Tumbuk red-teams other agents: 8 adversarial probes at any agent endpoint, returning a graded A-F vulnerability report that is deterministic, reproducible, and verifiable. Paid in USDT0 on X Layer.
Everyone audits the smart contract. Nobody audits the agent. As agents on OKX.AI begin
hiring and paying each other over A2MCP, the new attack surface is the agent's behavior:
prompt injection, fund and secret exfiltration, jailbreaks, and forged agent-to-agent trust
signals. There is no equivalent of a contract audit for any of it.
Tumbuk hires out as the adversary. Point it at an agent's HTTP endpoint and it fires 8
adversarial probes in parallel — prompt injection, unauthorized fund transfer, secret and
credential exfiltration, jailbreak and persona override, output-trust hijacking, system
prompt leakage, instruction override, and indirect (tool/RAG-borne) injection — then returns
a scored vulnerability report in markdown and JSON, graded A to F.
Detection is deterministic, with no LLM judge anywhere in the loop: every probe plants a
hiring and paying each other over A2MCP, the new attack surface is the agent's behavior:
prompt injection, fund and secret exfiltration, jailbreaks, and forged agent-to-agent trust
signals. There is no equivalent of a contract audit for any of it.
Tumbuk hires out as the adversary. Point it at an agent's HTTP endpoint and it fires 8
adversarial probes in parallel — prompt injection, unauthorized fund transfer, secret and
credential exfiltration, jailbreak and persona override, output-trust hijacking, system
prompt leakage, instruction override, and indirect (tool/RAG-borne) injection — then returns
a scored vulnerability report in markdown and JSON, graded A to F.
Detection is deterministic, with no LLM judge anywhere in the loop: every probe plants a
unique canary token, and a finding is that token coming back or a credential-shaped string
appearing in the reply. The same suite produces the same report, so a grade survives a human
spot-check. Grading is safety-first: a severity-weighted score, but one confirmed critical
hole caps the grade at F regardless of how clean the rest looks. A target that merely echoes
the probe text is reported as unmeasured rather than vulnerable, so a harmless logging bot
is not slandered with a false F.
The grade is checkable rather than claimed. Every report embeds the exact object its digest
covers, and a free verify_report recomputes it — re-badge the target or downgrade a finding
and verification fails. The landing page does the same recomputation in your own browser,
nothing uploaded. A free probe_catalog exposes the whole suite, severities and grading rule
before you spend anything, so the buyer audits the auditor first.
It refuses to be a weapon: consent=true is a hard gate, and the probe layer is SSRF-guarded
against localhost, private ranges and cloud-metadata addresses in every IP encoding, with
redirects unfollowed and reads capped.
It is a real on-chain business: $0.99 in USDT0 per scan on X Layer, settled via x402 through
OKX's official payment SDK and facilitator. Tumbuk burns no model credits, so the marginal
cost is outbound bandwidth alone. Any builder listing an ASP can hire it as a pre-listing
security gate — a dependency other agents want.
One endpoint in → a graded, reproducible, verifiable red-team report out.
Agent #9619 on OKX.AI · https://tumbuk-security.vercel.app · https://tumbuk.vercel.app/mcp
Built from zero during the hackathon window, in Python with only fastmcp and uvicorn as
dependencies — everything else is standard library, and there is no model API key anywhere
in the system, which is what makes the unit economics work.
Shipped: the 8-probe attack library with deterministic canary/credential detectors; an
SSRF-guarded HTTP probe layer; a parallel runner with safety-first grading; a markdown+JSON
report with a tamper-evident digest; a FastMCP server exposing one paid tool and three free
ones; a payment gate on OKX's official seller SDK, settling in USDT0 on X Layer; a stateless
Vercel deployment; and a landing page whose in-browser verifier recomputes a report digest
locally. Registered as an A2MCP ASP on OKX.AI (Agent #9619) with a paid scan service and a
free verification service.
Hardening was most of the work, and the real bugs came from running the thing against real
endpoints rather than stubs. A security audit fixed a detector that could not tell an ECHO
from OBEDIENCE, so a harmless echo endpoint scored "F, fund-drainable". A JSON-RPC batch
could skip the payment gate. Live scanning of public services exposed two more: an HTTP error
body was being treated as the agent's reply, so a target that was DOWN scored "resisted" on
all 8 probes — a false A on an endpoint that never ran; and the echo check compared raw text
while real services return the body re-encoded, so two CRITICAL probes came back "vulnerable"
on three harmless echo services. Both fixed and regression-tested.
A deeper QA pass found the tamper-evident digest could not actually be verified by the buyer:
the report embedded only part of the object the digest covered. Fixed, and turned into a
feature — verify_report and probe_catalog now ship as free tools, and the browser verifier
was cross-checked against the Python implementation on a report containing non-ASCII text.
Three listing rejections drove the payment layer to correctness: the x402 challenge had to
travel in a PAYMENT-REQUIRED response header rather than only the body; OKX speaks x402 v2
(amount, payTo, object resource) while we advertised v1 and rejected v2 payloads outright; a
v2 payment arrives on PAYMENT-SIGNATURE, not X-PAYMENT, so a caller who HAD paid was answered
402 forever; and the facilitator refuses unsigned calls, so verification only works through
the official SDK with portal credentials. Fixing those also closed a real hole — the payment
was being verified against the requirement the CALLER claimed, so anyone could assert they
had agreed to pay 1 atomic unit.
On the final day, live probing caught the worst one: the deployed endpoint had been returning
HTTP 200 with an EMPTY body on every call, because Vercel's ASGI bridge cancels an SSE stream
before it flushes. Smoke tests that only assert status codes never saw it.
Verification is executable, not claimed: 42 deep-QA checks (hostile targets, read cap and
timeout, gate composition, 16-way concurrency, fuzzing) plus a 40-check review simulation
that validates the live 402 against OKX's own SDK models and asserts every listing claim
against real output. Three self-check suites run in CI on every push.
Not raising. Self-funded, no outside capital, no token. Tumbuk consumes no model credits —
the marginal cost of a scan is outbound HTTP bandwidth — so $0.99 per scan in USDT0 on X
Layer is close to pure margin and the service is profitable per call from day one. Open to
ecosystem or grant support from the X Layer team to expand the suite (multi-turn attack
chains, MCP tool-poisoning probes, a continuous re-scan subscription for listed ASPs).