Foundry — security evidence for agents

Discover public contracts and request parameters, obtain an x402 quote in USDC on Base, and recover the authenticated original without a second charge.

11 public offers in this composition.

Direct HTTP x402

Choose an offer and construct its exact JSON using the public parameters. Send it to the product route for a fresh unsigned quote. A qualification refusal requests no payment. A 402 is a quote, not a settlement.

MCP

STREAMABLE_HTTP · POST https://foundry-api-production-95ae.up.railway.app/mcp · JSON-RPC 2.0

The MCP envelope differs from the direct business HTTP POST. Inspect the business status inside the MCP result; free discovery never signs or pays.

Recover the same original

Keep the receipt and original request. Authenticated recovery of that same original uses POST /v1/x402/purchases/recover under its contract; it does not create a new purchase. A newer version requires a new decision and separate payment authorization.

Historical sources and coverage are specific to each contract. No current safety, installed applicability or global absence is inferred. USDC settlement prices do not assert a guaranteed USD exchange rate.

PostgreSQL - fait historique de fin de support

A qualified historical support-end fact for a PostgreSQL major release cycle. Original captured evidence; no assertion of current lifecycle state.

Product
foundry.lifecycle.postgresql.terminal-history.v1
Revision
postgresql-terminal-history-v3
Settlement price
0.003000 USDC
Network
eip155:8453
Unit
qualified_postgresql_terminal_fact
Billable states
HISTORICAL_TERMINAL_FACT
Original access from purchase
30 days

POST https://foundry-api-production-95ae.up.railway.app/v1/lifecycle/postgresql/terminal-history

Public output contract

Public request parameters — no purchased result

{
  "schema_version": "1.0",
  "version": "8.3.0"
}

PSF/CPython historical vulnerability evidence

Exact native ID and full held snapshot. Complete licensed historical evidence, not current applicability. Fixed 0.005000 USDC per successful original fulfillment; retries and original READ are not new purchases.

Product
foundry.native-security.psf.psrt-evidence
Revision
psf24-commercial-v2
Settlement price
0.005000 USDC
Network
eip155:8453
Unit
psf24_historical_evidence_fulfillment
Billable states
MATCH, MULTI_MATCH
Original access from purchase
30 days

POST https://foundry-api-production-95ae.up.railway.app/v1/security/psf-evidence

Public output contract

Public request parameters — no purchased result

{
  "native_id": "PSF-2023-12",
  "snapshot_id": "sha256:dfdb16597b18cd94ee1a069ac5ed5090fc5acc4909bdd12e5766da8c4b1150a1",
  "client_request_id": "psf-historical-example"
}

Historical security evidence / certfr27

One complete exact historical CERT-FR advisory and snapshot in an explicit native version, up to262144 UTF8 bytes. Ambiguity, wrong version and no match are nonbillable. Experimental fixed 5000 atomic USDC per successful original MATCH; original authorization replay/READ is free. Commercial route configured; Wallet payment and authenticated original READ remain unqualified. Economic demand is not validated.

Product
foundry.native-security.certfr.family-evidence
Revision
certfr27-commercial-v3
Settlement price
0.005000 USDC
Network
eip155:8453
Unit
certfr27_exact_historical_fulfillment
Billable states
MATCH
Original access from purchase
30 days

POST https://foundry-api-production-95ae.up.railway.app/v1/security/certfr27-evidence

Public output contract

Public request parameters — no purchased result

{
  "client_request_id": "commercial-certfr27-example",
  "native_schema_version": "0.1.0",
  "query": {
    "native_id": "CERTFR-2026-AVI-0326",
    "record_id": "b-candidate:certfr:native-evidence:CERTFR-2026-AVI-0326:f64b46fdbeef6dd5",
    "snapshot_id": "sha256:0f3ac520ec0fe8db7d1e43da83056d0c55b1bcde7d87c3ef52c47e54e981b1e0"
  }
}

Historical security evidence / psf47

One complete exact additional PSF historical advisory and snapshot in an explicit native version, including all admitted fields and presence. Not a PSF24 reimport. Experimental fixed 5000 atomic USDC per successful original MATCH; original authorization replay/READ is free. Commercial route configured; Wallet payment and authenticated original READ remain unqualified. Economic demand is not validated.

Product
foundry.native-security.psf47.additional-evidence
Revision
psf47-commercial-v3
Settlement price
0.005000 USDC
Network
eip155:8453
Unit
psf47_exact_historical_fulfillment
Billable states
MATCH
Original access from purchase
30 days

POST https://foundry-api-production-95ae.up.railway.app/v1/security/psf47-evidence

Public output contract

Public request parameters — no purchased result

{
  "client_request_id": "commercial-psf47-example",
  "native_schema_version": "0.1.0",
  "query": {
    "native_id": "PSF-2026-44",
    "record_id": "b-candidate:psf:native-evidence:PSF-2026-44:686fd993f05bc35c",
    "snapshot_id": "sha256:d7d6e8233c260fcb2abe4ba2cc7458f76c62887faf4b5a5e1ce875cf5248e1ac"
  }
}

Historical security evidence / change_brief

One complete qualified answer for one exact pair of distinct CERT-FR source observations, including a material correction or proven HTTP304 revalidation without change. First qualified NOOP is paid. Selecting the same observation twice, unknown pair, invalid order and technical failure are not answers. All admitted fields and notices together. Fixed 10000 atomic USDC per qualified first answer. Free authenticated original READ requires the same buyer, exact original question, stored answer/provenance version and previously settled receipt. A newer answer requires a new quote and explicit payment authorization; never automatic debit. Old receipts and NO_CHARGE outcomes keep their original terms.

Product
foundry.native-security.certfr.change-brief
Revision
change-brief-commercial-v3
Settlement price
0.010000 USDC
Network
eip155:8453
Unit
certfr_change_brief_material_pair
Billable states
MATCH, UNCHANGED
Original access from purchase
30 days

POST https://foundry-api-production-95ae.up.railway.app/v1/security/certfr-change-brief

Public output contract

Public request parameters — no purchased result

{
  "after_observation_id": "b-certfr-observation:d0fdba3591d26b1a3d0039cd7ba16a191ee0b56b829e4d39719ba4dc896825de",
  "before_observation_id": "b-certfr-observation:7dee2e9642e69374101e71210891f0853298076f64b86109367ba939460c1c43",
  "client_request_id": "real-pair-2",
  "native_id": "CERTFR-2026-AVI-1264"
}

Historical security evidence / go37

One complete exact advisory/snapshot/module/version/context case, all related findings. Qualified MATCHED or NOT_MATCHED publisher-declared conditions only; actual applicability, currentness and reachability UNKNOWN. No promised fix or per-finding charge. Experimental fixed 10000 atomic USDC per successful original MATCH; original authorization replay/READ is free. Commercial route configured; Wallet payment and authenticated original READ remain unqualified. Economic demand is not validated.

Product
foundry.native-security.go.advisory-conditions
Revision
go37-commercial-v3
Settlement price
0.010000 USDC
Network
eip155:8453
Unit
go37_exact_conditions_fulfillment
Billable states
MATCH
Original access from purchase
30 days

POST https://foundry-api-production-95ae.up.railway.app/v1/security/go37-conditions

Public output contract

Public request parameters — no purchased result

{
  "advisory_id": "GO-2021-0067",
  "client_request_id": "go-condition-1",
  "module": "stdlib",
  "package_path": "archive/zip",
  "snapshot_id": "sha256:6cd704b5b8c36b661b777c5ee46c98043b7fcf09f6837e282c33fa5efd17998e",
  "symbol": "toValidName",
  "version": "1.16.0"
}

Historical security evidence / pg_security

One complete documentary response for one exact CVE, release-note snapshot and record, including publisher version, paragraphs, XPath and complete license notice. CITATION_ONLY proves citation, never a fix; EXPLICIT_CVE_CORRECTION preserves the declared release. Historical, installed applicability UNKNOWN. Not per paragraph or CVE mention. Experimental fixed 3000 atomic USDC per successful original MATCH; original authorization replay/READ is free. Commercial route configured; Wallet payment and authenticated original READ remain unqualified. Economic demand is not validated.

Product
foundry.native-security.postgresql.release-evidence
Revision
pg-security-commercial-v3
Settlement price
0.003000 USDC
Network
eip155:8453
Unit
pg_security_exact_documentary_fulfillment
Billable states
MATCH
Original access from purchase
30 days

POST https://foundry-api-production-95ae.up.railway.app/v1/security/postgresql-release-evidence

Public output contract

Public request parameters — no purchased result

{
  "client_request_id": "commercial-pg-security-example",
  "native_schema_version": "0.1.0",
  "query": {
    "native_id": "CVE-2025-1094",
    "record_id": "b-candidate:postgresql:native-evidence:CVE-2025-1094:84f6f2dacf7c78f9",
    "snapshot_id": "sha256:08a0e699b1c45225746b7f5f611ba65387022fa98287cb6ff83f6d0348791ba7"
  }
}

Historical security evidence / concordance

One complete exact CVE concordance answer in explicit pinned historical snapshots, including all admitted families and provenance or established absence of multi-family overlap in that bounded scope. First qualified scoped absence is paid. No global absence, current safety or installed-applicability claim; refusals and technical failures are nonbillable. Fixed 10000 atomic USDC per qualified first answer. Free authenticated original READ requires the same buyer, exact original question, stored answer/provenance version and previously settled receipt. A newer answer requires a new quote and explicit payment authorization; never automatic debit. Old receipts and NO_CHARGE outcomes keep their original terms.

Product
foundry.native-security.cve.concordance
Revision
cve-concordance-commercial-030
Settlement price
0.010000 USDC
Network
eip155:8453
Unit
cve_exact_complete_concordance
Billable states
MATCH, ABSENT
Original access from purchase
30 days

POST https://foundry-api-production-95ae.up.railway.app/v1/security/cve-concordance

Public output contract

Public request parameters — no purchased result

{
  "client_request_id": "concordance-example",
  "query": {
    "cve_id": "CVE-2020-0601"
  }
}

Historical security evidence / cve_httpd

One complete answer for one exact CVE in the specified pinned HTTPD capture, with the held single CNA projection when admitted. Includes established absence of facts in this capture, all required notices and source hashes. First qualified scoped absence is paid. One response and meter regardless of contributing sources; no global absence, currentness or installed-applicability claim. Fixed 5000 atomic USDC per qualified first answer. Free authenticated original READ requires the same buyer, exact original question, stored answer/provenance version and previously settled receipt. A newer answer requires a new quote and explicit payment authorization; never automatic debit. Old receipts and NO_CHARGE outcomes keep their original terms.

Product
foundry.native-security.cve-httpd.complete-projections
Revision
cve-httpd-commercial-030
Settlement price
0.005000 USDC
Network
eip155:8453
Unit
pinned_cve_complete_projection_fulfillment
Billable states
MATCH, ABSENT
Original access from purchase
30 days

POST https://foundry-api-production-95ae.up.railway.app/v1/security/cve-httpd-facts

Public output contract

Public request parameters — no purchased result

{
  "client_request_id": "cve-httpd-example",
  "query": {
    "cve_id": "CVE-2026-42356",
    "httpd_source_sha256": "3edeb2dde2f2207cede2f2994dd55fcf8697638275671c4bd113d1ab88175cfd",
    "projection_version": "0.1.0",
    "registry_source_sha256": "5b056d07b683afb143c9314a7d03801d8007585658636d97165db48396c3c9ec"
  }
}

Historical security evidence / kev_change

One complete answer for one exact CVE in two pinned complete CISA catalogs, including material change, established unchanged membership or scoped absence. All available native records, membership hashes, dates and notices together. The first qualified answer is paid even when unchanged or absent. Not per field; no current-world or installed-applicability claim. Fixed 5000 atomic USDC per qualified first answer. Free authenticated original READ requires the same buyer, exact original question, stored answer/provenance version and previously settled receipt. A newer answer requires a new quote and explicit payment authorization; never automatic debit. Old receipts and NO_CHARGE outcomes keep their original terms.

Product
foundry.native-security.kev.exact-material-change
Revision
kev-change-commercial-020
Settlement price
0.005000 USDC
Network
eip155:8453
Unit
kev_exact_material_change_fulfillment
Billable states
MATCH, UNCHANGED, ABSENT
Original access from purchase
30 days

POST https://foundry-api-production-95ae.up.railway.app/v1/security/kev-exact-change

Public output contract

Public request parameters — no purchased result

{
  "client_request_id": "kev-change-example",
  "query": {
    "from_raw_sha256": "f51fed1c9213e7b797104fcd6dbeb1b0dc0c7073a80467b9d4b1fc25e7dd786b",
    "native_cve_id": "CVE-2022-0995",
    "projection_version": "0.1.0",
    "to_raw_sha256": "b6e27975f6635ecfc546fbd4fd6e444ba63a07ab2abc8876229d77fe083d357d"
  }
}

Historical security evidence / httpd_dossier

Complete historical Apache HTTP Server 2.4.69 correction-group dossier: 20 native CVE identities, pinned KEV membership, available CNA evidence, complete manifest and source notices. One original costs 0.020000 USDC; authenticated original READ is included for 30 days without another payment. Currentness, installed applicability and safe-upgrade status are UNKNOWN.

Product
foundry.native-security.httpd.release-dossier
Revision
httpd-dossier-commercial-v2
Settlement price
0.020000 USDC
Network
eip155:8453
Unit
httpd_correction_group_dossier_original
Billable states
NATIVE_GROUP_FOUND
Original access from purchase
30 days

POST https://foundry-api-production-95ae.up.railway.app/v1/security/httpd/release-dossier

Public output contract

Public request parameters — no purchased result

{
  "schema_version": "foundry.httpd-dossier.purchase.v1",
  "client_request_id": "httpd-dossier-example",
  "selector": {
    "bundle_sha256": "2ca0354e889faf29af928901206d6031e9ff7d911f3cd82899379041269788cf",
    "correction_group_native": "Fixed in Apache HTTP Server 2.4.69",
    "httpd_source_sha256": "3edeb2dde2f2207cede2f2994dd55fcf8697638275671c4bd113d1ab88175cfd",
    "kev_to_raw_sha256": "b6e27975f6635ecfc546fbd4fd6e444ba63a07ab2abc8876229d77fe083d357d"
  }
}