insumer-verify — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited insumer-verify (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Privacy-preserving on-chain token and NFT verification across 37 blockchains (31 EVM + Solana + XRPL + Bitcoin + Tron + Stellar + Sui). Returns ECDSA-signed boolean results. No raw balances exposed.
Version: 1.21.0
InsumerAPI lets agents evaluate wallet state against conditions without handling private keys or raw balance data. Every response is ECDSA P-256 (ES256) signed and independently verifiable; attest and trust results are signed twice, ES256 and a post-quantum ML-DSA-65 signature.
Agents can:
Use the insumer_setup tool with your email, or sign up at insumermodel.com/developers. Free tier available (instant, no credit card).
export INSUMER_API_KEY="insr_live_..."{
"mcpServers": {
"insumer": {
"command": "npx",
"args": ["-y", "mcp-server-insumer"],
"env": {
"INSUMER_API_KEY": "insr_live_..."
}
}
}
}#### insumer_setup(email, appName?) Generate a free InsumerAPI key instantly. Returns an insr_live_... key with 10 free verifications plus 100 requests a day. No credit card required. One free key per email, with a per-IP daily limit.
#### insumer_jwks() Get the JWKS (RFC 7517): five entries over two keys. An ECDSA P-256 key under three kids (insumer-attest-v1, insumer-attest-v2, insumer-trust-v2) and an ML-DSA-65 post-quantum key under two (insumer-attest-pq1, insumer-trust-pq1). Match the entry by the kid (or pqKid) on the response, never by position. No authentication required.
#### insumer_attest(wallet?, solanaWallet?, xrplWallet?, bitcoinWallet?, tronWallet?, stellarWallet?, suiWallet?, conditions, proof?, format?) Verify 1-10 on-chain conditions (token balances, NFT ownership, EAS attestations, Farcaster identity, boolean view calls, supply/amount ratios, ERC-8004 agent registration, ERC-7710 delegation validity, and account_code: the code state of the wallet address itself on an EVM chain, with expect of none for a plain key account, eip7702 for an EIP-7702 delegation designator, optionally to a given delegate, or contract for any other code; the answer is met or not met, and the code and the delegation target are never returned) across 37 chains. Returns ECDSA-signed boolean results with evaluatedCondition, conditionHash (SHA-256), and blockNumber/blockTimestamp. Stellar results include ledgerIndex/ledgerHash and surface assetCode (which flows into conditionHash for non-native assets). Sui results include checkpointSequence/checkpointDigest. 1 credit (2 with proof: "merkle" for EIP-1186 Merkle proofs, available on 27 of the 31 EVM chains: not on ZKsync Era, Sei, Viction or XDC Network, and not on non-EVM chains; subjects account_balance for the native coin, account_code for the account's code hash, delegation_revocation for a delegation's revocation slot, and no subject on an ERC-20 balance-slot proof). Optional format: "jwt" for ES256-signed JWT output.
#### insumer_compliance_templates() List available EAS compliance templates (Coinbase Verified Account/Country/One on Base, Gitcoin Passport on Optimism). Pre-configured schema IDs, attester addresses, and decoder contracts. Free, no auth.
#### insumer_wallet_trust(wallet, solanaWallet?, xrplWallet?, bitcoinWallet?, tronWallet?, stellarWallet?, suiWallet?, proof?) Generate an ECDSA-signed wallet trust fact profile. 155 base checks across 27 chains in 10 dimensions: stablecoins (USDC, USDT, OUSD, PYUSD, USDG, USD1, RLUSD, USDS, DAI, EURC across 23 EVM chains), governance, NFTs, staking, institutional stablecoins (EURCV, USDCV, USDC, BENJI across Ethereum, Solana, XRPL, Stellar, Sui), tokenized treasuries (BUIDL, USYC, OUSG, USTB, USDY), stablecoin deposits (Aave v3, sUSDS, sDAI, Morpho USDC vaults), wrapped bitcoin (cbBTC, WBTC, tBTC), names (ENS, Basenames) and account (contract code and EIP-7702 delegation at the wallet address on Ethereum, Base, Arbitrum, Optimism and Polygon; a plain key reads false on both, and which contract is never named). Up to 176 checks across 29 chains in 14 dimensions with optional Solana, XRPL, Bitcoin, and Tron wallets; Stellar and Sui wallets switch on rows inside the base dimensions. Every check is a presence check; the account rows are present or not present. Dimensions arrive in a fixed order: the base dimensions as listed, then any of solana, xrpl, bitcoin and tron that were switched on, in that order. conditionSetVersion (currently 2026-10-08) is signed and names the check list; log it, never reject on it. 3 credits (6 with merkle).
#### insumer_batch_wallet_trust(wallets, proof?, detail?) Batch trust profiles for up to 10 wallets (each accepts wallet, solanaWallet, xrplWallet, bitcoinWallet, tronWallet, stellarWallet, suiWallet). Faster than sequential calls. Partial success supported. 3 credits/wallet (6 with merkle). The text is a per-wallet summary by default (profile ID, held / not held / not evaluated counts, checks held per dimension in the fixed dimension order, identical for every wallet; the account dimension's checks are present rather than held); the complete signed profiles are in structuredContent. detail: "full" puts them in the text too, tens of thousands of characters per wallet; set it on the call that needs it, since profiles cannot be fetched again and a second call is charged again.
#### insumer_verify(merchantId, wallet?, solanaWallet?, xrplWallet?) Create a signed discount code (INSR-XXXXX, 30-min expiry) for a wallet at a merchant. Returns tier and discount percentage. Takes an EVM, Solana or XRPL wallet. A code that carries a discount costs 1 credit from the API key that owns the store; a 0% result is free. A caller using another key is not charged.
#### insumer_list_merchants(token?, verified?, limit?, offset?) Browse the merchant directory. Filter by accepted token symbol, verification status. Returns company name, website, tokens accepted, and discount info.
#### insumer_get_merchant(id) Get full public merchant profile including token tiers, NFT collections, discount mode, and verification status.
#### insumer_list_tokens(chain?, symbol?, type?) List the tokens and NFT collections listed in the registry. Filter by chain ID, symbol, or asset type (token/nft). A directory, not the list of what can be checked: an attestation checks any token on a supported chain, and NFTs on EVM chains, Solana and XRPL, so an empty result does not mean a token is unsupported.
#### insumer_check_discount(merchant, wallet?, solanaWallet?, xrplWallet?) Calculate discount for a wallet at a merchant. Returns tier and discount percentage per token. Takes an EVM, Solana or XRPL wallet. Free, no credits consumed. An rpc_failure answer means a read did not complete; it is never "not eligible".
#### insumer_credits() Check verification credit balance, tier (free, pro, enterprise, paid or x402), and daily rate limit for the current API key.
#### insumer_buy_key(txHash, chainId, amount, appName, senderSignature) Buy a new API key with USDC (no auth required). Send the payment, then call with the transaction hash, the amount and senderSignature: the sending wallet's signature over a fixed text naming the payment (call once without it and the 400 returns the exact text). The sending wallet becomes the key's identity. One key per wallet. Supported chains: Ethereum, Base, Polygon, Arbitrum, Optimism, BNB Chain, Avalanche, Solana. USDT and other tokens are refused. Minimum $5. Non-refundable.
#### insumer_buy_credits(txHash, chainId, amount, updateWallet?, senderSignature?) Buy verification credits with USDC. Volume discounts: $5-$99 = $0.04/call, $100-$499 = $0.03, $500+ = $0.02. Minimum $5. Supported chains: Ethereum, Base, Polygon, Arbitrum, Optimism, BNB Chain, Avalanche, Solana. The first purchase registers the sending wallet; updateWallet: true replaces it. senderSignature is required when the key has no registered wallet yet, or with updateWallet: true from a different wallet; a payment from the registered wallet needs none. Non-refundable.
#### insumer_confirm_payment(code, txHash, chainId, amount) Confirm a USDC payment for a discount code. After calling insumer_verify, confirm the on-chain payment. The server verifies the transaction receipt. Supported chains: Ethereum, Base, Polygon, Arbitrum, Optimism, BNB Chain, Avalanche, Solana.
#### insumer_create_merchant(companyName, companyId, location?) Create a new merchant, owned by the API key that creates it. The store has no balance of its own: that key pays for its codes, scans and taps, and credits in the response is that key's balance. A key can create a limited number of merchants (429 past it).
#### insumer_merchant_status(id) Get full private merchant details: credits, token configs, NFT collections, directory status, verification status, USDC settings.
#### insumer_configure_tokens(id, ownToken?, partnerTokens?) Configure merchant token discount tiers. Set own token and/or partner tokens. Max 8 tokens total. Each token can carry a display name and logo; the own token takes enabled (true or false). Tier discounts are whole numbers from 1 to 50.
#### insumer_configure_nfts(id, nftCollections) Configure the NFT collections a merchant recognizes. Max 4 collections. Each grants a discount (a whole number from 1 to 50) or, with benefitType: "recognition", recognition only. enabled: false keeps a collection switched off; carry it through when re-saving. An XRPL taxon is an integer from 0 to 4294967295.
#### insumer_configure_settings(id, discountMode?, discountCap?, usdcPayment?) Update merchant settings: discount stacking mode (highest/stack/capped), cap (a whole number from 1 to 100), and USDC payment configuration.
#### insumer_publish_directory(id) Publish (or refresh) the merchant's listing in the public directory.
#### insumer_buy_merchant_credits(id, txHash, chainId, amount, updateWallet?, senderSignature?) Kept for compatibility. A store has no balance of its own: a USDC payment submitted here adds regular credits to the API key that owns the store, at a flat 25 credits per $1. Same chains and senderSignature rule as insumer_buy_credits, which has the volume tiers.
#### insumer_request_domain_verification(id, domain) Request a verification token for a merchant's domain. Returns the token and three methods: DNS TXT record, HTML meta tag, or file upload.
#### insumer_verify_domain(id) Complete domain verification after placing the token. Verified merchants get a trust badge in the public directory. Rate limited per merchant (429 says when to retry).
#### insumer_acp_discount(merchantId, wallet?, solanaWallet?, xrplWallet?, items?) Check discount eligibility in OpenAI/Stripe Agentic Commerce Protocol (ACP) format. Returns coupon objects, applied/rejected arrays, and per-item allocations. A code that carries a discount costs the store's owner key 1 credit; a 0% result is free. A caller using another key is not charged.
#### insumer_ucp_discount(merchantId, wallet?, solanaWallet?, xrplWallet?, items?) Check discount eligibility in Google Universal Commerce Protocol (UCP) format. Returns title, extension field, and applied array. A code that carries a discount costs the store's owner key 1 credit; a 0% result is free. A caller using another key is not charged.
#### insumer_validate_code(code) Validate an INSR-XXXXX discount code. Returns validity, discount percent, and expiry. Free, no auth required.
rpc_failureinsumer_attest, insumer_wallet_trust, insumer_verify, insumer_acp_discount, insumer_ucp_discount and insumer_check_discount can answer ok: false with error code rpc_failure (HTTP 503). It means a read did not complete and nothing was signed. Retry after a short delay. It is never a "no": do not report it as a failed condition or as "not eligible". insumer_batch_wallet_trust answers normally and carries an error entry for any wallet whose reads did not complete.
Ethereum, Base, Polygon, Arbitrum, Optimism, BNB Chain, Avalanche, XDC, Sonic, Gnosis, Mantle, Scroll, Linea, zkSync Era, Blast, Taiko, Ronin, Celo, Viction, opBNB, World Chain, Unichain, Ink, Sei, Berachain, ApeChain, Chiliz, Soneium, Plume, Robinhood Chain, Arc, Solana, XRPL, Bitcoin, Tron, Stellar, Sui.
pqSig/pqKid, and pqJwt beside jwt) rides beside sig/kidAKP entries), matched by kid or pqKid, never by positioninsumer-verify (npm, zero deps; also on PyPI for Python, same checks and test vectors) reports five verdicts: signature, condition hash, block freshness, expiry, and the post-quantum signature (1.8.1+)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.