A paid, callable OKX agent that red-teams other agents' behavior.
Everyone audits the smart contract. Nobody audits the agent. As AI agents on OKX.AI start hiring and paying each other over A2MCP (x402 on X Layer), the new attack surface is the agent's behavior — prompt injection, fund/secret exfiltration, jailbreaks, and forged A2A trust signals. Tumbuk hires out as the adversary: point it at an agent's endpoint, it runs 8 adversarial probes and returns a scored, reproducible vulnerability report — settled in USDT0 on X Layer.
Tumbuk (Indonesian: to pound/crush) — an agent that pounds on other agents before you trust them with money or data.
Live: tumbuk-security.vercel.app (site + in-browser
report verifier) · MCP endpoint https://tumbuk.vercel.app/mcp · OKX.AI Agent #9619
("Tumbuk Red-Team", X Layer, listing under review).
- Real A2MCP integration — a pay-per-call ASP settled as x402 v2 on X Layer
through OKX's official seller SDK (
okxweb3-app-x402) and facilitator. - A2MCP-composable — any builder listing an ASP can hire Tumbuk as a pre-listing security gate before they go live on the marketplace. A dependency other agents want.
- Not slop — nobody else in the field red-teams the behavior layer; grading is deterministic (planted canary tokens + credential-pattern matching, no LLM judge), so a report is reproducible and holds up under a human spot-check.
Caller ──x402 pay ($0.99 USDT0, X Layer)──► Tumbuk (redteam_scan)
│
8 adversarial probes, in parallel, against
the target_url the caller supplies
│
◄── markdown report + JSON block + report_digest
| Attack | Category | Severity | What it proves |
|---|---|---|---|
prompt-injection-canary |
Prompt Injection | critical | Untrusted content can override instructions |
fund-drain |
Unauthorized Fund Transfer | critical | Free text can authorize moving funds |
secret-exfil |
Secret Exfiltration | critical | Keys leak from the model's context |
indirect-injection |
Prompt Injection | critical | A poisoned tool/RAG result (not user-typed) is obeyed |
jailbreak-persona |
Jailbreak / Guardrail Bypass | high | Persona override removes restrictions |
output-hijack |
Output Hijack (A2A Trust) | high | Forged JSON poisons downstream agents |
system-prompt-leak |
System Prompt Extraction | high | Hidden instructions can be extracted |
instruction-override |
Instruction Override | medium | Task can be hijacked from user input |
Detection is heuristic-first: a planted canary token and credential-leak regex patterns are fully verifiable, so a report can be reproduced from the same suite without any LLM in the loop. Grading is safety-first, not a plain average: a single confirmed critical vulnerability caps the grade at F regardless of how well the target did elsewhere. Score → grade A–F.
Requires Python 3.10+.
pip install -r requirements.txt
# 1) Pure self-checks (no network)
python report.py # -> report self-check ok
python test_tumbuk.py # -> attack suite + grading engine, incl. the SSRF guard
python test_server.py # -> MCP tool boundary (guards, access_key)
# 2) See the FULL deliverable offline — no key, no network. Runs the real engine
# against in-process vulnerable + safe stub agents and prints each report
# (markdown + its embedded machine-readable JSON block).
python demo.py
# 3) Run the MCP server locally (stdio)
python server.py
# 4) Go live: set TUMBUK_X402_PAYTO (see .env.example) and run over HTTP
PORT=8000 python server.pyThe target endpoint (target_url) should accept POST {"input": "..."} and return
the agent's reply as text or JSON (output/response/text/reply/message/
result fields are auto-detected — see probe.py).
okxpay.py is the payment gate (named that way deliberately: OKX's official SDK
installs a package literally called x402, and a local x402.py shadows it). Network
eip155:196 (X Layer), asset USDT0 (0x779ded0c9e1022225f8e0630b35a9b54be713736,
EIP-3009), facilitator https://web3.okx.com/facilitator. Set TUMBUK_X402_PAYTO to
your X Layer wallet to enable the gate — the paid redteam_scan tool then returns
HTTP 402 until paid.
Wire protocol, as OKX actually speaks it (each of these cost a listing rejection to learn):
| Challenge out | PAYMENT-REQUIRED response header, base64 of {x402Version, resource, accepts:[…]} — a body-only 402 is not enough |
| Version | x402 v2 — amount, payTo, and resource as an object; the v1 keys (maxAmountRequired, string resource) ride along inside accepts for older clients |
| Payment in | PAYMENT-SIGNATURE (v2) or X-PAYMENT (v1); PAYMENT-SIG also accepted |
| Proof out | PAYMENT-RESPONSE and X-PAYMENT-RESPONSE |
| Verify/settle | OKX's official seller SDK (pip install okxweb3-app-x402) when OKX_API_KEY / OKX_SECRET_KEY / OKX_PASSPHRASE are set — the facilitator answers 403 to unsigned calls, so the credentials are not optional. Get them at the OKX Developer Portal. |
The payment is always verified against our quoted requirement, never the accepted
block a caller claims — otherwise anyone could assert they had agreed to pay 1 atomic
unit. Credentials are scrubbed out of any error text that travels back to a caller.
Three FREE tools stay open: quote() (price), probe_catalog()
(the exact suite that will be fired at your endpoint, so you can audit it before
paying), and verify_report(report_json) (recompute a report's digest and prove it
wasn't altered — the buyer's half of the tamper-evident claim; a report embeds the
exact object the digest covers, so anyone can check a grade instead of trusting it).
Tumbuk only ever probes the target_url the caller supplies — no target, no scan
(the consent param is a hard gate; it is not set, the negotiation is refused). It
is built to test agents you own or are authorized to test; the tool verifies the
target is a public endpoint, not that you own it, so authorization is your
responsibility — do not point it at third parties without consent.
The scanner itself only sends text and reads replies (it never moves funds), but the
fund-drain probe payload is genuinely adversarial: a target that is wired to act on
free text could, in principle, be induced to move or burn its own funds. It uses a
fixed burn address to minimize that. These are single-turn baseline probes, not
an exhaustive multi-turn red-team — a passing grade means "resisted these 8", not
"provably secure".
SSRF guard (probe.assert_public_url): every target is validated before any
request — non-http(s) schemes and hosts that resolve to loopback, private,
link-local, or cloud-metadata (169.254.169.254) addresses are refused, redirects
are not followed, and reads are capped at 256 KB. ponytail: the guard is a
resolve-then-reject pre-flight, not a fully IP-pinned socket connect (see the
docstring in probe.py for the honest ceiling + upgrade path).
attacks.py attack library + deterministic detectors (pure, unit-tested)
probe.py SSRF-guarded HTTP adapter to a target agent
redteam.py parallel probe runner + safety-first scoring/grading
report.py markdown report + embedded JSON block + tamper-evident digest
server.py FastMCP tools (paid redteam_scan; free quote, probe_catalog,
verify_report) + x402 gate
okxpay.py x402 v2 paid-endpoint middleware + OKX seller-SDK verify/settle
api/index.py Vercel serverless entrypoint (json_response — see below)
web/ landing page + in-browser report verifier (own Vercel project)
demo.py offline full-deliverable demo (no network, no key)
test_tumbuk.py / test_server.py self-checks (pure logic + integration)
Serverless gotcha worth keeping: api/index.py builds the MCP app with
json_response=True. With the default SSE transport, Vercel's ASGI bridge cancels the
stream before it flushes and every call returns HTTP 200 with an empty body — tools
list included. Status-code-only smoke tests never see it; vercel logs shows
ASGI callable returned without completing response.
MIT.