment flow has been independently checked against a real 402 quote but has not been tested with a live buyer-signed payment.

HONEST LIMITS

Heuristics are not a security audit.

We detect patterns worth investigating, not all bugs, exploits, or compliance failures. A clean report does not validate external scripts, custom runners, organization settings, repository secrets, permissions outside the workflow, or actual production behavior. Do not upload private keys, employee data, secret workflow tokens or confidential company files. The VM2 free tool and VM5 paid merchant belong to the same human economic owner; they are not separate independent vendors or testimonials. No customer count, guaranteed savings, or unverified revenue is claimed.

Free tool source and tests ↗ · Existing merchant source ↗ · Contact support