{"policy_version":"1","service":"PayCheck","suite":"toolweather","summary":"Start at 100 and subtract the penalties below. Hard blocks cap the score and force verdict block. Verdict trusted is allowed only for an allowlisted host served over https on port 443. Wallets are never trusted in v1.","determinism":"amount_usd, category, purpose, and any other free-text field are discarded. They are not scored and they are not stored. Repeating a check with different wording cannot change the verdict.","does_not":"PayCheck does not send payments, does not sign transactions, and does not hold wallet keys. PAY_TO only receives the optional x402 micropayment for an over-cap check.","verdicts":{"trusted":"Allowlisted https host on port 443. recommended_action proceed.","unknown":"No hard block and score >= 70, but not on the allowlist. recommended_action verify_out_of_band.","suspicious":"Score 40–69, or a soft signal such as a young domain, heavy hyphenation, or brand impersonation. recommended_action require_human_review.","block":"Hard rule or score under 40. recommended_action do_not_pay."},"hard_rules":["Missing target caps the score at 5 and blocks.","Non-https schemes, raw IP hosts, localhost, and private addresses block.","URL userinfo (user:pass@host) blocks.","Denylist domains, scam-name patterns, and bad TLDs block.","Typosquats of allowlist brands block: homoglyph or leetspeak fold equal to the brand, one insertion or deletion, an adjacent transposition, or a confusable single-character substitution.","Domain age under 2 days blocks (cap 20). Age is never invented. A failed RDAP lookup is unknown, not zero.","A brand-new or random domain is never trusted, even with a high score.","0x wallets: invalid hex blocks, burn and zero addresses block, every other address is unknown. There is no chain analysis in v1."],"penalties":{"age_under_2_days":{"cap":20,"verdict":"block"},"age_under_7_days":{"subtract":55,"effect":"suspicious"},"age_under_30_days":{"subtract":35,"effect":"suspicious"},"age_under_180_days":{"subtract":8,"effect":"small"},"age_180_days_or_more":{"subtract":0,"effect":"no age penalty; still not trusted unless allowlisted"},"age_unknown":{"subtract":12,"effect":"unknown, not trusted"},"hyphen_count_at_least_3":{"subtract":22,"effect":"forces suspicious (score capped at 69)"},"brand_impersonation":{"subtract":45,"effect":"forces suspicious"},"unicode_or_punycode_lookalike":{"subtract":40,"effect":"forces suspicious; homoglyph of a brand blocks"},"unusual_port":{"subtract":15,"effect":"not trusted; forces suspicious"},"embedded_wallet_in_url":{"subtract":15,"effect":"host is scored, not the address; cannot be trusted"},"ens_name":{"subtract":30,"effect":".eth is not resolved in v1; forces suspicious"},"wallet_unanalyzed":{"subtract":20,"effect":"unknown"},"allowlist_floor":92},"caps":{"missing_target":5,"invalid_wallet":0,"burn_address":0,"non_https":12,"raw_ip":8,"local_or_private":5,"url_userinfo":10,"unsupported_scheme":10,"bad_tld":15,"denylist":5,"typosquat":8},"allowlist":["openai.com","anthropic.com","stripe.com","github.com","cloudflare.com","vercel.com","supabase.com","google.com","googleapis.com","microsoft.com","azure.com","amazon.com","nvidia.com","huggingface.co","replicate.com","groq.com","mistral.ai","cohere.com","together.ai","fireworks.ai","openrouter.ai","deepseek.com","x.ai","perplexity.ai","notion.com","slack.com","linear.app","sentry.io","twilio.com","npmjs.com","docker.com","gitlab.com","atlassian.com","shopify.com","paypal.com","coinbase.com","etherscan.io","alchemy.com","infura.io","cursor.com"],"denylist_domains":["metamask-support.com","metamask-wallet.io","wallet-connect-secure.com","claim-airdrop.com","free-usdc.com","openai-login.com","stripe-secure-pay.com","github-verify-login.com","coinbase-wallet-secure.com"],"denylist_patterns":[{"code":"airdrop_bait","reason":"Hostname matches an airdrop-bait pattern."},{"code":"seed_phrase","reason":"Hostname matches a seed-phrase phishing pattern."},{"code":"wallet_connect_phish","reason":"Hostname matches a wallet-connect phishing pattern."},{"code":"free_crypto","reason":"Hostname matches a free-crypto bait pattern."},{"code":"claim_crypto","reason":"Hostname matches a claim-crypto bait pattern."}],"bad_tlds":["tk","ml","ga","cf","gq","zip","mov"],"wallet":{"chain_analysis":"not_in_v1","checksum":"EIP-55 is not validated in v1. Any 40 hex characters are accepted.","burn_addresses":["0x0000000000000000000000000000000000000000","0x000000000000000000000000000000000000dead","0xffffffffffffffffffffffffffffffffffffffff"]},"domain_age":{"source":"RDAP via https://rdap.org (public, no API key)","cache_ttl_days":7,"failure_cache_ttl_hours":24,"never_invent_age":true,"allowlist_skips_lookup":true},"quota":{"anonymous_per_utc_day":100,"free_key_per_utc_day":1000,"bundle_hex_client_per_utc_day":1000,"bundle_anon_prefix_per_utc_day":100,"key_mints_per_ip_per_utc_day":10,"idempotent_window_seconds":60,"billed_operation":"check_merchant and POST /v1/check only","free_operations":["get_quota","get_api_key","GET /v1/policy","GET /health","docs","MCP discovery"]},"x402":{"price_usd":"0.001","amount_atomic":"1000","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","asset_symbol":"USDC","network":"eip155:8453","scheme":"exact","facilitator":"https://facilitator.payai.network","pay_to":"Worker secret PAY_TO. Unset deployments return 402 payment_not_configured."},"bundle":{"secret_header":"x-tw-bundle-secret","client_header":"x-tw-bundle-client","secret_env":"BUNDLE_PROXY_SECRET","hex_client":"16 or more hex characters → 1,000/day","anon_prefix":"client id anon or anon:… → 100/day","other_client":"any other id → 100/day"}}