Tumbuk red-teams other agents: 8 adversarial probes at any agent endpoint, returning a graded A-F vulnerability report that is deterministic, reproducible, and verifiable. Paid in USDT0 on X Layer.
Everyone audits the smart contract. Nobody audits the agent. As agents on OKX.AI begin
hiring and paying each other over A2MCP, the new attack surface is the agent's behavior:
prompt injection, fund and secret exfiltration, jailbreaks, and forged agent-to-agent trust
signals. There is no equivalent of a contract audit for any of it.
Tumbuk hires out as the adversary. Point it at an agent's HTTP endpoint and it fires 8
adversarial probes in parallel — prompt injection, unauthorized fund transfer, secret and
credential exfiltration, jailbreak and persona override, output-trust hijacking, system
prompt leakage, instruction override, and indirect (tool/RAG-borne) injection — then returns
a scored vulnerability report in markdown and JSON, graded A to F.
Detection is deterministic, with no LLM judge anywhere in the loop: every probe plants a
hiring and paying each other over A2MCP, the new attack surface is the agent's behavior:
prompt injection, fund and secret exfiltration, jailbreaks, and forged agent-to-agent trust
signals. There is no equivalent of a contract audit for any of it.
Tumbuk hires out as the adversary. Point it at an agent's HTTP endpoint and it fires 8
adversarial probes in parallel — prompt injection, unauthorized fund transfer, secret and
credential exfiltration, jailbreak and persona override, output-trust hijacking, system
prompt leakage, instruction override, and indirect (tool/RAG-borne) injection — then returns
a scored vulnerability report in markdown and JSON, graded A to F.
Detection is deterministic, with no LLM judge anywhere in the loop: every probe plants a
unique canary token, and a finding is that token coming back or a credential-shaped string
appearing in the reply. The same suite produces the same report, so a grade survives a human
spot-check. Grading is safety-first: a severity-weighted score, but one confirmed critical
hole caps the grade at F regardless of how clean the rest looks. A target that merely echoes
the probe text is reported as unmeasured rather than vulnerable, so a harmless logging bot
is not slandered with a false F.
The grade is checkable rather than claimed. Every report embeds the exact object its digest
covers, and a free verify_report recomputes it — re-badge the target or downgrade a finding
and verification fails. The landing page does the same recomputation in your own browser,
nothing uploaded. A free probe_catalog exposes the whole suite, severities and grading rule
before you spend anything, so the buyer audits the auditor first.
It refuses to be a weapon: consent=true is a hard gate, and the probe layer is SSRF-guarded
against localhost, private ranges and cloud-metadata addresses in every IP encoding, with
redirects unfollowed and reads capped.
It is a real on-chain business: $0.99 in USDT0 per scan on X Layer, settled via x402 through
OKX's official payment SDK and facilitator. Tumbuk burns no model credits, so the marginal
cost is outbound bandwidth alone. Any builder listing an ASP can hire it as a pre-listing
security gate — a dependency other agents want.
One endpoint in → a graded, reproducible, verifiable red-team report out.
Agent #9619 on OKX.AI · https://tumbuk-security.vercel.app · https://tumbuk.vercel.app/mcp
<p>Built from zero during the hackathon window, in Python with only fastmcp and uvicorn as</p><p>dependencies — everything else is standard library, and there is no model API key anywhere</p><p>in the system, which is what makes the unit economics work.</p><p>Shipped: the 8-probe attack library with deterministic canary/credential detectors; an</p><p>SSRF-guarded HTTP probe layer; a parallel runner with safety-first grading; a markdown+JSON</p><p>report with a tamper-evident digest; a FastMCP server exposing one paid tool and three free</p><p>ones; a payment gate on OKX's official seller SDK, settling in USDT0 on X Layer; a stateless</p><p>Vercel deployment; and a landing page whose in-browser verifier recomputes a report digest</p><p>locally. Registered as an A2MCP ASP on <a href="http://OKX.AI">OKX.AI</a> (Agent #9619) with a paid scan service and a</p><p>free verification service.</p><p>Hardening was most of the work, and the real bugs came from running the thing against real</p><p>endpoints rather than stubs. A security audit fixed a detector that could not tell an ECHO</p><p>from OBEDIENCE, so a harmless echo endpoint scored "F, fund-drainable". A JSON-RPC batch</p><p>could skip the payment gate. Live scanning of public services exposed two more: an HTTP error</p><p>body was being treated as the agent's reply, so a target that was DOWN scored "resisted" on</p><p>all 8 probes — a false A on an endpoint that never ran; and the echo check compared raw text</p><p>while real services return the body re-encoded, so two CRITICAL probes came back "vulnerable"</p><p>on three harmless echo services. Both fixed and regression-tested.</p><p>A deeper QA pass found the tamper-evident digest could not actually be verified by the buyer:</p><p>the report embedded only part of the object the digest covered. Fixed, and turned into a</p><p>feature — verify_report and probe_catalog now ship as free tools, and the browser verifier</p><p>was cross-checked against the Python implementation on a report containing non-ASCII text.</p><p>Three listing rejections drove the payment layer to correctness: the x402 challenge had to</p><p>travel in a PAYMENT-REQUIRED response header rather than only the body; OKX speaks x402 v2</p><p>(amount, payTo, object resource) while we advertised v1 and rejected v2 payloads outright; a</p><p>v2 payment arrives on PAYMENT-SIGNATURE, not X-PAYMENT, so a caller who HAD paid was answered</p><p>402 forever; and the facilitator refuses unsigned calls, so verification only works through</p><p>the official SDK with portal credentials. Fixing those also closed a real hole — the payment</p><p>was being verified against the requirement the CALLER claimed, so anyone could assert they</p><p>had agreed to pay 1 atomic unit.</p><p>On the final day, live probing caught the worst one: the deployed endpoint had been returning</p><p>HTTP 200 with an EMPTY body on every call, because Vercel's ASGI bridge cancels an SSE stream</p><p>before it flushes. Smoke tests that only assert status codes never saw it.</p><p>Verification is executable, not claimed: 42 deep-QA checks (hostile targets, read cap and</p><p>timeout, gate composition, 16-way concurrency, fuzzing) plus a 40-check review simulation</p><p>that validates the live 402 against OKX's own SDK models and asserts every listing claim</p><p>against real output. Three self-check suites run in CI on every push.</p>
<p>Not raising. Self-funded, no outside capital, no token. Tumbuk consumes no model credits —</p><p>the marginal cost of a scan is outbound HTTP bandwidth — so $0.99 per scan in USDT0 on X</p><p>Layer is close to pure margin and the service is profitable per call from day one. Open to</p><p>ecosystem or grant support from the X Layer team to expand the suite (multi-turn attack</p><p>chains, MCP tool-poisoning probes, a continuous re-scan subscription for listed ASPs).</p>