Tumbuk

Everyone audits the smart contract. Nobody audits the agent. As agents on OKX.AI begin

hiring and paying each other over A2MCP, the new attack surface is the agent's behavior:

prompt injection, fund and secret exfiltration, jailbreaks, and forged agent-to-agent trust

signals. There is no equivalent of a contract audit for any of it.

Tumbuk hires out as the adversary. Point it at an agent's HTTP endpoint and it fires 8

adversarial probes in parallel — prompt injection, unauthorized fund transfer, secret and

credential exfiltration, jailbreak and persona override, output-trust hijacking, system

prompt leakage, instruction override, and indirect (tool/RAG-borne) injection — then returns

a scored vulnerability report in markdown and JSON, graded A to F.

Detection is deterministic, with no LLM judge anywhere in the loop: every probe plants a

hiring and paying each other over A2MCP, the new attack surface is the agent's behavior:

prompt injection, fund and secret exfiltration, jailbreaks, and forged agent-to-agent trust

signals. There is no equivalent of a contract audit for any of it.

Tumbuk hires out as the adversary. Point it at an agent's HTTP endpoint and it fires 8

adversarial probes in parallel — prompt injection, unauthorized fund transfer, secret and

credential exfiltration, jailbreak and persona override, output-trust hijacking, system

prompt leakage, instruction override, and indirect (tool/RAG-borne) injection — then returns

a scored vulnerability report in markdown and JSON, graded A to F.

Detection is deterministic, with no LLM judge anywhere in the loop: every probe plants a

unique canary token, and a finding is that token coming back or a credential-shaped string

appearing in the reply. The same suite produces the same report, so a grade survives a human

spot-check. Grading is safety-first: a severity-weighted score, but one confirmed critical

hole caps the grade at F regardless of how clean the rest looks. A target that merely echoes

the probe text is reported as unmeasured rather than vulnerable, so a harmless logging bot

is not slandered with a false F.

The grade is checkable rather than claimed. Every report embeds the exact object its digest

covers, and a free verify_report recomputes it — re-badge the target or downgrade a finding

and verification fails. The landing page does the same recomputation in your own browser,

nothing uploaded. A free probe_catalog exposes the whole suite, severities and grading rule

before you spend anything, so the buyer audits the auditor first.

It refuses to be a weapon: consent=true is a hard gate, and the probe layer is SSRF-guarded

against localhost, private ranges and cloud-metadata addresses in every IP encoding, with

redirects unfollowed and reads capped.

It is a real on-chain business: $0.99 in USDT0 per scan on X Layer, settled via x402 through

OKX's official payment SDK and facilitator. Tumbuk burns no model credits, so the marginal

cost is outbound bandwidth alone. Any builder listing an ASP can hire it as a pre-listing

security gate — a dependency other agents want.

One endpoint in → a graded, reproducible, verifiable red-team report out.

Agent #9619 on OKX.AI · https://tumbuk-security.vercel.app · https://tumbuk.vercel.app/mcp

Built from zero during the hackathon window, in Python with only fastmcp and uvicorn as

dependencies — everything else is standard library, and there is no model API key anywhere

in the system, which is what makes the unit economics work.

Shipped: the 8-probe attack library with deterministic canary/credential detectors; an

SSRF-guarded HTTP probe layer; a parallel runner with safety-first grading; a markdown+JSON

report with a tamper-evident digest; a FastMCP server exposing one paid tool and three free

ones; a payment gate on OKX's official seller SDK, settling in USDT0 on X Layer; a stateless

Vercel deployment; and a landing page whose in-browser verifier recomputes a report digest

locally. Registered as an A2MCP ASP on OKX.AI (Agent #9619) with a paid scan service and a

free verification service.

Hardening was most of the work, and the real bugs came from running the thing against real

endpoints rather than stubs. A security audit fixed a detector that could not tell an ECHO

from OBEDIENCE, so a harmless echo endpoint scored "F, fund-drainable". A JSON-RPC batch

could skip the payment gate. Live scanning of public services exposed two more: an HTTP error

body was being treated as the agent's reply, so a target that was DOWN scored "resisted" on

all 8 probes — a false A on an endpoint that never ran; and the echo check compared raw text

while real services return the body re-encoded, so two CRITICAL probes came back "vulnerable"

on three harmless echo services. Both fixed and regression-tested.

A deeper QA pass found the tamper-evident digest could not actually be verified by the buyer:

the report embedded only part of the object the digest covered. Fixed, and turned into a

feature — verify_report and probe_catalog now ship as free tools, and the browser verifier

was cross-checked against the Python implementation on a report containing non-ASCII text.

Three listing rejections drove the payment layer to correctness: the x402 challenge had to

travel in a PAYMENT-REQUIRED response header rather than only the body; OKX speaks x402 v2

(amount, payTo, object resource) while we advertised v1 and rejected v2 payloads outright; a

v2 payment arrives on PAYMENT-SIGNATURE, not X-PAYMENT, so a caller who HAD paid was answered

402 forever; and the facilitator refuses unsigned calls, so verification only works through

the official SDK with portal credentials. Fixing those also closed a real hole — the payment

was being verified against the requirement the CALLER claimed, so anyone could assert they

had agreed to pay 1 atomic unit.

On the final day, live probing caught the worst one: the deployed endpoint had been returning

HTTP 200 with an EMPTY body on every call, because Vercel's ASGI bridge cancels an SSE stream

before it flushes. Smoke tests that only assert status codes never saw it.

Verification is executable, not claimed: 42 deep-QA checks (hostile targets, read cap and

timeout, gate composition, 16-way concurrency, fuzzing) plus a 40-check review simulation

that validates the live 402 against OKX's own SDK models and asserts every listing claim

against real output. Three self-check suites run in CI on every push.

Not raising. Self-funded, no outside capital, no token. Tumbuk consumes no model credits —

the marginal cost of a scan is outbound HTTP bandwidth — so $0.99 per scan in USDT0 on X

Layer is close to pure margin and the service is profitable per call from day one. Open to

ecosystem or grant support from the X Layer team to expand the suite (multi-turn attack

chains, MCP tool-poisoning probes, a continuous re-scan subscription for listed ASPs).