One API call before money moves. It screens the payee against US sanctions lists, spots domains imitating real vendors, catches mistyped or fabricated bank and wallet details, and recognizes the patterns behind invoice fraud. You get back proceed, review or block, the reasons, and a signed receipt for your audit trail.
POST /v1/check payee email ar@acmesupp1y.com on file acmesupply.com bank details changed, by email tone "pay today"
Every finding comes with a plain-English explanation, the evidence behind it, and how much it moved the score. Anything that could not be checked is listed, never silently passed.
| Check | What it looks for | Typical effect |
|---|---|---|
| Sanctions | Payee name and aliases against the OFAC SDN and consolidated lists, with fuzzy matching; receiving wallets against OFAC-listed crypto addresses; embargoed countries and regions. | block |
| Vendor impersonation | Website and email domains that imitate the vendor domain you have on file: swapped characters, extra words, a different ending, the real name tucked into someone else's domain. | block |
| Executive impersonation | Payment requests sent from addresses imitating your own company's domain. | block |
| Changed payment details | New bank or wallet details compared with the last payment, how the change was requested, and whether there was pressure to pay quickly. | review to block |
| Domain and email | Domain registration age, domains that don't exist, mail servers, SPF and DMARC, free and disposable email used by businesses. | review |
| Brand impersonation | Domains and names posing as well-known companies such as Microsoft, PayPal, DocuSign or major banks. | review to block |
| Payment details | US routing number check digits, IBAN check digits and length, SWIFT/BIC format, wallet checksums for Ethereum-style, Bitcoin, Solana and TRON addresses. | review |
Everything above, in one call. POST /v1/check
Names, wallets and jurisdictions only. POST /v1/screen
Prove a past check is authentic. POST /v1/receipts/verify
Agents with a wallet pay each call in USDC on Base using the x402 protocol. Call the endpoint, receive a 402 with the price, pay, and retry. No sign-up, no API key. The Machine Payments Protocol (MPP) is accepted too.
Pay by card, get an API key immediately, and spend the balance on any check. Credit doesn't expire. Unused credit can be refunded within 30 days of purchase; see the refund policy.
$25 of credit, about 100 full checks.
$110 of credit, about 440 full checks.
$600 of credit, about 2,400 full checks.
curl https://counterpartycheck.com/v1/check \
-H "Authorization: Bearer cc_live_…" \
-H "Content-Type: application/json" \
-d '{
"counterparty": {"name": "Acme Supply Co", "country": "US", "email": "ar@acmesupply.com"},
"payment": {"method": "ach", "routing_number": "021000021", "amount": 4850, "currency": "USD"},
"context": {"known_good_domain": "acmesupply.com", "bank_details_changed": false}
}'
Add it to Claude, Cursor or any MCP client. Your agent gets check_counterparty, screen_sanctions, check_balance and verify_receipt.
{
"mcpServers": {
"counterparty-check": {
"url": "https://counterpartycheck.com/mcp",
"headers": { "Authorization": "Bearer cc_live_…" }
}
}
}
import { wrapFetchWithPayment, x402Client } from '@x402/fetch';
import { ExactEvmScheme } from '@x402/evm';
const pay = wrapFetchWithPayment(fetch,
new x402Client().register('eip155:8453', new ExactEvmScheme(signer)));
const res = await pay('https://counterpartycheck.com/v1/check', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ counterparty: { name: 'Acme Supply Co', email: 'ar@acmesupply.com' } }),
});
Give the context object everything your agent knows: whether this is the first payment, whether bank details changed and how the change arrived, the vendor's domain on file, your own domain. Those fields are what separate a routine invoice from a fraud attempt.