{"packs":[{"slug":"earnings-deep-dive","title":"Earnings deep-dive","tagline":"Everything you need before a company reports: the upcoming earnings date, the latest financials, recent SEC filings, the live quote, and fresh analyst news - in one pass.","useCase":"Prepping for an earnings call or positioning ahead of a print - you want the date, the fundamentals, any recent filings, the market's current read, and the news narrative without stitching five sources together by hand.","toolSlugs":["earnings-calendar","company-financials","edgar-filings","stock-quote","search"],"workflow":["Get the next earnings date from earnings-calendar so you know the window you're positioning around.","Pull the latest fundamentals from company-financials - revenue, margins, EPS, cash flow - the baseline the print will be judged against.","List recent SEC filings via edgar-filings to catch any 8-K, guidance, or S-1 activity since the last report.","Get the live quote from stock-quote for the market's current positioning (price vs 52-week range).","Search the web for analyst expectations and recent news to frame the whisper number and the key debates."],"claudePrompt":"Prepare an earnings deep-dive on TSLA using Agent402's earnings-deep-dive skill pack. (1) Get the next earnings date, (2) pull the latest financials, (3) list recent SEC filings, (4) get the live quote, (5) search for analyst expectations. Summarize as a pre-earnings brief: date, what to watch in fundamentals, filing flags, current positioning, and the key debate going into the print.","promptArgs":[{"name":"ticker","description":"Stock ticker (e.g. TSLA, MSFT)","required":true}]},{"slug":"options-analytics","title":"Options analytics","tagline":"Price a European option on a live stock: pull the current quote, estimate volatility from recent history, run Black-Scholes for fair value + the full greeks, and check the news for catalysts.","useCase":"Sizing an options trade or hedging a position - you want a fair value and the greeks (delta, gamma, vega, theta, rho) grounded in the stock's live price and realized volatility, not a stale textbook input.","toolSlugs":["stock-quote","stock-history","black-scholes","search"],"workflow":["Get the live spot price from stock-quote - the underlying S for the option.","Pull ~60 days of closes from stock-history and compute annualized realized volatility (stddev of daily log returns × sqrt(252)) - the sigma input.","Run black-scholes with the live spot, your strike/expiry, the current risk-free rate, and that volatility to get fair value plus delta, gamma, vega, theta, and rho.","Search the web for any earnings, guidance, or events before expiry that could move implied vol beyond the realized estimate."],"claudePrompt":"Price a call option on AAPL using Agent402's options-analytics skill pack. (1) Get the live quote for the spot price, (2) pull 60 days of history and compute annualized realized volatility, (3) run black-scholes with spot=live price, strike=nearest round number, 30 days to expiry, riskFreeRate=0.05 and the realized vol, (4) search for events before expiry. Report the fair value, all five greeks, and whether the option looks rich or cheap versus the model.","promptArgs":[{"name":"ticker","description":"Stock ticker (e.g. AAPL, NVDA)","required":true}]},{"slug":"fixed-income-desk","title":"Fixed-income desk","tagline":"Read the rate environment and price a bond in one workflow: the live Treasury curve, the recession-signal spread, inflation context, then price and yield a specific coupon bond at current rates.","useCase":"Evaluating a bond or building a rates view - you want the current curve, the 2s10s spread as a cycle signal, real-yield context from inflation, and the price/yield math on a specific coupon bond, all grounded in live Treasury data.","toolSlugs":["treasury-yield-curve","yield-curve-spread","bond-price","bond-ytm","cpi-yoy"],"workflow":["Pull the live Treasury yield curve with treasury-yield-curve - every maturity from 1M to 30Y.","Check yield-curve-spread for the 2s10s (and 3M-10Y) spread - a persistent inversion is the classic recession lead indicator.","Get year-over-year CPI from cpi-yoy so you can read the curve in real (inflation-adjusted) terms.","Price a coupon bond with bond-price using the relevant maturity's yield from the curve as the YTM.","Invert it with bond-ytm from a market price to confirm the yield, and compare to the curve to see if the bond is cheap or rich."],"claudePrompt":"Analyze the bond market using Agent402's fixed-income-desk skill pack. (1) Pull the live Treasury yield curve, (2) get the 2s10s spread and say whether it's inverted, (3) get YoY CPI for real-yield context, (4) price a 10-year bond with a 0.05 coupon at the current 10Y yield, (5) invert that price with bond-ytm to confirm the yield. Summarize the rate environment and whether the bond is fairly priced.","promptArgs":[{"name":"couponRate","description":"Bond annual coupon rate as a decimal (e.g. 0.05)","required":false}]},{"slug":"defi-protocol-scanner","title":"DeFi protocol scanner","tagline":"Due-diligence a DeFi protocol in one workflow: live token price, market context, protocol TVL across chains, and recent news - the on-chain and off-chain picture together.","useCase":"Evaluating a DeFi protocol or its token before allocating - you want the token price, its scale in the broader market, the protocol's total value locked (the real usage signal), and the latest news, without hopping between explorers and aggregators.","toolSlugs":["crypto-price","crypto-market","defi-tvl","search"],"workflow":["Get the token's live price with crypto-price - the current quote and 24h move.","Pull crypto-market for market cap, volume, and rank so you know the token's scale and liquidity.","Get the protocol's total value locked from defi-tvl - headline TVL across chains is the clearest real-usage signal for a DeFi protocol.","Search the web for recent news, audits, or incidents the price and TVL don't yet reflect."],"claudePrompt":"Scan the aave DeFi protocol using Agent402's defi-protocol-scanner skill pack. (1) Get the token's live price, (2) pull market cap and volume, (3) get the protocol TVL across chains, (4) search for recent news or security incidents. Summarize as a due-diligence note: price and momentum, market scale, real usage (TVL), and any risk flags from the news.","promptArgs":[{"name":"protocol","description":"DeFiLlama protocol slug (e.g. aave, uniswap)","required":true}]},{"slug":"security-audit","title":"Security audit","tagline":"Enumerate a domain's external attack surface in one workflow: certs, DNS posture, email auth, HTTP security headers, and tech stack.","useCase":"Before a pentest, an acquisition diligence call, or a quarterly review - you want a fast read on what an attacker sees from the outside.","toolSlugs":["cert-transparency","dns-lookup","spf-check","dmarc-check","http-headers","tls-cert","tech-stack"],"workflow":["Pull the certificate transparency log to enumerate every subdomain a CA has ever issued a cert for - this is the fastest external recon step.","For each interesting subdomain, resolve A/AAAA/MX/NS/CAA records to map the live infrastructure and certificate authority constraints.","Check SPF and DMARC on the apex to see whether the domain can be spoofed in email - a missing or weak DMARC is one of the highest-impact findings on most audits.","Pull HTTP response headers on the apex and a few key subdomains; the security analyzer scores HSTS, CSP, XFO, XCTO, Referrer-Policy, Permissions-Policy, and the COOP/CORP/COEP triad.","Inspect the live TLS cert (chain, expiry, SANs) - useful for spotting near-expiry, mismatched SANs, or weak chain configurations.","Fingerprint the tech stack so you know what CMS/framework/CDN to research for known CVEs."],"claudePrompt":"Run a security audit on example.com. Use Agent402 to: (1) pull the certificate transparency log, (2) check SPF and DMARC on the apex, (3) fetch HTTP security headers and the TLS cert, (4) fingerprint the tech stack. Report findings ranked by severity, and call out anything that would block a SOC 2 review.","promptArgs":[{"name":"domain","description":"Target domain to audit (e.g. stripe.com)","required":true}]},{"slug":"email-deliverability","title":"Email deliverability","tagline":"Diagnose why a domain's email lands in spam: SPF posture, DMARC policy, DKIM key strength, MX targets, and a composite 0–100 score.","useCase":"Marketing or transactional email is landing in spam, or you're rolling out a new sending domain and want to verify the auth posture before the first campaign.","toolSlugs":["spf-check","dmarc-check","dkim-lookup","email-deliverability","email-validate","dns-lookup"],"workflow":["Parse the SPF record - the tool flags the most common failures (>10 DNS lookups, +all permissive directive, syntax errors).","Parse the DMARC policy - p=none means receivers ignore SPF/DKIM failures, which usually explains a 'we set it all up but it still goes to spam' problem.","Probe 14 common DKIM selectors and warn on <1024-bit keys and testing-mode (t=y) records. Most sending platforms publish under a predictable selector this catches.","Run the composite deliverability score (25 points each for SPF + DMARC + DKIM + MX) for a single integer to report back to the team.","Validate a single recipient address with email-validate to confirm the MX is actually reachable.","Spot-check the MX records with dns-lookup type=MX to verify the chain matches the sending platform's documented setup."],"claudePrompt":"Diagnose email deliverability for sender@example.com. Use Agent402 to check SPF, DMARC, DKIM (probe common selectors), and the composite email-deliverability score. If the score is below 75, explain which auth records are missing or weak and how to fix each one.","promptArgs":[{"name":"domain","description":"Sending domain to diagnose (e.g. stripe.com)","required":true}]},{"slug":"market-brief","title":"Crypto market brief","tagline":"Quick crypto market snapshot: price for a specific coin, trending coins, and global market stats (total cap, BTC dominance, volume) - one call.","useCase":"An agent needs to answer 'what's happening in crypto right now?' without making 3 separate calls. Covers the price-check + market-context combo agents buy most.","toolSlugs":["crypto-price","crypto-trending","crypto-global"],"workflow":["Get the live price, 24h change, market cap, and volume for the requested coin via crypto-price.","Pull the top trending coins from crypto-trending - what the market is paying attention to right now.","Get global market stats from crypto-global - total market cap, BTC dominance, 24h volume, active coins."],"claudePrompt":"Give me a quick crypto market brief focused on bitcoin. Use Agent402's market-brief skill pack to get the current BTC price, today's trending coins, and global market stats. Summarize in bullet points.","promptArgs":[{"name":"coin","description":"Coin id to price (e.g. bitcoin, ethereum, solana)","required":true}]},{"slug":"financial-analysis","title":"Financial analysis","tagline":"Quick company snapshot: live quote, 9 key financial metrics (revenue through cash flow), and upcoming earnings - one call, one payment.","useCase":"An agent needs to answer 'how is this company doing?' without knowing XBRL tags or juggling 3 separate API calls. The $0.04 bundle is cheaper than calling the tools individually ($0.045).","toolSlugs":["stock-quote","company-financials","earnings-calendar"],"workflow":["Get the live quote from stock-quote - current price, market cap, day range, 52-week high/low, volume.","Pull key financials from company-financials - revenue, net income, operating income, total assets, liabilities, equity, EPS, and operating cash flow from the latest annual and quarterly SEC filings.","Check the earnings calendar for today's date to see if this company has upcoming or just-reported earnings (EPS estimate vs actual)."],"claudePrompt":"Give me a quick financial snapshot of AAPL. Use Agent402's financial-analysis skill pack to get the current quote, key financial metrics (revenue, net income, EPS, cash flow), and any upcoming earnings. Summarize in a few bullet points.","promptArgs":[{"name":"ticker","description":"Stock ticker symbol (e.g. AAPL, MSFT, NVDA)","required":true}]},{"slug":"financial-research","title":"Financial research","tagline":"Pull SEC filings, real-time quotes, historical prices, and macro context for a single ticker in one pass.","useCase":"Building a one-pager on a public company - you want fundamentals, recent insider activity, and the macro backdrop without leaving the agent loop.","toolSlugs":["stock-quote","stock-history","edgar-filings","edgar-company-facts","edgar-insider-trades","fred-series","research-company"],"workflow":["Get the live quote from stock-quote - current price, market cap, day range, volume.","Pull 1Y of OHLCV from stock-history to compute return, vol, and drawdown for the brief.","List recent SEC filings (10-K, 10-Q, 8-K) via edgar-filings - link each one in the report.","Pull the structured XBRL company facts (revenue, net income, total assets, share count) from edgar-company-facts for the canonical numbers.","Check edgar-insider-trades for Form 4 filings in the last 90 days - directional insider activity is a real signal.","Drop in macro context (CPI, fed funds, unemployment) from fred-series so the brief contextualizes the company-level view.","If you need a 1-call composite, research-company fans out to several of the above in a single paid call."],"claudePrompt":"Build a one-page research brief on AAPL. Use Agent402 to pull: (1) current quote, (2) 1-year price history with return/vol/max-drawdown, (3) the last 4 SEC filings, (4) XBRL revenue and net income trend, (5) Form 4 insider trades in the last 90 days, (6) CPI and fed funds rate as macro context. Output a clean markdown brief.","promptArgs":[{"name":"ticker","description":"Stock ticker symbol (e.g. AAPL, MSFT, NVDA)","required":true}]},{"slug":"macro-economics","title":"Macro economics","tagline":"Pull the canonical US macro dataset - yield curve, CPI, unemployment, fed funds, Sahm rule - without an API key.","useCase":"Producing a weekly macro note, charting the recession-indicator dashboard, or feeding a model with the latest FRED/Treasury data.","toolSlugs":["treasury-yield-curve","yield-curve-spread","cpi-yoy","unemployment-rate","fed-funds","sahm-rule","fred-release-calendar"],"workflow":["Pull the live Treasury yield curve (all maturities from 1M to 30Y) - the base data for every spread/inversion chart.","Get the 10Y–2Y and 10Y–3M spreads from yield-curve-spread; the latter is the NY Fed's preferred recession indicator.","Pull CPI YoY (cpi-yoy) for the headline and core inflation read.","Pull the headline unemployment rate (unemployment-rate) - the U-3 series.","Get the effective fed funds rate (fed-funds) for the current policy stance.","Compute the Sahm rule (sahm-rule) - a real-time recession indicator that triggers when the 3-month unemployment average rises >0.5pp above its 12-month low.","Pull the upcoming FRED release calendar (fred-release-calendar) so the brief can flag what's hitting this week."],"claudePrompt":"Build today's macro dashboard. Use Agent402 to pull the Treasury yield curve, 10Y–2Y and 10Y–3M spreads, latest CPI YoY, unemployment rate, fed funds rate, and the Sahm rule reading. Highlight any indicator that is at a multi-year extreme, and list FRED releases scheduled for this week.","promptArgs":[]},{"slug":"macro-dashboard","title":"Macro dashboard refresh","tagline":"The full macro + crypto dashboard in one call: 5 FRED series, 5 Treasury reads, yield-curve spread, crypto market/trending/global, and live gas - the 14-tool basket recurring buyers refresh every cycle, bundled below its a la carte price.","useCase":"An agent keeping a live macro dashboard warm needs the same basket of reads every refresh cycle. Buying the 14 tools individually costs $0.143 per cycle; this bundle is $0.10 - one call, one payment, every series in one JSON envelope. Built from observed demand: a production agent repeatedly bought exactly this basket a la carte.","toolSlugs":["fred-release-calendar","fed-funds","cpi-yoy","unemployment-rate","sahm-rule","yield-curve-spread","treasury-yield-curve","treasury-yield-history","treasury-debt","treasury-avg-rates","crypto-market","crypto-trending","crypto-global","gas-estimate"],"workflow":["Pull the five FRED macro series: upcoming release calendar (14 days), fed funds rate (30 days), CPI year-over-year, unemployment rate (12 months), and the Sahm-rule recession signal.","Read the Treasury complex: full yield curve, 90 days of yield history, the 10y-2y spread, total public debt, and average interest rates on the debt.","Snapshot crypto: top coins by market cap, trending coins, and global market stats (total cap, BTC dominance, volume).","Read live Base gas via gas-estimate so onchain execution cost rides the same refresh."],"claudePrompt":"Refresh my macro dashboard using Agent402's macro-dashboard skill pack: FRED releases, fed funds, CPI, unemployment, Sahm rule, the full Treasury yield curve and spread, crypto market overview, and current gas. Summarize what changed since the last refresh in one paragraph.","promptArgs":[]},{"slug":"dns-network-ops","title":"DNS & network ops","tagline":"End-to-end DNS health check: records, multi-resolver propagation, WHOIS, ASN, robots.txt, and reachability.","useCase":"Investigating a DNS-related outage, debugging propagation after a record change, or onboarding a new domain and checking the operator chain.","toolSlugs":["dns-lookup","dns-propagation","asn-info","whois","http-check","robots-check"],"workflow":["Resolve A/AAAA/MX/TXT/NS/CAA records on the apex with dns-lookup to baseline what the authoritative answer should be.","Run dns-propagation across Cloudflare/Google/Quad9/OpenDNS in parallel - divergent answers mean a stale cache somewhere or a botched TTL during a migration.","Look up the ASN and prefix that the apex resolves into with asn-info (Team Cymru DNS-based whois - no auth needed). Useful for spotting an unexpected hosting move.","Pull whois for ownership, expiry, and registrar - catches the 'we forgot to renew' class of outage.","Run http-check for status code, response time, and final URL after redirects - the fastest 'is it actually up' read.","Spot-check robots.txt with robots-check to make sure a redeploy didn't accidentally Disallow: / the whole site."],"claudePrompt":"Run a DNS health check on example.com. Use Agent402 to: pull the apex DNS records, check propagation across major public resolvers, look up the ASN/prefix, pull whois for ownership and expiry, run an HTTP reachability check, and confirm robots.txt isn't broken. Report any inconsistency or near-expiry.","promptArgs":[{"name":"domain","description":"Domain to check (e.g. stripe.com)","required":true}]},{"slug":"crypto-research","title":"Crypto research","tagline":"Pull live price, market structure, OHLC history, trending status, global market context, and recent news for a single coin in one pass.","useCase":"Building a one-pager on a token, prepping for a positioning decision, or monitoring a new listing - you want price, supply, sentiment, and headlines without leaving the agent loop.","toolSlugs":["crypto-price","crypto-market","crypto-history","crypto-trending","crypto-global","search-news","extract"],"workflow":["Get the live quote from crypto-price - last price, 24h change, 24h volume, and market cap.","Pull the market overview from crypto-market - circulating supply, max supply, ATH, ATH date, and 7d/30d performance for the deep dive.","Pull OHLC history from crypto-history to compute return, volatility, and max drawdown over a chosen window.","Check crypto-trending to see whether the coin is on CoinGecko's most-searched list - a fast read on retail attention.","Pull crypto-global for total market cap, BTC dominance, and 24h volume - contextualizes the coin's move against the broader market.","Pull the last week of search-news headlines for the coin - catalysts, partnerships, exploit reports.","For the top 2–3 headlines, use extract to convert the article to clean markdown for the brief."],"claudePrompt":"Build a one-page research brief on BTC. Use Agent402 to pull: (1) live quote (price, 24h change, volume), (2) market overview (supply, ATH, 30d performance), (3) 90 days of OHLC history with return and max drawdown, (4) whether BTC is in CoinGecko's trending list, (5) Bitcoin dominance and total market cap context from crypto-global, (6) the last 7 days of news headlines via search-news, (7) clean markdown of the top 2–3 articles via extract. Output a clean markdown brief.","promptArgs":[{"name":"coin","description":"Coin ticker or CoinGecko id (e.g. BTC, ETH, bitcoin)","required":true}]},{"slug":"content-extraction","title":"Content extraction","tagline":"Turn arbitrary URLs and PDFs into clean structured text - articles, page metadata, PDF pages, OCR'd images, browser-rendered SPAs.","useCase":"Building a RAG corpus, a daily newsletter from a list of source URLs, or extracting a table from a scanned PDF.","toolSlugs":["extract","meta","pdf-to-markdown","pdf-extract-pages","render","image-ocr"],"workflow":["For an article URL, extract returns clean markdown (Readability-style) plus title, byline, word count.","For OpenGraph card data (title, description, image, canonical), meta is faster than extract.","For a PDF that lives at a URL, pdf-to-markdown converts the whole document; pdf-extract-pages pulls a specific page range.","For a SPA or paywalled page that needs JavaScript execution, render returns the post-JS HTML - extract usually works directly against the rendered URL.","For an image URL (scanned receipt, screenshot of a table), image-ocr returns the text.","Pipeline: render → extract → embed for a robust ingest path that handles client-rendered sites without breaking."],"claudePrompt":"Ingest these 10 URLs into clean markdown using Agent402. For each: try extract first; if it returns no body, fall back to render→extract; for any PDF URL, use pdf-to-markdown. Return one markdown blob per URL with the source URL as the H1.","promptArgs":[{"name":"urls","description":"Newline- or comma-separated list of URLs / PDF links to ingest","required":false}]},{"slug":"sec-filings-deep-dive","title":"SEC filings deep-dive","tagline":"Pull the full EDGAR picture of a US public company in one workflow: recent filings, key financial time series, insider trades, and full-text search across the corpus.","useCase":"Pre-earnings prep, an investment thesis, M&A diligence, or journalism - anywhere you need the source documents instead of a paid terminal's summary.","toolSlugs":["edgar-company-lookup","edgar-filings","edgar-company-facts","edgar-company-concept","edgar-insider-trades","edgar-search","edgar-13f-holdings"],"workflow":["Resolve the ticker to a SEC CIK with edgar-company-lookup - every other tool keys off CIK, and tickers change (mergers, listings, spinoffs) while CIKs are stable.","Pull the recent filing history with edgar-filings - 10-K (annual), 10-Q (quarterly), 8-K (material events), DEF 14A (proxy). The 8-K stream is the freshest signal: M&A, exec departures, material agreements, restatements.","Use edgar-company-facts for a structured snapshot of every XBRL tag the company has ever filed (revenue, net income, assets, cash, etc.) - one call returns the full time series for tagging in your own model.","Drill into a single concept with edgar-company-concept (e.g. us-gaap:Revenues, NetIncomeLoss) to compare a specific metric across years without parsing 10-K HTML.","Run edgar-insider-trades to surface Form 4 transactions (officer/director buys + sells) in the last N days - concentrated insider selling around an event is one of the highest-signal-to-noise flags in public-markets research.","Run edgar-search to full-text query the filing corpus for any phrase the company has ever filed - useful for finding the exact 10-K paragraph mentioning a competitor, a risk factor, or a litigation matter.","Optional: pull edgar-13f-holdings on a known institutional manager (Berkshire = CIK 1067983, Bridgewater, etc.) to see whether they hold the target company and at what dollar weight."],"claudePrompt":"Build a research brief on AAPL using Agent402's EDGAR tools. (1) Resolve the ticker → CIK with edgar-company-lookup. (2) List the 25 most recent filings via edgar-filings - flag any 8-K from the last 90 days. (3) Pull edgar-company-facts and report the 4-quarter trend for Revenues, NetIncomeLoss, and Assets. (4) Run edgar-insider-trades over the last 90 days and flag any director/officer who sold >$1M. (5) Run edgar-search for 'going concern' restricted to this CIK to surface auditor risk language. Output a markdown brief with each section linking back to the source filing URL.","promptArgs":[{"name":"ticker","description":"US stock ticker (e.g. AAPL, NVDA, BRK.B)","required":true}]},{"slug":"structured-scrape","title":"Structured scrape","tagline":"Pull structured data out of any web page deterministically - articles to clean text, tables to JSON rows, specific elements via CSS selector - without writing regex against raw HTML.","useCase":"Extracting a product price, a sports stats table, a roster, a pricing tier, an outlink list - anything where the page has the data but no public API exposes it, and you need a repeatable deterministic answer instead of an LLM guess.","toolSlugs":["extract","render","html-select","html-table","html-strip","html-links","html-meta"],"workflow":["If the page is prose (an article, a blog post, a docs page), try extract first - it returns clean Readability-style markdown in one call, no HTML wrangling needed.","If the page is a SPA, paywalled-but-bypassable-with-render, or has data that lives outside the article body, fall back to render - it runs Chromium and returns the post-JS HTML you can then drill into.","Pipe the HTML from render into html-select with a CSS selector to pull specific elements (a price, a header, a button label). Use the `attr` parameter when you only need href/id/data-* values - keeps the response tight.","If the data is in a <table>, use html-table - it returns header-keyed JSON rows by default, or RFC 4180 CSV if you'd rather paste it into a spreadsheet. It picks the first matching table; pass a selector for more specificity.","If you need plain text from a specific subtree (e.g. \"give me the body of <article>\"), use html-strip with a selector - it preserves block-level newlines and removes <script>/<style>.","To enumerate outlinks (link audits, crawl seeds, footnote URLs), use html-links - it resolves relative hrefs against a base URL and dedups by href. Filter by regex when you only want one host or path prefix.","If you already have the rendered HTML and just want the metadata (title, description, OpenGraph, Twitter, canonical, JSON-LD), use html-meta on the string - avoids paying for a second fetch from /api/meta."],"claudePrompt":"Scrape the price and SKU from https://example.com/product/42 using Agent402. (1) Try extract first; if the price isn't in the article body, (2) call render to get the post-JS HTML. (3) Use html-select with a precise CSS selector to pull the price element - fall back to a broader selector if the first returns 0 matches. (4) Use html-select again with attr=\"data-sku\" or similar to read the SKU. Return a single JSON object {price, sku, url, source} where source = \"extract\" or \"render\" depending on which path worked.","promptArgs":[{"name":"url","description":"Page to scrape (e.g. https://example.com/product/42)","required":true},{"name":"target","description":"What to extract - a price, a table, a list, a paragraph, etc.","required":true}]},{"slug":"decode-blob","title":"Decode this blob","tagline":"Hand the agent an opaque string - a JWT, a base64'd JSON payload, a gzip-encoded API response, a hex-encoded hash - and walk it through identifying what it is and unwrapping it layer by layer until it's human-readable.","useCase":"You pulled a suspicious string out of a log, a webhook body, a network capture, a cookie, or an API response, and you need to know what's inside without writing a one-off Node script. The tools in this pack are all deterministic and pure-CPU - every step is free over the proof-of-work tier.","toolSlugs":["jwt-decode","gunzip","brotli-decompress","base64","hex","json-format","hash"],"workflow":["Look at the first few characters before calling anything. \"eyJ\" → almost certainly a JWT (it's base64url for `{\"`). \"H4sI\" → base64-encoded gzip (gzip's 1f 8b magic, base64'd). All hex chars and a multiple-of-2 length → likely hex-encoded bytes. Mostly A-Z/a-z/0-9/+// with optional `=` padding → base64.","If it looks like a JWT, call jwt-decode - returns the header + payload as JSON without verifying the signature. The header tells you the algorithm; the payload is your answer. If decoded successfully but the payload is itself base64'd or gzipped, recurse with this pack.","If the prefix is \"H4sI\" (or starts with bytes 1f 8b after a base64 decode), it's gzipped. Call gunzip with the base64 string directly - outputFormat \"utf8\" if you expect text, \"base64\" if you expect another binary layer.","Brotli has no fixed magic in the stream, but if you've ruled out gzip and the bytes still don't look like text after base64 decode, try brotli-decompress. Failure is cheap (a 400, not a 500) so this is safe to attempt.","Fall back to base64 with mode=\"decode\" - it's the most common wrapper. If the result is human-readable text, you're done; if it looks like more binary, you're peeling another layer (very common: base64(gzip(json))).","If everything is in [0-9a-f] pairs and an even length, use hex with mode=\"decode\". This is how a lot of crypto/hash tooling formats output - sha256 digests, wallet addresses, encryption ciphertexts.","When you finally land on something that parses as JSON, run json-format to pretty-print it - much easier to inspect a 50-key payload with indented keys than as one long line. If the original blob was a hash you wanted to verify, call hash on the source content and compare hex outputs."],"claudePrompt":"Identify and decode this opaque string using Agent402: \"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ\". (1) Inspect the prefix - \"eyJ\" suggests a JWT. (2) Call jwt-decode and return the header + payload. (3) If any field in the payload is itself a base64 / gzip / hex string, peel it: base64 → gunzip → brotli-decompress → hex, trying each only if the prefix suggests it. (4) When you reach plain text or JSON, return a single object describing what each layer was (e.g. {layers: [\"jwt\", \"base64\", \"gzip\", \"json\"], finalPayload: {...}}). All steps are free over the proof-of-work tier - no payment needed.","promptArgs":[{"name":"blob","description":"The opaque string to identify and decode","required":true}]},{"slug":"trend-analysis","title":"Trend analysis","tagline":"Take any numeric time series - a stock's daily close, a FRED macro indicator, a treasury yield history - and run it through the full quantitative workup: descriptives, moving averages, trend line, outliers, optional correlation against a benchmark, and a deterministic forecast forward with a 95% prediction interval. Everything an analyst writes a notebook for, in one chain of cheap calls.","useCase":"You have a question like \"is AAPL trending up over the last year - and what does the next quarter look like?\" or \"is unemployment a leading indicator for fed-funds moves?\" and want a deterministic numerical answer (slope, r², outlier dates, point forecast + 95% interval) instead of a hand-wavy LLM summary or hallucinated projection. The stats + forecast steps are pure-CPU and free over PoW; only the upstream data fetch (finance/macro) is paid.","toolSlugs":["stock-history","fred-series","stats-summary","moving-average","linear-regression","outliers","correlation","forecast-eval"],"workflow":["Fetch the series. For an equity ticker, call stock-history with range=horizon (or \"1y\" if unspecified) and pull the array of `close` prices in chronological order. For a macro indicator, call fred-series with the series id (UNRATE, CPIAUCSL, FEDFUNDS, etc.) and pull the array of `value`s.","Run stats-summary on the values to get the full descriptive panel (mean, median, stddev, min, max, q1/q3, IQR). This is the one-line \"what does this series even look like\" answer - agents that skip this step end up reporting trends without context.","Smooth the noise with moving-average. A 20-day SMA is the textbook short-term trend smoother for daily prices; a 12-month MA suits monthly macro data. Use which=\"both\" so you can compare SMA (lagging but stable) with EMA (responsive but jittery).","Fit linear-regression with x = [0, 1, ..., n-1] (just the index) and y = values. Slope tells you direction + magnitude per unit time; r² tells you how clean the trend is (>0.7 = strong trend, <0.3 = mostly noise). Pass `predict` for next-N-period extrapolation if the user wants a projection.","Flag anomalies with outliers method=\"iqr\" - Tukey fences (1.5·IQR) are the conservative default. Report the indices + values; agents should then map indices back to dates from the original fetch so the answer says \"2024-03-14: $187.23 outlier\" not just \"index 142\".","If the user asked a comparison question (\"is AAPL correlated with the S&P?\", \"do CPI and fed funds move together?\"), repeat steps 1-2 for the benchmark series, then call correlation with the two equal-length arrays. r above 0.7 = strong same-direction move; near 0 = independent; negative = inverse. Use the `interpretation` field as your one-line answer.","Pick a forecast method honestly by backtesting. Call forecast-eval three times - once each with method=\"drift\", \"ses\", \"holt\" - passing the same values + testSize (≈ 20% of the series, capped at half). Compare RMSE; the lowest wins. Check `warnings` - non-empty means treat the result as indicative not predictive. Skip the bake-off only if you already know the series shape (e.g. holt-winters for clearly seasonal data with a known period).","Forecast forward with the winning method. Call forecast-naive / forecast-ses / forecast-holt (whichever won) with the full values + the user's horizon. Return the point forecast AND lower95/upper95 - never report a point estimate without its interval; that's the whole reason these tools exist instead of an LLM guess. Combine summary + trend + outliers + optional correlation + forecast into a single JSON object. That's the deterministic analyst-grade reply."],"claudePrompt":"Run a full trend analysis on AAPL over the last 1y using Agent402, then project the next quarter forward. (1) Fetch the daily closes via stock-history (ticker=AAPL, range=1y). (2) Run stats-summary on the closes for the descriptive panel. (3) Run moving-average with window=20, which=\"both\" - compare SMA vs EMA. (4) Run linear-regression with x=[0..n-1], y=closes; report slope (annualized = slope·252), intercept, r². (5) Run outliers method=\"iqr\" and map the flagged indices back to actual dates from the fetch. (6) Pick a forecast method: call forecast-eval three times with method=\"drift\", \"ses\", \"holt\" and testSize=50 (≈ 20% of a 252-day year); pick the lowest RMSE. (7) Forecast the next ~63 trading days using the winning method (forecast-naive / forecast-ses / forecast-holt) and report both point and 95% interval. (8) Return a single JSON object: {summary, trend, outlierDates, forecastMethod, forecastWithIntervals, oneLineConclusion}. The stats + forecast steps are free over PoW; only the stock-history fetch is paid.","promptArgs":[{"name":"series","description":"What to analyze - a ticker (AAPL), a FRED series id (UNRATE), or a treasury maturity (10Y)","required":true},{"name":"horizon","description":"Lookback window for the fetch - e.g. \"1y\", \"5y\", \"6mo\". Maps to the upstream tool's range parameter.","required":false}]},{"slug":"forecasting-bake-off","title":"Forecasting bake-off","tagline":"Don't guess which forecasting method to trust. Backtest all four (naive/drift, SES, Holt, Holt-Winters) on a real series, rank by out-of-sample RMSE, then forecast forward with the winner and its 95% prediction interval. Method selection without the hand-waving.","useCase":"You need a forecast and you're not sure whether the series is stationary, trending, or seasonal. Instead of picking a method by gut and praying, the bake-off lets the data choose: every method runs the same holdout backtest, the lowest RMSE wins, and you forecast forward with that winner only. Pure-CPU and free over PoW - only the upstream data fetch is paid.","toolSlugs":["stock-history","fred-series","forecast-eval","forecast-naive","forecast-ses","forecast-holt","forecast-holt-winters"],"workflow":["Fetch the equity series with stock-history (ticker, range=horizon-scaled - e.g. \"2y\" if you want to forecast ~6 months out). Pull `close` in chronological order; you want at least ~50 observations for the backtest to be meaningful, more if you suspect seasonality.","If the user is asking about a macro indicator instead (unemployment, CPI, fed funds), fetch via fred-series with the series id. Monthly FRED data with 10+ years of history is the sweet spot for Holt-Winters with period=12.","Run the bake-off. Call forecast-eval four times on the same values with testSize ≈ 20% of the series (capped at half): method=\"naive\" or \"drift\", \"ses\", \"holt\", \"holt-winters\" (the last only if you have ≥ 2·period observations and suspect seasonality). Compare RMSE; lowest wins. Watch the `warnings` field - \"insufficient data\" or \"could not detect seasonal period\" means treat that method's score as suspect, not as a clean win/loss.","If forecast-naive (or drift, the mean-reversion variant) won, the series is essentially random-walk and there's nothing to extrapolate - call forecast-naive with the full values + horizon. The point forecast is just the last value (or last + average drift); the interval widens with √h. This is the honest answer for noisy series; don't over-engineer.","If forecast-ses won, the series has no trend but local level matters more than the long-run mean. Call forecast-ses with the full values + horizon; the alpha SES picked tells you how much weight goes on recent vs. older observations (high alpha = react fast, low alpha = smooth heavy). Report alpha alongside the forecast - it's diagnostic.","If forecast-holt won, the series has a persistent trend worth extrapolating. Call forecast-holt with full values + horizon; it returns level + trend smoothing parameters (alpha, beta) and a forecast that walks forward at the fitted trend slope. The 95% interval grows faster than SES because trend uncertainty compounds.","If forecast-holt-winters won, the series has seasonality you should respect (e.g. monthly macro with annual cycle, quarterly retail with year-end peak). Call forecast-holt-winters with the full values + horizon + period (12 for monthly-annual, 4 for quarterly-annual, 7 for daily-weekly) and seasonality=\"additive\" or \"multiplicative\". The forecast carries the seasonal pattern forward; never report the point forecast without the interval - seasonal forecasts look confident but compound multiple sources of error."],"claudePrompt":"Run a forecasting bake-off on AAPL over the last 2y and project the next 30 trading days using Agent402. (1) Fetch the daily closes via stock-history (ticker=AAPL, range=2y). (2) Run forecast-eval four times on the closes with testSize=100: method=\"drift\", \"ses\", \"holt\", and \"holt-winters\" with period=21 and seasonality=\"multiplicative\" (try the seasonal one - equities usually don't have strong calendar seasonality but the backtest will tell you). (3) Rank by RMSE ascending; the lowest is the winner. Note any `warnings` returned. (4) Call the winning forecast tool (forecast-naive / forecast-ses / forecast-holt / forecast-holt-winters) with the full closes + horizon=30 to get the forward forecast and 95% interval. (5) Return a single JSON object: {rankings: [{method, rmse, mape, warnings}, ...], winner: \"holt\", forecast: {point: [...], lower95: [...], upper95: [...]}, oneLineConclusion}. All bake-off + forecast calls are free over PoW; only stock-history is paid.","promptArgs":[{"name":"series","description":"What to forecast - a ticker (AAPL) or a FRED series id (UNRATE, CPIAUCSL)","required":true},{"name":"horizon","description":"How many periods to project forward - e.g. 30 (days for daily data, months for monthly)","required":false}]},{"slug":"document-intel","title":"Document intelligence","tagline":"Turn any PDF or image URL into structured data - metadata, extracted text, sliced page ranges, OCR for scanned docs, decoded barcodes / QR codes - without falling back to a vision LLM guess. Built for the messy 30% of documents where pdf-to-markdown alone returns nothing useful.","useCase":"An agent gets a PDF link from a webhook (invoice, contract, receipt, regulatory filing) or an image URL (shipping label, scanned form, photographed ticket) and needs to extract structured fields deterministically. content-extraction handles the easy path; document-intel adds metadata inspection, page slicing, OCR fallback for scanned PDFs, embedded barcode / QR decoding, and PDF reassembly for downstream sharing.","toolSlugs":["pdf-info","pdf-to-markdown","pdf-extract-pages","image-ocr","barcode-decode","pdf-merge","images-to-pdf"],"workflow":["Start with pdf-info - confirms the URL actually serves a PDF (some webhooks lie about content-type), returns the page count for scoping, and surfaces flags like `encrypted` so you don't waste a pdf-to-markdown call that will fail. Skip only if you already know the document's shape.","Run pdf-to-markdown for the happy path. Digital-native PDFs - invoices generated by accounting software, Word/Google-Docs exports, EDGAR filings - come back as clean markdown in one call. This handles ~70% of real-world PDF intake; the next steps are for the other 30%.","If the document is long (>20 pages) and you only need a slice - the signature page on a contract, the line-item table on an invoice, an appendix from a research report - call pdf-extract-pages with the page range first. Then run pdf-to-markdown on the extracted slice. Cheaper, faster, and the smaller payload reduces noise downstream.","If pdf-to-markdown returns <50 characters of text, the PDF is a raster (a scanned document, a photo-of-a-receipt PDF, or a contract that was printed and re-scanned). Fall back to image-ocr - feed it the rendered page image. Tesseract-grade OCR is deterministic and surfaces the text that pdf-to-markdown couldn't.","For invoices, shipping labels, event tickets, and packaging, the high-value structured payload is often encoded in a barcode or QR code rather than visible text. Run barcode-decode on the page image - it returns the raw payload (shipping tracking numbers, EAN/UPC product codes, base64 / JWT ticket payloads). Feed JWT-shaped payloads to the decode-blob pack for further unwrapping.","Use pdf-merge when you've extracted slices from multiple PDFs and want to combine them into a single artifact - building a deal package (term sheet + signature page + appendix), or stitching a multi-vendor invoice export back together for accounting.","Use images-to-pdf when the source material was a set of phone photos (receipts, whiteboard captures, scanned pages handed to you out-of-order) and you need to wrap them into one shareable PDF - either as the final deliverable or as the input to a re-run of this same pipeline at higher quality."],"claudePrompt":"Process this invoice with Agent402: https://example.com/invoice.pdf. (1) Run pdf-info to confirm it's a PDF, get the page count, check the `encrypted` flag. (2) If not encrypted, call pdf-to-markdown with the URL. (3) Inspect the returned markdown - if it has <50 chars of text, the PDF is scanned: call pdf-extract-pages to get each page as an image, then run image-ocr on each. (4) If you still can't find a tracking number after parsing the OCR text, run barcode-decode on page 1 to surface an embedded QR / barcode payload. (5) Return a single JSON object: {invoiceNumber, totalAmount, vendor, lineItems, trackingNumber, source: \"pdf-to-markdown\" | \"image-ocr\" | \"barcode-decode\"} - populate `source` based on which extraction path actually produced the data. Budget ≤ $0.05 per document; all of these tools are wallet-only (paid per call).","promptArgs":[{"name":"url","description":"PDF or image URL to process (e.g. https://example.com/invoice.pdf)","required":true}]},{"slug":"document-brief","title":"Document brief","tagline":"Metadata, an AI-written summary, and a preview of the opening pages of a PDF - understand what a document says without reading the whole thing. The catalog's first AI-summarization pack, complementary to document-intel's deterministic format extraction (no AI, no summarization there).","useCase":"An agent is handed a PDF link - a research paper, an earnings report, a whitepaper, a long contract - and needs the gist before deciding whether to read further or which section to pull next. document-intel answers \"what format is this and can I get the raw text out\"; document-brief answers \"what does this document actually say.\"","toolSlugs":["pdf-info","pdf-summarize","pdf-extract-pages"],"workflow":["Run pdf-info first - page count, title, author, encryption flag, byte size. Confirms the URL is really a PDF and gives you the page count before spending on the AI summary.","Run pdf-summarize for the actual gist - a factual, AI-written summary of the document's content, with the model that served disclosed in the response. This is the one paid-AI step in the pack; the other two are pure deterministic extraction.","Run pdf-extract-pages for a quick visual preview of the opening pages (default \"1-2\") - useful when you want to show the document's actual formatting/layout alongside the summary, not just prose about it."],"claudePrompt":"Give me a brief on this PDF: https://bitcoin.org/bitcoin.pdf. Use Agent402's document-brief skill pack to get (1) the document's metadata and page count, (2) a ~150-word AI summary of what it actually says, and (3) the first two pages as a preview PDF. Present the summary first, then the metadata, and note the preview is available if I want to see the original formatting.","promptArgs":[{"name":"url","description":"PDF URL to summarize (e.g. https://example.com/report.pdf)","required":true}]},{"slug":"fraud-signals","title":"Fraud signals","tagline":"Is this domain trustworthy, or is it a phishing site / typosquat / scam? Pull the reputation signals an analyst checks before clicking anything: domain age, cert issuance history, hosting reputation, DNS topology, tech-stack fingerprint, and page-content red flags. Different from a security audit - this is about whether the domain is what it claims to be.","useCase":"You got a link from email, a webhook, a referral, or a search result and you need to decide whether to trust it before authenticating, paying, or downloading. The security-audit pack tells you whether a domain you own is configured securely; fraud-signals tells you whether a domain you don't own is who it says it is. Newly registered domain + Let's Encrypt cert from yesterday + hosted on a bulletproof ASN + WordPress restaurant theme imitating a bank = the agent should refuse, not click.","toolSlugs":["whois","cert-transparency","tls-cert","asn-info","dns-lookup","tech-stack","extract"],"workflow":["Start with whois - domain age is the single best fraud predictor. Established brands have domains registered years ago; impersonators are usually using domains < 90 days old. Also surfaces the registrar (some - like privacy-shrouded resellers operating out of jurisdictions with slow abuse response - are over-represented in fraud) and registrant info (privacy-protected WHOIS is normal for personal sites, suspicious for a business claiming to be Fortune-500 established).","Pull the cert-transparency log. CT logs every TLS cert ever issued for the domain. A legitimate long-running site shows years of cert renewals from major CAs. A classic phishing pattern is a brand-new domain with exactly one Let's Encrypt cert issued in the last few days - there's no history because there's no history. Burst issuance across many subdomains in a short window can indicate a phishing kit operator.","Inspect the live cert with tls-cert. Self-signed = major red flag, period. Wildcard certs across a sprawling subdomain set on a brand-new domain can indicate a phishing kit operator running many landing pages off one cert. Cert validity window matters too - Let's Encrypt's 90-day cert on a domain claiming to be an established bank is anomalous (real banks use OV/EV certs with longer validity and the green-bar / org-name treatment).","Run asn-info on the resolved IP. Cloudflare / AWS / GCP / Azure are neutral - most of the internet runs there. Known abuse-friendly hosters (specific ASNs in Russia, China, and certain Eastern European countries) over-index on fraud. Geographic mismatch matters: a US-targeted brand impersonator hosted in a country with no business presence there is a meaningful signal. Cross-reference the ASN against public abuse databases if the user wants depth.","Map the DNS topology with dns-lookup. MX records: a site claiming to be a business with no MX records (can't receive email) is a red flag. CNAMEs to shared hosting (Wix / Webflow / Squarespace on a domain impersonating a bank) are common in scams - legitimate financial institutions don't host on shared CMS platforms. Many A records spread across disparate subnets can indicate a fast-flux network rotating IPs to evade takedowns.","Fingerprint the application layer with tech-stack. Off-the-shelf scam templates are detectable: certain WordPress themes ('AI investment platform' kits, 'crypto exchange' kits), specific obfuscated jQuery patterns, telltale Bitrix or older CMS versions. Mismatch between detected tech and the claimed brand is meaningful - a 'bank' running on a WordPress theme designed for restaurants doesn't pass even a casual review.","Pull the page content with extract and scan for fraud-pattern keywords. Phishing kits use predictable language: urgency ('act now', 'limited time'), unsolicited payment requests, crypto-only payment ('USDT only'), dubious testimonials, broken English on a site claiming to be US-headquartered, gift-card payment instructions. Combine all 7 signal sources into a single rollup: low / medium / high fraud likelihood with each piece of cited evidence - let the user see exactly which signals fired, not just a black-box score."],"claudePrompt":"Evaluate example.com for fraud signals using Agent402. (1) whois - record the domain creation date and the registrar. If age < 90 days, flag as a strong fraud signal. (2) cert-transparency - pull the cert log. Count entries; first issuance date should match (or predate) the whois creation date by at most a few days. (3) tls-cert - inspect the live cert: issuer (Let's Encrypt is fine, self-signed is a hard red flag), validity window, wildcard scope. (4) asn-info - resolve the A record, pull the ASN: is it a mainstream cloud (Cloudflare/AWS/GCP) or a known abuse-friendly hoster? Surface country. (5) dns-lookup - MX records (a 'business' with no MX is suspicious), CNAMEs (shared-hosting CNAMEs on a brand-impersonator site are a red flag). (6) tech-stack - fingerprint the running stack; flag mismatches with the claimed brand (e.g., a 'bank' on a WordPress restaurant theme). (7) extract - pull the home-page text, scan for urgency language, crypto-only payment requests, gift-card mentions, broken English. Return: {domain, age_days, certHistoryCount, hostingProvider, hostingCountry, hasMX, techStack, redFlags: [{signal, evidence}], fraudLikelihood: \"low\"|\"medium\"|\"high\", oneLineRecommendation}. All seven tools are wallet-only (egress) - budget ≤ $0.05 per domain check.","promptArgs":[{"name":"domain","description":"Domain to evaluate (e.g. example.com or suspicious-bank-login.com)","required":true}]},{"slug":"api-investigation","title":"API investigation","tagline":"Point at an unknown API endpoint and figure out how to use it: auth scheme, content type, version, rate limits, OpenAPI/Swagger spec discovery, and JSON response structure. The deterministic recon workflow before writing a single line of integration code.","useCase":"A developer just got handed an API base URL with minimal docs (\"here's the endpoint, integrate it\"). The pack walks through the recon-before-code workflow: decompose the URL, probe headers for auth + versioning + rate-limit signals, find the human-readable docs page, hunt for an OpenAPI/Swagger link in the docs page, and once a real response is in hand, pretty-print and drill into the JSON structure. Saves the cycle of \"send request → 401 → guess auth header → 415 → guess content-type → ...\" by surfacing it all in one workup.","toolSlugs":["url-parse","http-check","http-headers","extract","html-links","json-format","json-query"],"workflow":["Decompose the URL first with url-parse. Surfaces scheme, host, port (default-or-explicit matters for whether you're hitting a non-standard reverse proxy), path, and parsed query parameters. The host alone often tells you whether the API is multi-tenant (api.example.com vs. tenant.example.com vs. example.com/api) which affects how rate limits will work. Cheap, deterministic, and orients the rest of the investigation.","Liveness-probe with http-check. Returns the status code, response time, and (most importantly) confirms whether the host even resolves and answers TCP/443. A 401 here is the friendliest answer - it tells you the endpoint exists and what auth scheme is expected (Bearer, Basic, Digest via the WWW-Authenticate header). A 404 might mean the path is wrong; a 502 / connection refused means you have a different problem (DNS, infra, or simply wrong URL). Don't burn calls on the next steps until http-check returns a 2xx or an authenticated 4xx.","Inspect the full response headers with http-headers - this is where most of the API contract leaks out. Watch for: Content-Type (application/json, application/hal+json, application/vnd.api+json, etc. - each implies a different response convention), WWW-Authenticate (auth scheme + realm), X-RateLimit-* (anticipate quotas before you hit them), X-API-Version / API-Version (call out the version you're actually pinned to), CORS headers (whether browser-side calls will work), and any vendor-prefixed headers (X-Stripe-*, X-GitHub-*, X-Twilio-*) that hint at the platform and unlock platform-specific patterns.","Pull the human-readable docs page with extract. Most APIs publish at a guessable path: api.example.com → docs.example.com, /docs, /api, /reference, /developer. extract returns clean markdown, suitable for skimming. Look for: an authentication section (token format, where to put it), a rate-limit section (quotas + retry behavior), a versioning/changelog section (deprecations), and a base URL section (sometimes the URL the user handed you is not the canonical base).","Hunt for the machine-readable spec by feeding the docs page HTML to html-links. Filter for hrefs matching openapi, swagger, postman, schema, or .json / .yaml suffixes. An OpenAPI spec is gold - it documents every endpoint, every parameter, every response shape deterministically. If found, fetch it (separate call outside this pack) and feed it to json-format / json-query in steps 6-7 to navigate the schema. If not found, fall back to fishing on conventional paths: /openapi.json, /swagger.json, /v1/openapi, /.well-known/openapi.","Once you have an actual JSON response (from the live API or the spec), pretty-print it with json-format. Two-space-indented JSON is much faster to scan than a flat line, especially for nested envelopes (RFC 7807 errors, JSON:API resource objects, HAL _links/_embedded structures). This is the cheapest possible reality check that you've correctly understood the wire format.","Drill into specific fields with json-query - JSONPath ($.data[*].id) is the deterministic way to verify 'does this response actually contain the field I'm going to depend on?' Use it to validate assumptions before writing integration code: confirm the pagination cursor is at $.meta.next_cursor not $.next_page; confirm the array of items is at $.data not $.results; confirm error envelopes are at $.errors[*].detail not $.error.message. Wrong assumption here = the entire integration breaks later when the second-page response shape differs from the first."],"claudePrompt":"Investigate this API endpoint using Agent402: https://api.example.com/v1/users. (1) url-parse the URL: scheme=https, host=api.example.com, path=/v1/users - flag that this is a versioned, multi-tenant-ish path. (2) http-check it (unauthenticated). Expect a 401 - record the response time and confirm the host resolves. If you get 404 or connection-refused, stop and ask the user for the correct URL. (3) http-headers - record Content-Type, WWW-Authenticate scheme, all X-RateLimit-* values, any X-API-Version header, and any vendor-prefixed (X-*) hints. (4) extract https://docs.example.com (or /docs, /api, /reference - try in that order until one returns a real article body). Skim for auth + rate-limit + versioning sections. (5) feed the docs HTML to html-links and filter for hrefs matching /openapi|swagger|schema|\\.json$|\\.yaml$/. If found, that's the spec URL - note it. If not found, try probing /openapi.json directly via http-check. (6) Once you have any sample JSON response from the API (provided by the user or fetched via http-check on an OPTIONS endpoint), json-format it for easy reading. (7) Use json-query to verify the expected fields are where you think they are: $.data[*].id for resource IDs, $.meta.next_cursor for pagination, $.errors[*] for error envelope. Return: {baseUrl, authScheme, contentType, version, rateLimit: {requests, window}, openApiSpecUrl, sampleResponseStructure: {pagination, dataLocation, errorEnvelope}, integrationNotes}.","promptArgs":[{"name":"endpoint","description":"API URL to investigate (e.g. https://api.example.com/v1/users)","required":true}]},{"slug":"location-intel","title":"Location intel","tagline":"Point at an address (or even a rough place name) and assemble the situational brief: precise coordinates, the canonical postal address, what's within walking distance, the live weather forecast, active NWS hazard alerts, and recent seismic activity. The deterministic 'what should I know about this place right now?' workup.","useCase":"A field-ops agent (sales rep about to visit a customer, contractor scoping a job site, traveler arriving in a new city, emergency-response coordinator) hands the pack an address and needs the full pre-arrival brief in one workup. Geocode pins the spot, reverse-geocode confirms the canonical postal form (catches stale addresses where the building number changed), place-search surfaces nearby POIs (gas, coffee, hospital, supplies), weather-forecast covers the next 24-48h conditions, weather-alerts surfaces any active NWS warning (red flag / flood / heat / tornado), and earthquakes filters recent seismic activity in the region. US-centric for hazards/forecast; geocoding works globally.","toolSlugs":["geocode","reverse-geocode","place-search","weather-forecast","weather-alerts","earthquakes"],"workflow":["Pin the location with geocode. Free-form input ('1600 Penn Ave', 'Joshua Tree', 'Eiffel Tower') resolves to lat/lon + display name + bounding box via OpenStreetMap/Nominatim. The bounding box matters: a query like 'New York' resolves to a city-sized box, whereas '1600 Penn Ave' resolves to a building-sized box. The box size tells you immediately whether the next steps will return city-wide or building-specific results.","Round-trip with reverse-geocode using the lat/lon from step 1. This is the verification step - if you got the wrong place (an obscure 'Springfield' in a different state, a homonym match in another country) the canonical postal address surfaced here won't match what the user expected, and the agent should stop and ask rather than confidently brief on the wrong location. It also returns the structured ISO country code, which gates whether the US-only steps (4 and 5) will work at all.","Pull nearby POIs with place-search around the lat/lon. Useful pre-arrival categories: gas stations, coffee, ATM, hospital, hardware store, supplies. Each result includes distance + bearing, so the agent can render directional context ('coffee 200m N'). For pure tourism arrivals this surfaces sights; for emergency contexts this surfaces critical infrastructure (hospital, police, fire). For sales/customer-visit contexts, surface restaurants near the customer site for the post-meeting lunch suggestion.","Layer current conditions with weather-forecast. US-only (api.weather.gov / NWS) - takes the lat/lon and returns a 7-day forecast in 12-hour blocks. If reverse-geocode in step 2 returned a non-US country code, skip this step and surface in the writeup. Pre-arrival you want the next 24-48h: temp range, precip probability, wind, hazards (ice/snow/heat). For multi-day deployments include the full 7-day window so the team can pack accordingly.","Check for active hazards with weather-alerts using the two-letter US state code from step 2's reverse-geocode result. Active NWS alerts cover everything from severe thunderstorms to red flag (fire-weather) warnings to coastal flood watches. Even if the forecast looks calm, an active alert in the state is critical: 'no rain at this address tomorrow but a red flag warning means an avoidable burn restriction'. Skip with a note if the location isn't in the US.","Survey recent seismic activity with earthquakes (USGS, global). Filter the result list by proximity to the lat/lon from step 1 - recent activity within ~200km matters; a 5.0 across the planet doesn't. For non-seismic regions (most of the Midwest, most of Europe) the result is reassuringly empty. For Pacific Rim regions / California / Japan / New Zealand / Italy the historical baseline isn't zero, so the framing is 'is recent activity within 200km elevated vs. the regional baseline?' Composes nicely with the structured-scrape pack if the user wants to chase a quake into a deeper bulletin."],"claudePrompt":"Build a location situational brief for: 1600 Pennsylvania Ave NW Washington DC. (1) geocode 'q=1600 Pennsylvania Ave NW Washington DC&limit=1'. Record the lat / lon / display name / bounding-box size. Flag if bounding box is city-sized when the user clearly asked for a specific building. (2) reverse-geocode with the lat/lon from step 1. Confirm the canonical postal address matches what the user asked for. Extract the two-letter US state code (e.g. DC) and the country code (e.g. US) - these gate the next steps. (3) place-search around the lat/lon at a 1km radius. Categorize results into: food (cafes/restaurants), services (gas/ATM/pharmacy), and critical (hospital/police/fire). Top 5 in each category by distance. (4) IF country == US: weather-forecast for lat/lon. Surface next-24h temp range, precip probability, wind, any in-period hazards (NWS sometimes embeds advisory text in the forecast itself). Otherwise note 'weather-forecast US-only, skipped'. (5) IF country == US: weather-alerts for the state code from step 2. List active alerts: event, severity, headline, area, onset/expires. Flag severity in (Severe, Extreme) as a hard 'do not travel' signal. (6) earthquakes for period=week, minMag=2.5. Filter to events within ~200km of the lat/lon from step 1 - use the haversine of (lat,lon) vs each quake's (lat,lon). If the filtered list is non-empty, sort by magnitude desc and report the top 3. If empty for a non-seismic region, report 'baseline quiet'. Final return: {location: {displayName, lat, lon, country, state}, nearby: {food, services, critical}, weather: {next24h, precipProbability, hazards}, activeAlerts: [{event, severity, headline}], seismic: {recentNear, status}, travelRecommendation: 'green'|'yellow'|'red', oneLineBrief}. All six tools touch external APIs (egress) - wallet-only, budget ≤ $0.02 per address.","promptArgs":[{"name":"address","description":"Address or place name (e.g. '1600 Pennsylvania Ave NW Washington DC' or 'Joshua Tree National Park')","required":true}]},{"slug":"user-onboarding","title":"User onboarding","tagline":"Take a signup form submission and run the full onboarding workup deterministically: validate the email, score the chosen password, mint a stable internal ID, derive a URL-safe handle from the display name, generate a recovery / API secret, hash the password for storage, and verify the 2FA setup code. One pass, every step a pure-CPU call.","useCase":"An onboarding/account-provisioning agent receives a signup payload ({email, password, displayName, totpCode, totpSecret}) and needs to validate every field, mint every supporting identifier, and produce a storable record - without leaking the plaintext password into intermediate logs. The pack chains the steps in dependency order: validate before mint, mint stable IDs before deriving display fields, hash before storing. Output is a clean 'persistable record' shape plus a 'reject this signup because…' explanation when any step fails.","toolSlugs":["email-validate","password-strength","uuid","slugify","password","hash","totp"],"workflow":["Validate the email with email-validate. Returns a structured verdict beyond a regex - surfaces whether the local-part / domain are well-formed, whether the domain looks like a typo of a major provider (gmial.com), and whether the address has obvious red flags. Reject here on hard failures (malformed) and surface soft warnings (likely typo) for the agent to confirm with the user. Every step after assumes a valid email so any downstream 'send confirmation email' step doesn't fail silently.","Score the password with password-strength. Returns a score (0-4 or similar zxcvbn-style band) plus the actual weakness reason ('common password', 'contains username', 'too short'). Reject below a threshold and surface the *specific* weakness - 'your password is too weak' is unhelpful, 'your password contains your username' tells the user exactly what to change. Doing this here, before any hashing or mint step, means a rejected signup leaves no trace of the bad password anywhere.","Mint the stable internal ID with uuid. UUID v4 is the right default - globally unique, no information leakage, decoupled from any user-controlled field. This is the dedupe / primary-key for the rest of the workup; every downstream record (user record, audit row, related entity) references this UUID rather than email or handle, both of which can change. Generate ONCE per signup and never regenerate.","Derive the URL-safe handle with slugify on displayName. 'Ada Lovelace' → 'ada-lovelace'; 'Søren Kierkegaard' → 'soren-kierkegaard' (diacritics folded). Two failure modes to handle: collision with an existing handle (append the first 6 chars of the UUID), and reserved / forbidden slugs (admin, api, login - match against a denylist). The UUID from step 3 is the collision-resolution suffix because it's the only stable thing you have.","Generate auxiliary secrets with password. Use this for: a one-time recovery code (16-20 alphanumeric, presented to the user and never stored plaintext server-side), an API key for the user's first programmatic access (32-48 chars), or a temporary password for an admin-created account that the user must change at first login. Output is uniformly random and meets common entropy requirements out of the box - no need to argue policy with the user.","Hash with hash. NOTE: this is for FINGERPRINTING and dedupe lookups - real password storage MUST use bcrypt / argon2 / scrypt with per-user salt + work factor, not a bare SHA-256. Legitimate use cases for hash here: pwned-password fingerprint (SHA-1 of the password, sent as a 5-char prefix to a k-anonymity API), recovery-code fingerprint for fast lookup (the recovery code itself is shown to the user once and stored only as a hash), and integrity fingerprints for audit logging. Surface the algorithm choice (sha256 by default) and never use hash output as the primary password store.","Verify 2FA setup with totp. Takes the base32 secret you generated server-side during enrollment, computes the current code, compares to what the user typed in. Three outcomes: (a) match → 2FA is wired up correctly, persist the secret encrypted-at-rest; (b) off by one window (the user took 30+ seconds to type) → accept and warn; (c) mismatch → either the user scanned the QR but typed wrong, or the QR encoded a different secret - re-issue the secret rather than letting them retry indefinitely. Doing this BEFORE finalizing the account means a broken 2FA enrollment fails the entire signup, not the next login attempt."],"claudePrompt":"Onboard this signup using Agent402: email=ada@example.com, password=S0meStrongPassw0rd!, displayName=Ada Lovelace, totpSecret=JBSWY3DPEHPK3PXP, totpCode=492039. (1) email-validate the email. If invalid, return {accepted: false, reason: 'invalid-email', detail}. If 'likely-typo', surface the suggested correction and ask the user to confirm rather than rejecting outright. (2) password-strength on the password. If score < 3, return {accepted: false, reason: 'weak-password', specifically: <why>, suggestion: 'add length / drop common-pattern / vary character classes'}. Hard-reject signups that contain the email local-part or the displayName. (3) uuid (v4). Save as userId - this is the dedupe key for the rest of the steps. (4) slugify the displayName. If the slug collides with a reserved word (admin/api/login/root/help/about) or an existing handle, append the first 6 chars of userId hex. (5) password - generate one recovery code (length=20, alphanumeric) and one API key (length=48, alphanumeric+symbol). Return both to the user ONCE; persist only the hash. (6) hash the recovery code with alg=sha256 - this is what you'll store. Separately, hash the user-chosen password ONLY for the pwned-password k-anonymity probe (first 5 chars of SHA-1) - DO NOT use the SHA-256 output as the password store; the prompt MUST recommend bcrypt/argon2 for real persistence. (7) totp with secret=totpSecret. Compare computed code to totpCode. If match, set enrollment=confirmed. If off-by-one window, accept-with-warning. If mismatch, reject 2FA and instruct re-enroll (don't reject the whole signup; let the user retry the QR). Final return: {accepted: true|false, reason?, userId, handle, email, recoveryCodeHash, apiKey, twofaConfirmed, persistableRecord: {userId, email, handle, passwordStorage: 'TODO: replace SHA-256 with bcrypt/argon2', recoveryCodeHash, totpSecretEncrypted}}. All seven tools are pure-CPU (PoW-eligible / free tier). Budget ≤ $0.01 even paid. Never log plaintext password / recovery code / API key - these appear in the return value only.","promptArgs":[{"name":"email","description":"User-supplied email address","required":true},{"name":"password","description":"User-chosen password (plaintext, will be scored then hashed; never logged)","required":true},{"name":"displayName","description":"User-supplied display name (will be slugified into a URL handle)","required":true},{"name":"totpSecret","description":"Base32 TOTP secret generated during 2FA enrollment (server-side state)","required":true},{"name":"totpCode","description":"6-digit code the user typed in to confirm their authenticator app is wired up","required":true}]},{"slug":"trip-planner","title":"Multi-stop trip planner","tagline":"Plan a multi-stop journey deterministically: geocode each stop, sum the pairwise haversine distances, estimate arrival times by adding driving hours per leg, count business days from today to each arrival, and pull the weather forecast at every US stop. Six tools - three pure-CPU (math + time), three egress (geocoding + weather) - covering the deterministic skeleton of every road-trip / sales-tour / delivery-route planning problem.","useCase":"Trip planning bounces between three or four single-purpose apps: a maps tool for distance, a calendar for business-day windows, a weather site per stop, a spreadsheet to add it all up. Each handoff is a place to copy a wrong number. This pack does the whole skeleton - locate, measure, time-shift, weather-check - as a single round-trip of tool calls so the final itinerary is reproducible and the agent can re-run a single step (e.g. shift the start date by a day) without re-doing the rest. Weather is US-only via NWS; geocoding is global via OSM Nominatim.","toolSlugs":["geocode","geo-distance","add-time","business-days","time-convert","weather-forecast"],"workflow":["Resolve every stop to coordinates with geocode. One call per stop name: 'New York, NY' → {lat: 40.7128, lng: -74.006}. Use the OSM Nominatim backend (free, global). Watch for ambiguous names ('Portland' returns Maine before Oregon by default unless you pass a countryCodes filter or a more specific query) - surface the resolved display_name back to the user so they can confirm. This is one of two egress tools in the pack - it counts toward the wallet/paid budget; the other four pure-CPU steps run free via proof-of-work.","Sum the pairwise great-circle distances with geo-distance. One call per consecutive pair of stops: (stop[0], stop[1]) → km/miles, (stop[1], stop[2]) → km/miles, etc. The haversine formula gives the as-the-crow-flies distance on a sphere; real driving distance is typically 1.2–1.4x this (winding roads, no straight-line bridges). The writeup should multiply by 1.3 as a reasonable driving-distance estimate and label it as such - don't pretend haversine is road distance. Total trip distance = sum of legs × ~1.3.","Estimate arrival timestamps with add-time. Start from the user-supplied start ISO; for each leg, add (legDistanceKm / averageSpeedKph) + a buffer (lunch break, fuel, traffic). Conventional defaults: 80 km/h average highway speed, 30 min buffer per stop. This gives you a per-stop arrival ISO. The compounding here is important: a 30-min buffer per stop on a 6-stop trip is 3 hours of cumulative delay that a naive 'distance / speed' calc would miss. add-time also handles cross-day rollover so multi-day trips don't silently wrap timestamps.","Count business days to each arrival with business-days. From today to the arrival date for each stop. Two purposes: (a) staffing - if a stop arrives on weekend day, the agent flags it for the user ('your Tuesday Chicago stop falls on Memorial Day Monday'); (b) deadline check - if the arrival is fewer business days away than tasks-to-complete-before-arrival, the agent surfaces the conflict. business-days respects weekends by default; passing the `holidays` array adds the US federal calendar.","Render arrival times in local timezone with time-convert. Driving across time zones (EST → CST → MST → PST is common on a US trip) silently breaks naive itinerary printouts. time-convert turns each arrival ISO into the local clock time at each stop's coordinates. The agent should also flag the timezone-crossing legs explicitly ('you gain an hour entering CST') so the user understands the lived experience of the schedule, not just the UTC math.","Pull weather at each stop with weather-forecast. NWS-backed, US-only - one call per stop on the arrival date. Returns hourly + daily forecast: temperature, precipitation probability, wind. The writeup should flag any stop with rain probability > 60% (delay risk), high winds > 25 mph (bridge/RV risk), or extreme temperatures (heat advisory or freeze). For non-US stops, skip this step with a one-line note - the pack stays deterministic on the parts that work and is honest about the parts that don't, rather than falling back to a fabricated forecast."],"claudePrompt":"Plan this multi-stop trip using Agent402.\n\nStops (in order): New York NY, Pittsburgh PA, Cleveland OH, Chicago IL.\nStart: 2026-07-20T08:00:00Z (8am UTC, ~4am ET local Monday morning).\nAverage driving speed: 80 km/h. Stop buffer: 30 min per stop.\n\n(1) geocode each of the 4 stops. Return display_name + {lat, lng} per stop. Confirm 'Pittsburgh' resolves to PA, not Kansas - flag ambiguous resolutions. (2) geo-distance for each consecutive leg: NY→PIT, PIT→CLE, CLE→CHI. Multiply each leg by 1.3 to estimate driving distance and label as such. Total trip distance = sum. (3) add-time to compute arrival ISO per stop: leg duration = (km_driving / 80) hours + 0.5 hour buffer. Start from 2026-07-20T08:00:00Z; chain the deltas. (4) business-days from today (use 2026-06-22 as 'today' since that's the demo date) to each arrival date. Report business days remaining per stop. Flag any arrival that lands on a Saturday or Sunday. (5) time-convert each arrival ISO to local time: New York/Pittsburgh/Cleveland = America/New_York; Chicago = America/Chicago. Flag the CST entry: 'you gain an hour entering Chicago'. (6) weather-forecast for each stop on its arrival date. Surface high temp, low temp, precipitation %, wind. Flag any stop with precipitation > 60% (delay risk) or wind > 25 mph. Final return: {stops: [{name, coords, arrivalUtc, arrivalLocal, businessDaysUntil, weather: {high, low, precipPct, wind, flags: []}}], legs: [{from, to, km, drivingKmEstimate, hours}], total: {km, drivingKmEstimate, hours, businessDaysUsed}, warnings: [...], oneLineSummary: '4-stop trip, ~1380 driving km, 17 driving hours, all weekday arrivals, 1 weather warning (Cleveland 70% rain Tuesday)'}. Two egress tools (geocode, weather-forecast) - budget ~$0.05. Four pure-CPU tools - free via proof-of-work.","promptArgs":[{"name":"stops","description":"comma-separated ordered list of stops (e.g. 'New York NY, Pittsburgh PA, Cleveland OH, Chicago IL')","required":true},{"name":"startIso","description":"trip start time as UTC ISO 8601 (e.g. '2026-07-20T08:00:00Z')","required":true}]},{"slug":"macro-context","title":"Macro backdrop snapshot","tagline":"The 'is the economic backdrop you're modeling against still current?' pack. Pull the canonical macro signals - CPI year-over-year, unemployment, fed funds, the Treasury yield curve, a G10 FX dashboard, the Sahm Rule recession indicator, and the next scheduled economic releases - in one composed workflow. Seven egress tools, one composite snapshot the agent can cite before doing any forecast or investment math.","useCase":"Every finance/forecast pack in Agent402 assumes the macro backdrop is known. This pack makes that assumption explicit and dated. Before you NPV a 10-year cashflow, before you forecast a revenue series, before you recommend a savings vehicle - pull this snapshot, cite the as-of date, and pin the assumptions. The Sahm Rule + yield curve combination is the canonical 'are we in or near a recession' diagnostic; CPI + fed funds gives you the real-rate environment; FX dashboard tells you whether your USD assumption is even the right denominator. Pairs with investment-decision, loan-comparison, savings-goal, and forecasting-bake-off - none of those packs check macro state themselves.","toolSlugs":["cpi-yoy","unemployment-rate","fed-funds","treasury-yield-curve","yield-curve-spread","sahm-rule","fx-dashboard","fred-release-calendar"],"workflow":["Pull current US CPI year-over-year with cpi-yoy. FRED series CPIAUCSL converted to YoY % change. This is the headline inflation number every cashflow assumption is implicitly indexed to - if you're discounting at a nominal rate, you need to know real-vs-nominal spread. Returns the latest observation date and value; flag if the latest observation is more than 45 days stale (BLS publishes monthly with ~2-week lag - anything older signals a FRED outage or a holiday).","Pull current US unemployment rate with unemployment-rate. FRED series UNRATE. The level matters less than the trend: U3 going from 3.5 → 4.5 over 6 months is the historical recession signal (formalized as the Sahm Rule, called in step 6). Report both the latest level AND the 6-month delta. A rising-unemployment regime invalidates 'steady-state' forecasting assumptions in every downstream pack.","Pull effective federal funds rate with fed-funds. FRED series FEDFUNDS. This is the risk-free rate every NPV/IRR calc should be discounting against (or close to it - treasury yields are the more precise instrument but fed funds is the policy anchor). Report the latest level and the YoY delta. A rising-rate environment systematically biases NPV calculations toward 'reject the project' - make sure the loan-comparison / investment-decision packs are using a current rate, not a stale one.","Pull the current Treasury yield curve with treasury-yield-curve. Returns the daily snapshot of yields at 1M, 3M, 6M, 1Y, 2Y, 5Y, 10Y, 30Y maturities. This is the shape of the risk-free curve the entire fixed-income world prices off. The shape itself is the signal: upward-sloping = normal, flat = transitional, inverted = recession-priced. The next step quantifies the inversion explicitly.","Compute yield-curve spreads with yield-curve-spread. Returns the canonical inversion gauges: 10Y-2Y (the academic favorite) and 10Y-3M (the Fed's preferred recession predictor per Estrella & Mishkin). Negative = inverted = market is pricing rate cuts = historical recession signal with 6-18 month lead. The tool returns both spreads plus a boolean isInverted flag per spread. Surface inversions prominently - every downstream forecast needs to know if the curve is signaling regime change.","Compute the Sahm Rule with sahm-rule. Defined as: current 3-month moving average of UNRATE minus its 12-month minimum. Triggers when ≥ 0.5 percentage points. This is the most-cited contemporaneous recession indicator (it has historically triggered within the recession's first few months, not as a lagging confirmation). Returns the current value and the triggered boolean. Pair this with the yield-curve inversion from step 5 - the two together are the canonical 'recession probability is non-trivial' signal.","Pull G10 FX dashboard with fx-dashboard. Returns USD vs EUR, JPY, GBP, CHF, AUD, CAD, NZD, SEK, NOK - the standard developed-market basket. Critical for any cashflow denominated in non-USD: a 10% USD strengthening turns a 12% EUR-denominated return into 2%. The dashboard returns the current cross plus the YTD change per pair. Surface any pair with >10% YTD change as a 'denomination matters here' callout.","Pull the next 14 days of economic releases with fred-release-calendar. Returns the schedule of upcoming releases (next CPI, next NFP, next FOMC, etc.) with their release dates. This tells the agent which numbers in the snapshot are about to be refreshed - if CPI prints in 3 days, the agent should caveat any inflation-sensitive recommendation with 'reassess after the CPI print on date X'. Closes the snapshot with a forward-looking 'what will be stale soon' list."],"claudePrompt":"Pull the current macro backdrop using Agent402 before doing any finance/forecast math.\n\nAs-of: 2026-06-22 (use today's date). USD-denominated assumptions.\n\n(1) cpi-yoy - return {asOfDate, yoyPct}. Flag if asOfDate > 45 days stale. (2) unemployment-rate - return {asOfDate, level, sixMonthDelta}. (3) fed-funds - return {asOfDate, level, yoyDelta}. (4) treasury-yield-curve - return {asOfDate, points: [{maturity, yield}, ...]} for the standard 1M/3M/6M/1Y/2Y/5Y/10Y/30Y set. (5) yield-curve-spread - return {asOfDate, tenTwo: {spread, isInverted}, tenThreeM: {spread, isInverted}}. (6) sahm-rule - return {asOfDate, value, triggered}. Pair with the yield-curve inversion from step 5 in the writeup: both triggered = strong recession signal. (7) fx-dashboard - return {asOfDate, crosses: [{pair, level, ytdPct}, ...]}. Flag any pair with |ytdPct| > 10 with a 'denomination matters here' note. (8) fred-release-calendar with daysAhead=14 - return {nextReleases: [{date, seriesName}, ...]}. Final return: {asOf: '2026-06-22', cpiYoy, unemployment, fedFunds, yieldCurve, spreads, sahm, fx, nextReleases, regimeAssessment: '<one paragraph synthesizing CPI direction + fed-funds direction + curve shape + Sahm Rule into rising-rate-late-cycle / cutting-cycle-early-recession / normal-expansion etc.>', oneLineSummary: 'CPI 2.4% YoY (Apr 26), UE 4.1% (May 26, +0.4 over 6m), fed funds 4.25%, curve disinverted 10Y-2Y at +12bps, Sahm not triggered (0.33), USD broadly flat YTD, next CPI prints 2026-07-10 - reassess any inflation-sensitive recommendation after that date.'}. All eight tools are egress (FRED + Treasury + ECB FX). Budget ~$0.10 paid. Cache this snapshot per session - do not re-call within the same agent task.","promptArgs":[{"name":"asOfDate","description":"the as-of date for the snapshot in YYYY-MM-DD (use today if unspecified)","required":false}]},{"slug":"regulatory-watch","title":"SEC regulatory monitoring","tagline":"The 'who just filed / who just bought / what just IPO'd / what does the full-text search say' monitoring loop. Five EDGAR tools composed: full-text search for a keyword, surface recent filings on the matched companies, pull insider Form 4 transactions, pull 13F institutional holdings changes, and check the IPO calendar. Different from sec-filings-deep-dive (which goes deep on one company's earnings) - this is the wide-and-recent radar.","useCase":"Most EDGAR workflows fall into two modes: 'tell me everything about company X' (covered by sec-filings-deep-dive) or 'what just happened across the universe that I care about?' (this pack). The monitoring mode powers competitor watch, M&A signal scanning, insider-buying screens, and 'is the IPO window open' market-timing checks. The full-text search seeds the watch list; insider trades + 13F changes are the canonical informed-money signals; the IPO calendar is the supply-side gauge. All five tools are egress to SEC EDGAR (free upstream, but counted as paid for the deterministic-tool wrapper).","toolSlugs":["edgar-search","edgar-filings","edgar-insider-trades","edgar-13f-holdings","edgar-recent-ipos"],"workflow":["Seed the watch list with edgar-search. Full-text search across the EDGAR filing corpus for the keyword/theme - e.g. 'AI infrastructure', 'GLP-1', 'small modular reactor'. Returns matched filings with company CIK, ticker, filing type, and date. The query language is EDGAR's own (supports exact phrases, AND/OR, and date filters). This is the 'who is talking about this' step - the resulting CIK list seeds every downstream step. Cap the result set at 25 to keep the pack budget bounded.","Pull recent filings on each matched company with edgar-filings. One call per CIK from step 1. Returns the company's last N filings (10-K, 10-Q, 8-K, S-1, etc.) with dates and accession numbers. The 8-K filings are the disclosure firehose - material events (acquisitions, exec departures, going-concern doubt). Surface any 8-K filed in the last 7 days as 'fresh material event' - those are typically the actionable signal in a monitoring loop, not the 10-K/10-Q (which are scheduled and pre-baked into the price).","Pull insider Form 4 transactions with edgar-insider-trades. One call per CIK. Returns recent buys and sells by officers and directors with transaction value. The classical signal: clusters of *open-market buys* by multiple insiders within a short window are the highest-conviction informed-money signal in equity markets (sells are noisy - insiders sell for diversification, taxes, divorce; they only buy for one reason). Surface buy clusters (≥ 2 insiders, ≥ $100k each, within 30 days) prominently. Sales without context are deprioritized.","Pull 13F institutional holdings changes with edgar-13f-holdings. One call per CIK. Returns the latest quarterly snapshot of which 13F-filing institutions hold the stock and how their position changed (new, increased, decreased, sold-out). New positions by concentrated managers (Berkshire, Pershing Square, Baupost, etc.) are the canonical 'smart money rotated in' signal. Caveat: 13F is delayed 45 days from quarter-end, so this is a confirmation signal, not a leading one - useful for narrative, not for timing.","Check the IPO calendar with edgar-recent-ipos. Returns S-1 / S-1/A filings in the recent window - both freshly filed (signals coming-soon) and recently effective (signals just-launched). This is the supply-side gauge: open IPO window = capital markets are absorbing risk; closed = risk-off regime. If the search theme from step 1 has IPO-stage entrants showing up here, that's the 'thematic capital is being raised' confirmation. Final radar synthesizes all five signals into a one-screen actionable summary."],"claudePrompt":"Run a regulatory monitoring sweep using Agent402.\n\nTheme: 'AI infrastructure datacenter'.\nLookback: last 30 days.\nAs-of: 2026-06-22.\n\n(1) edgar-search with q='AI infrastructure datacenter', dateRange=last-30-days, limit=25. Return {matches: [{cik, ticker, companyName, filingType, filingDate, snippet}, ...]}. Dedupe to unique CIKs - call that list `watchlist`. (2) edgar-filings for each CIK in watchlist (cap watchlist to 10 to bound budget). For each: return the last 6 filings with type + date + accession. Flag any 8-K filed in the last 7 days as 'fresh_8k=true'. (3) edgar-insider-trades for each CIK. Return {buys: [], sells: []} with {insiderName, role, date, value, sharesAfter}. Compute `buyCluster: true` if ≥ 2 insiders, each ≥ $100k, all within a 30-day window. Surface buy clusters prominently in the writeup; deprioritize standalone sells. (4) edgar-13f-holdings for each CIK. Return {newPositions: [{filerName, value}, ...], increases: [], decreases: [], soldOut: []} for the latest quarter (caveat: 45-day delayed). Flag any newPosition from a 'name-brand' concentrated holder (Berkshire, Pershing Square, Baupost, Greenlight, etc.). (5) edgar-recent-ipos with theme='AI infrastructure datacenter' if supported, else unfiltered, lookback=30d. Return {filed: [{cik, companyName, filingType, date}, ...], effective: [...]}. Cross-reference: any IPO entrant whose company description matches the theme is a 'theme-stage entrant'. Final return: {asOf: '2026-06-22', theme, watchlist: [...], fresh_8ks: [...], buyClusters: [...], smartMoneyNewPositions: [...], themeIpos: [...], synthesis: '<one-paragraph radar summary: which CIKs got buy clusters, which got smart-money entries, which had fresh material 8-Ks, whether the IPO window for the theme is open or closed>', oneLineSummary: '5 CIKs on AI-infrastructure watch; 1 fresh insider buy cluster (NVDA), 2 smart-money new positions (CRWV, NBIS), 1 theme IPO effective (Astera Labs add-on) - capital is rotating in, no fresh 8-K surprises this week.'}. All five tools are egress to SEC EDGAR. Budget ~$0.30 paid. Cache per session.","promptArgs":[{"name":"theme","description":"the keyword or theme to monitor (e.g. 'AI infrastructure datacenter', 'GLP-1', 'nuclear small modular reactor')","required":true},{"name":"lookbackDays","description":"the lookback window in days for fresh filings (default 30)","required":false}]},{"slug":"search-and-cite","title":"Answer-a-question with sources","tagline":"The 'research a question, return an answer with citations' workflow. Brave answer for the AI-synthesized take with citations, Brave web for the canonical SERP, Brave news for time-sensitive context, then a deterministic web-fetch + extract pass on the top citations to verify the answer hasn't hallucinated. Five tools, one cited paragraph, every claim traced back to a fetched URL.","useCase":"Most agent research workflows have the same failure mode: an LLM answer with confident-sounding citations that don't actually contain the claim. This pack solves that by separating the *answer-generating* surface (Brave's answer endpoint) from the *evidence-fetching* surface (web-fetch + extract on the citations). The agent's final response cites only claims that survive both the search-answer hit AND a deterministic re-fetch of the cited page. Pairs with rag-prep when the answer needs to be turned into a structured knowledge document; pairs with macro-context for time-sensitive 'is this still current' questions.","toolSlugs":["answer","search","search-news","extract","extract-entities"],"workflow":["Get the AI-synthesized answer with answer. Brave's answer endpoint returns a short prose paragraph synthesized from the top SERP results, plus a citations array (URL + title + snippet per source). This is the *starter* answer - never the final answer, because Brave's synthesis can still hallucinate connections between citations or misquote them. Treat the answer text as a hypothesis and the citations as the evidence to verify. Keep the maxTokens cap modest (≤ 250) so the synthesis stays close to the source material rather than wandering.","Pull the canonical SERP with search. Brave web search, top 10 organic results. This gives you (a) the search-engine consensus on which pages are authoritative for the query (so you can sanity-check Brave's answer didn't pick fringe sources), and (b) backup sources if the answer's citations turn out to be wrong or paywalled. Compare the SERP's top URLs against the answer's citation URLs - if they barely overlap, the answer is probably weighted toward an unusual angle and deserves extra skepticism.","Pull time-sensitive context with search-news. Brave news search on the same query. For evergreen questions ('what is a closure in JavaScript') this returns mostly noise and can be skipped; for time-sensitive questions ('is the IPO market open', 'did the Fed raise rates last week') the news pass is essential - the regular web search is heavily SEO-optimized and stale-friendly, while news is recency-biased. Always check the news result dates: if the most recent news result on a time-sensitive query is more than 30 days old, the answer might already be wrong even if it was correct when Brave indexed it.","Re-fetch and clean the top 2-3 citation URLs with extract. This is the verification step that turns a citation from a URL into actual readable bytes - extract runs Readability over the page and returns clean markdown of the article body, stripping nav, footer, ads, comments. One call per citation. If extract returns empty (page is a SPA, paywalled, or anti-bot-blocked), that's signal: a citation that can't be re-extracted is effectively dead and any claim resting on it should be downgraded or dropped. Cap at 3 citations to bound budget - the marginal value of citation #4 is low.","Cross-reference named entities with extract-entities on each cleaned article body. Returns people, organizations, places, dates mentioned in the extracted text. The agent now grep-checks: every named entity in Brave's answer (step 1) should appear in at least one extracted article's entity list. If the answer claims 'according to Powell at the FOMC meeting' but neither 'Powell' nor 'FOMC' appears in any cited article's entities, the answer is hallucinating attribution. Final output: a paragraph where every sentence has at least one URL footnote pointing at content that was re-fetched, re-read, and entity-checked against the original claim."],"claudePrompt":"Answer this research question with sources, using Agent402.\n\nQuestion: 'What is the Sahm Rule and has it triggered recently?'\nMax answer length: 250 tokens.\nAs-of: 2026-06-22.\n\n(1) answer with q='What is the Sahm Rule and has it triggered recently?', maxTokens=250. Return {answer: '<paragraph>', citations: [{url, title, snippet}, ...]}. Treat this answer as a *hypothesis*. (2) search with q='Sahm Rule recession indicator current', topN=10. Return {results: [{url, title, snippet}, ...]}. Compute overlap with step 1's citation URLs - if overlap < 30%, flag 'answer drew from non-canonical sources'. (3) search-news with q='Sahm Rule triggered', topN=5. Return {results: [{url, title, snippet, age}, ...]}. Critical for the 'triggered recently' half of the question: pick the freshest news result. If the freshest news result is > 30 days old, caveat the answer with 'most recent news coverage is from [date]'. (4) extract on the top 3 citation URLs from step 1. Return {extracted: [{url, ok, markdown|err}, ...]}. Drop any citation where ok=false or markdown is empty. (5) extract-entities on each successfully-extracted markdown body. Return {entities: [{url, people: [], orgs: [], places: [], dates: []}, ...]}. For each named entity in step-1 answer text, verify it appears in at least one citation's entity list. Drop any claim whose key entity isn't supported by any citation. Final return: {question, answer: '<rewritten paragraph where every sentence has a [url] footnote pointing to a citation whose markdown was re-extracted AND whose entities support the claim>', citations: [{url, title, verified: true|false}, ...], droppedClaims: [...], freshness: {newsLatestDate, isStale: true|false}, oneLineSummary: 'Sahm Rule is the 0.5pp 3M-vs-12M-low UE trigger; not currently triggered (0.33 as of May 26); cited 2 verifiable sources (FRED, Bloomberg), dropped 1 unsupported claim.'}. Five tools: answer + search + search-news are egress (Brave API); extract is egress (raw web + Readability); extract-entities is pure-CPU. Budget ~$0.08 paid.","promptArgs":[{"name":"question","description":"the research question to answer with citations","required":true}]},{"slug":"media-pipeline","title":"Uploaded-media normalize","tagline":"The 'user uploaded a thing, normalize it before storing' workflow. Probe the file (image or audio/video) with media-info, decode any embedded barcodes/QRs, resize and thumbnail the image, convert it to a web-friendly format, and normalize audio loudness to broadcast standard. Six tools, one canonical normalize-on-upload pipeline that turns arbitrary user uploads into predictable storage artifacts.","useCase":"Every product that accepts user uploads ships the same five bugs: the receipt photo nobody can read because it's 11MB and rotated, the audio voice-memo that's 6dB louder than every other voice-memo because the user had headphone gain cranked, the QR code in the uploaded business card that the app never scanned because it looked at the filename instead of the bytes, the AVIF that the iOS WebView can't display, the 4K hero image that blew up the thumbnail grid. This pack runs the canonical normalize-then-store pipeline so every uploaded artifact lands in storage with predictable dimensions, predictable codec, predictable loudness, and any embedded payload (QR/barcode) already extracted into metadata. Pairs with document-intel when the upload is a PDF.","toolSlugs":["media-info","barcode-decode","image-resize","image-thumbnail","image-convert","audio-normalize"],"workflow":["Probe the file with media-info. Runs ffprobe under the hood - returns format, codec, dimensions (width x height for images/video), duration (audio/video), bitrate, sample rate, color space, EXIF orientation. This is the *triage* call: it tells the agent which downstream branch to take. Image? → barcode + resize + thumbnail + convert. Audio? → normalize. Video? → probe-only, video transcoding is outside this pack's scope. Critical edge case: a file with extension `.jpg` and MIME `image/jpeg` that ffprobe identifies as `image/heic` is a real production case (iOS sends HEIC named .jpg). Trust media-info, not the extension.","Try to decode embedded barcodes/QR codes with barcode-decode. One call on the image bytes. Returns the decoded payload (URL, EAN-13, UPC, etc.) and the symbology. Many uploads have actionable payloads the agent should extract before treating the image as 'just a photo': uploaded business cards contain vCard QRs, uploaded receipts contain GS1 product codes, uploaded shipping labels contain tracking URLs. If decode returns empty, that's fine - most images don't have barcodes, and the pack continues. If decode returns a payload, surface it as metadata alongside the stored image.","Resize the image to a max long-edge with image-resize. Default cap: 2000px on the long edge. Most uploaded photos from modern phones are 4000+ px wide; 2000px is the sweet spot where retina displays still look sharp but storage and bandwidth costs drop 4-8x. Critical: preserve aspect ratio (don't squish), and respect EXIF orientation from step 1 (rotate to upright before resize, so the stored bytes are already the right way up - never trust the consuming client to handle orientation). image-resize also strips EXIF GPS by default - good for privacy, since uploaded photos often carry the user's home coordinates.","Generate a small thumbnail for grid/list views with image-thumbnail. Default size: 200x200 cover crop. The thumbnail is a separate stored artifact from the resized image - UIs grid-displaying 50 thumbnails should not be loading 50 × 2000px resized images. Cover crop (not contain) is the right default for grid UIs because mixed aspect ratios in a grid look chaotic; the small loss of edge content is a fair tradeoff for visual consistency.","Convert the resized image to a web-friendly format with image-convert. Default target: WebP, quality 82. WebP is the universal-support sweet spot in 2026 - supported by every browser including iOS Safari, 25-35% smaller than JPEG at equivalent quality. AVIF compresses better but Safari + many in-app WebViews still have gaps; HEIC is iOS-native but Android can't display it. Skip conversion if the source is already WebP. The thumbnail from step 4 should be converted too - same WebP target.","Normalize audio loudness with audio-normalize. Only runs if the file probed as audio in step 1 (skip for images). Applies EBU R128 loudness normalization to -23 LUFS (broadcast standard) or -16 LUFS (podcast/voice standard). This is the difference between 'every uploaded voice-memo plays at the same volume' and 'half the user's library hits the volume limiter and the other half is whispers'. Critical: this changes loudness, not peak - the dynamic range of the original is preserved, just shifted into a predictable absolute range. After this step, the artifact is canonical and ready to store. Pack returns: {storedKey, dimensions, format, sizeBytes, thumbnailKey, barcodePayload|null, audioLufs|null, processingTimeMs}."],"claudePrompt":"Normalize this user upload using Agent402.\n\nInput: uploaded file at temp path /tmp/upload-abc123 (1 file per invocation).\nMax stored long-edge: 2000px.\nThumbnail size: 200x200.\nTarget image format: WebP quality 82.\nAudio target: -16 LUFS (voice-memo standard).\n\n(1) media-info - return {kind: 'image'|'audio'|'video'|'other', format, codec, width, height, durationSec, bitrate, sampleRate, colorSpace, exifOrientation, declaredMime, detectedMime}. If declaredMime ≠ detectedMime, log 'mime mismatch' and trust detectedMime. Branch on kind: 'image' → steps 2-5, 'audio' → step 6 only, 'video' → return as-is with kind=video and stop (out of scope), 'other' → reject. (2) barcode-decode on the image bytes - return {payload: '<decoded text>'|null, symbology: 'qr'|'ean13'|'upc'|...|null}. Pure-CPU. Null = no decodable barcode, that's fine. (3) image-resize with maxLongEdge=2000, preserveAspect=true, applyExifRotation=true, stripExifGps=true - return {bytes: <resized>, width, height}. (4) image-thumbnail with size=200, mode='cover' - return {bytes: <thumb>}. (5) image-convert on both step-3 output and step-4 output, format='webp', quality=82, skipIfAlreadyTarget=true - return {primary: {bytes, sizeBytes}, thumb: {bytes, sizeBytes}}. (6) audio-normalize with targetLufs=-16, format='mp3' - return {bytes, lufsBefore, lufsAfter, peakDbfs}. ONLY if step 1 said kind='audio'. Final return: {kind, normalized: {primaryBytes: <ref>, primarySize, thumbBytes: <ref>, thumbSize, width, height, format} | audio: {bytes: <ref>, durationSec, lufsAfter, format}, metadata: {barcodePayload, originalSizeBytes, sizeSavingsPct, exifOrientation, declaredVsDetectedMime}, oneLineSummary: 'image normalized: 4032x3024 HEIC → 2000x1500 WebP (847KB → 162KB, 81% smaller), 1 QR decoded (https://example.com/menu/42), thumb 200x200 → 8KB' | 'audio normalized: 6m 12s, -23.4 LUFS → -16.0 LUFS, peak -1.2 dBFS'}. media-info + barcode-decode + image-* + audio-normalize all involve ffmpeg/ffprobe/imagemagick under the hood - egress is 0, but CPU is meaningful, so this is a wallet/paid pack, not PoW. Budget ~$0.06 per upload.","promptArgs":[{"name":"uploadPath","description":"the temp path or URL of the uploaded file (e.g. '/tmp/upload-abc123')","required":true}]},{"slug":"schema-evolution","title":"API contract drift check","tagline":"The 'did this API contract change in a way that breaks our integration?' workflow. Diff two OpenAPI snapshots structurally, lint the new one for agent-readiness regressions, extract the endpoint surface for inventory comparison, validate a known-good payload against the new contract, and summarize security-relevant changes. Six tools, one go/no-go answer on whether the upstream API broke us.","useCase":"Every integration eventually hits the 'upstream changed something and now our requests 422' incident. The fix-time is dominated by figuring out *what* changed: was it a renamed field, a tightened enum, a new required parameter, a moved endpoint, a security scheme change? This pack runs that diagnosis deterministically the moment a new OpenAPI snapshot lands - before traffic breaks. Pairs with api-investigation when you don't yet have an OpenAPI snapshot (that pack discovers one); this pack assumes you have two snapshots (yesterday's and today's) and want to know what changed and whether it matters.","toolSlugs":["openapi-diff","openapi-lint","openapi-extract","openapi-required-params","openapi-validate-payload","openapi-security-summary"],"workflow":["Diff the two snapshots with openapi-diff. Pass the old spec and new spec; returns a structural diff: added/removed endpoints, added/removed parameters per endpoint, changed schemas, changed response codes, changed security schemes. The diff is *structural*, not textual - a reordering of fields or a whitespace change won't show up; a renamed property will. This is the raw change-list every downstream step interprets. Bucket changes by breaking-vs-additive: removed endpoint = breaking, added endpoint = additive, new required param = breaking, new optional param = additive, tightened enum = breaking, widened enum = additive.","Lint the new snapshot with openapi-lint for agent-readiness regressions. Even if the diff is empty, the *quality* of the new spec might have degraded - descriptions removed, examples deleted, response schemas downgraded to free-form objects. Returns a score and a list of regressions. This is the signal for 'the upstream maintainer is taking the spec less seriously over time' - it predicts future drift even when this diff was clean. Cross-reference with the diff: drops in lint score that coincide with endpoint changes are the highest-priority concerns.","Extract the endpoint surface from the new snapshot with openapi-extract. Returns the full {path, method, operationId, summary} table - the inventory the integration code is coded against. Compare this inventory to your client code's call sites: any operationId your code calls that's missing from the inventory is an integration that's about to fail. Conversely, any operationId in the inventory that your code doesn't call is a new capability you might want to expose. The diff in step 1 surfaces *changes*; this step surfaces the *full current surface*.","Pull the required-params delta with openapi-required-params on both old and new specs. For each endpoint, returns the list of required parameters. Compare old vs new: any param newly required is a breaking change that the diff in step 1 also caught, but this step gives you the *concrete request shape* a client has to send - easier to translate into client-code patches than the abstract structural diff. If a previously optional field is now required, your existing client code probably doesn't send it, and every request 400s the moment the new contract is live.","Replay a known-good payload through openapi-validate-payload against the new spec. Pass your fixture (the request body you've been sending successfully for months); the tool validates it against the new schema. If validation fails, the failure messages tell you exactly which field is the problem - much faster than reading the diff and guessing. If validation passes, you have positive evidence the existing client code's request shape is still acceptable; the breakage if any is elsewhere (auth, headers, query params). This is the single most decision-relevant check in the pack.","Diff security schemes with openapi-security-summary on both specs. Auth changes are usually filed under 'breaking' but spec-diff tools often surface them as just-another-field-change rather than the migration project they actually are. This step bubbles them to the top: 'apiKey moved from header to query', 'oauth2 scope renamed', 'new scope required for endpoint X'. Security-scheme drift is the most expensive kind of breakage because it requires credential rotation, not just a code patch - flag prominently. Final return is a single 'breaking | additive | clean' verdict plus a per-endpoint impact table the integration team can prioritize from."],"claudePrompt":"Check if this OpenAPI contract drifted in a breaking way, using Agent402.\n\nInputs:\n  oldSpec: <yesterday's snapshot, JSON or YAML>\n  newSpec: <today's snapshot, JSON or YAML>\n  knownGoodPayload: { endpoint: 'POST /v1/orders', body: {customerId: 'cust_abc', items: [{sku: 'SKU-42', qty: 1}], currency: 'USD'} }\n\n(1) openapi-diff with oldSpec + newSpec - return {added: {endpoints: [], params: [], schemas: []}, removed: {endpoints: [], params: [], schemas: []}, changed: {endpoints: [{path, what: 'response-schema|request-schema|param-required|param-removed|...'}, ...]}}. Bucket every change as breaking|additive in the writeup. (2) openapi-lint on newSpec - return {score, regressions: [{severity, what}], comparisonToPriorLint: 'manual - note if score dropped'}. Note: this pack doesn't store prior lint scores; surface the current score and ask the integration team whether it dropped. (3) openapi-extract on newSpec - return {endpoints: [{path, method, operationId, summary}, ...]}. Compare in the writeup against the diff from step 1 to confirm no endpoint your client calls is missing. (4) openapi-required-params on BOTH specs separately - return {old: [{endpoint, requiredParams: []}, ...], new: [{endpoint, requiredParams: []}, ...], newlyRequired: [{endpoint, paramName}, ...]}. Every entry in newlyRequired is a guaranteed 400 for existing clients. (5) openapi-validate-payload with spec=newSpec, endpoint='POST /v1/orders', body=knownGoodPayload.body - return {valid: true|false, errors: [...]}. This is the decisive check. (6) openapi-security-summary on BOTH specs - return {old: {schemes: [...], requirements: [...]}, new: {schemes, requirements}, drift: [{endpoint, change: 'scope-added|scheme-changed|location-moved|...'}]}. Final return: {verdict: 'breaking'|'additive'|'clean', breakingItems: [...], additiveItems: [...], requiredClientChanges: [{file: '<guess based on operationId>', change: '<what to patch>'}], knownGoodPayloadStillValid: true|false, securityDrift: [...], lintScoreNow: <number>, oneLineSummary: 'BREAKING: POST /v1/orders now requires currencyOverride; 2 endpoints removed (/v1/legacy/quote, /v1/legacy/refund); auth unchanged; existing fixture fails validation - patch client before next deploy.'}. All six tools are pure-CPU schema operations (no egress to the API itself). Budget ~$0.015 paid; PoW-eligible.","promptArgs":[{"name":"oldSpec","description":"the prior OpenAPI snapshot as JSON or YAML","required":true},{"name":"newSpec","description":"the current OpenAPI snapshot as JSON or YAML","required":true}]},{"slug":"link-preview","title":"Link preview card","tagline":"The 'turn a URL into a card-shaped preview' workflow. Pull OpenGraph/Twitter card metadata, fetch the article body as a description fallback, normalize the og:image into a standard 1200×630 social card variant and a 400×400 square thumbnail, and extract URL/mention entities from the body for related-link surfacing. Five tools, one structured card payload ready for chat embeds, social shares, or RSS-to-card pipelines.","useCase":"An agent (or a bot, or a chat client, or a CMS) is handed a URL and needs to render a card-shaped preview - like the rich link previews Slack/Discord/iMessage show inline. The naive approach (one HTTP GET + a regex on <meta property=\"og:*\">) breaks when the page is JS-heavy, the og:image is non-standard, or the og:description is missing. This pack does the whole thing deterministically: metadata + readable-text fallback + image normalization to two standard sizes (1200×630 social card and 400×400 inline thumbnail) + outbound-link discovery. Returns a single card-ready JSON payload - agents stop hand-rolling og: scrapers, embed builders get a normalized image they can drop into a <img>, and chat surfaces get a thumbnail that won't blow out the layout.","toolSlugs":["meta","extract","image-resize","image-thumbnail","extract-entities"],"workflow":["Call meta with the URL to pull the page's OpenGraph + Twitter card metadata: og:title, og:description, og:image, twitter:card, twitter:image, canonical URL, and favicon. This is the *card-shape* answer - every downstream step normalizes or augments fields this step surfaced. If og:image is missing, fall back to twitter:image; if both are missing, the card will be image-less (still valid, but degrade gracefully in the final payload). canonical_url is the link the card should point at - not the input URL, which might be a tracker-wrapped redirect. favicon is the small site mark most chat clients show alongside the title.","Call extract on the same URL for the readable article body as clean markdown. Two uses: (1) when og:description is short (<60 chars) or missing, derive the card's description from the first paragraph of the markdown body - most chat clients show 2–4 lines, so 240 chars is the working budget; (2) feed the body text into step 5 for entity extraction. extract handles paywalls and JS-light pages cleanly; if it returns empty or 4xx (heavy SPA), the agent should fall back to render (more expensive - $0.02 - but executes JavaScript) before deciding the page is unreachable.","Call image-resize on the og:image (or twitter:image) with width=1200, height=630, fit=cover. This is the standard social-card aspect ratio that Facebook, LinkedIn, and most chat clients expect; serving a card with a non-standard image ratio either gets it cropped poorly or rejected by the embed builder. Returns a base64 PNG the card payload can either inline (small images) or hand to a CDN for a stable URL. If the source og:image is *already* 1200×630, image-resize is idempotent - cheap insurance against weirdly-sized source images.","Call image-thumbnail on the same og:image with size=400. Square 400×400 is the standard inline-thumbnail dimension for chat clients (Discord, Slack DMs, Matrix), and it's what an RSS-to-card pipeline wants for the per-item icon. Two variants in the final payload - the 1200×630 hero for full cards and the 400×400 square for compact previews - means a single Agent402 call serves both the rich and the compact rendering contexts without forcing the caller to re-fetch + re-resize.","Call extract-entities on the markdown body from step 2. Returns deduped lists of URLs, emails, IPv4s, @mentions, and #hashtags. The URLs list is the highest-value output here: it's the 'related links' set most card surfaces show beneath the main preview (e.g. 'this article links to 3 other sources'). The @mentions and #hashtags lists are exactly the metadata social embed builders surface for X/Bluesky-style cards. Final payload shape: { canonical, title, description, hero: <1200×630 base64>, thumbnail: <400×400 base64>, favicon, relatedUrls: [...], mentions: [...], hashtags: [...] } - a single object the caller's embed builder or CDN-upload step consumes."],"claudePrompt":"Build a structured link-preview card for https://example.com using Agent402.\n\n(1) meta with url=https://example.com - return {title, description, og: {image, title, description, type}, twitter: {card, image, title}, canonical, favicon}. (2) extract with url=https://example.com - return {title, byline, excerpt, wordCount, markdown}. Use the markdown's first paragraph as the description fallback if og.description and twitter.title are both empty or shorter than 60 chars. (3) image-resize with imageUrl=<og.image or twitter.image>, width=1200, height=630, fit='cover' - return {base64, contentType, width, height}. Skip this step (set hero=null) if no source image is available. (4) image-thumbnail with imageUrl=<same source image>, size=400 - return {base64, contentType, width, height}. Same skip rule. (5) extract-entities with text=<markdown body from step 2> - return {urls: [], emails: [], ips: [], mentions: [], hashtags: []}. Final return: {url: 'https://example.com', canonical: <step 1 canonical || input>, title: <og.title || meta.title>, description: <og.description || twitter.description || first-paragraph-of-markdown || ''>, hero: {base64, width: 1200, height: 630} | null, thumbnail: {base64, width: 400, height: 400} | null, favicon: <step 1 favicon || null>, relatedUrls: <step 5 urls, filtered to exclude same-host as canonical, max 8>, mentions: <step 5 mentions>, hashtags: <step 5 hashtags>, oneLineSummary: '<plain-text card description, ~140 chars, no markdown>'}. Budget ~$0.024 paid; 4 of 5 tools are PoW-eligible (extract is wallet-only).","promptArgs":[{"name":"url","description":"Public http(s) URL to build a preview card for (e.g. https://example.com/article)","required":true}]},{"slug":"any-to-markdown","title":"Convert anything to markdown","tagline":"Convert anything at a URL - HTML, PDF, or an image - to clean markdown. The 'I have a URL but it might be any content-type, give me markdown either way' workflow: HEAD-detect the content-type, branch to the right deterministic extractor (article extract for HTML, pdf-to-markdown for PDFs, OCR for images), and report token/word stats on the output so the caller can budget the result against an LLM context window.","useCase":"An agent is handed a URL by a user and needs LLM-clean text out - but the URL might point at an HTML article, a PDF whitepaper, or a JPG screenshot, and the naive single-tool approach (just call extract on everything) silently fails on PDFs (returns empty) and images (returns nothing at all). Agents currently hand-roll the content-type detection + branching, often badly: they call extract first, get an empty body, then guess at a PDF extractor. This pack hands them the canonical decision tree - HEAD probe → branch → extract → stat - as a single workflow. Output is markdown plus a {chars, words, est_tokens} block so the caller can decide whether to chunk before feeding an LLM. The same pattern powers any 'ingest the document at this URL' agent step: research assistants, RAG ingest pipelines, document QA bots, archive-to-knowledge-base scripts.","toolSlugs":["http-headers","extract","pdf-to-markdown","image-ocr","html-to-markdown","text-stats"],"workflow":["Call http-headers with the URL to fetch the response headers without downloading the body. The decisive field is Content-Type - `text/html` → step 2, `application/pdf` → step 3, `image/*` → step 4. If Content-Type is missing or generic (`application/octet-stream`), fall back to extension sniffing on the path (`.pdf`, `.png`, `.jpg`, `.jpeg`, `.gif`, `.webp` for images; everything else default to HTML). http-headers is cheaper than a full fetch and returns the HTTP status too - bail early with a clear message if the URL is 4xx/5xx before spending money on a downstream extractor.","HTML branch - call extract on the URL for the readable article body as clean markdown. extract handles the boilerplate-stripping (nav, footer, sidebars, cookie banners) and returns title + byline + excerpt + markdown. If extract returns an empty markdown body (some heavy SPAs render fully client-side and extract can't see the article without JS), fall back to html-to-markdown on the same URL - it converts the raw DOM verbatim, which is noisier but never empty. Cost: extract is wallet-only ($0.005); html-to-markdown is PoW-eligible.","PDF branch - call pdf-to-markdown with the URL. Returns markdown preserving headings, paragraphs, and bullet structure from the PDF's text layer. For scanned PDFs (image-only, no text layer), pdf-to-markdown will return empty or near-empty - in that case the caller should hand the PDF pages to image-ocr (step 4) page-by-page, which is more expensive but the only path that works on scans. Most modern PDF whitepapers and research papers have proper text layers and don't need OCR fallback.","Image branch - call image-ocr with the imageUrl. Returns the recognized text plus per-word confidence scores. Confidence < 60 on most words signals a low-resolution or low-contrast source - surface this to the caller so they don't trust the output as authoritative text. image-ocr is the catch-all for screenshots, scanned receipts, whiteboard photos, and image-only PDF pages. The output is plain text (not markdown) - wrap it in a single fenced code block if downstream needs a markdown payload.","Optional: re-render - if the HTML branch picked extract and the agent wants *raw* HTML-to-markdown instead of the boilerplate-stripped article (e.g. for archiving a documentation page where the nav links matter), swap step 2 for html-to-markdown directly. It's the same shape (URL → markdown), just verbose. Both extract and html-to-markdown return the same field name (`markdown`) so the rest of the workflow is interchangeable.","Finalize - call text-stats with the markdown body to compute word count, character count, and estimated token count (≈chars/4). This is a budget step: it tells the caller whether the result fits in a single LLM call (<32k tokens), needs chunking (32k-200k), or warrants a RAG-style ingestion (>200k). Final payload: { url, contentType, branch: 'html'|'pdf'|'image'|'html-raw', markdown: '<body>', stats: { chars, words, est_tokens } } - a single object the caller's LLM-input layer consumes directly."],"claudePrompt":"Convert https://example.com to clean markdown using Agent402, branching on content-type.\n\n(1) http-headers with url=https://example.com - return {status, headers}. Read headers['content-type']. If status >= 400, abort with {error: 'unreachable', status}. (2) Branch: if content-type starts with 'text/html' → call extract with url=https://example.com, return {title, markdown}. If empty markdown, retry with html-to-markdown (url=https://example.com). If content-type is 'application/pdf' or the path ends in .pdf → call pdf-to-markdown with url=https://example.com, return {markdown}. If content-type starts with 'image/' or the path ends in .png/.jpg/.jpeg/.gif/.webp → call image-ocr with imageUrl=https://example.com, return {text, confidence}. Wrap the text in a single fenced code block as the markdown. (3) text-stats with text=<markdown from step 2> - return {chars, words}. Compute est_tokens = Math.ceil(chars/4). Final return: {url: 'https://example.com', contentType: <from step 1>, branch: 'html'|'pdf'|'image'|'html-raw', markdown: <step 2 result>, stats: {chars, words, est_tokens}, warnings: [<'low OCR confidence' if image branch and confidence<60, 'empty extract - used raw html-to-markdown' if html-raw fallback>]}. Budget ~$0.018 paid; 4 of 6 tools are PoW-eligible (extract and pdf-to-markdown are wallet-only).","promptArgs":[{"name":"url","description":"Public http(s) URL to convert to markdown. Can point at an HTML article, a PDF, or an image - the workflow auto-detects.","required":true}]},{"slug":"status-snapshot","title":"Site status snapshot","tagline":"The 'is this site healthy, addressable, and crawlable - right now?' workflow. DNS resolution → HTTP reachability → security headers → TLS certificate expiry → robots policy. Five tools, one structured status payload an operator (or an uptime bot, or a pre-flight check before an extract/crawl) can act on.","useCase":"An agent (or an on-call operator, or a crawler about to spend money on extract/render) needs a one-shot answer to 'can I talk to this site and should I?' The naive approach (one curl) tells you only that the door opened - not whether DNS is healthy, whether the cert expires next week, whether security headers are sane, or whether robots.txt actually allows the path you're about to crawl. This pack runs the canonical pre-flight in a fixed order: resolve DNS first (cheapest, fails earliest), then check HTTP reachability, then inspect security/cache headers, then verify the TLS cert isn't about to expire, then ask robots.txt whether the agent is allowed in. Output is a single status object with a top-level rollup (ok|warn|fail) plus per-step findings - usable as the gate condition before a paid extract, as the body of an uptime alert, or as the first step in a site-audit run.","toolSlugs":["dns-lookup","http-check","http-headers","tls-cert","robots-check"],"workflow":["Call dns-lookup with host=<URL host> and type=A to confirm the hostname actually resolves. This is the cheapest, fastest failure mode - NXDOMAIN or zero answers means the site is unreachable for a reason no downstream tool can fix, and the workflow should fail fast with {ok: false, stage: 'dns'} rather than spend money on http-check + tls-cert + headers all returning the same connection error. Optional: re-run with type=NS to capture nameservers for an alert payload (helpful when the failure is 'wrong DNS' vs 'origin down').","Call http-check with url=<URL> for the basic reachability signal: HTTP status code, response latency (ms), and the final URL after following redirects. This is the 'is the door open' check - status 2xx is healthy, 3xx with a redirect chain might mean the canonical URL moved (record finalUrl for the caller), 4xx means the path is wrong (not necessarily a site outage), 5xx means the origin is broken. Latency > 3000ms is a soft warn even when status is 200 - flag it in the rollup so a slow site doesn't masquerade as fully healthy.","Call http-headers with url=<URL> to capture the response headers in full. The fields that matter for the snapshot: Strict-Transport-Security (HSTS - present = good, missing on an HTTPS site = warn), Content-Security-Policy (present = good, missing = info), X-Content-Type-Options (should be `nosniff`), Cache-Control (informational - tells the caller whether downstream extract will hit cache), Server (informational - useful for tech-stack notes). Surface a security-header subscore (count of expected headers present / total expected) so the rollup can flag a site with a working HTTPS cert but a weak header posture.","Call tls-cert with host=<URL host> to inspect the live certificate: issuer, subject, validity window, days remaining, SANs, fingerprint. The single most important field is daysRemaining - < 14 days is a *fail* in the rollup (cert is about to break and break production), < 30 days is a *warn* (renewal window), >= 30 days is *ok*. Also surface altNames so the caller can verify the URL host matches a SAN (mismatch = browser will reject regardless of expiry). Skipped automatically if the URL is http:// (not https://) - no cert to inspect.","Call robots-check with url=<URL> and userAgent=<caller's agent token> to verify the agent is actually allowed to crawl the path. Returns {allowed, matchedRule, sitemaps}. This is the policy gate that should run *before* the caller spends money on extract/render - calling extract on a Disallow'd path is wasteful at best, hostile at worst. The sitemaps[] list is a bonus side-benefit: hand it to the caller's crawl planner so it doesn't have to discover sitemaps separately. Final payload: { url, host, ok: true|false, rollup: 'ok'|'warn'|'fail', dns: {...}, http: {status, latencyMs, finalUrl}, headers: {securityScore, hsts, csp, server, cacheControl}, tls: {daysRemaining, issuer, altNames} | null, robots: {allowed, matchedRule, sitemaps}, warnings: [<string flags>] } - a single object the caller's monitor/gate consumes directly."],"claudePrompt":"Run a status snapshot for https://example.com using Agent402. Derive host = new URL(url).host. Initialize warnings = [].\n\n(1) dns-lookup with host=<host>, type='A' - return {answers}. If answers is empty, return {url, host, ok: false, rollup: 'fail', stage: 'dns', warnings: ['NXDOMAIN or no A records']}. (2) http-check with url=https://example.com - return {status, latencyMs, finalUrl}. If status >= 500, push warnings += ['origin 5xx']. If latencyMs > 3000, push warnings += ['slow response (>3s)']. (3) http-headers with url=https://example.com - return {headers}. Compute securityScore = ['strict-transport-security','content-security-policy','x-content-type-options'].filter(h => headers[h]).length / 3. If securityScore < 0.67, push warnings += ['weak security headers']. (4) tls-cert with host=<host> ONLY if URL starts with 'https://' - return {daysRemaining, issuer, altNames}. If daysRemaining < 14, push warnings += ['cert expires in <14 days']. If daysRemaining < 30, push warnings += ['cert renewal window (<30 days)']. (5) robots-check with url=https://example.com, userAgent='*' - return {allowed, matchedRule, sitemaps}. If !allowed, push warnings += ['robots.txt disallows this path']. Compute rollup: 'fail' if step 2 status>=500 OR step 4 daysRemaining<14 OR step 5 !allowed; 'warn' if any warnings remain; else 'ok'. Final return: {url: 'https://example.com', host, ok: rollup !== 'fail', rollup, dns: {answers: <step 1>}, http: {status, latencyMs, finalUrl}, headers: {securityScore, hsts: !!headers['strict-transport-security'], csp: !!headers['content-security-policy'], server: headers.server || null, cacheControl: headers['cache-control'] || null}, tls: <step 4 or null>, robots: {allowed, matchedRule, sitemaps}, warnings}. Budget ~$0.013 paid; all 5 tools are PoW-eligible (pure network I/O, free here on the hosted connector after a small PoW).","promptArgs":[{"name":"url","description":"Public http(s) URL to snapshot (e.g. https://example.com/path)","required":true}]},{"slug":"weather-brief","title":"Weather briefing","tagline":"Full weather briefing for a location: current conditions, 7-day forecast, and air quality index in one pass.","useCase":"An agent needs a comprehensive weather picture for a location - not just 'is it raining now?' but 'what's the full outlook?' Common triggers: a user asks about weather before a trip, a scheduling agent needs to warn about upcoming severe weather, or a logistics system needs outdoor conditions + AQI for worker safety. Running the three weather tools individually loses the composite picture; this pack sequences them and produces a unified briefing with current snapshot, daily forecast, and air quality side-by-side.","toolSlugs":["weather-current","weather-daily","weather-air-quality"],"workflow":["Call weather-current with lat and lon to get the real-time snapshot: temperature, wind speed and direction, humidity, apparent temperature, weather condition code. This is the 'what's happening right now' answer. If the response includes a condition like 'Thunderstorm' or wind > 60 km/h, flag it as a severe-weather alert in the final briefing.","Call weather-daily with the same lat and lon (days=7 or the caller's horizon) for the extended forecast. Each day returns high/low temperatures, precipitation probability and sum, max wind gust, and dominant weather code. Scan for any day with precipitation probability > 70% or max gust > 80 km/h and add to a warnings list. Also compute the temperature trend (rising/falling/stable) across the 7 days for a one-line summary.","Call weather-air-quality with the same lat and lon for the current AQI reading: PM2.5, PM10, ozone, NO2, SO2, CO, and the US AQI category (Good/Moderate/Unhealthy/etc.). AQI category 'Unhealthy for Sensitive Groups' or worse should appear as a health advisory in the final briefing. Final payload: { location: {lat, lon}, current: {temperature, feelsLike, humidity, windSpeed, windDirection, condition}, forecast: [{date, high, low, precipProbability, precipSum, maxGust, condition}], airQuality: {aqi, category, pm25, pm10, ozone}, trend: 'warming'|'cooling'|'stable', warnings: [<string flags>] }."],"claudePrompt":"Generate a weather briefing for coordinates lat=48.8566, lon=2.3522 using Agent402.\n\n(1) weather-current with lat=48.8566, lon=2.3522 - returns {temperature, feelsLike, humidity, windSpeed, windDirection, condition, conditionCode}. Initialize warnings = []. If conditionCode >= 95 (thunderstorm), push 'Thunderstorm in progress'. If windSpeed > 60, push 'High winds (>{windSpeed} km/h)'.\n\n(2) weather-daily with lat=48.8566, lon=2.3522, days=7 - returns {days: [{date, high, low, precipProbability, precipSum, maxGust, condition}]}. For each day: if precipProbability > 70, push 'Rain likely on {date} ({precipProbability}%)'. If maxGust > 80, push 'Strong gusts on {date} ({maxGust} km/h)'. Compute trend: compare days[0].high vs days[6].high - diff > 3 = 'warming', diff < -3 = 'cooling', else 'stable'.\n\n(3) weather-air-quality with lat=48.8566, lon=2.3522 - returns {aqi, category, pm25, pm10, ozone, no2, so2, co}. If category is not 'Good' and not 'Moderate', push 'Air quality advisory: {category}'.\n\nFinal return: {location: {lat: 48.8566, lon: 2.3522}, current: <step 1>, forecast: <step 2 days>, airQuality: {aqi, category, pm25, pm10, ozone}, trend: <computed>, warnings}. Budget ~$0.005 paid; all 3 tools are wallet-only (external API calls to Open-Meteo).","promptArgs":[{"name":"lat","description":"Latitude of the location (e.g. 48.8566 for Paris)","required":true},{"name":"lon","description":"Longitude of the location (e.g. 2.3522 for Paris)","required":true}]},{"slug":"price-monitor","title":"Cross-asset price monitor","tagline":"Side-by-side snapshot of a stock and a crypto asset: live quotes, 1-year history, and a date-stamped comparison.","useCase":"An agent or analyst wants to compare a traditional equity with a crypto asset - e.g. 'How has AAPL performed versus BTC over the last year?' Running stock-quote and crypto-price individually gives two disconnected numbers; adding historical data from both sides plus a date-format timestamp turns it into a dated comparison card the caller can track over time or feed into a report. Useful for portfolio dashboards, market-update bots, newsletter generators, and any agent that needs a quick cross-asset health check.","toolSlugs":["stock-quote","stock-history","crypto-price","crypto-history","date-format"],"workflow":["Call date-format with datetime='now' (or the current ISO timestamp) to get a formatted snapshot timestamp - ISO, date-only, and day of week. This anchors the comparison to a specific point in time so the caller can track changes across repeated runs. The unix timestamp is useful as a cache key or filename.","Call stock-quote with symbol=<ticker> to get the live equity price: price, change, changePercent, volume, marketCap. This is the 'right now' read for the traditional side. If the market is closed, the quote reflects the last close - note the timestamp from step 1 so the caller knows whether this is live or stale.","Call stock-history with symbol=<ticker> and range='1y' to get the 1-year price series. Extract the first and last data points to compute the year-over-year return: ((last - first) / first * 100). This is the equity's trailing-12-month performance.","Call crypto-price with coins=<coin> and currency=usd to get the live crypto price: price, market_cap, 24h_volume, 24h_change. This is the 'right now' read for the crypto side.","Call crypto-history with coin=<coin>, days=365, and currency=usd to get the 1-year price series. Compute the year-over-year return the same way as step 3. Final payload: { timestamp: <step 1>, stock: { symbol, price, change, changePercent, yearReturn }, crypto: { coin, price, change24h, yearReturn }, comparison: { stockOutperforms: stockYearReturn > cryptoYearReturn, spreadPct: Math.abs(stockYearReturn - cryptoYearReturn) } }."],"claudePrompt":"Build a cross-asset price comparison for ticker=AAPL vs coin=bitcoin using Agent402.\n\n(1) date-format with datetime=new Date().toISOString() - returns {iso, date, dayOfWeek, unix}. Save as snapshot timestamp.\n\n(2) stock-quote with symbol=AAPL - returns {price, change, changePercent, volume, marketCap}.\n\n(3) stock-history with symbol=AAPL, range='1y' - returns {history: [{date, close}]}. Compute stockYearReturn = ((history[last].close - history[0].close) / history[0].close * 100).toFixed(2).\n\n(4) crypto-price with coins=bitcoin, currency='usd' - returns [{price, market_cap, change_24h}].\n\n(5) crypto-history with coin=bitcoin, days='365', currency='usd' - returns {prices: [[timestamp, price]]}. Compute cryptoYearReturn = ((prices[last][1] - prices[0][1]) / prices[0][1] * 100).toFixed(2).\n\nFinal return: {timestamp: {iso: <step 1 iso>, date: <step 1 date>, dayOfWeek: <step 1 dayOfWeek>}, stock: {symbol: 'AAPL', price: <step 2 price>, change: <step 2 change>, changePercent: <step 2 changePercent>, yearReturn: stockYearReturn}, crypto: {coin: 'bitcoin', price: <step 4 price>, change24h: <step 4 change_24h>, yearReturn: cryptoYearReturn}, comparison: {stockOutperforms: parseFloat(stockYearReturn) > parseFloat(cryptoYearReturn), spreadPct: Math.abs(parseFloat(stockYearReturn) - parseFloat(cryptoYearReturn)).toFixed(2)}}. Budget ~$0.005 paid; all 5 tools are wallet-only (external API calls).","promptArgs":[{"name":"ticker","description":"Stock ticker symbol (e.g. AAPL, MSFT, TSLA)","required":true},{"name":"coin","description":"Crypto coin ID from CoinGecko (e.g. bitcoin, ethereum, solana)","required":true}]},{"slug":"wallet-readiness","title":"Agent wallet readiness check","tagline":"One call answers 'can this wallet pay right now?' - USDC balances on Base AND Solana, live Base gas, and a ready-to-share Coinbase Onramp funding link if it's running dry.","useCase":"An agent (or the human operating it) is about to start a paid work session and needs to know the wallet is actually ready: does it hold USDC on the chains it pays on, what's gas doing, and - if the balance is low - where does a human top it up with a card? Checking each of those separately means three tools and a docs page; this pack returns the whole preflight in one envelope. Run it at session start, before a batch job, or on a schedule as a balance monitor.","toolSlugs":["wallet-balances","gas-snapshot","onramp-link"],"workflow":["Call wallet-balances with {address, network: \"base\"} - returns every indexed ERC-20 + native balance. Find the USDC row (contract 0x833589fcd6edb6e08f4c7c32d4f71b54bda02913) and read its amount: this is the wallet's x402 spending power on Base.","If the agent also pays on Solana, call wallet-balances again with {address: <the Solana address>, network: \"solana\"} - same envelope, SPL balances, USDC mint EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v. (x402 settlement is gasless via EIP-3009 / sponsored transactions, so USDC is the only balance that matters - no ETH or SOL required.)","Call gas-snapshot with {network: \"base\"} for slow/standard/fast gas. The agent never pays gas on x402 buys, but gas context tells you whether any NON-x402 onchain action you're planning (a manual transfer, a contract call) is cheap right now.","If the USDC balance is below your working budget, call onramp-link with {address, network: \"base\", amount: \"<usd>\"} - it mints a single-use Coinbase Onramp URL a human can open to fund the wallet with a card or Apple Pay. Include the URL in your report; it expires unvisited, so minting it costs nothing but the call.","Assemble the verdict: { ready: usdcBase >= budget, balances: { base, solana }, gas, fundingLink } - 'ready' should be computed against the session budget the caller stated, not a fixed threshold."],"claudePrompt":"Run a wallet readiness preflight for 0xaBF4FAbd7c416fB67202E5f9002389Fc75e2a9D0 (Solana: J7aN3PLJnTCF5qpEnvJHJsnCjcGuqC2rYtEM8Gv3xwg) using Agent402. (1) wallet-balances {address, network: \"base\"} - find the USDC row and note the amount. (2) wallet-balances {address: <the Solana address>, network: \"solana\"} - the SPL USDC amount. (3) gas-snapshot {network: \"base\"} - note standard gas. (4) If USDC < $5, onramp-link {address, network: \"base\", amount: \"10\"} and include the funding URL. Return {ready, usdcBase, usdcSolana, gas, fundingLink?} with ready = (usdcBase + usdcSolana) >= 5.","promptArgs":[{"name":"address","description":"The EVM wallet address to check (0x…)","required":true},{"name":"solanaAddress","description":"Optional Solana address to check SPL USDC as well","required":false}]},{"slug":"onchain-analyst","title":"Onchain analyst (SQL over Base)","tagline":"Ask Base anything in one paid call: your SQL runs against Coinbase's indexed, DECODED chain data (events with parsed parameters, transactions, blocks, user-ops) with the live schema alongside - no indexer, no RPC archaeology.","useCase":"You need an answer that lives on-chain - 'how many wallets touched this contract this week', 'what did this address settle today', 'top USDC recipients yesterday' - and writing an indexer or paging through explorer HTML is absurd for one question. This pack runs your read-only ClickHouse-dialect SQL against base.events / base.transactions / base.blocks and returns the schema document in the same envelope, so a follow-up query can be written without a second discovery call. This is the same data path that powers the economy-over-time section at /marketplace#economy.","toolSlugs":["onchain-sql-schema","onchain-sql","stats-summary"],"workflow":["Read the schema step first (onchain-sql-schema, no input): base.events is the workhorse - decoded logs with event_name, address, transaction_hash, block_timestamp, and a parameters map you can address as parameters['from']. Cast Variant values with toString()/toUInt256OrZero() before comparing or summing.","Write SELECT-only SQL (WITH … SELECT is fine) against the tables you found. ALWAYS bound by block_timestamp (e.g. >= now() - INTERVAL 7 DAY) - the caps are 50k rows / 30s / 100GB read, and an unbounded scan of base.events will hit them. Joins are limited to 12; prefer transaction_hash IN (subquery) shapes over raw JOINs.","Run it through the onchain-sql step. If the result is empty, suspect the WHERE before the data: addresses in base.events are FixedString(42) lowercase - compare against lower('0x…'). If it errors with a budget/timeout message, narrow the time window first, then the column list.","Iterate: the pack is cheap enough to run several times while you refine. For repeated dashboards pass cacheSeconds (up to 900) so identical queries within the window are served from cache without re-scanning.","The pack's final step runs stats-summary over the first numeric column of your result set - count, sum, mean, median, stddev, quartiles in one shot. For a time series (daily counts, per-block values) that's the distribution picture without a second query; for a single-row aggregate it's a no-op you can ignore."],"claudePrompt":"Answer a question with SQL over Base using Agent402's onchain-analyst pack. Warm-up: run SELECT COUNT(*) AS blocks FROM base.blocks WHERE block_number > 32000000 to prove the pipe. Then the real question - 'How many USDC transfers settled on Base in the last 24 hours?': (1) read the schema from the pack's schema step, (2) write SELECT COUNT(*) AS transfers FROM base.events WHERE address = '0x833589fcd6edb6e08f4c7c32d4f71b54bda02913' AND event_name = 'Transfer' AND block_timestamp >= now() - INTERVAL 1 DAY, (3) run it via the sql step and report the count. Keep every query SELECT-only and time-bounded.","promptArgs":[{"name":"sql","description":"Read-only ClickHouse-dialect SQL to run (SELECT/WITH only, time-bounded)","required":true}]},{"slug":"seo-audit","title":"Technical SEO audit","tagline":"Can search engines and AI crawlers actually index this page? One pass over reachability, TLS, robots policy, sitemap health, meta/OpenGraph tags, and the on-page link graph.","useCase":"You shipped a page (or inherited a site) and want the technical indexability picture without opening six tools: is it up and fast, is TLS valid, does robots.txt allow the crawlers that matter (including LLM bots), does the sitemap parse, are title/description/OG tags present and sized right, and where do its links point? Distinct from a security audit (headers/SPF/CT) and an uptime snapshot - this is the 'will Google and ChatGPT see what I meant' check. Run it pre-launch, post-migration, or on a competitor.","toolSlugs":["http-check","tls-cert","robots-check","sitemap","meta","http-headers"],"workflow":["http-check with the page URL - status, latency, redirect chain. A 200 under ~800ms is healthy; a 3xx chain longer than one hop wastes crawl budget and should be flattened.","tls-cert with the host - issuer, expiry, chain trust. daysRemaining < 21 is a renewal warning; an untrusted chain is an indexing risk (and a browser warning for humans).","robots-check with the page URL - is it fetchable by crawlers? Re-run with userAgent values you care about (Googlebot, GPTBot, ClaudeBot, PerplexityBot) - LLM crawler policy is part of modern SEO, and an accidental Disallow: / for AI bots silently removes you from answer engines.","sitemap with the site's sitemap.xml URL - type, URL count, parse errors. A sitemap that 404s or is empty means discovery depends entirely on the link graph.","meta with the page URL - title, description, canonical, OpenGraph/Twitter cards. Flag: missing description, title > 60 chars, missing og:image (kills social/link-preview CTR), missing canonical on parameterized URLs.","http-headers with the page URL - the response headers search engines act on. Flag: an X-Robots-Tag: noindex (silently removes the page from every index regardless of robots.txt), a missing/short Cache-Control on static assets, and a Content-Type without charset. Summarize as a pass/warn/fail card per check with the two highest-impact fixes on top."],"claudePrompt":"Run a technical SEO audit of https://example.com with Agent402: (1) http-check {url} - status + latency + redirects. (2) tls-cert {host: \"example.com\"} - expiry + trust. (3) robots-check {url, userAgent: \"Googlebot\"} and again with \"GPTBot\" - crawlability for search AND answer engines. (4) sitemap {url: \"https://example.com/sitemap.xml\"} - parses, URL count. (5) meta {url} - title/description/OG completeness, title ≤ 60 chars. (6) http-headers {url} - flag X-Robots-Tag: noindex and cache policy. Return a card: {reachability, tls, robots: {googlebot, gptbot}, sitemap, meta, headers, topFixes: [two highest-impact items]}.","promptArgs":[{"name":"url","description":"The page URL to audit (https://…)","required":true}]},{"slug":"cheapest-rail","title":"Cheapest rail right now","tagline":"Where should an agent transact this minute? Live gas on Ethereum + every major L2 side by side, Base gas tiers, a fee estimate for your transaction type, and ETH spot to price it all in dollars.","useCase":"An agent about to do REAL onchain work - deploy a contract, move funds, batch-settle, mint - wants to pick the chain and the moment. Gas varies 10-100x between Ethereum and its L2s and swings hour to hour; eyeballing four gas trackers is human work. One call returns the cross-chain comparison, the chosen chain's slow/standard/fast tiers, a per-transaction-type estimate, and the ETH price to convert gwei into dollars. (x402 tool payments themselves are gasless - this pack is for everything else an agent does on-chain.)","toolSlugs":["l2-gas-comparison","gas-snapshot","gas-estimate","crypto-price"],"workflow":["l2-gas-comparison with {networks: [\"ethereum\", \"base\", \"arbitrum\", \"optimism\", \"polygon\"]} - one row per chain with current gas. This is the headline: sort ascending and you have the cheapest venue.","gas-snapshot with {network: <the winner>} - slow/standard/fast tiers on the chosen chain. If your action is deferrable, the slow tier is often half the fast tier; note the spread.","gas-estimate for your transaction type on that chain - a simple transfer, an ERC-20 transfer, and a contract deploy differ by an order of magnitude in gas units; this converts 'gwei is low' into 'this action costs N'.","crypto-price with {coins: \"ETH\", currency: \"usd\"} - multiply units × price × ETH spot to state the cost in dollars, which is the number a budget check actually wants.","Report: { cheapest: <chain>, comparison: [...], tiers: {...}, estimatedCostUsd, decision: 'act now on <chain>' | 'defer - spread suggests off-peak in a few hours' }."],"claudePrompt":"Find the cheapest chain for an ERC-20 transfer right now using Agent402 (networks: ethereum,base,arbitrum,optimism,polygon): (1) l2-gas-comparison with that network list - sort by gas ascending. (2) gas-snapshot {network: <cheapest>} - read the standard tier. (3) gas-estimate on that network for an ERC-20 transfer. (4) crypto-price {coins: \"ETH\", currency: \"usd\"} - express the final cost in USD. Return {cheapest, gasStandard, estimatedCostUsd, comparison}.","promptArgs":[{"name":"networks","description":"Comma-separated chains to compare (default: ethereum,base,arbitrum,optimism,polygon)","required":false}]},{"slug":"company-dossier","title":"Company dossier","tagline":"Comprehensive company research report in one call: live quote, financials, SEC filings, insider trades, and recent news - all in parallel.","useCase":"Building an investment thesis, preparing for a board presentation, or doing acquisition diligence - you want the full public picture of a company without leaving the agent loop.","toolSlugs":["stock-quote","company-financials","edgar-filings","edgar-insider-trades","search"],"workflow":["Get the live quote from stock-quote - current price, market cap, day range, 52-week high/low, volume.","Pull key financials from company-financials - revenue, net income, operating income, total assets, liabilities, equity, EPS, and operating cash flow.","List the 5 most recent SEC filings via edgar-filings to surface any 10-K, 10-Q, 8-K, or S-1 activity.","Check edgar-insider-trades for Form 4 filings in the last 90 days - directional insider activity is a real signal.","Search the web for recent news about the company to catch catalysts, analyst upgrades, or red flags."],"claudePrompt":"Build a comprehensive dossier on NVDA using Agent402's company-dossier skill pack. Get (1) live quote, (2) key financials, (3) last 5 SEC filings, (4) 90-day insider trades, (5) recent news search, (6) full text of the top article. Summarize as a structured one-pager with sections for valuation, fundamentals, insider signal, and news catalyst.","promptArgs":[{"name":"ticker","description":"Stock ticker (e.g. NVDA, AAPL)","required":true}]},{"slug":"domain-intel","title":"Domain intel","tagline":"Full domain security and SEO intelligence in one call: WHOIS, DNS, TLS cert, HTTP headers, tech stack, robots policy, and certificate transparency.","useCase":"Evaluating a domain for acquisition, investigating a phishing site, auditing a competitor's infrastructure, or preparing a security review - one call gives you the complete external footprint.","toolSlugs":["whois","dns-lookup","tls-cert","http-headers","tech-stack","robots-check"],"workflow":["Pull WHOIS records - registrar, creation date, expiry, registrant (often privacy-shielded but the age alone is a signal).","Resolve DNS A records to identify the hosting provider and detect CDN fronting.","Inspect the live TLS certificate - issuer, expiry, SANs, and chain validity.","Fetch HTTP response headers - security posture (HSTS, CSP, XFO), caching, and server fingerprint.","Fingerprint the tech stack - CMS, framework, CDN, analytics, and third-party scripts.","Check robots.txt for crawl directives - reveals hidden paths and bot policies."],"claudePrompt":"Run a full domain intelligence report on stripe.com using Agent402's domain-intel skill pack: (1) WHOIS - age, registrar, expiry. (2) DNS A records - hosting/CDN. (3) TLS cert - issuer, expiry, SANs. (4) HTTP headers - security headers score. (5) Tech stack - frameworks, CDN, analytics. (6) robots.txt - hidden paths. Output a structured report with a risk summary.","promptArgs":[{"name":"domain","description":"Domain to investigate (e.g. stripe.com)","required":true}]},{"slug":"crypto-dossier","title":"Crypto dossier","tagline":"Everything about a cryptocurrency in one call: live price, 90-day history, trending status, global market context, news search, and top article extraction.","useCase":"Building a one-pager on a token for a portfolio decision, writing a research note, or monitoring a new listing - price, history, market context, and headlines in a single payment.","toolSlugs":["crypto-price","crypto-history","crypto-trending","crypto-global","search","extract"],"workflow":["Get the live price from crypto-price - last price, 24h change, market cap, and volume.","Pull 90 days of OHLC history from crypto-history - compute return, volatility, and max drawdown.","Check crypto-trending to see whether the coin is on the most-searched list - a fast read on retail attention.","Pull crypto-global for total market cap, BTC dominance, and 24h volume - contextualizes the coin's move.","Search the web for recent cryptocurrency news about the coin to catch catalysts and red flags.","Extract the top news article as clean markdown for the brief's headline analysis."],"claudePrompt":"Build a comprehensive crypto dossier on bitcoin using Agent402's crypto-dossier skill pack: (1) live price + 24h change, (2) 90-day price history with return and drawdown, (3) trending status, (4) global market context (BTC dominance, total cap), (5) recent news search, (6) full text of the top article. Output a structured brief with sections for price action, market context, and news catalyst.","promptArgs":[{"name":"coin","description":"Coin id (e.g. bitcoin, ethereum, solana)","required":true}]},{"slug":"earnings-watch","title":"Earnings watch","tagline":"Is this company reporting soon and what's the consensus? Earnings calendar, live quote, and recent search results in one call.","useCase":"Pre-earnings positioning - check if a report is imminent, what the stock price implies, and what analysts are saying.","toolSlugs":["earnings-calendar","stock-quote","search"],"workflow":["Check the earnings calendar for upcoming or recent report dates and EPS estimates.","Get the live stock quote - price, market cap, and day range heading into earnings.","Search the web for recent earnings-related coverage and analyst expectations."],"claudePrompt":"Check if AAPL is reporting earnings soon using Agent402's earnings-watch skill pack. Get (1) earnings calendar for dates and EPS consensus, (2) live quote, (3) recent search results for analyst expectations. Summarize the setup heading into the report.","promptArgs":[{"name":"ticker","description":"Stock ticker symbol (e.g. AAPL, NVDA)","required":true}]},{"slug":"insider-alert","title":"Insider alert","tagline":"Insider buying/selling activity for a stock: Form 4 trades, live quote, and recent SEC filings in one call.","useCase":"Screening for insider signal - large buys or cluster selling often precede material moves.","toolSlugs":["edgar-insider-trades","stock-quote","edgar-filings"],"workflow":["Pull Form 4 insider trades from the last 30 days - direction, size, and insider role.","Get the live stock quote for context on where the price is relative to insider activity.","List the 3 most recent SEC filings to correlate insider moves with material disclosures."],"claudePrompt":"Check insider activity for AAPL using Agent402's insider-alert skill pack. Get (1) 30-day insider trades, (2) live quote, (3) last 3 SEC filings. Flag any cluster buying or selling and correlate with recent filings.","promptArgs":[{"name":"ticker","description":"Stock ticker symbol (e.g. AAPL, NVDA)","required":true}]},{"slug":"ipo-watch","title":"IPO watch","tagline":"What companies are going public? Recent S-1/IPO filings from EDGAR plus a web search for IPO news.","useCase":"Tracking the IPO pipeline - new S-1 filings, pricing dates, and market commentary.","toolSlugs":["edgar-recent-ipos","search","search-news"],"workflow":["Pull recent IPO/S-1 filings from EDGAR over the last 14 days.","Search the web for recent IPO filings and pricing news.","Pull recent news specifically with search-news - pricing dates, debut-day moves, and withdrawals surface in news faster than in the general web index."],"claudePrompt":"What companies are going public this month? Use Agent402's ipo-watch skill pack to (1) pull recent S-1/IPO filings from EDGAR, (2) search the web, (3) pull recent IPO news with search-news. Summarize the pipeline.","promptArgs":[]},{"slug":"yield-dashboard","title":"Yield dashboard","tagline":"Current yield curve snapshot: full Treasury curve, key spreads, and average rates in one call.","useCase":"Quick fixed-income read - is the curve inverted, what are spreads doing, and where are average rates.","toolSlugs":["treasury-yield-curve","yield-curve-spread","treasury-avg-rates"],"workflow":["Pull the live Treasury yield curve across all maturities.","Get the 10Y-2Y and 10Y-3M spreads - inversion signals.","Pull Treasury average interest rates for context on the cost of government debt."],"claudePrompt":"Give me a yield curve snapshot using Agent402's yield-dashboard skill pack. Pull (1) the full Treasury curve, (2) key spreads (10Y-2Y, 10Y-3M), (3) average rates. Flag any inversion.","promptArgs":[]},{"slug":"inflation-check","title":"Inflation check","tagline":"Is the economy in recession territory? CPI, fed funds, unemployment, and Sahm rule in one call.","useCase":"Quick macro health check - the four numbers that answer 'are we in a recession?'","toolSlugs":["cpi-yoy","fed-funds","unemployment-rate","sahm-rule"],"workflow":["Pull CPI year-over-year for the headline inflation read.","Get the effective fed funds rate for the current policy stance.","Pull the unemployment rate (U-3).","Compute the Sahm rule - triggers when 3-month unemployment average rises >0.5pp above its 12-month low."],"claudePrompt":"Run a recession check using Agent402's inflation-check skill pack. Get (1) CPI YoY, (2) fed funds rate, (3) unemployment rate, (4) Sahm rule. Is the economy in recession territory?","promptArgs":[]},{"slug":"fx-monitor","title":"FX monitor","tagline":"Major currency snapshot: EUR/USD, GBP/USD, JPY/USD rates plus the full FX dashboard in one call.","useCase":"Quick read on major crosses - are any at extremes, and what's the full dashboard showing.","toolSlugs":["fx-rate","fx-dashboard","fx-historical"],"workflow":["Pull EUR/USD, GBP/USD, and JPY/USD spot rates.","Get the full FX dashboard for a broader view of currency movements.","Pull the recent historical series for EUR/USD with fx-historical - a spot rate only means something read against its own trend."],"claudePrompt":"Give me a major currency snapshot using Agent402's fx-monitor skill pack. Get (1) EUR/USD, GBP/USD, JPY/USD spot rates, (2) the full FX dashboard, (3) the recent EUR/USD history via fx-historical. Flag any pair at a multi-month extreme.","promptArgs":[]},{"slug":"defi-dashboard","title":"DeFi dashboard","tagline":"DeFi market overview: total TVL, ETH price, Base gas, and global crypto stats in one call.","useCase":"Quick DeFi health check - TVL trends, ETH price context, gas costs, and market-wide metrics.","toolSlugs":["defi-tvl","crypto-price","gas-snapshot","crypto-global"],"workflow":["Pull total DeFi TVL across all chains.","Get the live ETH price as the reference asset for DeFi.","Check Base gas for current transaction costs.","Pull global crypto market stats for total cap and dominance context."],"claudePrompt":"Give me a DeFi market overview using Agent402's defi-dashboard skill pack. Get (1) total DeFi TVL, (2) ETH price, (3) Base gas tiers, (4) global crypto stats. Summarize the health of DeFi right now.","promptArgs":[]},{"slug":"nft-portfolio","title":"NFT portfolio","tagline":"NFT + wallet snapshot: NFT holdings, native balance, and ETH price for a given address in one call.","useCase":"Quick portfolio view - what NFTs does this address hold, what's the wallet balance, and what's ETH worth.","toolSlugs":["nft-holdings","wallet-balance","crypto-price"],"workflow":["Pull NFT holdings for the address on Base.","Get the native wallet balance on Base.","Get ETH price for portfolio valuation."],"claudePrompt":"Show me the NFT portfolio for 0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045 using Agent402's nft-portfolio skill pack. Get (1) NFT holdings, (2) wallet balance, (3) ETH price. Summarize the collection.","promptArgs":[{"name":"address","description":"Wallet address (0x…)","required":true}]},{"slug":"wallet-audit","title":"Wallet audit","tagline":"Full wallet activity review: balance, recent transactions, and token metadata for a given address.","useCase":"Investigating wallet activity - what's the balance, what has it been doing, and what tokens are involved.","toolSlugs":["wallet-balance","wallet-transactions","token-metadata"],"workflow":["Get the native + token balances for the address.","Pull recent transactions to see activity patterns.","Look up token metadata for contracts the wallet interacts with."],"claudePrompt":"Audit the wallet 0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045 using Agent402's wallet-audit skill pack. Get (1) balance, (2) recent transactions, (3) token metadata. Summarize activity and flag anything unusual.","promptArgs":[{"name":"address","description":"Wallet address (0x…)","required":true}]},{"slug":"gas-optimizer","title":"Gas optimizer","tagline":"Find the cheapest gas right now: Base gas, Ethereum gas, Base fee estimate, and ETH price for USD conversion.","useCase":"Timing a transaction - compare gas across chains and decide whether to act now or wait.","toolSlugs":["gas-snapshot","gas-estimate","crypto-price"],"workflow":["Get Base gas tiers (slow/standard/fast).","Get Ethereum gas tiers for comparison.","Get a Base fee estimate for a standard transfer.","Get ETH price to express costs in USD."],"claudePrompt":"Find the cheapest gas right now using Agent402's gas-optimizer skill pack. Get (1) Base gas tiers, (2) Ethereum gas tiers, (3) Base fee estimate, (4) ETH price. Tell me the cost in USD and whether to act now or wait.","promptArgs":[]},{"slug":"ssl-audit","title":"SSL audit","tagline":"TLS/SSL security posture check: live certificate inspection, HTTP security headers, and CAA DNS records.","useCase":"Verifying a domain's TLS posture - cert validity, security headers, and who's authorized to issue certs.","toolSlugs":["tls-cert","http-headers","dns-lookup"],"workflow":["Inspect the live TLS certificate - issuer, expiry, SANs, chain validity.","Fetch HTTP response headers - HSTS, CSP, and other security headers.","Check CAA DNS records to see which CAs are authorized to issue certs for this domain."],"claudePrompt":"Run an SSL audit on stripe.com using Agent402's ssl-audit skill pack. Get (1) TLS cert details - issuer, expiry, SANs, (2) HTTP security headers - HSTS, CSP, (3) CAA DNS records. Flag any near-expiry or missing HSTS.","promptArgs":[{"name":"domain","description":"Domain to audit (e.g. stripe.com)","required":true}]},{"slug":"email-security","title":"Email security","tagline":"Full email auth posture: SPF, DMARC, DKIM, and composite deliverability score in one call.","useCase":"Diagnosing email authentication - can this domain be spoofed, and is its mail configuration complete.","toolSlugs":["spf-check","dmarc-check","dkim-lookup","email-deliverability"],"workflow":["Parse the SPF record - flag permissive +all, excessive lookups, or syntax errors.","Parse the DMARC policy - p=none means failures are ignored.","Probe common DKIM selectors and check key strength.","Run the composite deliverability score for an overall grade."],"claudePrompt":"Check email security for stripe.com using Agent402's email-security skill pack. Get (1) SPF check, (2) DMARC policy, (3) DKIM probe, (4) deliverability score. Flag any missing or weak auth records.","promptArgs":[{"name":"domain","description":"Domain to check (e.g. stripe.com)","required":true}]},{"slug":"brand-protection","title":"Brand protection","tagline":"Is this domain legitimate? WHOIS age, DNS resolution, scam/phishing search results, and HTTP headers for a quick trust assessment.","useCase":"Evaluating a suspicious domain - checking registration age, hosting, web mentions, and security posture.","toolSlugs":["whois","dns-lookup","search","http-headers"],"workflow":["Pull WHOIS for domain age, registrar, and registrant - very young domains are suspect.","Resolve DNS A records to identify hosting and detect parking pages.","Search for scam/phishing reports mentioning this domain.","Fetch HTTP headers for security posture and server fingerprint."],"claudePrompt":"Investigate whether stripe.com is legitimate using Agent402's brand-protection skill pack. Get (1) WHOIS - age and registrar, (2) DNS A records, (3) search for scam/phishing reports, (4) HTTP headers. Rate the domain's trustworthiness.","promptArgs":[{"name":"domain","description":"Domain to investigate (e.g. stripe.com)","required":true}]},{"slug":"competitor-scan","title":"Competitor scan","tagline":"What's a competitor using? Tech stack, HTTP headers, WHOIS, and page metadata in one call.","useCase":"Competitive intelligence - fingerprint their infrastructure, hosting, frameworks, and page metadata.","toolSlugs":["tech-stack","http-headers","whois","meta"],"workflow":["Fingerprint the tech stack - CMS, framework, CDN, analytics, third-party scripts.","Fetch HTTP headers for server info, caching strategy, and security posture.","Pull WHOIS for domain age, registrar, and hosting provider.","Get page metadata - title, description, OG tags for their positioning."],"claudePrompt":"Scan the competitor at https://stripe.com using Agent402's competitor-scan skill pack. Get (1) tech stack, (2) HTTP headers, (3) WHOIS, (4) page metadata. Summarize their infrastructure and positioning.","promptArgs":[{"name":"url","description":"Competitor URL (e.g. https://stripe.com)","required":true}]},{"slug":"page-audit","title":"Page audit","tagline":"Full page SEO + security audit: content extraction, metadata, HTTP headers, robots policy, and sitemap health in one call.","useCase":"Comprehensive page review - content quality, metadata completeness, security headers, crawlability, and sitemap status.","toolSlugs":["extract","meta","http-headers","robots-check","sitemap"],"workflow":["Extract the page content as clean markdown.","Get page metadata - title, description, OG tags, canonical.","Fetch HTTP headers - security headers, caching, server info.","Check robots.txt policy for the page URL.","Probe the sitemap for the site."],"claudePrompt":"Audit the page at https://stripe.com using Agent402's page-audit skill pack. Get (1) extracted content, (2) metadata, (3) HTTP headers, (4) robots policy, (5) sitemap. Summarize SEO completeness and security posture.","promptArgs":[{"name":"url","description":"Page URL to audit (e.g. https://stripe.com)","required":true}]},{"slug":"article-digest","title":"Article digest","tagline":"Quick research brief on any topic - web search results plus an AI-generated answer in one pass.","useCase":"An agent needs a fast overview of a topic: the top 5 web results plus a synthesized answer. Useful for research briefs, background checks before a meeting, or seeding a longer document with cited sources.","toolSlugs":["search","answer","search-news"],"workflow":["Run search with q=<topic> and count=5 to get the top web results - titles, URLs, and snippets.","Run answer with q=<topic> to get a synthesized response with citations. Compare against the search results for consistency.","Run search-news with q=<topic> to surface recent, time-sensitive developments the general web index may lag on - the difference between a brief that's current and one that's months stale."],"claudePrompt":"Research 'x402 payment protocol' using Agent402's article-digest skill pack: (1) search for the top 5 results, (2) get an AI-generated answer with citations, (3) pull recent news with search-news. Summarize findings in a brief with key points, recent developments, and sources.","promptArgs":[{"name":"topic","description":"Topic to research (e.g. x402 payment protocol)","required":true}]},{"slug":"pdf-pipeline","title":"PDF processing pipeline","tagline":"Full PDF processing pipeline - metadata, markdown conversion, and first-page extraction in one call.","useCase":"An agent receives a PDF URL and needs to understand it quickly: what's the page count and metadata, what does the full text say (as markdown), and what's on page 1? Running three separate tools is three payments; this pack does it in one.","toolSlugs":["pdf-info","pdf-to-markdown","pdf-extract-pages"],"workflow":["Call pdf-info to get page count, file size, title, author, and other metadata.","Call pdf-to-markdown to convert the entire PDF to clean markdown text.","Call pdf-extract-pages with pages='1' to get just the first page as a separate document."],"claudePrompt":"Process the PDF at https://arxiv.org/pdf/1706.03762 using Agent402's pdf-pipeline skill pack: (1) pdf-info for metadata, (2) pdf-to-markdown for full text, (3) pdf-extract-pages for page 1. Summarize the document structure and first-page content.","promptArgs":[{"name":"url","description":"URL of the PDF to process","required":true}]},{"slug":"url-inspector","title":"URL inspector","tagline":"Quick URL health and metadata check - parse the URL structure, verify reachability, and pull page metadata in one pass.","useCase":"An agent needs to verify a URL is live and understand what's behind it before recommending it, embedding it, or crawling it. Combines structural parsing (protocol, host, path), liveness check (status, latency, redirects), and metadata extraction (title, description, OG tags).","toolSlugs":["url-parse","http-check","meta"],"workflow":["Call url-parse to decompose the URL into protocol, hostname, path, query parameters, and fragment.","Call http-check to verify the URL is reachable - status code, latency, redirect chain.","Call meta to pull the page's title, description, canonical URL, and OpenGraph/Twitter card tags."],"claudePrompt":"Inspect https://stripe.com using Agent402's url-inspector skill pack: (1) url-parse for structure, (2) http-check for reachability and latency, (3) meta for page metadata and OG tags. Report the URL health status and key metadata.","promptArgs":[{"name":"url","description":"URL to inspect (https://…)","required":true}]},{"slug":"content-grade","title":"Content grade","tagline":"Grade a page's content quality - extract the readable content then analyze keyword density.","useCase":"An SEO agent or content reviewer needs to evaluate a page: extract the clean text and then run keyword analysis to assess topic focus and density. Chain mode ensures keywords runs on the extracted text, not raw HTML.","toolSlugs":["extract","keywords","readability-score"],"workflow":["Call extract to pull the page's readable content as clean markdown - strips nav, ads, and boilerplate.","Call keywords on the extracted text to identify the top terms and their frequency - reveals topic focus and potential keyword stuffing.","Call readability-score on the extracted text - Flesch reading ease and grade level put a number on how accessible the writing is, the other half of a content grade beyond topic focus."],"claudePrompt":"Grade the content quality of https://blog.cloudflare.com/x402/ using Agent402's content-grade skill pack: (1) extract the readable content, (2) run keyword analysis on the extracted text, (3) score readability with readability-score. Report the top keywords, density, reading-ease/grade level, and whether the content is well-focused.","promptArgs":[{"name":"url","description":"URL of the page to grade","required":true}]},{"slug":"api-health","title":"API health check","tagline":"Is this API endpoint healthy? Liveness check, response headers, and TLS certificate status in one pass.","useCase":"An agent needs to verify an API is up and properly configured before making production calls: is it reachable (status + latency), what do the response headers say (rate limits, auth requirements, CORS), and is the TLS cert valid and not expiring soon?","toolSlugs":["http-check","http-headers","tls-cert"],"workflow":["Call http-check to verify the endpoint is reachable - status code, response time, redirect chain.","Call http-headers to inspect the response headers - rate limit headers, auth requirements, CORS policy, cache directives.","Call tls-cert with the host extracted from the URL to check certificate validity, issuer, expiry, and chain trust."],"claudePrompt":"Check the health of https://api.github.com using Agent402's api-health skill pack: (1) http-check for liveness and latency, (2) http-headers for rate limits and security headers, (3) tls-cert for certificate status. Report whether the endpoint is production-ready.","promptArgs":[{"name":"url","description":"API endpoint URL to check (https://…)","required":true}]},{"slug":"world-data","title":"World Bank country data","tagline":"GDP and population for a country - two key World Bank indicators in one call.","useCase":"An agent needs basic economic context for a country: what's the GDP and how many people live there? These are the two most-requested World Bank indicators and together they give GDP per capita as a derived metric.","toolSlugs":["world-bank-indicator","world-bank-indicator","world-bank-indicator"],"workflow":["Call world-bank-indicator with country and indicator='NY.GDP.MKTP.CD' to get GDP (current USD).","Call world-bank-indicator with country and indicator='SP.POP.TOTL' to get total population.","Call world-bank-indicator with country and indicator='FP.CPI.TOTL.ZG' to get inflation (annual consumer-price %) - the price-stability read that turns a raw GDP + population snapshot into economic context."],"claudePrompt":"Get key indicators for the US using Agent402's world-data skill pack: (1) World Bank GDP NY.GDP.MKTP.CD, (2) population SP.POP.TOTL, (3) inflation FP.CPI.TOTL.ZG. Compute GDP per capita and note the inflation backdrop.","promptArgs":[{"name":"country","description":"ISO 3166-1 alpha-2 country code (e.g. US, GB, JP)","required":true}]},{"slug":"fred-snapshot","title":"Fed economic snapshot","tagline":"Key Federal Reserve economic indicators - fed funds rate, unemployment, and CPI - in one call.","useCase":"An agent providing economic context needs the three most-watched Fed indicators: where rates are (FEDFUNDS), how tight the labor market is (UNRATE), and where inflation stands (CPIAUCSL). Three FRED series calls bundled into one payment.","toolSlugs":["fred-series","fred-series","fred-series"],"workflow":["Call fred-series with series='FEDFUNDS' to get the effective federal funds rate.","Call fred-series with series='UNRATE' to get the unemployment rate.","Call fred-series with series='CPIAUCSL' to get the Consumer Price Index for All Urban Consumers."],"claudePrompt":"Get a Fed economic snapshot using Agent402's fred-snapshot skill pack: (1) FEDFUNDS - current rate, (2) UNRATE - unemployment, (3) CPIAUCSL - CPI. Summarize the macro picture: is the Fed tightening or easing, and what does the jobs/inflation combo suggest?","promptArgs":[]},{"slug":"contact-verify","title":"Contact verification","tagline":"Verify an email address is deliverable - syntax validation plus MX record check on the domain.","useCase":"An agent collecting contact information needs to verify an email before storing it or sending to it: does the address pass syntax validation, and does the domain actually have mail servers? Catches typos, disposable domains, and dead mailboxes.","toolSlugs":["email-validate","dns-lookup","spf-check"],"workflow":["Call email-validate to check syntax, domain existence, and mailbox reachability.","Call dns-lookup with host=<domain from email> and type='MX' to independently verify the domain has mail exchange records.","Call spf-check on the domain - a domain that publishes a valid SPF record is configured for legitimate sending, an added deliverability signal beyond MX (and a hint the domain isn't a throwaway)."],"claudePrompt":"Verify the email address test@gmail.com using Agent402's contact-verify skill pack: (1) email-validate for syntax and reachability, (2) dns-lookup for MX records on gmail.com, (3) spf-check on gmail.com. Report whether the address is likely deliverable and whether the domain is properly configured for sending.","promptArgs":[{"name":"email","description":"Email address to verify (e.g. test@gmail.com)","required":true}]},{"slug":"domain-age","title":"Domain age and legitimacy","tagline":"How old and legit is this domain? WHOIS registration, DNS resolution, and TLS certificate in one pass.","useCase":"An agent evaluating a website's trustworthiness needs the basic legitimacy signals: how old is the registration (new domains are higher risk), does it resolve to a real IP, and is the TLS cert valid? Useful for fraud detection, link safety checks, and vendor due diligence.","toolSlugs":["whois","dns-lookup","tls-cert"],"workflow":["Call whois to get registration date, registrar, expiry, and age - domains less than 6 months old are higher risk.","Call dns-lookup with host=domain and type='A' to verify the domain resolves to a real IP address.","Call tls-cert with host=domain to check the certificate issuer, validity period, and chain trust."],"claudePrompt":"Check the age and legitimacy of google.com using Agent402's domain-age skill pack: (1) whois for registration age and registrar, (2) dns-lookup for A record resolution, (3) tls-cert for certificate validity. Report a trust assessment based on age, DNS health, and cert status.","promptArgs":[{"name":"domain","description":"Domain to check (e.g. google.com)","required":true}]},{"slug":"contract-audit","title":"Contract audit","tagline":"Triage a smart contract before an agent interacts with it: verified Solidity source, heuristic vulnerability scan, known-address check, function-selector resolution, and a read-only dry-run of the exact call you plan to make.","useCase":"An agent is about to approve, transfer, or call an unfamiliar contract - you want the verified Solidity source scanned for red flags, the address checked against known labels, and the intended calldata simulated before anything is signed or broadcast: the first pass a smart-contract auditor would run.","toolSlugs":["contract-source","solidity-scan","selector-lookup","address-label","tx-simulate"],"workflow":["Fetch the verified Solidity source and compiler metadata from Sourcify via contract-source - an unverified contract is itself a finding.","Run solidity-scan over the returned source for line-anchored heuristic findings: tx.origin auth, delegatecall, selfdestruct, unchecked calls, weak randomness, and more.","Resolve the 4-byte selector of the calldata you plan to send with selector-lookup so you know exactly which function it hits.","Check the address against the curated known-address dataset with address-label - is this the real token/router/bridge or an impostor?","Dry-run the exact call with tx-simulate (eth_call + gas estimate, strictly read-only) to see whether it succeeds or reverts before anything is signed."],"claudePrompt":"Audit the contract 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 on base before interacting with it, using Agent402's contract-audit skill pack. (1) Fetch the verified source from Sourcify, (2) run the heuristic Solidity scan over it, (3) resolve the selector of the planned calldata 0x70a08231000000000000000000000000abf4fabd7c416fb67202e5f9002389fc75e2a9d0, (4) check the address against known labels, (5) simulate the call read-only. Report: verification status, scan findings by severity, what the calldata does, whether the address is a known contract, and the dry-run verdict.","promptArgs":[{"name":"address","description":"0x-prefixed contract address to audit","required":true},{"name":"network","description":"EVM network (ethereum / base / polygon / arbitrum / optimism, default base)","required":false},{"name":"data","description":"0x-prefixed calldata you intend to send (default: a balanceOf probe)","required":false}]},{"slug":"tx-forensics","title":"Transaction forensics","tagline":"Explain what an EVM transaction actually did: confirmation status, the raw transaction from the chain, decoded calldata with typed parameters, the resolved function signature, and labeled counterparties.","useCase":"An agent (or its owner) is staring at a transaction hash and needs the plain-English story - did it confirm, which function was called, with what arguments, and is the counterparty a known contract or an unknown address.","toolSlugs":["tx-status","evm-rpc","calldata-decode","selector-lookup","address-label"],"workflow":["Get the confirmation verdict from tx-status - success, revert, or still pending, plus gas used and block number.","Pull the raw transaction with evm-rpc eth_getTransactionByHash for the from/to addresses, value, and the input calldata.","Decode the calldata with calldata-decode - function name and typed parameters via ABI signature databases.","Cross-check the 4-byte selector with selector-lookup to surface every known signature that matches.","Label the counterparty with address-label - known token contract, DEX router, bridge, exchange wallet, or unknown."],"claudePrompt":"Explain what transaction 0x0000000000000000000000000000000000000000000000000000000000000000 on base actually did, using Agent402's tx-forensics skill pack. (1) Check its confirmation status, (2) fetch the raw transaction via eth_getTransactionByHash, (3) decode the calldata into the function and arguments, (4) resolve the selector against the signature databases, (5) label the destination address. Summarize as a plain-English story: what was called, with what arguments, by whom, to whom, and whether it succeeded.","promptArgs":[{"name":"hash","description":"0x-prefixed 32-byte transaction hash","required":true},{"name":"network","description":"EVM network (ethereum / base / polygon / arbitrum / optimism, default base)","required":false}]},{"slug":"market-open","title":"Market open brief","tagline":"Full pre-trade snapshot for one ticker before the bell: the live quote, the pre-market quote, the options surface, dividend posture, and today's market-wide earnings calendar - one payment.","useCase":"An agent positioning ahead of the open needs everything that moves a pre-trade decision: where the stock closed, where pre-market has taken it, what the options chain implies, whether a dividend is imminent, and which earnings prints hit the tape today.","toolSlugs":["stock-quote","premarket-quote","options-chain","stock-dividends","earnings-calendar"],"workflow":["Get the live quote from stock-quote - last price, day range, 52-week range, volume.","Pull the pre-market quote from premarket-quote - where the stock is trading before the bell and the gap versus the prior close.","Fetch the options chain from options-chain - strikes, bids/asks, and implied volatility for the nearest expiry.","Check dividend posture with stock-dividends - recent payouts and whether an ex-dividend date is close.","Pull today's market-wide earnings calendar from earnings-calendar - every company reporting today, so no print ambushes the open."],"claudePrompt":"Build a pre-open trading brief for AAPL using Agent402's market-open skill pack. (1) Get the live quote, (2) get the pre-market quote and compute the gap, (3) pull the options chain for the nearest expiry, (4) check recent dividends and any upcoming ex-date, (5) pull today's market-wide earnings calendar to see which prints hit the tape today. Summarize: current positioning, pre-market signal, what implied vol says, dividend posture, and today's notable earnings reports.","promptArgs":[{"name":"ticker","description":"Stock ticker (e.g. AAPL, NVDA, SPY)","required":true}]},{"slug":"entity-enrich","title":"Entity enrichment","tagline":"Company name → verified identity + web footprint dossier: Wikidata facts, the official LEI legal-entity record, the SEC EDGAR filer, domain registration, tech stack, and brand favicon - in one pass.","useCase":"KYB, lead enrichment, or counterparty checks - an agent has a company name (maybe a domain and ticker) and needs to establish that the entity is real, who it legally is, and what its web presence looks like.","toolSlugs":["wikidata-entity","lei-lookup","edgar-company-lookup","whois","tech-stack","favicon-grab"],"workflow":["Resolve the name to a Wikidata entity with wikidata-entity - the encyclopedic identity: what it is, founding date, headquarters, official website.","Look up the Legal Entity Identifier record with lei-lookup (GLEIF) - the verified legal name, jurisdiction, and registered address.","Find the SEC EDGAR filer with edgar-company-lookup - CIK number and filing history existence (public companies only).","Pull domain registration with whois - creation date, registrar, and expiry; a week-old domain claiming a decades-old brand is a red flag.","Fingerprint the site's tech-stack - CMS, framework, CDN - the operational footprint.","Grab the favicon with favicon-grab as the brand asset for the dossier card."],"claudePrompt":"Build an identity dossier on Apple (domain apple.com, ticker AAPL) using Agent402's entity-enrich skill pack. (1) Resolve the Wikidata entity, (2) look up the LEI legal-entity record, (3) find the SEC EDGAR filer, (4) pull whois on the domain, (5) fingerprint the tech stack, (6) grab the favicon. Report as a KYB-style dossier: verified legal identity, public-company status, domain age vs claimed history, and web footprint - flag any mismatches.","promptArgs":[{"name":"name","description":"Company name to enrich (e.g. Apple)","required":true},{"name":"domain","description":"Company website domain (e.g. apple.com)","required":false},{"name":"ticker","description":"Stock ticker for the SEC EDGAR lookup (e.g. AAPL)","required":false}]},{"slug":"feed-watch","title":"Feed watch","tagline":"Monitor an RSS/Atom feed in one call: parse the feed, read the top story in full, extract the keywords driving the cycle, and diff the item list against your last run to isolate what's new.","useCase":"An agent on a monitoring loop - news, changelogs, security advisories, competitor blogs - needs each run to answer: what changed since last time, and what is it about?","toolSlugs":["feed-parse","extract","keywords","text-diff"],"workflow":["Parse the feed with feed-parse - titles, links, publish dates, and summaries for the latest items.","Extract the top item's linked page in full with extract - the actual story, not just the teaser.","Run keywords over the combined titles and summaries to surface what the current cycle is about.","Diff the current item list against your previous snapshot with text-diff - the added lines are the new items since last run."],"claudePrompt":"Monitor the feed https://hnrss.org/frontpage using Agent402's feed-watch skill pack. (1) Parse the feed for the latest items, (2) extract the top story's full text, (3) pull keywords from the titles and summaries, (4) diff the current item-title list against PREVIOUS_SNAPSHOT (paste your last run's list; leave empty on the first run). Report: new items since last run, the dominant topics, and a two-sentence summary of the top story.","promptArgs":[{"name":"url","description":"RSS/Atom feed URL to monitor","required":true},{"name":"previous","description":"The item-title list from your previous run (one per line) to diff against","required":false}]},{"slug":"subtitle-pipeline","title":"Subtitle pipeline","tagline":"Audio URL → finished subtitles in one call: transcribe the audio, emit the transcript as SRT/WebVTT/JSON cues, and report the text statistics - length, reading time, word count.","useCase":"An agent processing podcasts, voice notes, or video audio needs shippable subtitle files plus the stats to budget downstream steps (summarization, translation, chapters) - without stitching three tools by hand.","toolSlugs":["transcribe","srt-convert","text-stats"],"workflow":["Transcribe the audio with transcribe - OpenAI speech-to-text with language detection and duration.","Convert the transcript into subtitle cues with srt-convert in your chosen format (SRT, WebVTT, plain text, or JSON cues).","Run text-stats over the transcript - word count, sentence count, and estimated reading time for downstream budgeting."],"claudePrompt":"Turn the audio at https://upload.wikimedia.org/wikipedia/commons/c/c8/Example.ogg into subtitles using Agent402's subtitle-pipeline skill pack. (1) Transcribe the audio, (2) convert the transcript to vtt subtitles, (3) get the text statistics. Return the subtitle file content, the detected language and duration, and the word count.","promptArgs":[{"name":"url","description":"Public URL of the audio file to transcribe","required":true},{"name":"format","description":"Subtitle output format: srt | vtt | text | json (default vtt)","required":false}]},{"slug":"locale-brief","title":"Locale brief","tagline":"\"Can I reach this counterparty this week?\" - country facts, this year's public holidays, working days remaining this week, and what time it is there right now, in one call.","useCase":"An agent scheduling outreach, deliveries, or meetings across borders needs the practical local picture: currency and languages, whether a public holiday lands this week, how many business days are left, and the current local time.","toolSlugs":["country-info","public-holidays","business-days","timezone-convert"],"workflow":["Get the country facts from country-info - capital, currency, languages, calling code, and timezones.","Pull this year's public holidays with public-holidays (keyed off the country code from step 1) and check which land in the next 7 days.","Count the working days in the coming week with business-days.","Convert the current UTC time into the country's primary timezone with timezone-convert - is it business hours there right now?"],"claudePrompt":"Tell me whether I can realistically reach a counterparty in Japan this week, using Agent402's locale-brief skill pack. (1) Get the country facts (currency, languages, timezone), (2) pull this year's public holidays and flag any in the next 7 days, (3) count the business days remaining this week, (4) convert the current time to the local timezone. Answer: local time now, holidays in the window, working days available, and the best contact window in my timezone.","promptArgs":[{"name":"country","description":"Country name (e.g. Japan, Germany, Brazil)","required":true}]}]}