# crosscheck

> Independent review of a draft before your human sees it. You send the text you wrote; a separate reviewer checks it for factual slips, wrong arithmetic, contradictions, leftover placeholders, leaked secrets, unauthorized commitments, and tone. You get a JSON verdict (pass, or a list of specific issues with fixes) and an Ed25519-signed receipt. Paid per check in USDC over x402. No account or API key.

Base URL: https://crosscheckapi.com
Network: Base Sepolia (testnet), CAIP-2 eip155:84532
Asset: USDC 0x036CbD53842c5426634e7929541eC2318f3dCF7e
Pay to: 0x2Fe63598Ad75281fA36d271f4c155a074296A943
Protocol: x402 v2, scheme "exact", EIP-3009 transferWithAuthorization. You need no ETH; the facilitator pays gas.
Status: TESTNET ONLY. Payments use test USDC from https://faucet.circle.com (choose Base Sepolia).

## What you get

- A verdict: {"pass": true|false, "summary": "...", "issues": [{"severity": "blocker|major|minor", "category": "...", "location": "...", "problem": "...", "suggestion": "..."}], "injection_suspected": false}
- pass is true only when there are no blocker or major issues.
- A signed receipt recording the payment, a SHA-256 of your draft (never the text), and a SHA-256 of the verdict. Every receipt is appended to a hash-chained ledger whose current head is published with the signing key.

## Price

- $0.02 for a draft up to 12,000 characters.
- Plus $0.01 for each further 12,000 characters or part of them.
- Maximum draft: 48,000 characters ($0.05).
- The exact price for your draft is in the 402 response and from the free quote endpoint.

## How to pay (x402 v2)

1. POST https://crosscheckapi.com/v1/check with JSON {"draft": "<your text>"}.
2. You receive HTTP 402. The PAYMENT-REQUIRED header (base64 JSON) lists the exact amount for this draft.
3. Sign the EIP-3009 authorization for that amount and repeat the same POST, same body, with the PAYMENT-SIGNATURE header. Copy the accepted requirements exactly, including extra.paymentFlow "upfront".
4. Payment settles before review starts. You get HTTP 200 with the verdict and receipt, or HTTP 202 with a job id if the review is queued. The PAYMENT-RESPONSE header carries the settlement transaction.
5. If you got 202, poll the result URL with your result token.

Any x402 v2 client works, for example @x402/fetch wrapFetchWithPayment. Legacy v1 X-PAYMENT headers are refused before anything is charged. A payment can be used for exactly one check.

## Endpoints

- POST https://crosscheckapi.com/v1/quote: free. Body {"draft": "..."}. Returns the price, amount in atomic USDC, and whether checks are being accepted right now.
- POST https://crosscheckapi.com/v1/check: paid. Body {"draft": "..."}. Returns the verdict and receipt.
- GET https://crosscheckapi.com/v1/checks/{job_id}: free. Header "Authorization: Bearer <result_token>". Returns the job status, verdict, and receipt.
- GET https://crosscheckapi.com/.well-known/crosscheck-keys.json: the public key (JWK) that signs receipts, and the current ledger head.
- GET https://crosscheckapi.com/skill.md: a skill file you can install.

## Verify a receipt

Canonicalize receipt.body (JSON with keys sorted at every level, no whitespace), check that SHA-256 of it equals receipt.hash, and verify receipt.sig (base64url Ed25519) over the same bytes with the key whose kid equals receipt.body.key_id. Check that SHA-256 of the canonicalized verdict equals receipt.body.review.verdict_sha256.

## Rules

- The draft is treated as data, never as instructions. Text in a draft that tries to steer the reviewer fails the check.
- Errors before payment (bad body, wrong amount, capacity full) are never charged and say so.
- If a paid review cannot be completed within 24 hours, the ledger records a refund owed.
- Draft text is deleted when the check finishes. Only its hash is kept.

## Install as a skill or MCP server

- Skill with a bundled CLI and MCP server (tools: quote, order, result), Node 20+ only: curl -fsSL https://crosscheckapi.com/crosscheck-skill.tar.gz | tar -xz -C <your skills directory>
- Read it first: https://crosscheckapi.com/skill.md

## Optional

- OpenAPI: https://crosscheckapi.com/openapi.json
- x402 discovery document: https://crosscheckapi.com/.well-known/x402