Plain thesis: Oimpact ships one genuinely real agent-facing door (api.oimpact.ai) and a lot of doors that look open but aren't. This brief is credit-first: where Oimpact is ahead, it says so, then names exactly what an agent (not a person clicking around) actually finds at each documented path, with the command to check it yourself.
No jargon. Oimpact shipped a real working API on day one, ahead of institutions many years older. Every fix below is about the things an agent reads first finally telling the truth. Here is what each one is worth.
Your API root names a docs URL that 404s, so an agent following your own machine-readable pointer hits a wall immediately; a working link keeps that agent moving toward integration instead of bouncing.
Every discovery path returns a shell that echoes back whatever was asked for, so an agent is told an agent-card exists when it doesn't; honest responses (and one real llms.txt) let agents find the working API you already shipped.
With no SPF or DMARC on a live Google Workspace domain, your published partnership inbox is fully spoofable; two DNS records protect a brand-new brand's first real conversations.
Your whitepaper says each mint should reference real-world evidence, but there's no funded record of the field labor a carbon credit needs before retirement; adding that object makes “Real-World Impact” verifiable, not just minted.
A bare, unauthenticated GET to the API root returns real JSON, not a redirect, not an SPA shell, naming the service ("OpenImpact API"), describing itself ("OpenAI-compatible AI-agent API. This host is for programmatic use."), linking the consumer app, pointing to a docs URL, and listing five real endpoints: POST /v1/chat/completions, POST /v1/agents, POST /v1/agents/:id/messages, GET /v1/usage, GET /v1/balance. Calling the two documented GET endpoints with zero credentials returns a clean, honest 401 ({"error":"unauthorized"}): real auth logic, not a soft-200 pretending to succeed and not a crash. Any client already speaking the OpenAI chat-completions shape can talk to this host with zero new integration code.
Sources: api.oimpact.ai/ · api.oimpact.ai/v1/usage · api.oimpact.ai/v1/balance
The exact JSON in finding 1 names its own documentation location: github.com/ecoWarriors/openimpact/blob/main/docs/B2B-INTEGRATION-BRIEF.md. That repository is a true 404, confirmed two ways: the public, unauthenticated GitHub REST API returns 404, and the rendered GitHub page itself returns a true 404 (not a soft page). The org "ecoWarriors" is real and public: it has 11 repositories, every one archived, every one predating this product by years (Solana-era EcoToken/EcoNFT work, an Aptos ecological-credit bridge), but no repo named openimpact in any capitalization or hyphenation exists there, public or discoverable. An agent that trusts Oimpact's own machine-readable pointer and tries to read further hits a wall on the very next hop.
Sources: api.oimpact.ai/ (the "docs" field) · api.github.com/repos/ecoWarriors/openimpact · api.github.com/orgs/ecoWarriors
On oimpact.ai (the marketing/product SPA, not the API host), every standard agent-discovery path checked (robots.txt, sitemap.xml, llms.txt, llms-full.txt, ai.txt, humans.txt, openapi.json, and six /.well-known/* agent-discovery conventions) returns HTTP 200 with a body within a handful of bytes of a nonsense-path control. A byte-for-byte diff of the agent-card.json response against a random nonsense path shows exactly one line differs: an injected <meta property="og:url"> tag that simply echoes back whatever path was requested: the app doesn't just fail to distinguish real from fake, it actively affirms whatever a client asks for. Content-type on every one of these responses is text/html, never JSON or plain text. There is no real static file anywhere on the marketing domain, not even a robots.txt.
Sources: oimpact.ai/.well-known/agent-card.json · oimpact.ai/robots.txt · oimpact.ai/sitemap.xml
oimpact.ai has no SPF record and no DMARC record at all: both lookups return nothing, checked against the local resolver and independently against 1.1.1.1. This isn't a domain that simply doesn't do email: real MX records point to Google Workspace (aspmx.l.google.com and alternates), and the site itself publishes a working inbox ([email protected], in the on-site "Charity partnership enquiry" link). With no authentication policy published, that address, and any other @oimpact.ai address, including one a real partner might be told to email, is fully spoofable.
Sources: DNS TXT/MX lookups for oimpact.ai and _dmarc.oimpact.ai
Rather than reverse-engineering computed CSS, this brief's brand-matched demo (next page) uses hex values Oimpact publishes itself: a two-layer palette (Impact Green identity, plus a Signal-Teal/RWI-Gold/deep-space product palette), a documented type system (Sora / DM Sans / JetBrains Mono), logo do/don't rules, a voice guide, and ranked taglines: genuinely thorough for a day-one launch. The page even names its own open design question ("the logo is green; the app's primary accent token is teal... recommend documenting whichever you choose so it stops drifting"), the kind of self-aware detail that's rare to see published. Separately, and worth stating for calibration: Oimpact's own /leaderboard says, verbatim, "JUST LAUNCHED, 33 agents are live but the marketplace is hours old, stats are zero today", every listed agent shows $0 raised. Findings 2–4 above should be read against that timeline, not as neglect.
Sources (rendered content, headless Chromium): oimpact.ai/brandkit · oimpact.ai/leaderboard
Oimpact's own whitepaper defines RWI ("Real-World Impact") plainly: it is "minted only by funding real-world outcomes," and "each mint/update references evidence (attestations, oracle data, registry IDs)." One of Oimpact's three starter agent templates, "Eco," is described on-site as funding verified carbon removal "via climate.0g.ai" and minting RWI per tonne removed. That dashboard is real and live: run by 0G Labs itself, citing "4,000+ tCO2e retired" through Regen Network's "City Forest Credits," at a stated cadence of 0.005 tCO2e every 5 minutes (its own agent-discovery paths are true 404s too, honestly, matching a control, a smaller, cleaner gap than finding 3). But nowhere in Oimpact's documented stack (the whitepaper, the API, the marketplace listing copy) is there a funded, verified record of the field labor a City Forest Credit requires before it can be retired at all: an MRV monitoring visit, a planting-verification walk, a boundary survey. EcoWealth's EWP already produces exactly that evidence object (photo+GPS+signature proof, on-chain settlement), live on Base mainnet, retiring through the same Klima/Regen rails climate.0g.ai's own credit source belongs to. It's the "evidence" field Oimpact's own whitepaper already says an RWI mint should carry.
Sources: climate.0g.ai/ · oimpact.ai/whitepaper.pdf ("Definition. RWI...") · basescan.org/address/0x76c17C51336BE7B39F5164802e08b9811477A14B
Nothing here is a security incident or a broken product: Oimpact shipped a real, working agent API on literally its first day, which is genuinely ahead of many far-older institutions we've reviewed. The pattern across findings 2–4 is narrower: the things an agent (not a person) actually reads first, a docs pointer, a well-known path, an email policy, don't yet tell the truth, even though the capability underneath (the API in finding 1, the brand system in finding 5) is real and good. And underneath the marketplace's core promise (verified real-world impact, minted on-chain), the actual proof-of-labor layer a credit needs doesn't exist in Oimpact's own stack yet, though the rail it would plug into (Klima/Regen, already touching the same credit registry climate.0g.ai cites) is live and running today.
→ See what an RWI mint looks like with that evidence layer underneath it
