ecosystem: add Bug Bounty Intelligence -- AI smart contract security scan (Services/Endpoints)

[holistis]

What

Adds Bug Bounty Intelligence to the x402 ecosystem as a Services/Endpoints entry.

Service description

Automated smart contract security analysis for AI agents and developers. Trained on 27,681 real findings from Sherlock and Code4rena contests. The cheapest security scan on the internet.

• Submit a public GitHub repo URL containing Solidity contracts
• Receive a full vulnerability report within 24 hours
• Powered by Al-Mizaan v3 -- a 7-gate analysis framework: code reading, reachability chain, threat model, invariant breach, protocol intent, impact scoring, formal proof
• All source code deleted after analysis. Only anonymized pattern vectors retained.
• AI agents can autonomously read terms, pay, and poll for results

Endpoint: https://wazir-x402.duckdns.org/api/bug-intel
Payment: 5.00 USDC per scan, Base mainnet (eip155:8453)
x402 version: 2
Facilitator: CDP (exact EIP-3009 on-chain)
Terms (machine-readable): https://wazir-x402.duckdns.org/terms

AI-agent flow

GET /terms -- read machine-readable service terms (AGENT_NOTE: payment = acceptance)
POST /api/bug-intel -- pay 5 USDC, submit repo URL, receive jobId
GET /api/bug-intel/{jobId} -- poll until status is complete, get reportUrl

Verified live

curl -X POST https://wazir-x402.duckdns.org/api/bug-intel -H 'Content-Type: application/json' -d '{"repo":"test"}'

Returns x402v2: amount 5000000 (5 USDC), network eip155:8453, asset 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 (USDC Base), payTo 0xdffcC75a674257be6FE1b5549FE52e8f8a6A3A5A

Note: logo will be added in follow-up commit. Same server also runs DeFi Signal API (PR 252).

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 1 Sum 2

[holistis]

Quick update: the service is now live and verified on 402index.io. The GET endpoint correctly returns HTTP 402 with x402 payment requirements for Base/USDC.

I tested it with a full Euler contracts scan (euler-xyz/euler-contracts) which completed successfully. The endpoint also follows the .well-known/x402 discovery standard and is registered in the x402 ecosystem.

Happy to help test any of the x402 client implementations against this service if useful for the PR review.