WHAT: Catalog of every PII and secret entity type, which ones run locally for free (pii_scan_text / pii_redact_text) vs only in the paid Actor (NER names/locations, street addresses, URL/PDF documents), redaction styles, and the price of every paid tool in this server. WHEN: Before pii_scan_text / pii_redact_text to pick entityTypes, or to explain coverage and costs to a user. WHEN NOT: To actually scan text (pii_scan_text) or redact it (pii_redact_text). COST: Free. Static local data; no network, no token. RETURNS: {detectors:[{type,category,rule,local}], redaction_styles, paid_pricing}. EXAMPLE: {} -> {"detectors":[{"type":"AWS_ACCESS_KEY","category":"secret","local":true},...]}

WHAT: Detect PII (emails, phones, US SSNs, Luhn-valid cards, mod-97 IBANs, UK NINOs, IPv4/IPv6) and secrets (AWS/GitHub/GitLab/Slack/Stripe/Google/OpenAI/Anthropic/HF/npm/SendGrid/Twilio/Azure keys, JWTs, private keys, URL credentials, key=value secrets) in text. Runs 100% on your machine. WHEN: Before sending prompts, tickets, logs or files to an LLM or third party; to audit text for leaked credentials. Findings are paged across all documents. WHEN NOT: To get sanitized text use pii_redact_text. For person names/addresses (NER), public URLs or PDFs use pii_guard_documents (paid). Not for images (no OCR). COST: Free. Local regex/validators only; no network, no APIFY_TOKEN, nothing sent anywhere. RETURNS: Paged {count,total,offset,hasMore,nextOffset,meta:{documents:[{doc_index,chars,finding_count,counts_by_type,risk_level}]},items:[{doc_index,type,category,rule,start,end,confidence,masked}]}. Raw values are never returned. Errors: INPUT_TOO_LARGE. EXAMPLE: {"texts":["Mail jane@acme.com, key AKIAIOSFODNN7EXAMPLE"]} -> 2 findings: EMAIL (masked "j***@a***.com"), AWS_ACCESS_KEY; risk_level "critical".

WHAT: Return sanitized copies of texts with every local PII/secret finding replaced (placeholder [EMAIL_1], mask, or salted hash). Placeholders are consistent across documents in one call. Runs 100% on your machine. WHEN: Right before sending user data to an LLM/third party. Use returnPlaceholderMap=true if you need to restore originals in the LLM answer later (do the restore yourself by string replacement). WHEN NOT: For a findings report only use pii_scan_text. For names/addresses NER, URLs or PDFs use pii_guard_documents (paid). COST: Free. Local only; no network, no token. RETURNS: Paged {count,total,...,items:[{type:"redacted_document",doc_index,chars,finding_count,counts_by_type,risk_level,output_text}],meta:{placeholder_map?}}. One item per document (page with limit/offset). placeholder_map contains the ORIGINAL sensitive values; omit unless needed. Errors: INPUT_TOO_LARGE. EXAMPLE: {"texts":["Call +1 415 555 0100 or mail jane@acme.com"]} -> output_text "Call [PHONE_1] or mail [EMAIL_1]".

WHAT: Runs the Fairquery Apify Actor llm-data-guard-pii-secrets: everything pii_scan_text does PLUS person-name/location NER, street addresses, public document URLs (txt/md/json/csv/HTML/PDF text layer, <= 10 MB) and restore mode (put originals back into LLM output using a placeholder map). WHEN: You need NER names/addresses, need to scan files at URLs/PDFs, or want the hosted pipeline. For plain text with regex-detectable PII/secrets prefer free pii_scan_text / pii_redact_text. WHEN NOT: Plain text scans (free tools), images (no OCR), email deliverability. COST: Paid, billed to YOUR Apify account via your APIFY_TOKEN: $0.003 per document + $0.0005 per finding (Actor fairquery/llm-data-guard-pii-secrets). Example: 10 docs with 20 findings ~ $0.04. RETURNS: Paged rows: type="document" (id, source, chars, mode, finding_count, counts_by_type, risk_level, findings[] masked, output_text, placeholder_map if requested) or type="error". Tool errors: APIFY_TOKEN_MISSING, APIFY_TOKEN_INVALID, APIFY_PAYMENT_REQUIRED, APIFY_ACTOR_RUN_FAILED, APIFY_TIMEOUT, INPUT_EMPTY. EXAMPLE: {"documentUrls":["https://example.com/report.pdf"],"mode":"redact","detectNames":true}

WHAT: Offline email checks: RFC-style syntax + normalization, common domain typo "did you mean" (gmial.com -> gmail.com), disposable/temporary domain (bundled CC0 list, ~thousands of domains), role account (info@, sales@), free webmail provider. WHEN: Fast pre-filtering of signups or lead lists, before paying for email_validate_deliverability. WHEN NOT: Does NOT check DNS/MX - it cannot tell whether the domain receives mail (verdict is "invalid", "risky" or "unknown", never "valid"). Use email_validate_deliverability (paid) for MX/SPF/DMARC. COST: Free. Pure local function; no network, no token. RETURNS: Paged items: {type:"email_check",input,email,syntax_valid,local_part,domain,verdict(invalid|risky|unknown),reasons[INVALID_SYNTAX|DISPOSABLE_DOMAIN|ROLE_ACCOUNT|FREE_PROVIDER|POSSIBLE_TYPO|DNS_NOT_CHECKED],did_you_mean,is_disposable,is_role_account,is_free_provider,dns_checked:false}; meta.summary counts by verdict. EXAMPLE: {"emails":["someone@gmial.com"]} -> verdict "risky", reasons ["POSSIBLE_TYPO","DNS_NOT_CHECKED"], did_you_mean "someone@gmail.com".

WHAT: Runs the Fairquery Apify Actor email-validator-mx-disposable: syntax, domain existence, MX/null-MX, disposable, role, free provider, typo suggestion, SPF/DMARC policy, mail provider; final verdict valid | risky | invalid | unknown. WHEN: Cleaning lists before a send, verifying a lead's domain can receive mail. Pre-filter with free email_check_syntax to avoid paying for obviously bad rows. WHEN NOT: Offline format/typo checks (free email_check_syntax). It does not SMTP-probe mailboxes. COST: Paid, billed to YOUR Apify account via your APIFY_TOKEN: $0.002 per email (+ $0.00005/run). 100 emails ~ $0.20. RETURNS: Paged rows type="email" (email, domain, verdict, reasons[], has_mx, mx_records, mail_provider, has_spf, has_dmarc, dmarc_policy, did_you_mean, ...) or type="error". Tool errors: APIFY_TOKEN_MISSING, APIFY_TOKEN_INVALID, APIFY_PAYMENT_REQUIRED, APIFY_ACTOR_RUN_FAILED, APIFY_TIMEOUT. EXAMPLE: {"emails":["john@stripe.com"]} -> verdict "valid", has_mx true, mail_provider "Google Workspace / Gmail".

WHAT: Static list of the official sanctions lists sanctions_screen_names checks (id, name, authority, download URL), the score scale and the legal disclaimer. WHEN: To choose the lists parameter, cite sources in a report, or explain coverage before paying. WHEN NOT: To screen a name (sanctions_screen_names, paid). It does not download lists or report freshness. COST: Free. Static local data; no network, no token. RETURNS: {sources:[{id,name,authority,url}],score_scale,disclaimer,pricing}. EXAMPLE: {} -> {"sources":[{"id":"OFAC_SDN","authority":"US Treasury OFAC",...},...]}

WHAT: Runs the Fairquery Apify Actor sanctions-watchlist-screener: fuzzy-match people/organisations against OFAC SDN, OFAC Consolidated, EU, UK and UN lists downloaded fresh from official sources each run; optional country/DOB filters. WHEN: KYC/KYB onboarding, vendor/counterparty checks, bulk re-screening. Put all names in ONE call (lists download once per run, ~10-40 s). WHEN NOT: PEP/adverse media, certified compliance decisions. For coverage info use free sanctions_list_sources. COST: Paid, billed to YOUR Apify account via your APIFY_TOKEN: $0.005 per name screened. 200 names ~ $1.00. RETURNS: Paged rows type="screening" (query, status potential_match|no_match, best_score, match_count, matches[] with list/programs/countries/score, lists_screened, lists_unavailable, disclaimer) or type="error". Tool errors: INPUT_EMPTY, APIFY_TOKEN_MISSING, APIFY_TOKEN_INVALID, APIFY_PAYMENT_REQUIRED, APIFY_ACTOR_RUN_FAILED, APIFY_TIMEOUT. Not a certified screening service. Automated fuzzy matching against public lists; false positives and misses are possible. Review every potential match manually and consult official sources/legal counsel before acting. EXAMPLE: {"queries":[{"name":"Banco Nacional de Cuba","entityType":"entity"}],"minScore":90} -> status potential_match (OFAC_SDN).

WHAT: Query the public OSV.dev database (api.osv.dev querybatch) directly from your machine for exact package versions; returns which are vulnerable and the advisory IDs. WHEN: Quick "is lodash 4.17.20 vulnerable?" checks for up to 200 packages; then osv_get_vulnerability for details of specific IDs. WHEN NOT: Parsing manifests/lockfiles, severity filtering, fixed/recommended versions in one shot -> osv_audit_dependencies (paid). COST: Free. Direct HTTPS to api.osv.dev only (Google-run public API); no token, nothing sent to Fairquery or Apify. 20 s timeout. RETURNS: Paged items {type:"package",ecosystem,name,version,vulnerable,vuln_count,vuln_ids[],osv_url} or {type:"error",code:INVALID_ECOSYSTEM}; meta.vulnerable_count. Tool errors: OSV_FETCH_FAILED (retryable). EXAMPLE: {"packages":[{"ecosystem":"npm","name":"lodash","version":"4.17.20"}]} -> vulnerable true, vuln_ids ["GHSA-35jh-r3h4-6jhm",...].

WHAT: Fetch full OSV records (summary, details, aliases, severity vectors, affected ranges, fixed versions, references) for advisory IDs directly from api.osv.dev. WHEN: You have IDs (from osv_query_packages or a report) and need details or the fixed version. WHEN NOT: To find which vulns affect a package version (osv_query_packages, free) or a whole manifest (osv_audit_dependencies, paid). COST: Free. Direct HTTPS to api.osv.dev only; no token. Max 25 IDs per call, 20 s timeout each. RETURNS: Paged items {type:"vulnerability",id,summary,details,aliases,severity,affected,references,published,modified,osv_url} or {type:"error",code:VULN_NOT_FOUND|OSV_FETCH_FAILED,id,retryable}. EXAMPLE: {"ids":["GHSA-35jh-r3h4-6jhm"]} -> lodash command injection, fixed in 4.17.21.

WHAT: Runs the Fairquery Apify Actor osv-dependency-vulnerability-check: parses package.json, package-lock.json (v1-v3), requirements.txt or go.mod (or a package list), checks OSV, and returns per-package max severity/CVSS, fixed versions, a recommended upgrade version and one row per vulnerability (deduped aliases). WHEN: Full project audits from a pasted manifest, CI-style reports, severity-filtered output. WHEN NOT: Quick checks of a few exact versions (osv_query_packages, free) or one advisory (osv_get_vulnerability, free). COST: Paid, billed to YOUR Apify account via your APIFY_TOKEN: $0.0009 per package + $0.0028 per vulnerability found (+ $0.00005/run). Use minSeverity="HIGH" to cut vuln rows. lodash+django (2 pkgs, 41 vulns) ~ $0.12. RETURNS: Paged rows type="package" (vulnerable, vuln_count, max_severity, fixed_versions, recommended_version), type="vulnerability" (id, cve_ids, severity, cvss_score, fixed_versions, osv_url) or type="error". Tool errors: INPUT_EMPTY, APIFY_TOKEN_MISSING, APIFY_TOKEN_INVALID, APIFY_PAYMENT_REQUIRED, APIFY_ACTOR_RUN_FAILED, APIFY_TIMEOUT. EXAMPLE: {"manifestText":"django==3.2.0\nrequests==2.19.0","minSeverity":"HIGH"}

WHAT: One call per batch of leads/counterparties: runs email_validate_deliverability on their emails and sanctions_screen_names on their person/company names IN PARALLEL, then merges results per lead with an overall decision: block (invalid email or sanctions potential_match), review (risky email), pass. WHEN: Onboarding customers/vendors, qualifying inbound leads, CRM hygiene where both email quality and sanctions exposure matter. WHEN NOT: If you only need one check, call that tool directly (cheaper). Free pre-filter: email_check_syntax. COST: Paid, billed to YOUR Apify account via your APIFY_TOKEN: $0.002 per lead with email + $0.005 per lead with name (= $0.007 per full lead). 2 Actor runs per call. 100 full leads ~ $0.70. Takes ~15-45 s (sanctions list download). RETURNS: Paged items {type:"lead",ref,email,name,decision(pass|review|block),reasons[],email_verdict,email_reasons,did_you_mean,sanctions_status,sanctions_best_score,sanctions_matches[top 3]}; meta.summary counts by decision, meta.disclaimer. Partial failure: affected check shows "unavailable" and meta.errors lists codes. Tool errors: INPUT_EMPTY, APIFY_TOKEN_MISSING. EXAMPLE: {"leads":[{"ref":"L1","email":"cfo@acme.com","name":"Acme Trading LLC","country":"US"}]} -> {decision:"pass",email_verdict:"valid",sanctions_status:"no_match"}