HexRail is the security layer for agentic Robinhood apps.

curl -sS https://hexrailsec.io/api/guard/robinhood/0x<robinhood-usdc-address> | jq

# Returns:
# {
#   "decision":     "review",       # low_risk_signal | review | block_for_review | needs_scan
#   "score":        88,
#   "grade":        "B",
#   "easAttested":  true,
#   "attestationUrl": "<robinhood-eas-explorer>/attestation/view/0x963c…cad2",
#   "riskSurface":  { "admin_power": …, "upgradeability": …, … },
#   "proofStatus":  "needs_context",
#   "reasons":      [...],
#   "recommendedAction": "Review the flagged signals before integrating or interacting.",
#   "receiptUrl":   "https://hexrailsec.io/r/hsdoroxj",
#   "guardUrl":     "https://hexrailsec.io/guard/robinhood/0x833589…",
#   "stale":        false,
#   "source":       "cached_receipt"
# }

async function hexrailGuard(address: string) {
  const res = await fetch(`https://hexrailsec.io/api/guard/robinhood/${address}`);
  if (!res.ok) return { decision: "needs_scan" as const };
  return res.json() as Promise<{
    decision: "low_risk_signal" | "review" | "block_for_review" | "needs_scan";
    score?: number; grade?: string;
    easAttested: boolean;
    reasons: string[];
    recommendedAction: string;
    robinhoodNativeSignals?: { ruleId: string; severity: string; title: string }[];
    guardUrl: string;
    receiptUrl?: string;
    attestationUrl?: string;
  }>;
}

// Use it before any tx that depends on a contract address you haven't audited.
const { decision, guardUrl } = await hexrailGuard(targetAddress);
if (decision === "block_for_review") {
  throw new Error(`HexRail preflight: BLOCK FOR REVIEW. See ${guardUrl}`);
}
if (decision === "needs_scan") {
  // No public preflight on file — show user the Guard Link so they can run one.
  console.warn(`No HexRail preflight yet. Run one: ${guardUrl}`);
}
// decision === "review" or "low_risk_signal" → caller decides how to handle.