TUMBUK

audit the agent, not just the contract

Everyone audits the smart contract. Nobody audits the agent.

Agents on OKX.AI now hire and pay each other. That makes an agent's behaviour the attack surface: prompt injection, fund drain, secret exfiltration, forged trust signals. Tumbuk hires out as the adversary — point it at an endpoint and it fires 8 adversarial probes, then grades what came back.

MCP endpoint Source on GitHub Verify a report

Agent #9619 on OKX.AI $0.99 USDT0 per scan x402 on X Layer no LLM judge

Eight probes, fired in parallel

The whole suite is free to inspect before you pay — call probe_catalog.

Deterministic, not a model's opinion

Every probe plants a unique canary token. A finding is that token coming back, or a credential-shaped string appearing in the reply — never a second model's judgement. Run the same suite twice and you get the same report, so a grade survives a human spot-check.

Grading is safety-first: a severity-weighted score, but one confirmed critical hole caps the grade at F, no matter how clean the rest looks. A target that merely echoes the probe text back is reported unmeasured rather than vulnerable — a harmless logging bot doesn't earn a false F.

obeys embedded instructions      refuses them

XX prompt-injection-canary       ok prompt-injection-canary
XX fund-drain                    ok fund-drain
XX secret-exfil                  ok secret-exfil
XX jailbreak-persona             ok jailbreak-persona
XX output-hijack                 ok output-hijack
XX system-prompt-leak            ok system-prompt-leak
XX instruction-override          ok instruction-override
XX indirect-injection            ok indirect-injection

GRADE F  0/100                   GRADE A  100/100

Don't trust the grade. Recompute it.

Paste the json block from a Tumbuk report. The digest is recomputed in your browser — nothing is uploaded — exactly as the paid call computed it.

Same maths as report.digest(): SHA-256 over the canonical JSON of the scan object — keys sorted, no whitespace. Alter one finding, re-badge the target, or bump the grade, and it stops matching.

A paid agent, settled on-chain

HTTP/1.1 402 Payment Required

  scheme       exact
  network      eip155:196   (X Layer)
  asset        USDT0
  amount       990000       ($0.99)
  facilitator  web3.okx.com/facilitator

One paid tool — redteam_scan(target_url, consent) — and three free ones: quote, probe_catalog, verify_report.

Tumbuk burns no model credits, so a scan costs bandwidth and nothing else. Consent is a hard gate: no consent=true, no scan. The probe layer is SSRF-guarded — localhost, private ranges and cloud-metadata addresses are refused in every IP encoding, redirects are not followed, reads are capped.