# Validate Agent

> Security and data-quality guardrails for AI agents. Stop prompt injections before they reach your LLM. Strip PII to stay compliant. Sanitize untrusted HTML without installing dependencies. Validate emails, URLs, JSON schemas, and SQL syntax in under 10ms. Works from any environment — sandboxed, serverless, or containerized. No API key needed. 200 free requests, then pay-per-call via x402 (USDC on Base).

- **Domain**: `validate-agent.fly.dev`
- **Provider**: Validate Agent (https://validate-agent.fly.dev)
- **A2A protocol version**: 1.0
- **Kind**: a2a_agent
- **Category**: verification
- **Live-responds (last probe)**: True
- **Signed card**: False
- **Streaming**: False
- **Quality score**: 85%

## Skills
- **Prompt Injection Detection** — Screen untrusted text before it reaches your LLM. Catches obfuscation techniques including homoglyph substitution, zero-width character insertion, base64-encode
- **PII Detection & Redaction** — Find and redact personal data before logging, storing, or forwarding text. Detects SSNs, credit card numbers, emails, phone numbers, IP addresses, dates of birt
- **HTML/XSS Sanitization** — Remove XSS vectors from untrusted HTML without installing a sanitizer locally. Powered by nh3 (Rust). Strips script tags, event handlers, data URIs, and other i
- **SQL Syntax & Injection Check** — Validate SQL syntax and detect injection patterns before executing queries. Supports 30+ dialects via sqlglot including PostgreSQL, MySQL, BigQuery, Snowflake, 
- **Data Format Validation** — Validate and normalize emails, URLs, UUIDs, phone numbers, and IPv4 addresses. RFC-compliant checks with normalization output. Ideal for agents in sandboxed env
- **JSON Schema Validation** — Validate any JSON data against a JSON Schema definition. Supports Draft 4, 6, 7, 2019-09, and 2020-12. Use to verify LLM-generated structured output matches exp
- **Batch Validation** — Validate up to 1,000 values in a single request. Mix types freely — emails, URLs, UUIDs, phones, IPv4 in one call. Returns per-item results with a summary. Firs
- **IP Geo-Reputation & Sanctions** — Validate IP addresses and check geo-reputation. Detects private/reserved ranges, looks up country via MaxMind GeoLite2, and flags IPs from sanctioned countries.
- **Secret & Credential Sweeping** — Scan text for leaked secrets, API keys, tokens, and credentials. Detects AWS keys, GitHub PATs, JWTs, Stripe keys, RSA private keys, Google API keys, Slack toke
- **JSON & Markdown Repair** — Fix broken JSON (trailing commas, single quotes, comments, unquoted keys) and normalize malformed markdown tables (missing separators, uneven columns). Returns 
- **Web Asset & Citation Formatting** — Extract and validate URLs and markdown links from text. Checks URL structure, finds formatting issues (empty alt text, nested brackets), and optionally flags sp
- **Language & Toxicity Triage** — Detect the language of text and check for English profanity. Uses n-gram language detection and configurable English profanity word lists. Returns language code
- **Static Security Scan** — Regex-based malicious string and secret detection in source code. Detects dynamic execution (eval, exec, subprocess), hardcoded IPs, and exposed credentials. Su
- **Tool Chain Audit** — AST analysis of dangerous source-to-sink tool chains. Parses Python via AST and Node.js via regex heuristics. Identifies paths from data sources (read_file, inp
- **Adversarial Probe** — Honeytoken canary leak detection in execution logs. Multi-layer search: plaintext, HTML/URL decoded, base64-decoded, and URL-encoded segments. Detects exfiltrat

## URLs
- Agent card: https://validate-agent.fly.dev/.well-known/agent-card.json
- Page (HTML): https://agenstry.com/agents/validate-agent.fly.dev
- Documentation: https://validate-agent.fly.dev/docs