Compare each entry service date with its posting date against a period cutoff, and total what is in the wrong period. Reports work done before the cutoff and posted after it, which understates the period unless an accrual puts it back, and an amount posted inside the period for later service, which overstates it. An entry with no service date is reported as undeterminable rather than assumed to belong where it was posted.

Check that detail rows add up to the totals a summary declares, group by group. Sums are computed exactly on the decimal text, never through floating point: a float sum of 0.10 and 0.20 is 0.30000000000000004, so a tool built on one reports a false mismatch on the group that actually balances. Reports mismatches with the exact difference, groups with detail and no declared total, and totals with no detail at all.

Audit an HTTP response you captured against a contract you declare: expected status or status class, required and forbidden headers, header value rules, and a body schema. Header names compare case-insensitively. You supply the response, so this works against an API behind authentication or on a private network.

Judge a sequence of Avro schema versions against a named compatibility mode: BACKWARD, FORWARD or FULL, each with its transitive form, or NONE. A transitive mode compares every version against every earlier one; a per-step mode compares only the immediate predecessor, and the gap that leaves is stated rather than hidden. Every comparison performed is listed with its directional result, so a caller can see what was checked as well as the verdict.

Audit one Avro schema for what it makes impossible later. Reports a field with no default, which cannot be removed without breaking readers; a nullable field with no default; a null default where null is not the first union branch, which is invalid; an enum with no default, which makes adding a symbol permanently breaking; an absent namespace on a top-level record; a logical type on a base the specification disallows; and a binary float on a monetary field name.

Decide whether two Avro schemas are compatible, in both directions, under the resolution rules rather than by structural comparison. Backward is a reader on the new schema reading data already written with the old one; forward is a reader still on the old schema reading data written with the new one. Fields match by name with reader aliases consulted, int promotes to long, float and double one way only, and an enum symbol the reader lacks needs an enum default.

Match bank statement lines against ledger lines. References are matched before amounts, because a reference is an identity and an amount is not: matching on amount first pairs two unrelated lines that happen to agree and reports the real pair as unmatched. A reference match with a disagreeing amount or date is reported with the exact difference rather than discarded. With both balances supplied, the statement is also checked for agreeing with itself.

How settled is Base right now? Returns the latest and finalized block heights, how many confirmations the finalized head trails by, and both timestamps. Lets an agent decide whether a transaction is safe to treat as done, instead of guessing a confirmation count.

Is Base ready to transact right now? One call returns the current block height, gas price in wei and how many seconds old the chain head is, all read at the same block. Refuses before payment if the endpoint is on the wrong chain or its head is stale, so you are never charged for a reading that is quietly out of date.

Who owns this Base ERC721 token right now? Returns the current owner address at a pinned block. A token with no owner is refused before payment rather than returned as the zero address, which a caller could otherwise mistake for a real holder.

Read a Base token name, symbol, decimals and total supply in one call. Handles tokens that return a bytes32 name or symbol instead of a string, which is the case that breaks naive decoders. Fields the contract does not implement come back null and are listed, rather than guessed at. Refuses an address with no contract.

Did my Base transaction work and what did it cost? One call returns success or reverted, gas used, effective gas price, the fee in wei and in exact decimal ETH, confirmations behind the head, sender, recipient, value and log count. Pending and unknown hashes get a definite answer rather than an error.

Read a Base wallet native ETH balance and up to five ERC20 token balances at one pinned block. Separate balance lookups each answer at whatever height they happened to see, so they cannot be compared; these are all read at the same block and the block is in the response. Replaces six calls with one.

Watch up to ten reviewed public pages in one call. Supply the previous text hashes and it returns which pages actually changed, not ten hashes for you to compare. Hashes both the raw HTML and the visible text, so markup churn can be told from a real content change. A page that cannot be fetched is named individually and does not fail the batch.

Audit canonical and robots directives across a set of supplied pages together. Reports a canonical chain, where one page names another that names a third and crawlers do not follow reliably; pages consolidating onto a target that declares noindex; a page declaring noindex while naming itself canonical; an X-Robots-Tag header disagreeing with the markup, where which one wins is not under the page author control; a canonical crossing hosts; and pages with none at all. Nothing is fetched.

Compare the distribution of one categorical column between two datasets. Reports a category that appeared - which a consumer switching exhaustively on the column has no branch for - a category that vanished, and shares that moved beyond a tolerance. Shares are proportions of all rows including empty ones, so a rising empty rate is visible rather than hidden by renormalisation.

Audit a CI workflow for what it leaves movable or undeclared. Reports actions pinned to a tag rather than a commit - a tag can be moved by whoever owns the action, so the code a step runs can change without this file changing - missing permissions and timeouts, a job depending on one that is not declared, a pull_request_target trigger, and an expression interpolated straight into a shell command.

Compare two vintages of the same dataset and report where each column drifted. Covers columns added, removed and reordered, null-rate movement beyond a tolerance, a dominant type that changed, cardinality that moved, and a range that widened - which means values outside what anything downstream was built for, whatever the distribution looks like.

Company enrichment and KYB data for due diligence by domain: verify a counterparty, supplier or vendor before outreach, onboarding or payment. Returns firmographics (legal name, LEI, SEC CIK, industry, HQ, founded, employees), domain intelligence (age, email provider, SPF/DMARC), public role emails, socials, plus OFAC SDN and EU sanctions screening. Source-cited; unknowns null. Company data only, not personal contacts or compliance clearance. Unresolvable domains not charged.

Audit a Compose document against a contract. Reports an unpinned image tag, so the same file will produce a different container once the tag moves, a missing healthcheck or restart policy, a privileged or host-network service, added capabilities, host path mounts, a dependency on a service that is not declared, and an environment value written literally in the file rather than referencing a variable.

Parse Set-Cookie headers and report their attributes. Names cookies with no Secure, no HttpOnly or no SameSite; SameSite=None without Secure, which browsers reject so the cookie is never set at all; an unrecognised SameSite value, where the default applies instead; a lifetime beyond a stated maximum; an unexpected Domain; and a Domain attribute at all, which widens a cookie to every subdomain. No cookie value is returned, only its length.

Compare one logical record declared in two or three of Avro, protobuf and GraphQL, and report where the representations disagree. Names are matched with case and underscores set aside, since snake_case and camelCase across these formats is convention rather than disagreement. Reports a field present in one format and not another, a type class mismatch, disagreeing optionality or repeatedness, and enum symbol sets that differ.

Parse one Content-Security-Policy and report its structure, with the fallback rules applied. A fetch directive absent while default-src is present is reported as covered; base-uri and frame-ancestors do not fall back, so absence there is a finding. unsafe-inline alongside a nonce is reported differently from unsafe-inline alone, since supporting browsers ignore it. A repeated directive is reported because only the first takes effect. Structure only, not an assessment of adequacy.

Check that each amount can exist in the currency it names. Reports an amount needing more decimal places than its currency has, where a currency with no sub-unit cannot hold a fraction at all. Also reports an amount that arrived as a JSON number rather than a decimal string, since a binary double cannot hold most two-place decimals exactly, so the digits may already differ from what was written.

Check whether datasets that are meant to be disjoint share any keys. A key in both a training and an evaluation split means the evaluation is measuring memorisation, and every figure computed from it is optimistic. Reports overlap per pair with the share of the smaller set, since that is the one whose measurements are compromised, plus keys appearing in every dataset.

Reconcile two datasets you supply and get one answer plus every disagreement. Reports keys present on only one side, keys duplicated on either side, whether the join is really 1:1 or silently N:M, and field-level differences with the row number on each side. Numbers compare exactly on their decimal text, never through floating point, so 42.50 and 42.5 agree while 9007199254740992 and 9007199254740993 do not. A repeated key is compared as an unordered multiset. Nothing is fetched.

Triage a dead letter queue. Groups entries by failure reason, names the dominant cause when one accounts for most of the queue, and separates retryable failures from permanent ones so you know whether replaying will work or fail again. Reports the same item failing more than once, and entries stating no reason at all, which cannot be triaged by anybody.

Compare two dependency manifests and classify each move. Below 1.0.0 the versioning convention promises no stability, so a 0.x minor change is treated as potentially breaking - flagging only major bumps would miss the change that breaks most often. A range changing is reported as a change of intent rather than a version moving, and a dependency moving between a development and a runtime group is reported because it changes what ships.

Audit DKIM selector records. The key length follows from the length of the encoded public key, so a short RSA key is readable from the record itself with no cryptography. Reports a key shorter than a stated minimum; a selector left in testing mode, which asks receivers to treat a failure as unsigned so it cannot contribute to DMARC alignment however correctly it signs; a revoked key, with its consequence; and a key type verifiers do not implement.

Audit a DMARC record. Reports an absent or unrecognised policy tag, which makes the whole record ignored; a pct below 100, where the policy applies to that share of failing mail and the rest is treated as none, so a rollout left part way is not the policy it appears to be; a subdomain policy weaker than the organisational one; a reporting address outside the domain, which needs an authorising record there or no reports arrive; and a tag DMARC does not define.

Compare two DNS zone snapshots and report what the change does. Losing the last record of a type at a name stops something resolving once caches expire, and losing one value out of several does not, so the two are separated. A value change at one name is reported as a change rather than as an unrelated removal and addition. A TTL change is reported for its own reason: the old TTL governs how long the old answer survives, so a new one does not take effect until the old has expired.

Audit a DNS zone against the rules that make a zone illegal or make it quietly not work. Reports a CNAME at the apex, which is forbidden because the apex must also carry SOA and NS; a CNAME alongside any other record type; an MX, NS or CNAME pointing at a name that is itself a CNAME, whose failure is intermittent rather than total; a target inside the zone the zone does not define; a cyclic CNAME chain; TTLs that differ within one record set; and a record outside the zone.

Audit one Docker Compose file and resolve its internal references. Reports two services publishing the same host port, where only one can bind; a named volume or network mounted and never declared; a dependency on a service this file does not define; a depends_on with no condition, so Compose waits for the container to start rather than for the service to be ready; and a wait for a service with no healthcheck, which can never be satisfied.

Audit one Dockerfile for what its layers will cost and what its build records. Line continuations are joined first, which is what makes the layer questions answerable at all. Reports a package index updated in a layer of its own, so a later install uses a cached index months stale; a dependency install after a copy of the whole context, so that layer rebuilds on every source change; a download piped into a shell; and a credential-shaped build variable, recorded in the image history.

Check that journal entries balance, with exact decimal arithmetic. Reports an entry whose debits and credits differ, with the exact difference; a line carrying both a debit and a credit, which means two things to two readers; a negative debit, which is a credit written in a form that defeats every sign-based check downstream; a posting to an account outside a supplied chart; a repeated posting reference; and a posting into a period the caller says is closed.

Find duplicate keys in one dataset, exactly and nearly. An exact duplicate is reported with every row it occupies. A near duplicate is two different keys that become identical once case, spacing or punctuation is set aside, which a unique index accepts and which is almost always the same entity entered twice. Keys are canonicalised exactly, so 42 and 42.0 are one key.

Read the authentication headers a receiver added to one message. Headers are unfolded first, because a field continues on any line beginning with whitespace. Reports two From headers, where what is displayed and what is evaluated can differ, which is the shape of a spoof rather than a mistake; a lower Authentication-Results, which can have been written before the message arrived; a result from an untrusted server; and a DKIM or SPF domain that does not align with the From domain.

Audit a set of environment variables against a contract, without returning any value. Reports required variables that are absent, and separately those present but empty - which suppresses a default where absence does not. Checks value shapes such as port, url or duration, flags undeclared and forbidden variables, and names any value shaped like a credential without printing it.

Compare two sets of environment variables without revealing either side. Reports what was added, removed and changed, and describes each change by length and character classes rather than by value, so it is safe to run between staging and production. Flags a value that became empty, a value whose character classes changed, and a new variable shaped like a credential.

Audit a .env file and compare it with an example. Reports a duplicate name, where loaders disagree over which wins; an unquoted value with a trailing comment or space, kept by some loaders and trimmed by others; an interpolation of a name the file does not define, which most loaders substitute as empty so the value is silently incomplete; a required name absent or empty; and a name present in one file and not the other. No value is ever returned.

Measure an error budget against real counts, with exact decimal arithmetic rather than floating point. Reports the budget exhausted or mostly consumed, the objective not met, and a burn rate per interval above the sustainable one. A budget that rounds to fewer than one event is reported as carrying no information, since any failure is then a breach. Intervals are sorted by start, so the order supplied does not change the answer.

Audit a mixed batch of events, each against the schema for its own type. Reports the failing event index, type and pointer for every breach, events carrying no usable type, and event types with no schema supplied - because silently not validating a new type is how it reaches a consumer unchecked. Declared types nothing in the batch used are listed too.

Find out whether a batch can be deduplicated. Reports events carrying no id at all, ids that repeat with an identical payload - a redelivery a consumer must be idempotent about - and, separately, ids that repeat with a different payload, which means the id is not identifying the event. Volatile fields such as a delivery timestamp can be excluded from the comparison without being excluded from the duplicate detection.

Decide whether an event schema registry change breaks anyone. Compares every event type across two registries and classifies each change by the audience it breaks. An event has one producer and many consumers, so both directions are assessed and the strict reading is the default: a consumer cannot be assumed to tolerate a new enum value. A removed event type is breaking for whoever subscribed to it.

Find gaps, duplicates and ordering violations in an event sequence, per stream. Partitioning matters: auditing a merged multi-stream batch as one sequence would report a gap at every interleave. Gaps are judged on sequence values and ordering on arrival order, because they are different questions. A non-integral sequence is reported as unchecked for contiguity rather than guessed at.

Find out how many versions of each event type are actually in flight. Reports a type arriving at more than one version in a single batch, which means every consumer must handle all of them at once, versions outside the set you support, and supported versions nothing produces - handling carried for nothing is still a cost.

Check that converted amounts follow from the rates supplied. The converted figure is the exact product rounded once to the target currency minor unit under the stated mode, and a difference is reported with its exact size, because one unit is a rounding choice and a thousand is a wrong rate. Also reports two rates for one pair on one date, which means two sources.

Audit one GitHub Actions workflow against a contract the caller states. The finding that needs two parts of the file at once: a privileged trigger such as pull_request_target together with a checkout of the contributor ref, which runs untrusted code with the base repository secrets. Also reports an action pinned to a mutable tag, a secret or author-controlled event field interpolated into a run command, an absent permissions block, and the trigger key read as a boolean.

Compare two GitHub Actions workflow files and report what the change grants or removes. Permission scopes are ranked none, read and write, so a widening is reported and a narrowing is noted: only one of them grants something new. Also reports a privileged trigger added, a trigger removed, a permissions block removed so a default set elsewhere applies, an action moved from a commit to a mutable tag, an action version change, and a job removed so whatever it checked no longer runs.

Decide which named consumers a GraphQL schema change affects. Each consumer declares the parts of the schema it depends on, as Type.field and Type.field(argument), and the response says per consumer whether it is affected and exactly which dependency broke. A declared dependency the previous schema does not define is reported as not compared, not as unaffected. A new required input field is reported once against the schema, since it affects every consumer sending that input.