Fairquery Agent Trust & Data Safety

WHAT: Offline email checks: RFC-style syntax + normalization, common domain typo "did you mean" (gmial.com -> gmail.com), disposable/temporary domain (bundled CC0 list, ~thousands of domains), role account (info@, sales@), free webmail provider. WHEN: Fast pre-filtering of signups or lead lists, before paying for email_validate_deliverability. WHEN NOT: Does NOT check DNS/MX - it cannot tell whether the domain receives mail (verdict is "invalid", "risky" or "unknown", never "valid"). Use email_validate_deliverability (paid) for MX/SPF/DMARC. COST: Free. Pure local function; no network, no token. RETURNS: Paged items: {type:"email_check",input,email,syntax_valid,local_part,domain,verdict(invalid|risky|unknown),reasons[INVALID_SYNTAX|DISPOSABLE_DOMAIN|ROLE_ACCOUNT|FREE_PROVIDER|POSSIBLE_TYPO|DNS_NOT_CHECKED],did_you_mean,is_disposable,is_role_account,is_free_provider,dns_checked:false}; meta.summary counts by verdict. BEHAVIOR: Read-only, no side effects, idempotent (same input -> same output). No network calls (no DNS/SMTP); local, milliseconds. Max 10,000 addresses. PARAMETERS: emails: each element is parsed on its own (one address per element; a comma-separated list in one element is INVALID_SYNTAX, not split). Before checking, "Name <addr>" is reduced to addr, a leading "mailto:" is dropped, the domain is lowercased (local part keeps its case), a trailing dot is removed and IDN domains are converted to punycode; the normalized value is returned as email, the original as input. Duplicates are not merged: every element yields one row, in input order. Role detection ignores +tags (sales+eu@ counts as sales@) and disposable matching also covers subdomains of listed domains. limit/offset page those rows; meta.summary always counts verdicts over ALL rows, not just the current page. EXAMPLE: {"emails":["someone@gmial.com"]} -> verdict "risky", reasons ["POSSIBLE_TYPO","DNS_NOT_CHECKED"], did_you_mean "someone@gmail.com".

WHAT: Runs the Fairquery Apify Actor email-validator-mx-disposable: syntax, domain existence, MX/null-MX, disposable, role, free provider, typo suggestion, SPF/DMARC policy, mail provider; final verdict valid | risky | invalid | unknown. WHEN: Cleaning lists before a send, verifying a lead's domain can receive mail. Pre-filter with free email_check_syntax to avoid paying for obviously bad rows. WHEN NOT: Offline format/typo checks (free email_check_syntax). It does not SMTP-probe mailboxes. COST: Paid, billed to YOUR Apify account via your APIFY_TOKEN: $0.00079 per email (+ $0.00005/run). 100 emails ~ $0.08. RETURNS: Paged rows type="email" (email, domain, verdict, reasons[], has_mx, mx_records, mail_provider, has_spf, has_dmarc, dmarc_policy, did_you_mean, ...) or type="error". Tool errors: APIFY_TOKEN_MISSING, APIFY_TOKEN_INVALID, APIFY_PAYMENT_REQUIRED, APIFY_ACTOR_RUN_FAILED, APIFY_TIMEOUT. BEHAVIOR: Read-only, no side effects (no email is sent), idempotent apart from live DNS changes. Makes network calls: runs an Apify Actor (DNS/MX lookups) billed to your APIFY_TOKEN; latency seconds to minutes (300 s timeout). PARAMETERS: emails: elements may also hold comma/semicolon/newline-separated lists or "Name <addr>" forms; the Actor splits them, trims, and skips case-insensitive duplicates, so you pay once per unique address. The allow* flags only decide whether a condition downgrades the verdict to "risky": the matching reason code (ROLE_ACCOUNT, DISPOSABLE_DOMAIN, FREE_PROVIDER) is reported in reasons[] either way, and they can never turn an "invalid" address (bad syntax, no domain, null MX, no mail server) into "valid". POSSIBLE_TYPO and IMPLICIT_MX_ONLY always make it "risky" regardless of flags. Typical presets: B2B lead list = allowFreeProviders false + allowRoleAccounts false; consumer signups = defaults. checkSpfDmarc only adds has_spf / has_dmarc / dmarc_policy fields; it never changes the verdict or the price. limit/offset only page the returned rows: ever…

WHAT: Runs the Fairquery Apify Actor osv-dependency-vulnerability-check: parses package.json, package-lock.json (v1-v3), requirements.txt or go.mod (or a package list), checks OSV, and returns per-package max severity/CVSS, fixed versions, a recommended upgrade version and one row per vulnerability (deduped aliases). WHEN: Full project audits from a pasted manifest, CI-style reports, severity-filtered output. WHEN NOT: Quick checks of a few exact versions (osv_query_packages, free) or one advisory (osv_get_vulnerability, free). COST: Paid, billed to YOUR Apify account via your APIFY_TOKEN: $0.0005 per package + $0.0015 per vulnerability found (+ $0.00005/run). Use minSeverity="HIGH" to cut vuln rows. lodash+django (2 pkgs, 41 vulns) ~ $0.06. RETURNS: Paged rows type="package" (vulnerable, vuln_count, max_severity, fixed_versions, recommended_version), type="vulnerability" (id, cve_ids, severity, cvss_score, fixed_versions, osv_url) or type="error". Tool errors: INPUT_EMPTY, APIFY_TOKEN_MISSING, APIFY_TOKEN_INVALID, APIFY_PAYMENT_REQUIRED, APIFY_ACTOR_RUN_FAILED, APIFY_TIMEOUT. BEHAVIOR: Read-only, no side effects, idempotent. Makes network calls: runs an Apify Actor (querying OSV.dev) billed to your APIFY_TOKEN; latency seconds to minutes (300 s timeout). Up to 1000 packages or a 2,000,000-char manifest. PARAMETERS: packages or manifestText = input (one required); manifestType = format, default auto-detect; minSeverity = only report at/above ALL|LOW|MEDIUM|HIGH|CRITICAL (default ALL); includeDevDependencies (default true); limit = page size (default 100, max 1000); offset = items to skip for paging (default 0). EXAMPLE: {"manifestText":"django==3.2.0\nrequests==2.19.0","minSeverity":"HIGH"}

WHAT: Fetch full OSV records (summary, details, aliases, severity vectors, affected ranges, fixed versions, references) for advisory IDs directly from api.osv.dev. WHEN: You have IDs (from osv_query_packages or a report) and need details or the fixed version. WHEN NOT: To find which vulns affect a package version (osv_query_packages, free) or a whole manifest (osv_audit_dependencies, paid). COST: Free. Direct HTTPS to api.osv.dev only; no token. Max 25 IDs per call, 20 s timeout each. RETURNS: Paged items {type:"vulnerability",id,summary,details,aliases,severity,affected,references,published,modified,osv_url} or {type:"error",code:VULN_NOT_FOUND|OSV_FETCH_FAILED,id,retryable}. BEHAVIOR: Read-only, no side effects, idempotent. Makes one network call per ID to api.osv.dev (free, no key); typically <2 s, 20 s timeout. Max 25 IDs per call. PARAMETERS: ids: each ID is fetched separately (in parallel) and yields exactly one row in input order, so one bad ID never fails the others: an unknown ID returns a VULN_NOT_FOUND row (not retryable), a network/5xx problem an OSV_FETCH_FAILED row (retryable - retry just that ID). Prefer the ecosystem/GHSA IDs returned by osv_query_packages (vuln_ids); a CVE-... ID only resolves when OSV indexes that CVE as its own record, otherwise look up the GHSA alias. IDs are matched as given (no trimming of URLs or prefixes), and duplicates are fetched twice. limit/offset only page the returned rows; every call re-fetches all given IDs, so for a next page resend the same ids with offset = nextOffset. EXAMPLE: {"ids":["GHSA-35jh-r3h4-6jhm"]} -> lodash command injection, fixed in 4.17.21.

WHAT: Query the public OSV.dev database (api.osv.dev querybatch) directly from your machine for exact package versions; returns which are vulnerable and the advisory IDs. WHEN: Quick "is lodash 4.17.20 vulnerable?" checks for up to 200 packages; then osv_get_vulnerability for details of specific IDs. WHEN NOT: Parsing manifests/lockfiles, severity filtering, fixed/recommended versions in one shot -> osv_audit_dependencies (paid). COST: Free. Direct HTTPS to api.osv.dev only (Google-run public API); no token, nothing sent to Fairquery or Apify. 20 s timeout. RETURNS: Paged items {type:"package",ecosystem,name,version,vulnerable,vuln_count,vuln_ids[],osv_url} or {type:"error",code:INVALID_ECOSYSTEM}; meta.vulnerable_count. Tool errors: OSV_FETCH_FAILED (retryable). BEHAVIOR: Read-only, no side effects, idempotent (results change only when OSV publishes advisories). Makes one network call to api.osv.dev (free, no key); typically <2 s, 20 s timeout. Max 200 packages per call. PARAMETERS: packages: each entry is checked independently and returns exactly one row, in input order. ecosystem is case-insensitive and accepts aliases (pip -> PyPI, cargo -> crates.io, gem -> RubyGems, golang -> Go); an unknown ecosystem yields a per-entry INVALID_ECOSYSTEM error row while the other entries still run. version must be one exact released version: a range such as "^4.17.0" or ">=2" is not resolved and normally returns no vulnerabilities (a false "safe"), so pin versions from your lockfile first. Duplicate entries are queried and returned twice. limit/offset page the rows (all packages are sent to OSV in a single request); meta.vulnerable_count counts all packages, not only the page. EXAMPLE: {"packages":[{"ecosystem":"npm","name":"lodash","version":"4.17.20"}]} -> vulnerable true, vuln_ids ["GHSA-35jh-r3h4-6jhm",...].

WHAT: Runs the Fairquery Apify Actor llm-data-guard-pii-secrets: everything pii_scan_text does PLUS person-name/location NER, street addresses, public document URLs (txt/md/json/csv/HTML/PDF text layer, <= 10 MB) and restore mode (put originals back into LLM output using a placeholder map). WHEN: You need NER names/addresses, need to scan files at URLs/PDFs, or want the hosted pipeline. For plain text with regex-detectable PII/secrets prefer free pii_scan_text / pii_redact_text. WHEN NOT: Plain text scans (free tools), images (no OCR), email deliverability. COST: Paid, billed to YOUR Apify account via your APIFY_TOKEN: $0.0015 per document + $0.0002 per finding (Actor fairquery/llm-data-guard-pii-secrets). Example: 10 docs with 20 findings ~ $0.02. RETURNS: Paged rows: type="document" (id, source, chars, mode, finding_count, counts_by_type, risk_level, findings[] masked, output_text, placeholder_map if requested) or type="error". Tool errors: APIFY_TOKEN_MISSING, APIFY_TOKEN_INVALID, APIFY_PAYMENT_REQUIRED, APIFY_ACTOR_RUN_FAILED, APIFY_TIMEOUT, INPUT_EMPTY. BEHAVIOR: Read-only (does not modify your data), idempotent. Makes network calls: runs an Apify Actor billed to your APIFY_TOKEN; may fetch documentUrls. Latency seconds to a few minutes (300 s actor timeout). Up to 1000 texts / 100 URLs (10 MB each). PARAMETERS: texts and/or documentUrls: at least one non-empty (the schema marks both optional; neither -> INPUT_EMPTY, not billed); both may be combined and each text or URL becomes one billed document row. mode picks which other fields matter: "detect" ignores redactionStyle/returnPlaceholderMap; "redact" uses them; "restore" ignores all detector flags and only replaces placeholders found in texts using placeholderMap (pass the map from an earlier redact call; a placeholder missing from the map stays as is). returnPlaceholderMap works only with mode="redact" + redactionStyle="placeholder". detectNames / detectAddresses enable English NER (PERSON, LOCATION, STREET…

WHAT: Catalog of every PII and secret entity type, which ones run locally for free (pii_scan_text / pii_redact_text) vs only in the paid Actor (NER names/locations, street addresses, URL/PDF documents), redaction styles, and the price of every paid tool in this server. WHEN: Before pii_scan_text / pii_redact_text to pick entityTypes, or to explain coverage and costs to a user. WHEN NOT: To actually scan text (pii_scan_text) or redact it (pii_redact_text). COST: Free. Static local data; no network, no token. RETURNS: {detectors:[{type,category,rule,local}], redaction_styles, paid_pricing}. BEHAVIOR: Read-only, no side effects, idempotent (same input -> same output). No network calls; local static catalog, instant (<10 ms). No rate limits. PARAMETERS: None: call with an empty object {}; the catalog is always complete and cannot be filtered. Its output feeds other tools' parameters: copy detector "type" values verbatim into entityTypes of pii_scan_text / pii_redact_text (only rows with local:true can match there) or pii_guard_documents (all rows, incl. PERSON / LOCATION / STREET_ADDRESS); redaction_styles keys are the allowed redactionStyle values. EXAMPLE: {} -> {"detectors":[{"type":"AWS_ACCESS_KEY","category":"secret","local":true},...]}

WHAT: Return sanitized copies of texts with every local PII/secret finding replaced (placeholder [EMAIL_1], mask, or salted hash). Placeholders are consistent across documents in one call. Runs 100% on your machine. WHEN: Right before sending user data to an LLM/third party. Use returnPlaceholderMap=true if you need to restore originals in the LLM answer later (do the restore yourself by string replacement). WHEN NOT: For a findings report only use pii_scan_text. For names/addresses NER, URLs or PDFs use pii_guard_documents (paid). COST: Free. Local only; no network, no token. RETURNS: Paged {count,total,...,items:[{type:"redacted_document",doc_index,chars,finding_count,counts_by_type,risk_level,output_text}],meta:{placeholder_map?}}. One item per document (page with limit/offset). placeholder_map contains the ORIGINAL sensitive values; omit unless needed. Errors: INPUT_TOO_LARGE. BEHAVIOR: Read-only, no side effects, idempotent (same input -> same output). (hash style uses a random per-call salt, so hashes differ between calls). No network calls; local, milliseconds. Max 50 texts, 200,000 chars each, 500,000 total. PARAMETERS: texts: one element per document, 500,000 chars in total; the same value gets the same placeholder in every document of one call ([EMAIL_1] everywhere), but numbering restarts on each call. redactionStyle: "placeholder" is the only reversible style; "mask" keeps a few characters for human review; "hash" output differs between calls (random salt), so do not compare hashes across calls. returnPlaceholderMap: only has an effect with redactionStyle="placeholder" (ignored for mask/hash); the map in meta.placeholder_map holds the ORIGINAL values, so keep it out of the LLM prompt and restore answers yourself by string replacement. entityTypes / allowList / entropyScan / defaultPhoneRegion: identical semantics to pii_scan_text (filter after detection, whole-value case-insensitive allow-list). limit/offset page whole documents (one item per text, defa…

WHAT: Detect PII (emails, phones, US SSNs, Luhn-valid cards, mod-97 IBANs, UK NINOs, IPv4/IPv6) and secrets (AWS/GitHub/GitLab/Slack/Stripe/Google/OpenAI/Anthropic/HF/npm/SendGrid/Twilio/Azure keys, JWTs, private keys, URL credentials, key=value secrets) in text. Runs 100% on your machine. WHEN: Before sending prompts, tickets, logs or files to an LLM or third party; to audit text for leaked credentials. Findings are paged across all documents. WHEN NOT: To get sanitized text use pii_redact_text. For person names/addresses (NER), public URLs or PDFs use pii_guard_documents (paid). Not for images (no OCR). COST: Free. Local regex/validators only; no network, no APIFY_TOKEN, nothing sent anywhere. RETURNS: Paged {count,total,offset,hasMore,nextOffset,meta:{documents:[{doc_index,chars,finding_count,counts_by_type,risk_level}]},items:[{doc_index,type,category,rule,start,end,confidence,masked}]}. Raw values are never returned. Errors: INPUT_TOO_LARGE. BEHAVIOR: Read-only, no side effects, idempotent (same input -> same output). No network calls; text never leaves your machine; runs locally in milliseconds. Max 50 texts, 200,000 chars each, 500,000 total. PARAMETERS: texts: one array element per document; each finding carries doc_index = the element's 0-based position, and the 500,000-char cap applies to the SUM of all elements (over it -> INPUT_TOO_LARGE; split into several calls). entityTypes: filters findings after detection; names are case-insensitive, unknown names silently match nothing, and NER-only types (PERSON, LOCATION, STREET_ADDRESS) never match here. allowList: compared with the whole matched value, case-insensitively (allow "support@yourco.com", not "yourco.com"). entropyScan: only adds HIGH_ENTROPY_STRING findings; it never removes others. defaultPhoneRegion: affects only national-format numbers such as "030 1234567" (needs "DE"); "+49 ..." numbers parse with any region. limit/offset page the flat findings list across all documents, while meta.documents a…

WHAT: Static list of the official sanctions lists sanctions_screen_names checks (id, name, authority, download URL), the score scale and the legal disclaimer. WHEN: To choose the lists parameter, cite sources in a report, or explain coverage before paying. WHEN NOT: To screen a name (sanctions_screen_names, paid). It does not download lists or report freshness. COST: Free. Static local data; no network, no token. RETURNS: {sources:[{id,name,authority,url}],score_scale,disclaimer,pricing}. BEHAVIOR: Read-only, no side effects, idempotent (same input -> same output). No network calls; static local catalog, instant. No rate limits. PARAMETERS: None: call with an empty object {}; the result is static and cannot be filtered. Its output feeds sanctions_screen_names: each sources[].id (OFAC_SDN, OFAC_CONS, EU, UK, UN) is a valid value for its lists parameter, and score_scale explains how its minScore threshold is applied. EXAMPLE: {} -> {"sources":[{"id":"OFAC_SDN","authority":"US Treasury OFAC",...},...]}

WHAT: Runs the Fairquery Apify Actor sanctions-watchlist-screener: fuzzy-match people/organisations against OFAC SDN, OFAC Consolidated, EU, UK and UN lists from the official sources (re-downloaded when the cached copy in your Apify account is older than 6 h; every row reports each list's publication date); optional country/DOB filters. WHEN: KYC/KYB onboarding, vendor/counterparty checks, bulk re-screening. Put all names in ONE call (each call is one run with a $0.007 start fee; list loading takes ~2-5 s from the cache, or 10-40 s, up to ~60 s, when lists are re-downloaded). WHEN NOT: PEP/adverse media, certified compliance decisions. For coverage info use free sanctions_list_sources. COST: Paid, billed to YOUR Apify account via your APIFY_TOKEN: $0.003 per name + $0.007 per run. 200 names in one call ~ $0.61. RETURNS: Paged rows type="screening" (query, status potential_match|no_match, best_score, match_count, matches[] with list/programs/countries/score, lists_screened, lists_unavailable, disclaimer) or type="error". Tool errors: INPUT_EMPTY, APIFY_TOKEN_MISSING, APIFY_TOKEN_INVALID, APIFY_PAYMENT_REQUIRED, APIFY_ACTOR_RUN_FAILED, APIFY_TIMEOUT. Not a certified screening service. Automated fuzzy matching against public lists; false positives and misses are possible. Review every potential match manually and consult official sources/legal counsel before acting. BEHAVIOR: Read-only, no side effects, idempotent for a given list snapshot. Makes network calls: runs an Apify Actor billed to your APIFY_TOKEN; latency seconds to minutes (300 s timeout). Up to 10,000 names. PARAMETERS: names and/or queries: at least one non-empty (the schema marks both optional; neither -> INPUT_EMPTY, not billed). Both may be combined; every entry is billed once, so use names for bare strings and queries when you have country/dateOfBirth/entityType or want your own id echoed. In queries, dateOfBirth removes listed individuals born more than 1 year apart, while country never removes matc…

WHAT: One call per batch of leads/counterparties: runs email_validate_deliverability on their emails and sanctions_screen_names on their person/company names IN PARALLEL, then merges results per lead with an overall decision: block (invalid email or sanctions potential_match), review (risky email), pass. WHEN: Onboarding customers/vendors, qualifying inbound leads, CRM hygiene where both email quality and sanctions exposure matter. WHEN NOT: If you only need one check, call that tool directly (cheaper). Free pre-filter: email_check_syntax. COST: Paid, billed to YOUR Apify account via your APIFY_TOKEN: $0.00079 per lead with email + $0.003 per lead with name (= $0.00379 per full lead) + $0.007 per call for the sanctions run. 2 Actor runs per call. 100 full leads ~ $0.39. Takes ~5-45 s (sanctions lists come from a cache at most 6 h old, or are downloaded). RETURNS: Paged items {type:"lead",ref,email,name,decision(pass|review|block),reasons[],email_verdict,email_reasons,did_you_mean,sanctions_status,sanctions_best_score,sanctions_matches[top 3]}; meta.summary counts by decision, meta.disclaimer. Partial failure: affected check shows "unavailable" and meta.errors lists codes. Tool errors: INPUT_EMPTY, APIFY_TOKEN_MISSING. BEHAVIOR: Read-only, no side effects (no email sent), idempotent. Makes network calls: runs the email and sanctions Apify Actors in parallel, billed to your APIFY_TOKEN; latency seconds to minutes (300 s timeout). PARAMETERS: leads: each record needs email and/or name (if no lead has either -> INPUT_EMPTY, nothing billed); a lead with only an email skips sanctions (sanctions_status "not_checked") and one with only a name skips email (email_verdict "not_checked"), so you are billed $0.00079 per lead with an email and $0.003 per lead with a name, plus $0.007 per call for the sanctions run when any lead has a name. Identical emails across leads are validated and billed once. ref joins sanctions results back to the lead, so keep refs unique (default = the…