Threat model

Public x402 agent API threat model

This compact model explains what BMM is trying to protect for public discovery, x402 payment boundaries, and public-chain research workflows. It is intentionally scoped to the current product surface.

Trust overviewSecurity questionnaireObservability

Assets protected

  • Public discovery documents: llms.txt, OpenAPI, x402 catalog, agent manifest, MCP discovery
  • Paid x402 resource boundaries, prices, receiver, network, and endpoint paths
  • Public wallet, contract, and transaction inputs submitted for research
  • Unlisted saved-report links when a paid report endpoint creates them

Actors considered

  • Buyer agents calling public x402 endpoints
  • Human developers integrating BMM APIs
  • Marketplaces, crawlers, and MCP clients reading public discovery files
  • Abusive callers attempting malformed input, secret submission, replay, or endpoint confusion

Main risks

  • Buyer signs a payment challenge for the wrong receiver or resource.
  • Caller submits secrets that should never be sent to BMM.
  • A crawler or agent uses stale discovery metadata and routes payment to the wrong endpoint.
  • A saved report URL is shared beyond the intended reviewer group.
  • Upstream blockchain, data-provider, or facilitator outage causes failed or delayed paid retries.

Current controls

  • Publish canonical discovery at https://api.blockchainmoneymap.com/llms.txt, https://api.blockchainmoneymap.com/openapi.json, and https://api.blockchainmoneymap.com/.well-known/x402.json.
  • Require buyer agents to verify challenge payTo, price, network, and resource before signing.
  • Reject private-key and seed-phrase style inputs in protected user-facing flows where applicable.
  • Keep paid output framed as public-chain research, not custody, trading, compliance certification, or investment advice.
  • Publish health and status references at https://api.blockchainmoneymap.com/api/health and https://blockchainmoneymap.com/status.

Explicit non-goals

  • BMM does not custody wallets.
  • BMM does not sign transactions for buyers.
  • BMM does not execute trades or token swaps.
  • BMM does not certify AML, sanctions, identity, fraud certainty, or regulatory approval outcomes.