FinePrint

The fine-print firewall — for humans and agents. Never agree to anything unread again.

Live app → · API · MCP endpoint · x402 paid tier · Architecture

---

The problem

The average person clicks "I agree" on roughly 1,500 pages of fine print a year and reads almost none of it. Now AI agents accept terms on your behalf — signing up for services, subscriptions, and APIs — just as blindly.

Buried in that text: auto-renewals, 60-day cancellation windows, hidden fees, arbitration clauses, class-action waivers, and quiet grants of your data and IP. FinePrint reads it first.

Paste a contract, ToS, lease, or subscription agreement (or point it at a URL) and get back, in seconds:

• Gotcha Score 0–100 + a verdict: SIGN / CAUTION / WALK_AWAY
• Trap findings across 16 categories — each with the exact clause quoted verbatim, a plain-English translation, and concrete advice
• Your obligations — what you're actually committing to
• Money map — every amount that can be charged, with context
• Deadlines → .ics calendar file — "cancel by Apr 29 or pay for another year," dropped straight into your calendar before it costs you
• ToS Diff — what changed between two versions of the terms, and whether it got worse
• SHA-256 receipt for every scan

The third trust layer

Agents already verify outputs before trusting them, and transactions before signing them. FinePrint is the missing third layer: verify commitments before agreeing to them.

FinePrint is an Agentic Service Provider (ASP) on OKX.AI: a free rate-limited tier plus an x402 pay-per-call tier (X Layer, eip155:1952) so autonomous agents can pay per scan before accepting terms on their owner's behalf.

Built for trust

A contract scanner is worthless if it isn't reliable. FinePrint is engineered so the same document always produces the same answer — and never shows you anything it can't prove:

• Zero-hallucination guarantee — every finding's quote is string-match verified against the source document. Unverifiable quotes are dropped, never shown; the running drop count is published at /stats.
• Pinned models, no silent downgrades — Groq llama-3.3-70b-versatile (primary) and Gemini gemini-3.5-flash-lite (fallback).
• Content-addressed cache — identical input returns the identical previously-computed scan (24 h TTL), guaranteeing consistency across refreshes.
• Fail-closed, never fake — if both LLM providers are unavailable, a scan returns HTTP 503 "service unavailable". Degraded results are never cached.

Quick start

cp .env.example .env   # add a free GROQ_API_KEY and/or GEMINI_API_KEY
npm install
npm run dev            # http://localhost:7860 — playground + API
npm test               # 40 tests

Get free keys from console.groq.com and aistudio.google.com. At least one is required for AI analysis.

API

Base URL: https://fineprint-production-e356.up.railway.app

Endpoint	What it does
POST /scan {text | url, title?}	Full scan (free tier, 10 / 15 min per IP)
GET /scan/:id	Retrieve a previous scan (24 h TTL)
GET /scan/:id/calendar.ics?renewalDate=YYYY-MM-DD	Deadline reminders as an iCalendar file
POST /diff {before, after}	What changed, verdict BETTER / WORSE / MIXED / UNCHANGED
POST /x402/scan, POST /x402/diff	Paid tier — returns an x402 v2 402 challenge without payment (fail-closed)
POST /mcp	MCP endpoint (Streamable HTTP, stateless) — tools scan_document, scan_url, diff_terms
GET /judge/examples, POST /judge/run/:slug	One-click golden examples (pre-cached, quota-free)
GET /stats	Live scoreboard: scans, traps caught, hallucinations blocked, x402 revenue
GET /openapi.json, GET /health	Discovery probes

Example:

curl -s -X POST https://fineprint-production-e356.up.railway.app/scan \
  -H 'Content-Type: application/json' \
  -d '{"text": "<paste the contract>", "title": "My gym contract"}'

Use it from an agent (MCP)

FinePrint exposes an MCP server so any MCP client — Claude Code, Cursor, or an OKX.AI agent — can call it directly:

claude mcp add --transport http fineprint https://fineprint-production-e356.up.railway.app/mcp

This registers three tools: scan_document, scan_url, and diff_terms. An agent can now scan any terms it's about to accept before committing.

x402 paid tier

The /x402/* endpoints are gated by the x402 payment protocol on X Layer (eip155:1952). Without an X-PAYMENT header they return a spec-compliant 402 challenge and do no work (fail-closed):

curl -i -X POST https://fineprint-production-e356.up.railway.app/x402/scan \
  -H 'Content-Type: application/json' \
  -d '{"text": "test"}'
# → HTTP/1.1 402 Payment Required  (with an x402 v2 challenge body)

Setting both X402_FACILITATOR_URL and X402_PAY_TO_ADDRESS activates the official @x402/express middleware for real verification and settlement.

Architecture

Node 20 + TypeScript + Express. Stateless; in-memory 24 h scan cache; no database.

Analysis runs two layers that are merged:

1. Deterministic layer (always on) — sentence-level pattern taxonomy across 16 trap categories, plus money / date / obligation extraction. Every quote is lifted verbatim from the source.
2. LLM layer (Groq → Gemini fallback, JSON-constrained, deterministic) — surfaces subtler traps and writes plain-English explanations. Every LLM finding must survive verbatim-quote verification or it is dropped.

If the LLM layer is unavailable, the scan fails closed with a 503 rather than returning a partial result. See SECURITY.md for the threat model.

Deploy

Deployed on Railway. Connect the repo — Railway auto-detects the Dockerfile and builds it. In the service Variables, set:

Variable	Value
GROQ_API_KEY	your Groq key
GEMINI_API_KEY	your Gemini key
NODE_ENV	production

That's it — Railway exposes the service and health-checks /health. Optionally set X402_FACILITATOR_URL and X402_PAY_TO_ADDRESS to activate real x402 settlement.

Testing

npm test        # 40 tests — engine, HTTP API, x402 paid loop, MCP, SSRF guard
npm run typecheck

License

MIT. FinePrint is a reading aid, not legal advice.