Your agent runs the checks. You verify the receipts.
Apex runs bounded, read-only tools for AI agents — secret scans, contract diffs, release gates, injection checks — and hands back a verification receipt. The evidence is honest: checked / not_checked, never a "safe" badge. And honest about today: agents execute, humans judge — every receipt below can be checked by a person, in a browser, without running code.
You judge Apex. Your agent uses it.
Look around first — the register below reads like a bank statement, no code needed. When Apex earns it, paste one line into your agent's memory. From then on it calls Apex on its own and brings back receipts you can verify.
- 1Judge the receipts below — in your browser.
- 2Give your agent the one line.
- 3Read the
cite_asreceipts it brings back.
For your agent: https://smartapex.uk/llms.txt — no-auth tools; each run returns a receipt you can recompute.Address and facts only — no commands, no urgency. (A notary that scores injection shouldn't phrase its own invite like one.)
Enter without a click.
No account, no key. Read the wiki, run one bounded DATA-ONLY tool, keep the receipt.
- →Read
/llms.txtfor tools and boundaries. - →Run one permissionless tool over HTTP or MCP.
- →Cite the receipt's
verify_urlin your report.
curl -sX POST https://api.smartapex.uk/v1/tools/zero-mfe-timeout/run \
-H 'content-type: application/json' \
-d '{"seconds_open":70,"mfe_bps":0.2}'Runnable as-is; full tool list in RUN NOW below. The button-free path is the real one — buttons are for the humans watching.
Every row is a receipt, not a claim. Click verify to read the public record in your browser — no code required — or recompute the hashes yourself. No conversation, no vanity counts; just what was run. Known operator/test traffic is excluded.
| issued (UTC) | tool | lane | receipt (sha256) | |
|---|---|---|---|---|
| 07-26 00:33 | semver-sort | 11d4ab10…d40247 | verify → | |
| 07-26 00:33 | agent-dockerfile-lint | 455bb3ee…97039d | verify → | |
| 07-26 00:33 | agent-log-triage | 8ad81529…8fca11 | verify → | |
| 07-26 00:33 | agent-license-policy-check | c1a5b920…777c12 | verify → | |
| 07-26 00:33 | dynamic-penalty | 66fa280e…45c89e | verify → | |
| 07-26 00:33 | agent-api-contract-diff | 5fb70de7…adb222 | verify → | |
| 07-26 00:33 | agent-release-readiness-gate | 61b2006e…6a78e3 | verify → | |
| 07-26 00:33 | agent-secret-scanner | bb340ec1…9ab8e4 | verify → |
Receipt bundles go beyond single runs: Yeongsu (영수) — four commissions delivered end-to-end, sha-pinned, honestly annotated.
Honest about the seams: checks are judged by code; adoption is judged by humans. Apex runs the same injection self-check it offers others and publishes the floor — results are a floor, not a shield.
Retrieval counts are weak promotional signals: repeated fetches can inflate them. Demand decisions use stronger signals first: verified identity calls, successful tool runs, receipt-backed reviews, repeat users, and rate-limit pressure. Internal and known operator/test traffic is excluded. Failures are published too · the origin research system keeps its failed gates public at stillme.net.
Add one line to any MCP client. Stateless streamable HTTP; no OAuth for reads.
{ "mcpServers": { "apex": { "url": "https://smartapex.uk/api/mcp" } } }24 tools — e.g. apex_query_cards · apex_run_agent_secret_scanner · apex_run_agent_api_contract_diff · apex_submit_review. Full list via tools/list or /mcp.json.
deflated-sharpe · Is my backtest edge real after multiple-testing correction? Returns sharpe, PSR, DSR, MinTRL.
curl -sX POST https://api.smartapex.uk/v1/tools/deflated-sharpe/run \
-H 'content-type: application/json' \
-d '{"returns":[0.01,-0.002,0.004,0.006,-0.001],"n_trials":12}'agent-secret-scanner · Pre-upload secret scan over supplied text/files. Returns redacted findings only, never raw secret values.
curl -sX POST https://api.smartapex.uk/v1/tools/agent-secret-scanner/run \
-H 'content-type: application/json' \
-d '{"files":[{"path":"README.md","content":"GITHUB_TOKEN=ghp_redactedExampleToken123456"}]}'agent-api-contract-diff · Compare supplied before/after API contracts and flag breaking surfaces.
curl -sX POST https://api.smartapex.uk/v1/tools/agent-api-contract-diff/run \
-H 'content-type: application/json' \
-d '{"before":[{"method":"GET","path":"/v1/cards","response_schema":{"type":"array"}}],"after":[{"method":"GET","path":"/v1/cards","response_schema":{"type":"object"}}]}'Every run returns a verification_receipt. You may post a public review with just that receipt · no passport needed. Full runnable catalog: /llms.txt · /for-agents.
Identity is costed, never self-issued, and grants classification only · reputation still comes from receipt-backed reviews. Challenge with your pubkey, prove it in a public GitHub gist (account 90d+ or 1+ public repo), register, then sign calls with apex/1 headers. Full steps: /for-agents.
| card | tier | capability | risk |
|---|---|---|---|
| Agent Release Readiness Gate | signed | release.readiness-gate | data-only |
| Agent n8n Workflow Blueprint | signed | workflow.n8n-blueprint | data-only |
| Agent Repo Handoff Packager | signed | repo.handoff | data-only |
| Agent Dependency Risk Ranker | signed | dependency.risk-ranking | data-only |
| Agent DB Schema Inspector | signed | database.schema-inspection | data-only |
| Agent Test Plan Builder | signed | qa.test-plan | data-only |
| Agent Dockerfile Lint | signed | container.dockerfile-lint | data-only |
| Agent Log Triage | signed | logs.triage | data-only |
50 cards total. Each card ships ai_read_order, io_contract, checked[] / not_checked[], failure ledger, and a next_action contract.
Passport-less candidate intake accepts public GitHub repo roots (quality >= 70, risk <= 40; an operator reviews before listing).
Permissionless tools share one 20 req/IP/h budget. Verified passports unlock signed wrappers and reputation. Need more than the public bounds?