# AGENTS.md — grokzilla.shop / x402-micro-pay.com

Instructions for autonomous agents consuming this marketplace.

## Identity

- **Name:** Grokzilla x402 micro pay
- **Base URL:** https://grokzilla.shop (alias https://x402-micro-pay.com)
- **Protocol:** x402 v2 (USDC) + Stripe (humans)
- **Network:** eip155:8453 (Base mainnet)
- **USDC:** 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913
- **Billing:** paid only (`free_beta: false`)

## Discovery (do this first)

```http
- Catalog (JSON): https://grokzilla.shop/api/catalog
- Agents JSON: https://grokzilla.shop/agents.json
- OpenAPI: https://grokzilla.shop/openapi.json
GET https://grokzilla.shop/contracts/humanless.json
GET https://grokzilla.shop/health
```

## Payment flow

1. Call a skill endpoint without payment → expect **HTTP 402** with `PAYMENT-REQUIRED` header **and** JSON body (`accepts[]`).
2. Decode accepts[]: scheme=exact, network=eip155:8453, asset=USDC mainnet, amount, payTo.
3. Sign and attach payment proof; retry same request with `PAYMENT-SIGNATURE`.
4. On success, response includes resource JSON (+ optional PAYMENT-RESPONSE).

Humans: `POST /api/stripe/checkout` with `{ "skill_id", "payload" }`.

## Spend limits

Respect `max_spend_per_call` and `max_spend_per_session` in `/contracts/humanless.json`.

## Cheap deterministic utils ($0.003, POST, JSON body)

- `/api/skills/pii-redact` `{ "text" }` → `{ ok, redacted, counts_by_type }` (emails, phones, SSN-shaped, Luhn-valid cards, IPv4 → `[EMAIL]`, `[PHONE]`, `[SSN]`, `[CARD]`, `[IPV4]`)
- `/api/skills/csv-normalize` `{ "csv", "delimiter"? }` → `{ ok, headers, rows, row_count }` (snake_case headers; 400 on ragged rows / unparseable CSV)
- `/api/skills/base64` `{ "mode": "encode"|"decode", "text", "url_safe"? }` → `{ ok, output }` (400 on invalid base64)

Bad param types or values → 422 `invalid_params`; content errors → 400. Neither is charged. Free preflight: header `X-X402-Validate-Only: 1`.

## Epoch, web reading, token risk (POST, JSON body)

- `/api/skills/epoch-convert` ($0.003) `{ "value", "tz"? }` → `{ epoch_s, epoch_ms, iso_utc, iso_tz }` (seconds vs ms by magnitude, or ISO-8601; IANA tz, 400 `unknown_tz`; deterministic, no network)
- `/api/skills/url-to-markdown` ($0.003) `{ "url" }` → `{ ok, url, final_url, title, markdown, bytes, truncated }` (one public page; honors robots.txt for `grokzilla-url-to-markdown`; SSRF-guarded; HTML only; 1 MB / 5 s; no JavaScript rendering; own domains refused before payment)
- `/api/skills/token-risk` ($0.005) `{ "token", "chain": "base" }` → `{ ok, token, chain, risk_level: low|medium|high|unknown, checks: { contract_code, erc20_metadata, proxy, ownership, privileged_functions, liquidity_pool, sell_simulation, buy_simulation, transfer_tax }, disclaimer }` (read-only public Base RPC; each check has `result` pass/warn/fail/unknown and `evidence`; informational, not financial advice)

## AI content detector ($0.01, POST, JSON body)

- `/api/skills/ai-detector` `{ "text" }` or `{ "url" }` → `{ verdict: likely_ai|likely_human|uncertain|possible_ai_influence, ai_likelihood, caveats, ... }`. Trained classifier, about 78% accurate on a held-out benchmark; not a guarantee and not sole evidence. `uncertain` results suggest a rerun on a longer section (300+ words). Tell phrases are only a secondary "possible AI influence" signal.

## Do not

- Assume free access (beta is off).
- Ignore 402 challenges or pay on the wrong network (must be Base mainnet).
- Exceed humanless spend caps.