Terms of Service

Effective 2026-07-08. These terms govern use of quartermaster.surewhynot.app, its APIs, MCP server, reports, and public pages (together, the "Service").

1. Who we are, and agreement

The Service is owned and operated by SureWhyNot, LLC ("SureWhyNot", "we", "us"), reachable at dev@surewhynot.app. By calling any endpoint, mounting the MCP server, ordering a report, or otherwise using the Service, you agree to these terms. If you use the Service on behalf of an organization, you represent that you can bind that organization.

2. The Service

Quartermaster provides (a) utility API endpoints, some free and some paid per call in USDC via the x402 protocol; (b) an MCP tool server exposing those endpoints; (c) paid endpoint reports (the Endpoint Health Report and Deep Review) ordered at /verify; and (d) public informational pages, including the ecosystem dashboard. No account is created and no API key is issued; access is per-request.

3. Payments, delivery, and refunds

• Paid calls settle in USDC on Base or Solana through the x402 protocol at the price stated in the payment challenge for that request; each request advertises both rails and your client chooses one. Prices may change at any time; the challenge you accept is the price you pay.
• A paid API call is delivered when the response is returned. A Health Report is delivered when the report permalink is generated (typically seconds after payment); Deep Review additionally includes a manual review delivered within 2 business days.
• Because delivery is immediate and per-call amounts are small, payments are final once the paid response or report is delivered. If you paid and did not receive what you paid for (an error response, a failed report), email dev@surewhynot.app with the transaction hash and we will re-run the work or refund the payment in USDC. On-chain network fees are outside our control and not refundable by us.
• SureWhyNot never takes custody of your funds. The receiving wallet is receive-only; settlement and verification happen on-chain through a standard x402 facilitator.

4. Acceptable use

• Do not use the Service for anything unlawful, or to harm, probe, or attack systems you are not authorized to test. The audit and inspection tools perform ordinary, read-only HTTP requests; they must not be used as part of an attack workflow.
• Do not attempt to circumvent rate limits, payment gates, or safety validation (including SSRF guards).
• Do not resell raw Service responses as your own competing API without adding material value.
• We may refuse, rate-limit, or block traffic that degrades the Service for others.

5. Dashboard, scores, badges, and reports

• Scores, checks, "top fix" summaries, and badges are automated, point-in-time technical assessments produced by our audit engine against publicly reachable endpoints listed in public discovery catalogs. They are informational only - not an endorsement, certification, security guarantee, or investment advice, and not a statement about any person or business.
• "Owner-verified" means the endpoint operator purchased a report for that endpoint; it does not mean we endorse the endpoint.
• Endpoint operators may request a re-check, correction, or removal review at dev@surewhynot.app. Scores cannot be bought or edited - re-audits use the same engine for everyone.
• Report contents, AI-written reviews, and recommended fixes are advisory. You are responsible for validating changes before applying them to production systems.

6. AI outputs

Some endpoints and reports include machine-generated content (summaries, translations, reviews). AI output can be wrong. It is provided as-is, is not professional advice, and must be verified before you rely on it.

7. Disclaimer of warranties

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, ACCURACY, OR UNINTERRUPTED AVAILABILITY. THE SERVICE DEPENDS ON THIRD-PARTY INFRASTRUCTURE (CLOUDFLARE, BASE RPC PROVIDERS, x402 FACILITATORS, EMAIL DELIVERY) THAT WE DO NOT CONTROL.

8. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, SUREWHYNOT, LLC WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR ANY LOSS OF PROFITS, DATA, OR GOODWILL, ARISING FROM OR RELATED TO THE SERVICE. OUR TOTAL AGGREGATE LIABILITY FOR ALL CLAIMS IS LIMITED TO THE GREATER OF (A) THE AMOUNTS YOU PAID TO THE SERVICE IN THE 12 MONTHS BEFORE THE CLAIM AROSE, OR (B) TWENTY-FIVE US DOLLARS ($25).

9. Indemnification

You will defend and hold harmless SureWhyNot, LLC and its members and agents from claims arising out of your misuse of the Service, your violation of these terms, or your violation of any law or third-party right.

10. Changes and termination

We may modify, price, suspend, or discontinue any part of the Service at any time. We may update these terms by posting a revised version with a new effective date at this URL (material changes are also noted in the changelog); continued use after posting is acceptance.

11. Governing law

These terms are governed by the laws of the United States and the state in which SureWhyNot, LLC is organized, without regard to conflict-of-law rules. Any dispute will be brought in the state or federal courts located in that state, and you consent to their jurisdiction.

12. Contact

Questions, refund requests, correction requests, and legal notices: dev@surewhynot.app.

See also Privacy, Security, and Transparency.