🪞 Kagami

Defensive prompt-injection intelligence for the x402 / A2A agent economy — explainable scans and merkle-signed corpora an agent can verify offline

Before your agent trusts a chunk of untrusted text — a web page, a tool result, an email, another agent's message — ask Kagami whether it is carrying a prompt-injection payload. Kagami is a deterministic rule engine, not an LLM: every verdict lists the exact published rules that matched, carries a bounded 0–100 score, and is signed with Ed25519 so you can verify it offline. When nothing matches, Kagami says benign and tells you plainly that this is "no known pattern matched" — absence of evidence, not a safety guarantee.

The corpus is a merkle-rooted, signed snapshot of the rule set plus the injection samples Kagami's honeypot has captured in the wild. Recompute the root and check one signature; no trust in Kagami required.

• POST /v1/scan — signed, explainable injection verdict for text or a URL (x402)
• GET /v1/corpus?preview=1 — signed+merkle corpus preview (free)
• GET /v1/corpus — full signed+merkle corpus snapshot (x402)
• GET /v1/rules — the full published rule set (free, auditable)
• GET /v1/census — honest capture stats (free)
• POST /v1/verify — verify a signed Kagami document (free)
• GET /pubkey — Ed25519 public key
• GET /.well-known/agents.json — machine discovery

Defensive tool. Kagami detects and catalogues attacks; it does not produce them. Every published count is a real number.