# ScrapeCheck

Checks whether a value you did not fetch yourself is actually on the page it
came from. Independently re-fetches the source and returns an ed25519-signed
pass/fail/unverifiable verdict. Not a retrieval tool: it checks a value you
already have, it does not find data for you.

## When to call it

You hold a value that came from somewhere else (a search result, a scraper,
an upstream API, another agent) and you are about to act on it. One check
answers: is this value on the source page right now, and is it the answer to
what was asked?

## When NOT to call it

- You need to FIND data: use a search or scraping API, then verify what it
  returned here.
- The page is client-rendered (JS-only): the verdict will be unverifiable by
  design. ScrapeCheck never guesses.

## Endpoints

POST /verify — $0.01 per check; first 100 free per client identity
  with header X-Use-Free-Allowance: yes (no payment needed while it lasts).
  Body: { "url": "<source page>", "claim": { "<field>": "<value>" }, "asked": "<question>" }
  Returns a signed verdict: pass, fail, or unverifiable. A claim is never
  certified unless the re-fetched page contains it, and the model judge can
  only veto a pass, never create one. Anything unconfirmed is unverifiable,
  never pass.

POST /verify-presence — $0.002 per check.
  Presence only: confirms the value appears on the page, NOT that it is the
  right answer to what was asked. Never returns pass. A was-price, another
  variant's price, a shipping cost, or a tax figure can all satisfy
  presence. If your decision depends on the value being the right value,
  use /verify.

POST /verify-json — $0.002 per check.
  JSON tier (deterministic, no LLM): verifies a claimed value lives at a
  named JSON path in a public endpoint's response, by independent double
  re-fetch. Use it for machine-readable API responses; for HTML pages use
  /verify. Claim keys are paths (data.items[0].price). Type-strict;
  volatile values return unverifiable, never a guess. Public HTTPS JSON
  only.

POST /verify-hash — $0.002 per check.
  Checksum tier (deterministic, no LLM): verifies the exact bytes served at
  a public URL hash to a claimed sha256, by independent double re-fetch.
  Use it to confirm a download or artifact matches its published checksum.
  Bodies up to 3 MB; dynamic pages return unverifiable, never a guess.
  sha256 only.

POST /verify-xml — $0.002 per check.
  XML tier (deterministic, no LLM): verifies a claimed value lives at a
  named path in a public XML document, by independent double re-fetch. Use
  it for feeds and sitemaps; for JSON use /verify-json, for HTML use
  /verify. Paths address elements and @attributes (urlset.url[0].loc).
  String-exact; ambiguous or volatile values return unverifiable, never a
  guess.

POST /verify-redirect — $0.002 per check.
  Redirect tier (deterministic, no LLM): verifies where a public URL
  actually leads: final URL (byte-exact), first response status, and hop
  count of the HTTP chain, walked twice with per-hop SSRF checks. Use it
  to confirm a link or a moved page points where it claims. Loops and
  unstable chains return unverifiable, never a guess.

GET /pubkey — free. The ed25519 key archive: the active signing key plus
  every retired key, so verdicts signed before a key rotation still verify
  offline. If a verdict verifies against a retired key, confirm it:

GET /verdicts/{verdict_id} — free. Confirms whether ScrapeCheck issued that
  verdict_id and returns the SHA-256 of the signature issued under it, which
  binds your copy content to the issuer record (mismatch = forged content
  under a real id). No verdict content, no client data; records are
  permanent.

GET /stats — free. Live verdict mix including fails and unverifiables.
GET /openapi.json — the machine-readable contract.

## Payment

x402 in-band, USDC on Base (eip155:8453). No API key, no signup. An unpaid
request without the free-allowance header, or past the allowance, receives
a standard 402 challenge; the challenge itself explains the allowance.

## Verify us before trusting us

Verdicts are signed over canonical sorted-key JSON of every field except
"signature". Open verifier (MIT, zero dependencies) with a real example
verdict: https://github.com/FieldmodeLLC/scrapecheck-mcp

Contact: sales@fieldmodesolutions.com