Base Gas Price

Paid DNS record lookup (A/AAAA/MX/NS/TXT/CNAME) via Cloudflare DoH

Paid WCAG-light accessibility audit (html lang, alt-text coverage, label/aria-label on inputs, ARIA roles, table th scope, button accessible name, tabindex, autocomplete + A-F grade) via x402

Paid deep WAI-ARIA accessibility audit (cycle 113) — parses every element with role= or aria-*, checks INTERACTIVE ROLES MISSING ACCESSIBLE NAMES (button/checkbox/combobox/img/link/listbox/menu/menuitem/option/progressbar/radio/scrollbar/search/slider/spinbutton/switch/tab/tabpanel/textbox/tree/treeitem — must have aria-label/aria-labelledby/inner-text), REQUIRED PARENT ROLES (combobox-in-listbox, menuitem-in-menu, option-in-listbox, tab-in-tablist, row-in-grid, etc), DISALLOWED ARIA...

Paid affiliate-program presence detection — 17-path landing-page probe with content signals + 16-network fingerprint (ShareASale/CJ/Impact/PartnerStack/Awin/Rakuten/ClickBank/Refersion/FirstPromoter/Tolt/LemonSqueezy/Gumroad/Rewardful/Tapfiliate/Tune/Everflow) + 2 outbound affiliate-link patterns + FTC disclosure language detection + partner-nav header scan + verdict + affiliate_program_score 0-100 A-F grade via x402

Paid agent cost calculator — detects auth scheme (Bearer/ApiKey/session_cookie/none) + rate-limit headers + CORS policy + cache max-age + compression + paid-API indicators (Stripe/Gumroad/pricing/checkout); returns estimated_cost_per_call_usd (free/low/medium/high) + agent_cost_score 0-100 A-F + findings[] via x402

Paid META-API cost projector for THIS service (cycle 98) — given calls_per_day + route list (or "all") + period (daily|weekly|monthly), pulls the live x402 price catalog and projects aggregate_daily_cost_usd + aggregate_weekly + aggregate_monthly + aggregate_yearly + period_total; returns per-route cost breakdown + cheapest_route + most_expensive_route + verdict (pennies/affordable/moderate/expensive/prohibitive) + is_viable_for_high_volume + recommendations[] (e.g. "use /api/og instead of...

Paid AI-agent cost-trend analyzer + multi-target batch estimator (cycle 178, x402 $0.001) - accepts POST application/json {'targets':[{'url':...,'weight':..}, ...]} OR POST application/json {'urls':[...],'weighting':'equal|price'} OR POST application/json {'url':...} (single) OR GET ?urls=u1,u2,u3 OR GET ?sample=3|5 (built-in test URLs); per-target parallel probes (HEAD + 10-path surface check via ThreadPoolExecutor max=8) capture status + auth_scheme...

Paid AI discovery surface cross-validator (cycle 104) — fetches 4 surfaces (llms.txt + /.well-known/security.txt + openapi.json + agents.txt); extracts the contact claim from each (H1 title / RFC 9116 Contact / openapi.info.title / agents.txt H1); cross-compares domains + org-names + openapi servers[]; reports agreements/disagreements + identity_consensus bool + consistency_score 0-100 A-F. Different from /api/agent-friendliness (presence-only scoring) and /api/llms-txt-author (single-source...

Paid composite AI-agent friendliness score — rolls up 9 AI-relevant discovery surfaces (llms.txt + llms-full.txt + sitemap.xml + RSS/Atom + robots.txt AI-bot allow-rate + openapi.json + webmanifest + .well-known/agents.txt + security.txt), per-surface status+size+points + composite agent_friendly_score 0-100 A-F + agent_friendly bool + top_recommendations[] for the surfaces with 0 points via x402

Paid open-source LICENSE evolution / migration analyzer (cycle 179, x402 $0.001) - accepts GET ?repo=<ORG>/<REPO> (e.g. elasticsearch/elasticsearch) OR ?url=https://github.com/<...> OR ?package=<NPM-PKG-NAME> (resolves npm registry license metadata) OR ?sample=redis|elasticsearch|mongodb|hashicorp_vault|react|tensorflow|gpl_oldschool|agpl_sample (built-in famous-migration fixtures). For github repo: HEAD-probes 10 candidate LICENSE files...

Paid RFC 7807 (Problem Details for HTTP APIs) conformance probe (cycle 168, x402 $0.001) - 6 candidate API paths (/api+/api/v1+/api/v2+/v1+/v2+/graphql) each probed with 5 malformed payloads (GET bad query / POST wrong Content-Type text/plain / POST malformed JSON / POST empty body / PUT bad-uuid-shape path). Each error response (4xx/5xx not 401/403/404) classified by content-type: application/problem+json with type+title+status = RFC 7807 §3.1 full conformance (20pts/response) /...

Paid multi-source search evidence card (cycle 218, x402 $0.01) - GET ?query=<TERMS> OR ?sample=1|2|3 OR POST application/json {query}. KEYLESS Wikipedia search API + OpenLibrary search API + Hacker News Algolia API -- no key, no account, no signup. Answers THE QUESTION A BUYER AGENT ALWAYS ASKS BEFORE SPENDING A TOKEN: what the published sources actually show about this, and how many INDEPENDENT sources agree. Returns per-source hit counts, the matched titles/snippets, cross-source AGREEMENT...

Paid AI-agent tool-call card generator (cycle 105) — accepts GET ?url=<TARGET> OR POST application/json {url: <TARGET>}; probes /.well-known/x402 + 4 OpenAPI candidate paths + /llms.txt; aggregates into a single structured "tool card" object: {card_id, target_url, name, description, vendor, kind, is_paid, x402{pay_to,asset,network,endpoint_count,min/max/median_price_usdc,sample_endpoints}, openapi{version,title,path_count,sample_paths[]}, llms_txt{h1,first_paragraph}...

Paid TLS server-cert trust chain inspection (cycle 126, x402 $0.001) - opens TLS via ssl.create_default_context, pulls full DER chain via get_verified_chain(), parses each cert (subject/issuer/not_before/not_after/key_type/key_size/sig_alg/pathLenConstraint/nameConstraints/EKU), validates chain build (each cert issuer = next cert subject), verifies root against system trust store, flags expired certs / SHA-1+MD5 signatures / weak RSA keys / DSA keys, computes chain_complete + root_trusted +...

Paid composite AI-agent onboardability summary (cycle 120, x402 $0.001) - single-call composite that answers 'could an AI agent onboard to use this URL as a paid tool?' - fetches target URL + probes /openapi.json + /.well-known/x402 + /llms.txt + /.well-known/security.txt + /.well-known/mcp.json + /.well-known/agents.txt + /robots.txt AI-bot policy; computes 7 weighted sub-checks (machine_readable_api 0-15 + machine_readable_x402 0-15 + ai_discovery_surface 0-12 + security_trust_signal 0-15...

Paid AI-agent readiness card composer (cycle 157, x402 $0.001) - produces a single structured card telling an AI agent whether a target URL is safe+affordable to call. Scores 6 axes (each 0-100) with equal weight: llms.txt presence (documentation), robots.txt AI-bot allowance (8 top commercial crawlers), OpenAPI/Swagger schema presence, /.well-known/x402 paid-API discoverability, auth-scheme clarity (Bearer/API-key/password detected in page), live health-endpoint presence. Returns card_id +...

Paid AI training / retrieval crawler policy audit (cycle 117) — fetches /robots.txt + /llms.txt + /llms-full.txt + /meta-robots + probes 3 ai.txt paths (/.well-known/ai.txt + /.well-known/ai-crawler-policy + /ai.txt), classifies per-UA policy for 19 AI crawlers across 4 categories: training (GPTBot/ClaudeBot/Claude-Web/anthropic-ai/Google-Extended/CCBot/PerplexityBot/Bytespider/cohere-ai/Applebot-Extended/Meta-ExternalAgent/Diffbot) + retrieval...

Paid AI-citable source credibility scorer (cycle 109) — fetches URL, extracts article text + meta description + article:published_time, then computes 6 sub-scores: hedging language density (30 terms tracked), sourcing (citation markers + realistic citation-link count per 1000 words), sensationalism (caps density + exclamation rate + 20 urgency terms), one-sidedness (22 counterpoint terms), freshness (published_at vs now + claimed-recency hints in body), and content fingerprint (sha256 of...

Paid AI bot policy audit via x402

Paid top anchor-text frequencies + internal/external classification + nofollow/sponsored/ugc counts + empty-anchor + generic anchor-text detection, A-F grade via x402

Paid machine-API discovery rollup — link rel=alternate (oembed/atom/rss/jsonfeed) + HTTP Link header + JSON-LD Action/EntryPoint/Service + declared-spec-path probes (/llms.txt, /openapi.json, /swagger.json, /graphql, /.well-known/ai-plugin.json) + spec_ui script detection + machine_readability_score 0-100 with A-F grade + citations_api boolean via x402

Paid API-freshness probe (cycle 96) — HEAD-probes 10 conventional health/version endpoints (/health, /healthz, /ready, /readyz, /livez, /api/health, /api/version, /api/status, /api/ping, /api/info); per-probe status + latency_ms + content_type; attempts to extract version_hint from /api/version JSON; returns api_freshness_score 0-100 A-F + alive_count + findings[] via x402

Paid auth-method discovery — WWW-Authenticate header + RFC 8414 oauth-authorization-server + OpenID Connect discovery + JWKS + RFC 8705 oauth-protected-resource + login-form introspection, surfaces bearer/basic/oauth2/oidc/jwt/session-cookie methods + auth_scheme_score A-F grade via x402

Paid BGP route-leak + prefix-hijack exposure probe (cycle 126, x402 $0.001) - resolves target host via Cloudflare DoH, queries RIPEstat prefix-overview for each IP, classifies announcing ASNs + holders, computes consensus (max ASNs per prefix), holder_match_ratio (fuzzy match vs target domain), crowded_prefix (RFC 7908 hijack indicator), single-ASN announcements vs multi-homed redundancy, returns asn_count + asn_set + holder_set + per_prefix[] + consensus_max + holder_match_ratio +...

Paid BIMI selector + rotation-cadence auditor (cycle 168, x402 $0.001) - probes 14 conventional BIMI selectors via Cloudflare DoH TXT (default._bimi.<d>, bimi._bimi.<d>, brand._bimi.<d>, logo._bimi.<d>, bimi1/_bimi2/_bimi.<d>, b2022q1/q2, b2023q1/q2, b2024q1/q2, b2025q1/q2). For each present selector parses v=BIMI1 + l=<SVG URL> + a=<VMC URL> + s=<ESP-tag> + p=<policy URL>. Computes distinct_svg_count + distinct_vmc_count + quarter_tagged_selectors + has_default_selector + multi_esp_overlap...

Paid brand-impersonation risk synthesis (cycle 106) — aggregates 8 signals (domain age via crt.sh, BIMI RFC 8848 record, RFC 9116 security.txt, llms.txt presence, /.well-known/x402 honest declaration, https→http redirect sanity, DMARC TXT, brand-lookalike string-similarity of page title/H1/domain SLD against 50 most-impersonated brands with Levenshtein-1 detection) into a single 0-100 trust_score with impersonation_risk verdict (very_low/low/moderate/high/very_high) + A-F grade + per-signal...

Paid Cache-Control header granularity audit (cycle 119, x402 $0.001) - fetches target URL, parses every Cache-Control directive (max-age / s-maxage / stale-while-revalidate / stale-if-error / public / private / no-cache / no-store / immutable / must-revalidate / proxy-revalidate), inspects Vary header for advisory-low patterns (User-Agent / 0 entries / >6 entries), reads Age/X-Cache/cf-cache-status CDN hit state, detects private vs CDN-cache conflicts, computes max-age band + s-maxage...

Paid cache-freshness strategy audit — probes HTML page + /favicon.ico + /robots.txt + /sitemap.xml + first stylesheet URL + first script URL; for each captures Cache-Control directives + ETag + Last-Modified + Age + Vary + Expires + Surrogate-Control + CDN headers + Set-Cookie count, scores per-asset cacheability_score 0-100 A-F, aggregate cache_freshness_score 0-100 A-F grade via x402

Paid web-cache-poisoning + deception active probe (cycle 145, x402 $0.001) - 5 unkeyed-header probes (X-Forwarded-Host + X-Original-URL + X-Forwarded-Prefix + X-Host + X-Forwarded-Server + X-Forwarded-For + X-Forwarded-Proto + X-Original-Host + X-Rewrite-URL) checking body-hash divergence WITHOUT Vary disclosure; 4 cachebuster-query probes (cb + nocache + utm_source + gclid) checking query-keying; 4 web-cache-deception path probes (robots.txt + .css + .js + .png). Detects...

Paid canonical URL consensus audit — link rel=canonical + HTTP redirect final + og:url + twitter:url + JSON-LD url/@id/mainEntityOfPage + hreflang x-default compared, consensus URL + agreement_count + canonical_health_score A-F grade + findings via x402

Paid CAPTCHA + bot-management vendor detection (cycle 94) — page-level fingerprint of 11 vendors (reCAPTCHA v2/v3/enterprise + hCaptcha + Cloudflare Turnstile + Cloudflare challenge page + Arkose Labs + GeeTest + DataDome + HUMAN/PerimeterX + Akamai Bot Manager) + 6 challenge-page indicators + bot-management cookies; returns captcha_vendors + bot_managers + challenge_page_indicators + is_protected + is_challenge_page + captcha_score A-F + recommendations via x402

Paid page carbon footprint (bytes, gzip ratio, CO2 per visit, A-F grade) via x402

Paid x402 seller catalog-integrity audit (cycle 185, x402 $0.001) - audits an x402 seller's OWN paid-route catalog for the defects that mechanically suppress demand. GET with no params audits THIS seller live against its own live surfaces; POST application/json {domain:'https://seller.example'} audits any third-party seller. Fetches /.well-known/x402, then checks: cart_or_quote_endpoint presence (a buyer cannot price a workflow if none exists), price_tier_histogram_usd + min/max...

Paid CDN cache-key collision probe (cycle 139, x402 $0.001) - actively fetches target with 4 probe pairs (Accept-Language en-vs-es / Accept-Encoding gzip-vs-br / Cookie session vs no-session / User-Agent desktop-vs-mobile) and compares response hashes to detect cache-key partitioning failures. CRITICAL severity for auth+cookie collisions (cache-leak vulnerability class), HIGH for Accept-Language when Vary says it should partition, MEDIUM for User-Agent desktop/mobile collision, LOW for...

Paid CDN cache-key probe via 4-variant request burst (cycle 134, x402 $0.001) - fetches target 4x with different dimensions (baseline, ?cb=12345, Accept-Language: fr, Accept-Encoding: identity), captures X-Cache/CF-Cache-Status/X-Vercel-Cache/Akamai/Vary/ETag/Last-Modified/Age headers per call, hashes first 8KB of each body, reports per-dimension cache_split/cache_unified verdicts, baseline cache-hit age, Vary-advertised check, cache_key_fidelity_score 0-100 A-F. Distinct from...

Paid CDN edge-coverage audit — 5 anycast probe points (Cloudflare/Google/Quad9/OpenDNS/CIRA), per-tenant reachability + edge diversity + PoP region detection + cdn_coverage_score A-F grade via x402

Paid CDN-edge fingerprint detector — 24-vendor catalog (Cloudflare/CloudFront/Fastly/Akamai/Vercel/Netlify/Google Cloud CDN/Azure Front Door/StackPath/BunnyCDN/KeyCDN/Cloudflare Workers/F5/WordPress VIP/Rackspace/Edgecast/VelocityEgress/Sucuri/SiteGround/SquareSpace/Wix/Shopify CDN/AHA-SLOWLY CDN), parses response headers + cookie-domain fingerprint + Server/X-Powered-By + edge-region via cf-ray/x-amz-cf-pop/x-served-by/x-vercel-id/x-azure-ref, primary_vendor + confidence...

Paid CDN edge cache-key constructor analyzer (cycle 158, x402 $0.0005) - actively probes the CDN edge cache across 9 variation dimensions (Accept-Language, Accept-Encoding, User-Agent, Cookie, Authorization, Origin, Referer, Accept, Query param) via paired baseline+variant cachebuster requests, hashes body responses with SHA-256 (truncated 16), and reports which dimensions ARE differentiated by the CDN cache key vs which collide. CRITICAL severity for cookie/authorization cache-key collision...

Paid CDN / edge-provider detection from response headers (cycle 116) — fetches target URL, inspects 25+ CDN-specific response headers (CF-Ray/CF-Cache-Status/CF-Request-Id + X-Amz-Cf-Id/X-Amz-Cf-Pop + X-Vercel-Id/X-Vercel-Cache + X-Served-By/X-Fastly-Request-Id + X-Akamai-Request-Id/Akamai-Request-Bcst + CDN-Pullzone-Id/Bunny + X-NF-Request-Id + Via: chain + Server/X-Powered-By); returns detected_cdn[] (vendor+evidence+matched_headers[]+confidence) + edge_location...

Paid CDN edge-runtime fingerprint + cold-start probe (cycle 163, x402 $0.001) - actively probes for serverless edge-compute runtimes (Cloudflare Workers/Vercel Edge Functions/Fastly Compute@Edge/Akamai EdgeWorkers/CloudFront Lambda@Edge/Netlify Edge/Deno Deploy/Bunny.net Edge) by examining 8 probe axes: (1) vendor header signature (CF-Ray/X-Vercel-Id/X-Amz-Cf-Id/X-Akamai-Request-ID/X-Netlify-Request-ID/X-Bunny-Cache); (2) Server header fingerprints matching 8 edge runtime families; (3) 14...

Paid CT-log certificate pre-fingerprint (cycle 124, x402 $0.001) - queries crt.sh for the target domain, parses every returned certificate record, and aggregates total_certs_observed + unique_sha256_count + duplicate_cert_count + self_signed_count + soon_to_expire_30d + issuer_distribution (top 5 CAs) + key_type_distribution (RSA/ECDSA/Ed25519) + signature_algorithm_distribution (SHA-1/SHA-256/SHA-384) + validity_period_buckets (<90d/90-398d/>398d) + apex_in_san_set + unique_sans_approx +...

Paid Certificate Transparency log auditor (cycle 85, x402 $0.001) - GET ?domain=<DOMAIN> queries crt.sh for issued certificates and reports issuer distribution, certificate records, first/last-seen timestamps and an A-F graded ct_score. via x402

Paid citation-density + source-quality audit — counts anchor + JSON-LD + cite + blockquote + soft-text outbound references, classifies by tier (primary .gov/.edu/standards / secondary news+publishers / tertiary blogs / self), returns citation_score 0-100 with A-F grade via x402

Paid clickjacking-protection audit (cycle 115) — fetches the page headers + body, audits (a) X-Frame-Options presence + value (DENY/SAMEORIGIN valid, ALLOW-FROM deprecated per Chrome/Edge), (b) CSP frame-ancestors policy across all CSP headers incl. report-only, classifies policy as none/self/wildcard/domain_list/domain_list_with_wildcard, (c) meta http-equiv X-Frame-Options (insecure — header is the real source), (d) JavaScript frame-busting code patterns (top.location=, self!==top guard —...

Paid Client Hints + Permissions-Policy probe (cycle 97) — captures Accept-CH (RFC 7231 §5.3.7) + Critical-CH (RFC 9981) request lines for Server Hints, parses Permissions-Policy header for feature gating intent; per-hint high_entropy flag for W3C high-entropy identifiers; requested_hints[] + requested_permissions[] + hint_count + critical_hint_count + permission_count + entropy_score 0-10 + fingerprint_risk low/medium/high/extreme + client_hints_score 0-100 A-F + findings[] via x402

Paid AWS S3 bucket public-read ACL + listability probe (cycle 155, x402 $0.001) - resolves target domain + derives 8 conventional bucket-name candidates (apex + hyphen_to_dot + -backup/-backups/-prod/-staging/-dev/-assets variants), for each candidate attempts ANONYMOUS GET against https://<bucket>.s3.amazonaws.com/?list-type=2 and follows region redirects to the region-specific endpoint (https://<bucket>.s3.<region>.amazonaws.com). Detects 404 NoSuchBucket, 403 AccessDenied (private)...

Paid DNS CNAME chain tracer (cycle 175, x402 $0.001) - accepts ?host=<HOST> OR ?domain=<HOST> OR ?url=<URL>; actively follows CNAME + A/AAAA hops via Cloudflare DoH for the target host (up to 12 hops with loop detection); returns chain_depth + hops[] (per-hop {hop, name, type CNAME|A|AAAA|NXDOMAIN|LOOP, data, ttl}) + final_a_records + cdn_detected[] (28 known CDN-suffix fingerprints: Cloudflare/CloudFront/Akamai/Fastly/Vercel/Netlify/Heroku/etc) + loop_detected + findings[] +...

Paid composite agent-trustworthiness score — security headers (HTTPS/HSTS/CSP/XFO/XCTO/RP/PP) + discoverability (robots/sitemap/llms.txt/security.txt) + standards (structured data/lang/cookie consent) rollup with A-F grade and prioritized findings via x402

Paid domain contactability audit — email/phone/physical-address/contact-page/social-profile/live-chat/contact-form detection with contactability_score 0-100 A-F grade via x402

Paid content-freshness detector (publish/modified dates from meta/JSON-LD/HTTP headers/time elements, age in days, A-F grade) via x402

Paid content hash + integrity ledger (cycle 217, x402 $0.01) - GET ?text=<STRING> OR ?data=<BASE64> OR ?sample=1|2|3 OR POST application/json {text|data}. Computes every digest an AI agent needs BEFORE it trusts a downloaded artefact: sha256, sha512, sha384, blake2b, sha1 and md5 in hex, the Subresource Integrity (SRI) form <alg>-<base64>, plus base64 / base64url / hex / urlencode encodings of the payload, the input byte length and its Shannon entropy (so an agent can tell a real file from...

Paid Content Language detector (cycle 139, x402 $0.001) - fetches URL + extracts language declarations across html lang attribute + HTTP Content-Language header + og:locale/og:locale:alternate + hreflang link tags + meta http-equiv=Content-Language + JSON-LD inLanguage (string or array). Returns primary_language + primary_source_count + declared_languages[{language,source_count,sources}] + consistency_score (100=single lang, 80=multilingual single root, 30=conflicting) +...

Paid readability + per-paragraph reading-time estimator (cycle 110) — fetches URL, extracts paragraph-level text, then computes 6 readability formulas (Flesch, Flesch-Kincaid, Gunning Fog, SMOG, Coleman-Liau, ARI) + total reading_time_minutes + per_paragraph[{word_count, reading_time_seconds, flesch, grade_estimate}] + target_audience_verdict + is_dense/is_easy/is_long_form flags + 0-100 content_readability_times_score A-F. Different from /api/readability-multi (sentence complexity only) and...

Paid cookie banner UX + dark-pattern audit — 19-CMP fingerprint + Accept/Reject parity + Manage-preferences link + pre-ticked toggles + cookie-wall + Reject click-depth + CCPA Do-Not-Sell + granular categories, cookie_banner_score 0-100 A-F grade via x402

Paid Set-Cookie × shared-cache disclosure scanner (cycle 148, x402 $0.001) — probes 8 sensitive paths on target origin (/login + /api/me + /api/session + /account + /profile + /dashboard + /me + /api/user, + optional extra) in parallel, for each: captures Set-Cookie count + cookie names classified as sensitive (session/auth/jwt/token/csrf/__Secure-/etc.) + Cache-Control + Vary, classifies cache directive as shareable per RFC 9111/7234 (public / s-maxage / max-age only / no Cache-Control =...

Paid GDPR/CCPA cookie consent audit (CMP detection, cookie categorization, security attrs) via x402

Paid Set-Cookie security-attribute audit (per-cookie Secure/HttpOnly/SameSite/Max-Age/Size/Priority/Partitioned + issue flags + A-F grade) via x402

Paid cookie partition consistency audit (cycle 130, x402 $0.001) - probes 6 conventional paths (apex/login/signup/api/cart/account), parses Set-Cookie from each, groups by cookie name across responses, flags inconsistencies in Secure/HttpOnly/SameSite/Path/Domain/Partitioned flags. Returns per_cookie[] + conflict_count + high_severity_conflict_count + partition_consistency_score 0-100 A-F. Catches privacy leaks from inconsistent partitioning (e.g. /login sets Secure cookie but /api sets...

Paid cookie name-prefix (__Secure-/__Host-) policy audit (cycle 115) — fetches page Set-Cookie headers, for each cookie: extracts Secure/Path/Domain/HttpOnly/SameSite attributes, flags __Secure- prefix and checks Secure attribute is set (browser drops otherwise), flags __Host- prefix and checks Secure + Path=/ + no Domain (browser drops otherwise — strongest cookie scoping), classifies cookie as session/auth/csrf/token/tracking/other by name pattern, REVERSE-audits sensitive cookies that...

Paid per-cookie IAB TCF v2.2 purpose classification (cycle 112) — fetches URL with HTTPCookieProcessor, captures every Set-Cookie, extracts inline document.cookie= writes, classifies each cookie by NAME heuristics (ga/_ga = Google Analytics, _fbp/fr = Facebook, _gcl_au = Google Ads, _hj = Hotjar, _pk_ = Matomo, li_/lidc = LinkedIn, _ttp = TikTok, twid = Twitter/X, ide/_gads = DoubleClick, csrf/sid = strictly-necessary) and DOMAIN fallback (third-party opaque = targeting). Returns per-cookie...

Paid per-cookie security-flags deep audit — parses every Set-Cookie individually for SameSite (Strict/Lax/None/missing/Lax-by-default-heuristic) + Secure + HttpOnly + Path + Domain (broad-domain detection) + Max-Age + Expires + Session-cookie detection + __Host- + __Secure- prefix validation (RFC 6265bis) + SameParty + Partitioned (CHIPS), flags samesite_none_without_secure (rejected-by-browsers), session_token_no_httponly, prefix_violation, broad_domain_cookies, cookie_samesite_score 0-100...

Paid CORS policy audit — baseline GET captures all Access-Control-* response headers (ACAO/ACAC/ACAM/ACEH/ACMA/ACRPN/ACEP/ACEN), dangerous-combo detection (ACAO=* + ACAC=true, ACAO='null', attacker-origin echo), preflight probe (Origin: https://evil.example + Access-Control-Request-Method: DELETE), Vary: Origin detection, cors_policy_score 0-100 A-F grade via x402

Paid CORS runtime cross-origin attack trace (cycle 152, x402 $0.001) - launches real cross-origin attack requests against target URL across 5 verbs (GET/POST/PUT/DELETE/PATCH) x 5 attacker origins (https://attacker.example / null / https://<target>.attacker.example subdomain-confusion / https://localhost / http://<target> http-downgrade), captures per-probe {acao_echo, acac_true, status, body_preview, response_ms} + classifies each as high_severity_attack_succeeded (ACAO echo + ACAC=true +...

Paid Cross-Origin Isolation (COOP+COEP+CORP+credentialless) coherence audit (cycle 138, x402 $0.001) - fetches URL + parses Cross-Origin-Opener-Policy (same-origin/same-origin-allow-popups) + Cross-Origin-Embedder-Policy (require-corp/credentialless/unsafe-none) + Cross-Origin-Resource-Policy (same-origin/same-site/cross-origin) + Origin-Agent-Cluster (?0/?1) + SAB-API indicators (SharedArrayBuffer/Atomics/WebAssembly.sharedMemory) on the page. Computes the BROWSER isolation_predicate = COOP...

Paid crypto token tradeability radar (cycle 219, x402 $0.01) - GET ?symbol=<TOKEN> OR ?token=<ADDRESS> OR ?chain=solana|bsc|base OR ?sample=1|2|3 OR POST application/json {symbol|token}. KEYLESS DexScreener pair search + CoinGecko markets/global + Solana RPC getTokenSupply -- no key, no account, no signup. Answers THE QUESTION A BUYER AGENT MUST ANSWER BEFORE IT BUYS A TOKEN: is this token actually TRADEABLE. Returns live liquidity, 24h volume, buy/sell flow, market cap, FDV, pair age, DEX...

Paid Content-Security-Policy parser (cycle 92 gating fix)

Paid deep Content-Security-Policy analyzer — parses ALL 4 CSP delivery mechanisms (header + meta + report-only variants), classifies each source value (wildcard/scheme/host/nonce/hash/unsafe-inline/unsafe-eval/strict-dynamic/wasm-unsafe-eval/inline-speculation-rules), checks 22 critical directive coverage (default-src/script-src/style-src/img-src/object-src/frame-ancestors/base-uri/form-action/etc), detects dangerous-directive combos (unsafe-inline in script-src, wildcard host, etc)...

Paid CSP inline-fidelity validator (cycle 130, x402 $0.001) - fetches target URL, parses CSP, extracts every inline <script>/<style> block + event handler, computes sha256 of each, reports per-block {hash_in_csp, nonce_in_csp, covered} + orphan counts + policy_verdict (strict/hash/nonce/mixed/strict-dynamic/unsafe-inline/none) + csp_inline_fidelity_score 0-100 A-F. Distinct from /api/csp-deep (parses policy only) and /api/csp-report-test (probes report endpoints): actually MEASURES whether...

Paid CSP permissive-source budget scorer (cycle 154) - quantifies aggregate attack-surface allowed by the policy. Parses header + meta + report-only delivery mechanisms, classifies every source value as high (script-src *, unsafe-inline, unsafe-eval, wasm-unsafe-eval, data:, blob:, filesystem:), medium (https: scheme-only, http: scheme-only, strict-dynamic nonce-propagation trust, host lists >=5, broad host wildcards) or low ('self', nonces, sha hashes, named HTTPS origins). Per-directive...

Paid CSP x Live-Script mapper (cycle 156, x402 $0.001) - fetches target HTML, extracts every <script src=...> URL, and maps each against the target's declared CSP script-src + default-src allow-list. Reports which running scripts ARE allowed (in-policy, on-origin, hash match, scheme match) and which are NOT (CSP would block them in a real browser). Also detects inline scripts violating script-src (no nonce/hash). Per-script: csp_allowed + matched_category + same_origin bool. Classifies each...

Paid CSP report-uri/report-to endpoint probe — extracts report-uri + report-to from CSP header + Reporting-Endpoints header lookup, then POSTs a synthetic csp-report payload to each declared endpoint to verify reachability + Content-Type acceptance + auth-gating + latency; returns per-probe status+content_type+accepts_csp_report bool + csp_report_score 0-100 A-F grade via x402

Paid CSP per-directive source-list extraction + classification (cycle 176, x402 $0.001) - accepts GET ?url=<URL> OR POST application/json {'url':...}; fetches target page; extracts CSP header + meta CSP fallback; tokenizes every directive; classifies every atom into 18 categories (wildcard/self/unsafe-inline/unsafe-eval/wasm-unsafe-eval/unsafe-hash/strict-dynamic/report-sample/inline-speculation-rules/nonce-template/hash-template/host/scheme-secure/scheme-insecure/scheme-data/scheme-blob/sche...

Paid CSP x Subresource-Integrity (SRI) verifier (cycle 150, x402 $0.001) - fetches URL HTML, extracts every external <script src=> + <link rel=stylesheet href=>, fetches each asset (200KB cap), computes sha256 + sha384, cross-references page's integrity= attribute. Detects csp_require_sri_for directive (CSP + meta). Per-asset {src, declared_integrity, computed_sha256, computed_sha384, integrity_match, fetch_ok, size_bytes, truncated, has_crossorigin}. Returns totals {scripts, stylesheets...

Paid Trusted Types policy enforcement audit (cycle 164, x402 $0.001) - actively audits W3C Trusted Types policy enforcement by examining 9 axes: (1) CSP require-trusted-types-for 'script' directive presence (the ENFORCEMENT signal); (2) CSP trusted-types directive + declared policy-name list; (3) window.trustedTypes global reachability in inline JS; (4) trustedTypes.createPolicy() availability + default-policy reference; (5) trustedTypes.getPolicyNames() enumeration calls; (6)...

Paid CSP violation-report ROUND-TRIP replay (cycle 170, x402 $0.001) - fetches target page; extracts CSP header + meta CSP + Reporting-Endpoints header + report-uri + report-to group; for each declared endpoint REPLAYS 4 violation scenarios (script_violation + style_violation + connect_violation + img_violation) by POSTing authentic application/csp-report payloads with realistic blocked_url / disposition / effectiveDirective fields. Captures each POST status + Content-Type + outcome...

Paid CSS surface audit — external stylesheet counts + inline-block sizes + Cache-Control quality + dark-mode + reduced-motion + a11y @media coverage + framework fingerprint (Tailwind/Bootstrap/Bulma/Foundation/Materialize/Tachyons/OpenProps) + render-blocking detection, css_audit_score 0-100 A-F grade via x402

Paid DANE/TLSA + SMTP STARTTLS active probe (cycle 137, x402 $0.001) - resolves MX for domain, looks up _25._tcp.<mxhost> + _587._tcp.<mxhost> + _465._tcp.<mxhost> TLSA records (RFC 6698/7672), opens SMTP socket to MX:25, sends EHLO+STARTTLS, validates TLSA association against observed leaf cert (matching type 0/1/2, selector 0/1, usage 0-3). Returns per_mx[] + dane_present + smtp_starttls_supported + dane_validated + dane_security_score 0-100 A-F + verdict. Distinct from...

Paid DeFi yield and liquidity opportunity radar (cycle 218, x402 $0.01) - GET ?chain=<CHAIN> OR ?chains=<A,B,C> OR ?sample=1|2|3 OR POST application/json {chain|chains}. KEYLESS DefiLlama public API (api.llama.fi) -- no key, no account, no signup. Answers WHERE IS THE LIQUIDITY AND WHAT IS IT PAYING, the question a yield-seeking buyer agent asks before it moves a token: live TVL per chain, 7-day and 30-day TVL change, TVL trend direction, the number of live protocols, the share of AUDITED...

Paid DeFi yield + risk verdict (cycle 214, x402 $0.01) - GET ?project= OR ?symbol= OR ?chain= OR ?sample=1|2|3 OR POST application/json {project|symbol|chain}. Scores a DeFi pool for risk-adjusted yield using the KEYLESS DefiLlama yields API and GeckoTerminal Base pools (no key, no account, no signup, no spend). Per pool: TVL, APY, APY base/reward split, stablecoin flag, IL risk, pool age, protocol and token pair, then a computed risk-adjusted verdict (deploy / watch / avoid), a yield_score...

Paid dev-portal / VCS-dotfile / debug-surface exposure probe (cycle 127, x402 $0.001) - probes 39 conventional dev/debug/VCS-leak paths (/swagger-ui.html + /graphiql + /actuator + /.git/HEAD + /.env + /server-status + /phpinfo.php etc), classifies per-path is_exposed (200 + non-empty + JSON-or-leak-tokens) + is_sensitive (matches DB_PASSWORD/AKIA/SECRET_KEY/BEGIN PRIVATE/bearer_token/swagger/graphiql/__schema/actuator/pprof/.git/HEAD), groups by category{api_docs, graphql, framework_leaks...

Paid W3C DID-method resolution + registry probe (cycle 165, x402 $0.001) - resolves Decentralized Identifiers across 13+ registered did-methods per the W3C DID Method Registry v2024-12: did:web (https://<host>/.well-known/did.json per DID Web v1.0), did:key (multibase 'z' base58btc + multicodec prefix decode 0xed=ed25519 / 0xe7=secp256k1 / 0x80=p256 / 0x24=x25519 - no network), did:plc (AT Protocol plc.directory), did:webvh (newly proposed 2026-05 W3C method using /.well-known/did.jsonl log...

Paid structural-diff between two URL snapshots — fetches both with 10s timeout, extracts 17 comparable dimensions (title/description/canonical/OG title/desc/image/h1-count/heading-count/image-count/link-count/word-count/JSON-LD types/microdata types/response-bytes/status/content-type/redirect-chain-length), returns per-field changed+delta+severity-high/medium/low/none, changed_count/unchanged_count/high-severity-count/medium-severity-count, diff_score 0-100 A-F grade (higher = more...

Paid legal/ethical disclosure completeness audit — Terms/Privacy/Cookie/Affiliate/AI-policy links + FTC affiliate language detection + EU AI Act Art. 50 AI-disclosure detection + CCPA 'Do Not Sell' link + gdpr_legal_compliant + ftc_affiliate_compliant + eu_ai_act_art50_compliant + disclosure_score 0-100 with A-F grade via x402

Paid DKIM (RFC 6376) selector lookup

Paid DKIM key-rotation freshness audit (cycle 157, x402 $0.001) - probes 25 common DKIM selectors in parallel via DoH, parses per-selector v/k/p/h/s/t/n tags, computes SHA-256 fingerprint of each public key, and scores rotation hygiene: distinct pubkey count (1=no rotation, >=2=rotation footprint), revoked-key detection (p= empty), weak-key detection (decoded DER < 128 bytes = RSA < 1024-bit), versioned selector naming (k1/k2/k3 = current best practice), DNS-leak detection (TXT present but...

Paid deep DMARC policy forensic analyzer (cycle 110) — fetches _dmarc.<domain> TXT via Cloudflare DoH and parses ALL DMARC tags (p, sp, pct, rua, ruf, adkim, aspf, rf, ri, fo) per RFC 7489. Returns policy_strength (none/quarantine/reject) + policy_score + pct enforcement + subdomain policy + alignment mode (relaxed/strict) + reporting URI count + fo forensic options + a 0-100 dmarc_strength_score A-F. Distinct from /api/dmarc (which only checks presence): this endpoint scores the FULL...

Paid DNS record lookup (A/AAAA/MX/NS/TXT/CNAME) via Cloudflare DoH

Paid comprehensive DNS audit — parallel A/AAAA/MX/NS/TXT/CAA/SOA/DS queries via Cloudflare DoH, email-auth rollup (SPF/DKIM/DMARC + bulk-sender Gmail/Yahoo compliance), nameserver diversity, CAA policies, DNSSEC DS hint, dns_score 0-100 A-F grade via x402

Paid DNS CAA (Certification Authority Authorization) policy audit (cycle 156, x402 $0.001) - parses a domain's CAA records per RFC 8659, classifies each authorized CA token against a 32-CA registry (Let's Encrypt/DigiCert/GlobalSign/Sectigo/GoDaddy/Comodo/RapidSSL/Thawte/GeoTrust/VeriSign/Entrust/Amazon/Google/Microsoft/SSL.com/Certum/Actalis/UserTrust/Buypass/etc + ISRG alias + the special 0-value ';' deny-all marker). Reports policy_semantics...

Paid HTTPS RR (RFC 9460 SVCB/HTTPS) resolver (cycle 132, x402 $0.001) - queries apex HTTPS record via Cloudflare DoH, parses SVCB wireformat per RFC 9460 §2.2 (SvcPriority + SvcParams), decodes 7 known SvcParamKeys (mandatory=0, alpn=1, ipv4hint=2, ech=3, ipv6hint=4, dohpath=5, port=6). Returns per-priority[] entries with parsed svc_params + alpn_set + has_ipv4hint + has_ipv6hint + has_ech + has_dohpath + has_port + https_record_score 0-100 A-F. Distinct from /api/dns (raw...

Paid DNS label & zone-naming standards-compliance audit (cycle 159, x402 $0.001) - audits every label of the zone against RFC 1035 §2.3.4 + RFC 5891 §4.2.3 + RFC 2782 SRV conventions: (1) per-label length <= 63 octets; (2) total zone name <= 253 octets; (3) LDH charset only (letters/digits/hyphen) - non-LDH chars flagged high; (4) leading/trailing hyphen disallowed (RFC 5891 §4.2.3.1); (5) xn-- punycode prefix tracked (IDN A-labels); (6) underscore handling - only allowed in service-label...

Paid DNS nameserver vendor fingerprint (cycle 116) — queries NS records via Cloudflare DoH, classifies each NS hostname against a 28-provider heuristic table (Cloudflare/AWS-Route53/Google-Cloud-DNS/NS1/Azure/Akamai-Edge-DNS/DNSimple/GoDaddy/Namecheap/Dyn/DNSPod/Alidns/Hurricane-Electric/ClouDNS/deSEC/Bunny/Vultr/Hetzner/OVH/ConoHa/Gandi/Hover/Porkbun/Squarespace/Name.com/DreamHost/IONOS/InternetX), returns detected_providers[] (vendor+matched_ns+evidence[]+confidence) + vendor_diversity +...

Paid RPKI Route Origin Validation (ROV) auditor per RFC 6811 (cycle 172, x402 $0.001) - accepts ?prefix=<CIDR> [auto-resolves announcing ASN via RIPEstat prefix-overview] OR ?prefix=<CIDR>&asn=ASxxxx OR ?asn=ASxxxx; calls RIPEstat rpki-validation endpoint (Routinator validator on RIPE NCC) which returns the canonical RPKI validity state per RFC 6811 §3 (valid / invalid_asn / invalid_length / not_found / unknown) plus the validating_roas[] list (origin / prefix / max_length / validity)...

Paid SPF (RFC 7208) policy forensic analyzer (cycle 125, x402 $0.001) - parses every mechanism (+/-/~/? qualifiers) and modifier (redirect/exp), counts total_lookups (a=1, mx=1, ptr=5, exists=1, include=recursive) vs RFC 4.6.4 limit of 10, flags missing_terminal_all + terminal_plus_all (allows ALL senders!) + lookup_limit_exceeded + ptr_deprecated (RFC 7208 §5.5) + softfail_only + many_includes_chain_risk, plus has_redirect_modifier + has_exp_modifier + includes[] +...

Paid DNS SRV (RFC 2782) record mapper + service-discovery auditor (cycle 174, x402 $0.001) - accepts ?domain=<DOMAIN> + ?service=<SVC> + ?proto=<tcp|udp|tls> OR shorthand ?q=<SVC>.<PROTO>.<DOMAIN>; actively probes Cloudflare DoH for type=SRV at the constructed name; when ?service= is omitted auto-probes 4 common templates (_sip._tcp + _xmpp-client._tcp + _minecraft._tcp + _caldav._tcp); parses RFC 2782 SRV RDATA (priority weight port target); classifies service-type...

Paid DNS AXFR (zone-transfer) vulnerability probe (cycle 148, x402 $0.001) — discovers authoritative NS via Cloudflare DoH, then opens raw TCP/53 to each NS and sends an RFC 1035 wire-format AXFR query (QTYPE=252) per RFC 5936; returns per_nameserver {reachable, axfr_status_code, record_count, first_records, elapsed_ms} + zone_is_publicly_transferable bool + nameservers_probed_count + axfr_allowed_count + refused_count + findings + dns_zone_transfer_score 0-100 A-F. Pure-socket (no dnspython...

Paid DNSSEC chain-of-trust audit via x402

Paid DNSSEC chain-of-trust validation (cycle 103) — fetches the zone's DNSKEY + RRSIG via Cloudflare DoH, walks the chain (zone DNSKEY ← DS at parent); for each step verifies the DS digest matches a computed DNSKEY digest per RFC 6605 (SHA-1/SHA-256/SHA-384); checks all RRSIG inception/expiration windows; reports chain_status (secure/insecure/bogus/indeterminate), ds_digest_match, signatures_in_window, chain_from_age_hours, algorithms[], digest_types[]. Different from /api/dnssec-chain...

Paid DNT/GPC policy probe (cycle 96) — fetches target URL 3x (baseline, with DNT:1, with Sec-GPC:1); compares Set-Cookie count + body size to detect server-side honoring of privacy signals; probes 5 common privacy-policy paths for DNT/GPC keyword mentions; returns dnt{cookies,echoed,reduced} + gpc{cookies,echoed,reduced} + privacy_policy{reachable,mentions_dnt,mentions_gpc} + policy_score 0-100 A-F + findings[] via x402

Paid DoH trust-anchor cross-resolver agreement probe (cycle 142, x402 $0.001) - sends the same DNS query (A/AAAA/DS/DNSKEY/MX/TXT/CNAME) to 3 public DoH resolvers: Cloudflare (RFC 8484 wire-format) + Google (JSON API /resolve) + Quad9 (RFC 8484 wire-format); compares ANSWER fingerprints; detects resolver_disagreement (poisoning / BGP hijack / stale cache), one_resolver_failed, all_agree; pulls IANA root-anchors.xml SPKI snippet for trust-anchor presence; trust_anchor_consistency_score 0-100...

Paid E-E-A-T signal audit (Experience/Expertise/Authoritativeness/Trust) — JSON-LD Organization/Person/author markup + byline + author bio links + about/contact/team/editorial/corrections/funding pages + social profile verifiability + rel=author/me + HTTPS/privacy/terms trust layer + eeat_score 0-100 with A-F grade + citation_trustworthy boolean via x402

Paid email + contact + social extraction via x402

Paid composite email-auth deliverability score (SPF + DKIM + DMARC + MTA-STS + BIMI rollup, A-F grade, post-Feb-2024 Gmail/Yahoo bulk-sender compliance check) via x402

Paid BIMI (Brand Indicators for Message Identification) + VMC (Verified Mark Certificate) validator (cycle 105) — probes default._bimi.<domain> TXT per RFC 8848; parses v=BIMI1; l=<SVG URL>; a=<VMC URL>; s=<selector>; HEAD-probes SVG (must be image/svg+xml + <512KB) and VMC (must be application/pkcs7-mime or PEM); parses VMC X.509 via cryptography; verifies chain to public CA via truststore + Validity window + Extended Key Usage (emailProtection/documentSigning) + SAN contains apex domain...

Paid bulk-sender email-deliverability verdict (cycle 100) — composes MX + SPF + DKIM + DMARC + MTA-STS + TLS-RPT + provider fingerprint into a single 0-100 deliverability score with A-F grade and findings[]. Different from /api/dns-all (raw records) and /api/email-auth-rollup (auth-only): this returns a deliverability VERDICT aimed at senders who need to know whether mail from the target domain will be accepted by Gmail, Yahoo, Microsoft, Apple, and the new bulk-sender requirements that took...

Paid email header forgery/anomaly detector (cycle 104) — accepts POST text/plain raw email OR GET ?header=<url-encoded RFC822> OR GET ?url=<.eml URL>; scores 13 forgery/anomaly patterns: From/Reply-To/Return-Path/Sender domain mismatch +10/+20, display-name spoofing +20, Message-ID domain != From domain +10, Authentication-Results all=none +15, Date in future/ancient +5/+15, Received chain negative-delay +15 or >10 hops +10, suspicious X-Mailer +10, X-Original-To without To +10, RE:/FWD...

Paid RFC822 email-header forensics (cycle 101) — POST text/plain raw email source OR pass ?header=<RFC822> (256KB cap); folds continuation lines, parses per-Received hop (from/by/with-protocol/id/for-address/ips/delay/timestamp), extracts Authentication-Results per RFC 7601 (spf/dkim/dmarc/arc/bimi/iprev/smtp.tls verdicts), DKIM-Signature tag parse per RFC 6376, ARC chain instance counter + cv= chain-validity per RFC 8617, List-Unsubscribe + List-Unsubscribe-Post (RFC 8058 one-click) +...

Paid heuristic email spam score for AI-agent triage (cycle 123, x402 $0.001) - accepts POST text/plain raw email source (RFC822 headers+body) or GET ?header=<url-encoded> or GET ?url=<.eml URL>; parses headers+body and computes a 0-100 spam score combining (a) HEADER signals: List-Unsubscribe missing, Precedence: bulk/list/junk, X-Mailer = bulk-sender lib (PHPMailer/Mailchimp/SendGrid/Mailgun/AmazonSES/Postmark/Brevo/etc.), Auto-Submitted (RFC 3834), X-Autoreply, From/Reply-To/Return-Path...

Paid deep SPF record parser + DNS-lookup budget auditor (cycle 160 restored 2026-10-17, x402 $0.001) - parses v=spf1 into its directive list, classifies each mechanism per RFC 7208 SS5 (pass/fail/softfail/neutral/literal/query/redirect), tracks DNS-lookup budget (RFC 7208 SS4.6.4 maximum 10 lookups - over returns permerror), recursively resolves nested include: targets via Cloudflare DoH, flags ptr mechanism (deprecated per SS5.5), unknown mechanisms, too-many-includes (>3). Returns...

Paid third-party embed/iframe/object inventory — YouTube/Vimeo/Wistia/GoogleMaps/Stripe/Calendly/Typeform/Spotify/Soundcloud/Twitch/Figma/Canva/Loom/Twitter/IG/CodePen/JSFiddle/CodeSandbox/Replit/SlideShare/SpeakerDeck/Issuu/Miro/Airtable detection, sandbox/allow/loading/referrerpolicy capture, A-F grade via x402

Paid Content-Encoding integrity + compression-bomb detector (cycle 141, x402 $0.001) - fetches URL 3x: no Accept-Encoding baseline + Accept-Encoding: gzip + Accept-Encoding: br, gzip; records raw bytes + Content-Length + Content-Encoding header per request; decompresses via zlib + brotli; compares against identity. Detects 4 failure classes: compression bomb (decompressed >> compressed + > 5MB), declared_gzip_but_identity (header lies), declared_br_but_gzip (encoding mismatch), empty/giant...

Paid single-endpoint quality benchmark (cycle 121, x402 $0.001) - given a target x402 endpoint URL, fetches the 402 envelope (without payment), parses out the description+price+network+asset, scores 9 metadata quality dimensions (description_length 0-10 + action_verb 0-10 + example_response 0-10 + error_code_doc 0-10 + input_param_doc 0-10 + distinctiveness 0-10 + price_documented 0-10 + network_asset_doc 0-10 + use_case_sentence 0-10) summed to 0-90 then normalized to 0-100 quality_score...

Paid error-response fingerprint + leakiness audit — 12-probe matrix (api-404/admin-path/.env/phpmyadmin/debug/wp-admin/graphql-invalid/internal-api/bad-json/wrong-accept/long-path/spoofed-loopback), captures per-probe status/content-type/body-fingerprint + 25-pattern leak-signal catalog (Python/JS/PHP/Ruby stack traces, framework versions, internal IPs, filesystem paths, SQL syntax errors, db brands, code-execution hints, secret-leak, debug-mode, template engine) + error_consistency +...

Paid security exposure-surface audit — HSTS preload-list membership via hstspreload.org API + HSTS header detection, RFC 9116 security.txt presence+format-validity (Contact/Expires/Canonical/Preferred-Languages), 18-path sensitive-file probe (/.env/.svn/.git/HEAD/.aws/credentials/.ssh/id_rsa/wp-admin/wp-login.php/phpmyadmin/backup.zip/dump.sql/server-status/.DS_Store), directory-listing fingerprint, login-page fingerprint with form actions, robots.txt Disallow admin-path exposure, http...

Paid external-resource inventory (script/stylesheet/font/image/iframe hosts, top domains, 22-family ad/tracker classifier, third-party dependency A-F grade) via x402

Paid URL metadata extraction via x402

Paid comprehensive favicon + app-icon extractor (link rel=icon/apple-touch-icon/mask-icon, manifest.json icons, msapplication-TileImage, og:image, Twitter image) via x402

Paid Permissions-Policy + Feature-Policy header audit (cycle 124, x402 $0.001) - fetches target URL + iterates ALL Permissions-Policy (modern) AND Feature-Policy (legacy) headers, parses 17 tracked features (camera/microphone/geolocation/payment/usb/accelerometer/gyroscope/magnetometer/midi/encrypted-media/display-capture/fullscreen/autoplay/picture-in-picture/xr-spatial-tracking/clipboard-read/clipboard-write) for coverage + allowlist + wide-open tokens. Returns per_feature[] +...

Paid RSS/Atom feed discovery + parse via x402

Paid HTML form extraction via x402

Paid form security + accessibility audit — per-form action analysis (empty/#/javascript:/data:/mixed-content http-on-https), method (GET with passwords = credential-in-URL), enctype (text/plain CRLF injection), target=_blank tabnabbing, CSRF token detection (named csrf/csrfmiddlewaretoken/authenticity_token + 32+ char base64 heuristic), hidden-field enumeration, password-field autocomplete (off = RFC violation), file-upload without multipart/form-data, required-without-label a11y...

Paid FX rate impact analyser (cycle 209, x402 $0.005) - GET ?base=USD&symbols=EUR,GBP,JPY OR ?base=EUR&notional=100000 OR ?sample=1|2|3 OR POST application/json {base, symbols, notional}. Uses the KEYLESS Frankfurter/ECB FX API and open.er-api.com (no API key, no account, no signup) to return live USD-based rates for a set of currencies, a cross-rate matrix, and the real BUSINESS IMPACT of a move: what a 1% / 3% / 5% adverse move costs a given notional in base currency, a 30-day change...

Paid GraphQL introspection exposure audit (cycle 129, x402 $0.001) - accepts host OR url param, probes up to 6 conventional GraphQL endpoints (/graphql, /api/graphql, /v1/graphql, /query), sends canonical IntrospectionQuery per graphql.org/October2021 spec, parses __schema response, returns per_endpoint[] (url, introspection_enabled, types_count, kind_counts{scalar/object/interface/union/enum/input_object}, has_mutation, has_subscription, sample_fields[], sensitive_types[] (regex match for...

Paid full HTTP response header inventory (cycle 99) — DUMPS every response header and classifies each into 5 categories (security / caching / cors / content-negotiation / custom-vendor-prefixed); reports legacy_disclosure_count (Server/X-Powered-By/X-AspNet-Version/etc.), custom_vendor_prefixes[] (X-Amz-*/X-Vercel-*/X-Cloudflare-*/X-CF-*/X-FB-*/X-Google-*/X-Akamai-*/etc.), duplicates[] (Set-Cookie counted multiple times), server_fingerprint parsed from Server header with leaks_version bool...

Paid deep HTTP header policy audit — 30+ headers across 12 groups: CSP (Content-Security-Policy + Report-Only) + HSTS (max-age + includeSubDomains) + COOP/COEP/CORP/Origin-Agent-Cluster + Permissions-Policy (feature list parsing) + X-Frame-Options + X-Content-Type-Options + Referrer-Policy + Cache-Control + Clear-Site-Data + X-DNS-Prefetch-Control + X-Download-Options + X-Permitted-Cross-Domain-Policies + Timing-Allow-Origin + Accept-CH + Server/X-Powered-By info-leak detection; per-group...

Paid HTML heading-hierarchy audit (h1-h6 counts, sequence validation, multiple-h1 detection, missing-h1, empty headings, aria-hidden flags, A-F grade) via x402

Paid HTTP/1.1 hop-by-hop header correctness probe (cycle 141, x402 $0.001) - opens raw TCP to host:443 + :80, sends 3 sequential GET requests with explicit Connection: keep-alive, X-Hop-Marker-A1b2c3, X-Internal-Trace-X9y8z7 headers; probes whether the response honors RFC 7230 §6.1 (Connection-listed headers consumed by intermediate, NOT forwarded to back-end). Detects caching/forward/reverse proxies that fail to strip Connection-listed headers. Returns probes[].evidence +...

Paid hreflang + x-default multilingual SEO audit (cycle 92 gating fix)

Paid HTTP cache-control audit — probes favicon/robots/sitemap headers (Cache-Control+max-age+s-maxage+immutable+stale-while-revalidate / ETag / Last-Modified / Vary / Surrogate-Control / CDN-specific) returns cache_validator_score 0-100 A-F grade via x402

Paid HTTP-method policy + dangerous-method exposure audit — OPTIONS Allow/DAV/ACAO/ACAM + TRACE echo-back + CONNECT + PUT/DELETE/PATCH write exposure + 4 method-override header sniffing (X-HTTP-Method-Override/X-Method-Override/X-HTTP-Method/X-Method) + CORS preflight probe (Origin evil.example + Access-Control-Request-Method DELETE), returns http_method_score 0-100 A-F grade via x402

Paid HTTP/2 frame-anatomy trace (cycle 180, x402 $0.001) - accepts GET ?host=<HOST> (default www.cloudflare.com); opens fresh TCP+TLS 1.2+ with ALPN [h2, http/1.1]; sends the 24-byte client connection preface PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n + a real SETTINGS frame (HEADER_TABLE_SIZE 4096 + ENABLE_PUSH 0 + MAX_CONCURRENT_STREAMS 100 + INITIAL_WINDOW_SIZE 65535 + MAX_FRAME_SIZE 16384 + MAX_HEADER_LIST_SIZE 65536); reads raw frames for ~600ms and classifies each by the 8-bit type byte per RFC...

Paid HTTP/2 Rapid Reset (CVE-2023-44487) DoS probe (cycle 149, x402 $0.001) - opens fresh TCP+TLS 1.3 with ALPN h2, sends HTTP/2 client preface + client SETTINGS, parses server SETTINGS, runs a rapid-reset loop (open stream HEADERS :method=GET :scheme=https :path=/ :authority=host, then immediately RST_STREAM, repeat n_streams times default 200 max 1000). Returns streams_opened + streams_reset + server_max_concurrent + max_concurrent_seen + server_goaway + connection_dropped +...

Paid active HTTP/2 SETTINGS frame probe (cycle 106) — opens fresh TCP, performs TLS 1.3 handshake with ALPN ["h2", "http/1.1"], sends the HTTP/2 client connection preface (PRI * HTTP/2.0 + 24-byte magic + client SETTINGS frame), reads the server SETTINGS frame (2s timeout), parses 6 standard settings (HEADER_TABLE_SIZE, ENABLE_PUSH, MAX_CONCURRENT_STREAMS, INITIAL_WINDOW_SIZE, MAX_FRAME_SIZE, MAX_HEADER_LIST_SIZE), sends SETTINGS ACK, optionally pings to measure RTT. Returns h2_negotiated +...

Paid HTTP/3 + Alt-Svc endpoint-discovery audit — parses RFC 7838 Alt-Svc header for h3/h3-29 protocol advertisement, captures port + host + max-age + persistent flag, reports advertised_h3, advertised_h3_port, advertised_h3_max_age, alt_svc_entries[], alpn_negotiated (h3/h2/http1.1), supports_http3, http3_score 0-100 A-F grade via x402

Paid Idempotency-Key header support probe (cycle 118) — fetches target URL, scans response headers for Idempotency-Replayed + X-Request-ID signals, probes 6 OpenAPI candidate paths for explicit Idempotency-Key parameter declarations, issues synthetic POST + replay POST with same Idempotency-Key but different bodies to 8 write-endpoint candidates (Stripe/Adyen/PayPal-style probe). Returns idempotency_header_policy{accepts_idempotency_key,replay_header_present} +...

Paid per-image alt-text quality audit — per-img verdicts (missing/decorative/present), length scoring (3-125 chars ideal), 'image of X' redundant-prefix detection, keyword-stuffing detection (>3 comma phrases), ALL-CAPS detection, duplicate-alt grouping (>5 occurrences), aria-labelledby/aria-label/figcaption fallback detection, image_alt_score 0-100 A-F grade via x402

Paid <img>/<picture>/<source>/<svg>/<canvas>/<video> inventory with first/third-party classification, lazy-loading adoption, modern format hints, missing-alt audit, A-F grade via x402

Paid IP geolocation via dual-source consensus (cycle 133, x402 $0.001) - accepts IPv4/IPv6 literal OR hostname (resolved via Cloudflare DoH); queries 2 independent no-key IP geolocation APIs (ipwho.is + ipinfo.io); returns consensus{{city, country, region, postal, latitude, longitude, timezone, org, asn}} + per-source raw data + per_field_agreement map + avg_field_agreement + ip_geolocation_score 0-100 A-F. Distinct from /api/dns (raw A/AAAA records without geo) and /api/bgp-route-leak-probe...

Paid JS bundle fingerprint (cycle 192, x402 $0.001) - GET ?url=<PAGE>[&max_scripts=N default 8 max 25] OR ?sample=react|vue|jquery|webpack|alpine|svelte|lodash|angular OR POST {url,max_scripts}. Reads first ~4 KB of each external bundle via Range header and applies 17-library fingerprints. Returns libraries_detected + dev_builds + blocked_fetches + score 0-100 A-F + verdict. via x402

Paid JavaScript framework + build-tool fingerprint — 11 detection surfaces (generator meta + data-* attrs + __NEXT_DATA__/__NUXT__/__remixContext + SPA root mount points + build-output paths /_next/_nuxt/_astro/build + JS-filename fingerprints react/vue/svelte/alpine/htmx/preact/stimulus/lit/qwik + CSS framework class signatures bootstrap/tailwind/bulma/foundation/materialize + Server header X-Powered-By), returns frameworks_detected + framework_categories + is_spa + is_static +...

Paid JavaScript syntax-validity probe (cycle 114) — fetches the page HTML, extracts every inline <script> block + every external <script src=> (parallel fetch with 8s timeout + 500KB cap per script, max 20 externals), for each script runs an AST-based syntax check (esprima or pyjsparser if installed, else heuristic). Detects: (a) unclosed string literals (" or unmatched), (b) unclosed template literals (` unmatched), (c) unclosed block comments (/* without */), (d) unbalanced braces { }...

Paid JSON-LD structured data extraction via x402

Paid JSON-LD structured-data cross-validator (x402 $0.001) - GET ?url=<URL> parses every <script type=application/ld+json> block and cross-validates the claims, reporting block counts by @type and an A-F grade. via x402

Paid JSONPath extraction (cycle 108) — accepts GET ?url=<URL>&path=<JSONPATH> OR GET ?json=<urlencoded JSON>&path=<JSONPATH> OR POST application/json {url|json, path}; fetches the URL (or parses inline JSON) and applies a subset of JSONPath ($.foo.bar / $.foo[0] / $.foo[*] / $..bar / $.foo[?(@.price<10)] with key-comparison filters) to extract matching values; returns match_count + matches[] (capped 50) + first_match + truncated bool + path_resolved bool + json_source (url/inline) +...

Paid JWKS (RFC 7517 + RFC 8414) JWK Set inspector (cycle 173, x402 $0.001) - accepts ?jwks_url=<URL> OR ?jwks=<JWK_SET_JSON> OR ?url=<PAGE> (auto-discovers jwks_uri via /.well-known/openid-configuration + /.well-known/oauth-authorization-server or probes /.well-known/jwks.json + /jwks.json); per-key classification (kty/alg/use/kid/crv/x5c), RFC 7638 JWK thumbprint SHA-256 dedup, algorithm-strength grading (EdDSA + ES* preferred over RS*/PS*), kid coverage + rotation-hygiene scoring...

Paid JWT algorithm-confusion + kid-injection + JWKS-header-hijack probe (cycle 153) - forges 12 forged-JWT attack classes (alg:none variants + kid-injection variants + jku/jwk/x5u attacker-controlled) and (when public_key supplied) RS256->HS256 key confusion. Per-attack response-status check (success = 200/201/202/203/204/302/304/307). Returns jwt_alg_confusion_score 0-100 A-F + verdict...

Paid JWT HS256 signature-timing sidechannel probe (cycle 152, x402 $0.001) - forges 32 HS256 JWTs varying the LAST signature byte, sends each (default 12 iterations) against target's Authorization: Bearer header, measures per-byte response timing via stdlib time.monotonic, detects non-constant-time HMAC verification (a classic JWT forgery primitive). Returns per_byte_stats {min_ms,max_ms,median_ms,mean_ms,stdev_ms,range_ms} + overall timing_uniformity_score 0-100 A-F + timing_leak_detected...

Paid Kalshi event odds verdict (cycle 222, x402 $0.01) - GET ?event=<TICKER OR SUBTITLE> OR ?series=<SERIES TICKER> OR ?category=<CATEGORY> OR ?sample=1|2|3 OR POST application/json {event|series|category}. KEYLESS Kalshi trade API (CFTC-regulated US prediction venue) -- no key, no account, no signup, no paid vendor. Answers THE QUESTION A US BUYER AGENT MUST ANSWER BEFORE IT ACTS ON A FORECAST: what does the REGULATED book say, is that price real or noise, how much money is behind it, and...

Paid keyword extraction via x402

Paid legal case search verdict (cycle 220, x402 $0.01) - GET ?entity=<COMPANY NAME> OR ?name=<COMPANY NAME> OR ?sample=1|2|3 OR POST application/json {entity|name}. KEYLESS public-domain US court records -- CourtListener search (Free Law Project) + SEC EDGAR full-text -- no key, no account, no signup, no paid legal vendor. Answers THE QUESTION A BUYER AGENT MUST ANSWER BEFORE IT SIGNS A CONTRACT: is this company being sued, and how much. Returns normalized case records (case name, court...

Paid outbound link rot / staleness audit (cycle 109) — fetches source URL, extracts every <a href>, then for each link: (a) HEAD-probes to detect 4xx/5xx/timeout/redirect, (b) parses Last-Modified + Date response headers for staleness, (c) checks archive.org Wayback availability for a historical snapshot. Returns per_link[] (capped 30) with status + redirect_target + last_modified + staleness_age_days + wayback_closest_url + link_status + staleness + findings[], plus summary {alive_2xx...

Paid publishing-velocity audit via Wayback CDX API — monthly distinct content-URL capture over 12 months, cadence classification (regular/bursty/dormant/irregular), burst + dormant detection, decay_trend (warming/stable/declining), velocity_score 0-100 with A-F grade via x402

Paid hyperlink extraction via x402

Paid AI/LLM crawl-policy synthesis (x402 $0.001) - GET ?domain=<DOMAIN> reads robots.txt, llms.txt, agents.txt and ai.txt, resolves policy for 40+ AI-bot User-Agents, and returns allow/block counts plus an A-F llm_crawl_score. via x402

Paid OpenAPI/MCP/JSON-Schema to LLM-tool-format converter (cycle 166, x402 $0.001) - accepts GET ?url=<TARGET> OR GET ?doc=<URL_ENCODED_JSON> OR GET ?mcp=<URL> OR POST application/json {url|doc|doc_text|mcp_text}; for each operation path X method produces 4 LLM-callable tool representations: (A) OpenAI function-calling strict-mode tools[]; (B) Anthropic Claude tool-use tools[]; (C) MCP server-card tools[] per 2025-06-18 spec; (D) Google Gemini function_declarations[]. Per-tool name sanitized...

Paid full llms.txt + llms-full.txt fetcher with parsed section breakdown (H1 title, per-section URL + bullet count) for AI-agent context loading via x402

Paid llms.txt parser via x402

Paid llms.txt provenance / author fingerprint (cycle 102) — extracts H1 + byline + contact emails + @-handles from llms.txt body, cross-references the same email against /.well-known/security.txt Contact: field (RFC 9116), probes default._domainkey.<domain> DKIM TXT record, distinguishes generic H1 ("llms.txt" alone, raw domain) from real organization claim. Returns author_confidence 0-100 (cross_verified=95, security.txt+contact=60, contact email alone=40 with DKIM-anchor bonus to 70...

Paid llms.txt grader (cycle 95) — probes /llms.txt + /llms-full.txt + /agents.txt per Answer.AI proposed LLM-discovery spec; parses H1 + blockquote summary + markdown list of [Name](URL): description; validates per-line format; HEAD-probes each link (max 25) for reachability; returns llms_txt_score 0-100 A-F + section_presence map + link_count + dead_link_count + recommendations via x402

Paid llms.txt multi-target drift monitor (cycle 149, x402 $0.001) - up to 20 domains in parallel via ThreadPoolExecutor; per_host H1 + first-5-URLs + sha256 fingerprint; compares to /tmp/llms_txt_monitor_state.json to detect first_observation / changed / fresh / no_llms_txt + added_urls[] + removed_urls[] + llms_txt_churn_score 0-100 A-F.

Paid main-content markdown extractor for RAG ingestion — strips noise (script/style/nav/aside/header/footer/ads/comments), picks <main>/<article>/content div, converts headings/paragraphs/lists/code/links/images/tables to markdown, returns markdown text + word_count + char_count + heading_outline + sections_count + images_count + links_count + code_blocks_count + is_mainstream_content + markdown_quality_score 0-100 A-F grade via x402

Paid internal link graph + PageRank-lite (cycle 132, x402 $0.001) - fetches target URL, extracts all same-domain <a href> anchors, fetches top 5 by anchor-text-length, builds an in-memory graph (nodes/edges), runs 20-iteration PageRank (damping=0.85). Returns top_pages_by_pagerank[] (top 10) + per_url {in_degree, out_degree, anchors_to_us[]} + target_metrics + findings[] + link_graph_score 0-100 A-F. Distinct from /api/links (c29, flat list) and /api/anchor-text (c53, frequencies): this...

Paid Model Context Protocol (MCP) server discovery (cycle 103) — fetches a target's MCP descriptor from 6 candidate paths (/.well-known/mcp.json, /mcp.json, /.well-known/model-context-protocol.json, /model-context-protocol.json, /mcp-server.json, /.well-known/ai-plugin.json); validates the schema per the MCP 2025-06-18 spec draft; extracts capabilities{tools, resources, prompts, sampling, roots}; vendor recognition...

Paid MCP server tool-list cross-discovery-surface aggregator (cycle 150, x402 $0.001) - parallel-fetch /.well-known/mcp/server.json + /mcp.json + /openapi.json + 8 health endpoints; aggregates MCP tools across surfaces (deduped by name), enumerates OpenAPI paths (capped 100), probes health endpoints. Returns mcp_tools[] + openapi_paths[] + health_endpoints[] + origin_aggregate_score 0-100 A-F + findings. Distinct from /api/mcp-server-discovery (single-surface only, c107) and...

Paid exhaustive meta-tag coverage audit — title + meta_description + meta_robots + meta_keywords + meta_author + meta_generator + meta_theme_color + meta_viewport + 17 OG fields (og:title/description/image/url/type/site_name/locale/determiner + article:* + og:image:width/height/alt + og:video/audio) + 10 Twitter Card fields + canonical + hreflang + manifest + favicon + apple-touch-icon + apple-mobile-web-app-capable + html_lang + html_charset + meta_coverage_score 0-100 A-F grade via x402

Paid meta-refresh + JS-redirect detector (cycle 92 gating fix)

Paid microdata + RDFa structured data extraction (cycle 92 gating fix)

Paid mixed-content body scanner (cycle 97) — parses HTML body for http:// subresources on https:// pages across 12 element types (img/script/link/iframe/source/object/embed/video/audio/form + CSS url() + inline event handlers); per-type count + sample URLs + total_mixed_content_count + blocked_active_count + total_http_link_count; mixed_content_score 0-100 A-F grade + findings[] via x402

Paid MTA-STS (RFC 8461) + TLSRPT (RFC 8460) policy audit (cycle 125, x402 $0.001) - probes _mta-sts.<domain> TXT (v=STSv1 + id) + smtp._mta-sts.<domain> HTTPS policy file (mode: enforce|testing|none + mx: + max_age: + id:) + _smtp._tls.<domain> TXT (v=TLSRPTv1 + rua=); verifies policy id matches TXT id, flags no_mta_sts_txt / no_policy_file / mode_none / mode_testing / policy_id_mismatch / no_tlsrpt / expired_max_age_too_short (<86400) / expired_max_age_too_long (>31557600); returns...

Paid RFC 8460 SMTP TLS-RPT (TLS Reporting) report parser (cycle 178, x402 $0.001) - accepts POST application/json {'report':<RFC 8460 JSON object>} OR POST application/json {'report_text':<JSON string>} OR GET ?report=<urlencoded JSON> OR GET ?report_b64=<base64(JSON)> OR GET ?sample=ok|critical (built-in fixtures for testing); extracts per-policy-block {policy_domain, policy_type, policy_string, mode (enforce|testing|none), mx_record_count, successful_session_count, failed_session_count...

Paid MTA-STS (RFC 8461) policy+record cross-validator (cycle 174, x402 $0.001) - accepts ?domain=<DOMAIN>; actively probes _mta-sts.<domain> TXT (RFC 8461 SS3.1) via DoH + https://mta-sts.<domain>/.well-known/mta-sts.txt (RFC 8461 SS3.2) + live MX records via DoH type=MX; cross-validates: TXT id == policy file id; live MX matches at least one policy mx pattern (with *. wildcard + *.<domain> suffix support); policy mode in {enforce, testing, none}; max_age in [86400, 31557600] sane range per...

Paid news headlines coverage feed (cycle 224 alias path, x402 $0.01) - GET ?topic=<TEXT> OR ?sources=<bcc|npr|guardian|ars|verge|coindesk|hn> OR ?sample=1|2|3 OR POST application/json {topic|sources}. KEYLESS multi-source RSS (BBC News, NPR, The Guardian, Ars Technica, The Verge, CoinDesk) + Hacker News Algolia -- no key, no account, no signup. Matched headlines with outlet, published timestamp, link and summary, the independent-outlet count, the freshness spread, the count under 24h old...

Paid news signal verdict (cycle 223, x402 $0.01) - GET ?topic=<TEXT> OR ?sources=<bcc|npr|guardian|ars|verge|coindesk|hn> OR ?sample=1|2|3 OR POST application/json {topic|sources}. KEYLESS multi-source RSS (BBC News, NPR, The Guardian, Ars Technica, The Verge, CoinDesk) + Hacker News Algolia API -- no key, no account, no signup, no paid news vendor. Answers THE QUESTION A BUYER AGENT MUST ANSWER BEFORE IT ACTS ON A STORY: is this actually being covered, by how many independent outlets, and...

Paid OAuth 2.0 / OpenID Connect discovery + flow-capability analyzer (cycle 133, x402 $0.001) - probes 4 RFC 8414 + OIDC discovery endpoints at target domain (/.well-known/openid-configuration + /oauth-authorization-server + /oauth-protected-resource + /openid-federation); parses grant_types_supported + response_types_supported + scopes_supported + token_endpoint_auth_methods + code_challenge_methods (PKCE S256) + subject_types + id_token_signing_algs + jwks_uri + registration_endpoint (DCR)...

Paid OAuth 2.0 / OIDC authorization endpoint hardening audit (cycle 159, x402 $0.001) - actively probes an issuer's OAuth/OIDC authorization endpoint against the 10 canonical misconfiguration classes defined by RFC 9700 (OAuth 2.0 Security BCP) and the historical CVE pattern: (1) discovery endpoint presence on /.well-known/openid-configuration + /.well-known/oauth-authorization-server; (2) PAR (RFC 9126) support flag; (3) response_type allowlist - detects if implicit 'token' is advertised...

Paid OCSP Must-Staple (RFC 7633) cert-feature detector (cycle 138, x402 $0.001) - opens TLS to target host, parses leaf cert via cryptography.x509 to detect status_request TLS Feature extension (OID 1.3.6.1.5.5.7.1.24) or status_request_v2 (OID 1.3.6.1.5.5.7.1.25); detects must-staple commitment at the certificate level; pairs with /api/ocsp-staple-verify (c128, responder reachability) for end-to-end OCSP coverage. CAVEAT: stdlib ssl cannot directly inspect TLS extension negotiation for...

Paid OCSP stapling live responder-reachability probe (cycle 128, x402 $0.001) - opens TLS to target host, fetches leaf cert DER via getpeercert(binary_form=True), parses via cryptography.x509 to extract Authority Information Access OCSP URLs (RFC 6960 §4.2.4.2), probes each OCSP responder URL for reachability + DER-response handling. Returns per_cert[] (ocsp_url, response_status, response_status_str, cert_status_str, error) + responder_reachable + ocsp_urls_found + findings[] +...

Paid OFAC SDN sanctions screen (cycle 214, x402 $0.01) - GET ?name= OR ?address= OR ?names= OR ?sample=1|2|3 OR POST application/json {name|name|address|names}. Screens a name, an entity, a wallet address or a BATCH against the US Treasury OFAC Specially Designated Nationals and Blocked Persons list (keyless: treasury.gov SDN CSV, 19,471 entities, public domain, no key, no account, no signup). Returns exact matches, token-overlap fuzzy matches with a confidence score, the sanctions PROGRAM...

Paid Open Graph + Twitter Card via x402

Paid Open Graph + Twitter Card metadata freshness + reachability probe (cycle 112) — fetches URL, extracts og:* + twitter:* meta tags, HEAD-probes each og:image / og:image:secure_url / twitter:image, returns per-image status+content_type+content_length+last_modified+age_days+cache_control+server+cdn_status (CF-Cache-Status/X-Cache/X-Vercel-Cache/X-Amz-Cf-Id/Akamai-Cache-Status) + is_reachable/is_stale/is_broken + per-image findings[] (missing_content_type, no_cache_control...

Paid social-share preview image audit — parses og:image / og:image:url / og:image:secure_url / twitter:image / twitter:image:src / twitter:image:alt / link rel=image_src / link rel=icon / largest inline <img>, HEAD-validates each candidate (200/404/MIME/content-length), computes per-platform chosen preview (Facebook/Twitter/LinkedIn/Slack/Discord fallback chains), reports alt text + declared dimensions + issues per candidate (status_404 / non_image_mime / very_small_bytes / inline_data_uri)...

Paid Open Graph + Twitter Card spec validator — required OG detection (og:title/type/image/url), recommended (description/site_name/locale/image:width/image:height/image:alt), og:type enum validation (website/article/book/profile/music.*/video.*), og:locale format check (xx_XX), og:image HEAD-probe content-type verification, twitter:card enum validation, missing_required + missing_recommended lists + og_validator_score 0-100 A-F grade via x402

Paid OpenAPI 3.x / Swagger spec diff — accepts two URLs (url_a + url_b) or two inline payloads (spec_a + spec_b) as JSON or YAML, reports breaking changes (removed paths, removed operations, type/format changes, enum narrowing, removed required request fields, added required request fields) + additive changes (added paths/operations, removed required fields, new response fields) + info changes (summary/description); diff_score 0-100 A-F grade + is_compatible bool + breaking_count +...

Paid OpenAPI/Swagger security lint (cycle 224 alias path, x402 $0.01) - GET ?url=<URL> OR ?doc=<BASE64 SPEC TEXT> OR POST application/json {url|doc_text}. KEYLESS HTTP fetch + spec parse -- no key, no account, no signup. Walks 6 candidate paths to find the OpenAPI document, then runs 10 lint rules mapped to the OWASP API Top 10 2023 categories and returns the score, the score band, the verdict and the candidate paths it tried. ALIAS PATH of /api/openapi-security-lint, named for the words a...

Paid OpenAPI / Swagger 2.0 best-practices quality audit (cycle 114) — accepts GET ?url=<openapi.json URL> OR POST application/json with {spec:{...}} or {spec_text:"<YAML or JSON>"}; scores 12 quality dimensions: (a) OpenAPI version compliance (openapi 3.0/3.1/Swagger 2.0), (b) info object completeness (title/version/description/contact/license — 5 sub-checks), (c) operationId coverage (every get/post/put/delete/patch/options/head/trace must have a unique operationId — catches "LLM cannot...

Paid OpenAPI/Swagger security-smell linter per OWASP API Top 10 (2023) (cycle 160 restored 2026-10-17, x402 $0.001) - accepts GET ?url=<TARGET> (walks 6 candidate paths /openapi.json+/openapi.yaml+/swagger.json+/swagger/v1/swagger.json+/api/openapi.json+/v3/api-docs) OR GET ?doc=<URL_ENCODED_JSON> OR POST application/json {url|doc|doc_text}; runs 10 rules (BOLA/BrokenAuth/BOPLA/RateLimit/BFLA/SensitiveFlow/SSRF/Misconfig/ImproperInventory/UnsafeConsumption) with per-rule...

Paid OWASP API Security Top 10 (2023) one-call composite audit (cycle 151, x402 $0.001) - fetches target URL + probes 24 conventional API paths in parallel via ThreadPoolExecutor, runs all 10 OWASP 2023 category checks: API1 BOLA (compare /api/users/1 vs /api/users/2), API2 Broken Auth, API3 BOPLA (PII keywords + over-exposure), API4 Unrestricted Consumption (no RateLimit-* + huge response), API5 BFLA (/admin 200 + PUT/DELETE/PATCH open), API6 Sensitive Business Flow (no CAPTCHA), API7 SSRF...

Paid page-archaeology — detects parked domains, thin content, stale copyright (>5y), auto-generated patterns, missing author bylines; returns is_parked + is_thin + is_stale + classification (human_curated/auto_generated/parked/thin/stale/unknown) + page_archaeology_score 0-100 A-F + findings[] via x402

Paid multi-signal page-type classifier (URL/title/JSON-LD/OG/microdata/forms/structure -> primary category + confidence + secondary + A-F grade) via x402

Paid web typography + font-loading audit (cycle 127, x402 $0.001) - fetches target HTML, extracts font-family from body + h1-h6 via inline style= attributes, parses inline <style> blocks for @font-face rules + font-display value + src origin domain, detects <link rel=preconnect> + <link rel=preload as=font crossorigin>, computes font-size range + line-height ratio distribution + letter-spacing samples + font-weight variance, scores FOIT/FOUT risk + font-display consistency + preconnect...

Paid page weight audit — HTML+CSS+JS+image+font byte breakdown (compressed + uncompressed) + per-category bytes + third-party resource ratio + render-blocking resource count + HTTP/2/3 ALPN detection + transfer-vs-uncompressed ratio + data-economy A-F grade, page_weight_score 0-100 via x402

Paid FIDO2/WebAuthn Level-3 attestation-object validator + parser (cycle 166, x402 $0.001) - accepts GET ?attestation=<base64url> OR ?attestation_obj=<URL_ENCODED_JSON> OR POST application/json {attestation|attestation_obj|client_data_json|client_data_b64url|expected_origin|expected_rp_id|expected_challenge_b64url}; decodes attestationObject CBOR, parses authData (rpIdHash 32 + flags 1 + signCount 4 BE + AT-flagged attestedCredData: aaguid 16 + credIdLen 2 BE + credId + COSE...

Paid WebAuthn / Passkey policy audit (cycle 117) — non-authenticated scan of a sites passkey posture: (a) detects 13 vendor SDKs in HTML (SimpleWebAuthn/Corbado/Hanko/Stytch/Clerk/WorkOS/Auth0/Okta/Descope/Keycloak/Bitwarden/1Password), (b) extracts WebAuthn ceremony hints from inline JS — navigator.credentials.create + .get, userVerification, residentKey, attestation level, allowCredentials, rpId, (c) flags 4 discouraged patterns (challenge-in-URL, attestation:direct-without-filter...

Paid page load performance (TTFB, size, compression, redirects) via x402

Paid Permissions-Policy header audit (browser feature gating, high-risk feature detection, source allowlist) via x402

Paid perpetual swap funding rate (cycle 224 alias path, x402 $0.01) - GET ?asset=<SYMBOL> OR ?assets=<A,B,C> OR ?sample=1|2|3 OR POST application/json {asset|assets}. KEYLESS Hyperliquid info API -- no key, no account, no signup. Live hourly funding rate and its annualised carry cost, open interest, 24h notional volume, mark vs oracle basis in bps, then a crowdedness signal and a funding_rate_score 0-100 A-F with a CROWDSHORT / CROWDEDLONG / BALANCED / ILLIQUID verdict. ALIAS PATH of...

Paid perpetual swap funding rate verdict (cycle 222, x402 $0.01) - GET ?asset=<SYMBOL> OR ?assets=<COMMA SEPARATED> OR ?sample=1|2|3 OR POST application/json {asset|assets}. KEYLESS Hyperliquid info API -- no key, no account, no signup, no paid vendor, 234 perpetual markets. Answers THE QUESTION A LEVERAGED TRADER MUST ANSWER BEFORE OPENING OR FLIPPING A PERP: who is paying to be long, how crowded is the trade, and is the mark diverging from the oracle. Returns the live hourly funding rate...

Paid prediction market odds verdict (cycle 221, x402 $0.01) - GET ?query=<TOPICS OR KEYWORDS> OR ?tag= OR ?sample=1|2|3 OR POST application/json {query|tag}. KEYLESS Polymarket Gamma API + Manifold Markets API -- no key, no account, no signup, no paid vendor. Answers THE QUESTION A BUYER AGENT MUST ANSWER BEFORE IT ACTS ON A FORECAST: what does the crowd think will happen, how confident is it, and do two independent venues agree. Returns per-market implied probabilities, the YES/NO split...

Paid deep CORS preflight OPTIONS audit (cycle 145, x402 $0.001) - 6 sequenced CORS probes (baseline GET + simple-Origin preflight + post+contenttype+auth preflight + multi-header preflight x-custom-1/x-custom-2 + credentials preflight + DELETE-method preflight) + per-probe full Access-Control-* response capture (ACAO + ACAC + ACAM + ACEH + ACRPN + ACEX + ACMA + ACPN) + Vary tracking + method_allowlist_observed cross-probe aggregation + header_allowlist_observed. Returns per_probe[] +...

Paid privacy-signal detection audit — DNT/GPC/AI-opt-out meta tags, JS-side navigator.doNotTrack + globalPrivacyControl + Sec-GPC detection, privacy-policy link check, A-F grade via x402

Paid public-domain audiobook monetisation advisor (cycle 211, x402 $0.01) - GET ?title=&lt;QUERY&gt; OR ?author=&lt;AUTHOR&gt; OR ?identifier=&lt;IA_ID&gt; OR ?sample=1|2|3 OR POST application/json {title|author|identifier}. Uses the KEYLESS Internet Archive advancedsearch + metadata APIs (no API key, no account, no signup) to answer: IS THIS PUBLIC-DOMAIN BOOK WORTH PRODUCING AS A PAID AUDIOBOOK? Returns the catalog entry (title, author, year, subjects, licence), the full mp3 file inventory...

Paid public-domain film clearance + distribution catalogue (cycle 215, x402 $0.01) - GET ?subject=<GENRE>&year=<YYYY>&decade=<1920s> OR ?sample=1|2|3 OR POST application/json {subject|year|decade}. KEYLESS Internet Archive advancedsearch + metadata APIs (no key, no account). Answers CAN THIS FILM BE CLEARED AND HOSTED: per title the identifier, title, year, public-domain verdict (a DATE test plus a licence hint), the actual video-file inventory with formats, sizes and runtimes, the total...

Paid public-domain media demand matcher (cycle 211, x402 $0.01) - GET ?subject=&lt;GENRE_OR_SUBJECT&gt; OR ?q=&lt;FREETEXT&gt; OR ?sample=1|2|3 OR POST application/json {subject|q}. Uses the KEYLESS Internet Archive advancedsearch + metadata APIs and the KEYLESS Open Library search API (no API key, no account, no signup) to answer the DEMAND question for a public-domain catalogue: given a subject or genre, which titles have the strongest existing demand signals (archive download counts...

Paid public-holiday calendar + planning verdict (cycle 215, x402 $0.01) - GET ?country=<ISO2>&year=<YYYY> OR ?sample=1|2|3 OR POST application/json {country|year}. KEYLESS Nager.Date public-holidays API (no key, no account, no signup, 204 countries). NOT a holiday list: returns working days lost, net working days, the LONGEST consecutive non-working BLACKOUT window (holidays plus adjacent weekends) with its date range, clustered blackout windows, the top risk dates, and a...

Paid HTTP/3 QPACK (RFC 9204) encoder-pattern fingerprint probe (cycle 179, x402 $0.001) - accepts GET ?host=<HOST> (default www.cloudflare.com) OR POST application/json {'host':...,'force_quic':...}; fetches https://<host>/ via urllib over TCP+TLS first to extract Alt-Svc header h3 advertisement (RFC 7838) + parse max-age; then reports a canonical QPACK encoder-field-block representation (3 indexed static-table fields :method=GET[index 17] + :scheme=https[index 23] + :path=/[index 1]; 1...

Paid live QUIC (HTTP/3) handshake probe (cycle 101) — actively opens UDP/443 QUIC Initial packets to the resolved A/AAAA, tests 10 candidate versions (draft-29/30/31/32/33/34 + h3 + h3-Q050 + v2); parses server reply to detect Retry packets, Handshake packets, Version Negotiation; reports per-version RTT, server_replied, supported_versions[], handshake_rtt_ms, zero_rtt_supported, retry_required, packets_sent/received, loss_pct, quic_handshake_score 0-100 A-F via x402. Different from...

Paid QUIC spin-bit privacy-leak audit (cycle 164, x402 $0.001) - actively probes RFC 9000 SS15.2 / RFC 9312 spin-bit privacy behavior. Per RFC 9312 SS3.2 the spin bit is the second-most-significant bit of byte 0 of long-header packets (mask 0x20 for QUICv1); implementations that reflect latency on every packet enable on-path observers to measure one-way delay (privacy-hostile). Steps: (1) Alt-Svc QUIC advertise detection; (3) 3 raw UDP/443 hand-rolled QUICv1 Initial probes (RFC 9000 SS17.2...

Paid rate-limit policy inference + adaptive burst probe — parses RFC 9239 RateLimit-* + X-RateLimit-* + X-Rate-Limit-* + Retry-After + vendor-specific headers (GitHub/Shopify/Anthropic/OpenAI) + optional N-request burst (default 8, max 30) to surface 429 ratio + Retry-After pattern; classifies policy fixed_window / sliding_window / leaky_bucket / token_bucket / explicit_rfc9239 / none_detected; returns limit + remaining + reset_seconds + reset_at_iso + burst_results[] + max_safe_burst...

Paid rate-limit header surface + live burst probe (cycle 134, x402 $0.001) - fetches target 4x in a burst, parses 7 known rate-limit header families (IETF RFC 9239 draft, X-RateLimit-*, Twitter, Stripe, Shopify, GitHub, Retry-After + misc), tracks first/last remaining values, detects saturation_observed, computes reset_in_seconds, returns rate_limit_health_score 0-100 A-F. Distinct from /api/header-inventory-full (raw dump, no semantic parsing) and /api/cache-control-granularity...

Paid readability metrics (cycle 92 gating fix)

Paid multi-formula readability analysis — 5 formulas (Flesch Reading Ease + Flesch-Kincaid Grade + Gunning Fog + Coleman-Liau + SMOG) computed from extracted main-content text, returns main_text_preview + word/sentence/syllable/character counts + complex_word_pct + avg_words_per_sentence + target_audience_verdict (child/middle_school/high_school/undergraduate/graduate/academic) + reading_time_minutes + is_dense + is_easy + readability_score A-F grade via x402

Paid redirect-chain map (cycle 95) — follows 3xx chain up to 15 hops without auto-follow (custom HTTPRedirectHandler); per-hop status+location+scheme_change+latency_ms+content_length; detects redirect loops, cross-domain hops, https-downgrade; returns redirect_map_score 0-100 A-F + chain[] + loop_detected + final_url + cross_domain_hops + https_downgraded via x402

Paid redirect-chain security audit — full chain traversal (max 10 hops), open-redirect detection (//, @, javascript:), cross-domain count, https-only check, meta-refresh detection, redirect-security_score A-F grade via x402

Paid deep HTTP redirect chain analyzer — per-hop latency_ms + headers (server/content-type/cache-control/x-cache/cf-ray/cf-ipcountry/vary/set-cookie count/hsts) + status sub-type classification (301/302/303/307/308) + cross-domain + redirect-loop detection + geo-redirect heuristic + HTTP->HTTPS upgrade + intermediate-page body sniff (title/meta-refresh/JS-redirect cloaked detection), redirect_complexity_score 0-100 A-F grade via x402

Paid HTTP redirect chain + final URL via x402

Paid US regulatory impact verdict (cycle 220, x402 $0.01) - GET ?sector=<SECTOR> OR ?entity=<COMPANY NAME> OR ?agency=<AGENCY> OR ?sample=1|2|3 OR POST application/json {sector|entity|agency}. KEYLESS Federal Register API + eCFR API -- no key, no account, no signup, no paid compliance vendor. Answers THE QUESTION A COMPLIANCE BUYER AGENT MUST ANSWER BEFORE IT SHIPS PRODUCT: which US federal rules touch this sector, and what are the two dates it acts on. Returns the matching rules (title...

Paid page render-mode + hydration-profile detector — Next/Nuxt/Remix/Astro/SvelteKit/React/Vue/Angular framework hints + body word count + hidden DOM % + noscript fallback + window.* hydration data keys + verdict string for AI-agent fetching strategy via x402

Paid HTTP request-smuggling CL.TE/TE.CL/TE.TE tolerance evidence probe (cycle 129, x402 $0.001) - opens low-level socket (bypasses urllib header normalization) to target host, sends 6 PortSwigger-style evidence requests per https://portswigger.net/web-security/request-smuggling: (1) CL.TE — both Content-Length + Transfer-Encoding: chunked, (2) TE.CL — reversed priority, (3-6) TE.TE with 4 obfuscation variants (leading space / trailing space / mixed case / baseline), reports per_probe[]...

Paid robots.txt audit via x402

Paid robots.txt vs meta robots vs X-Robots-Tag conflict detector — 4 conflict types (robots-disallow-vs-meta-index, robots-allow-vs-meta-noindex, X-Robots-Tag-noindex-vs-meta-index, X-Robots-Tag-index-vs-meta-noindex) + AI-bot-specific robots.txt directive capture (30+ AI crawlers) + redundant-signal flagging (defense-in-depth OK) + effective-path directive resolution, robots_meta_conflict_score 0-100 A-F via x402

Paid deep robots.txt audit — per-UA directive counts, sitemap, 34 AI-bot directive detection (GPTBot/ClaudeBot/Google-Extended/CCBot/PerplexityBot/Meta-ExternalAgent/Bytespider/etc), crawl-delay, anti-pattern flags, robots_score 0-100 A-F grade via x402

Paid x402 route quality-vs-cost ARBITER (cycle 180, x402 $0.001) - accepts GET ?urls=https://u1|https://u2|... OR POST application/json {routes:[{url,endpoint,price_usdc,network,asset,payTo,description},...]} OR GET ?sample=2|3 (built-in fixtures against own catalog). For each candidate route computes quality_score_pre 0-60 (description_length + action_verb presence + method_or_param_hint + price_documented + network_eip155 + asset_present) + distinctiveness_score 0-40 via Jaccard 3-gram...

Paid URL safety audit (sandbox-friendly) — 12-signal heuristic preflight for AI agents deciding whether to render/embed a URL: scheme allowlist (http = medium risk, mailto/file/javascript/data = high), Suspicious-TLD catalog (52 Freenom/free-tld per Spamhaus style: tk/ml/ga/cf/gq/xyz/top/click/download/loan/work/review/country/stream/science/date/racing/win/account/bid/cricket/faith/trade/party/study/link/men/mom/buzz/lol/rest/gdn/cyou/icu/monster), IDN/Punycode homograph detection (xn...

Paid prompt-safe URL preview (cycle 99) — fetches a URL and returns a plain-text preview with ALL scripts/styles/iframes/objects/embeds/event-handlers/javascript:-URLs/data:-URLs STRIPPED before text extraction; reports stripped_counts{scripts/styles/iframes/event_handlers/hidden_inputs/forms}, risk_flags[] (meta_refresh_redirect/form_with_external_action/open_redirect_link/iframe_with_srcdoc/noscript_with_payload/hidden_form_inputs/dangerous_urls_neutralized), word_count + paragraph_count...

Paid sanctions screening verdict (cycle 219, x402 $0.01) - GET ?name=<ENTITY NAME> OR ?names=<A,B,C> OR ?sample=1|2|3 OR POST application/json {name|names}. KEYLESS official sanctions lists -- OFAC SDN list XML (treasury.gov) + OFAC consolidated list + UN Security Council consolidated list -- no key, no account, no signup, no paid screening vendor. Answers THE QUESTION A BUYER AGENT MUST ANSWER BEFORE IT MOVES MONEY: is this counterparty on a sanctions list, and how strong is the match...

Paid scholar evidence card for a research claim (cycle 217, x402 $0.01) - GET ?query=<CLAIM_OR_TOPIC> OR ?sample=1|2|3 OR POST application/json {query}. KEYLESS arXiv (export.arxiv.org Atom), Crossref (api.crossref.org) and EuropePMC (ebi.ac.uk) -- no key, no account, no signup. Answers HOW STRONG IS THE EVIDENCE for a claim: the matching papers across all three indexes, total citations, the author count and institutional spread, the recency window, the open-access share, the...

Paid script-inventory extractor (x402 $0.001) - GET ?url=<URL> enumerates every <script src> with integrity/crossorigin/type attributes and reports same-origin vs third-party breakdown. via x402

Paid SEC EDGAR company filing search (cycle 224 alias path, x402 $0.01) - GET ?query=<TEXT> OR ?cik=<CIK> OR ?ticker=<SYMBOL> OR ?form=<10-K|8-K|S-1> OR ?sample=1|2|3 OR POST application/json {query|cik|ticker|form}. KEYLESS SEC EDGAR full-text search + company_tickers + submissions + companyfacts XBRL -- no key, no account, no signup. Matching filings (accession, form type, company, CIK, ticker, filing date, period, document URL), the form-type mix, the freshness window, the filing-cadence...

Paid SEC EDGAR filings verdict (cycle 223, x402 $0.01) - GET ?query=<TEXT> OR ?cik=<CIK> OR ?ticker=<SYMBOL> OR ?form=<10-K|8-K|S-1|DEF 14A> OR ?sample=1|2|3 OR POST application/json {query|cik|ticker|form}. KEYLESS SEC EDGAR full-text search API (efts.sec.gov) + company_tickers.json + data.sec.gov submissions + companyfacts XBRL -- no key, no account, no signup, no paid filings vendor. Answers THE QUESTION A BUYER AGENT MUST ANSWER BEFORE IT ACTS ON A COMPANY: what has this company actually...

Paid security-header mutation test (cycle 143, x402 $0.001) - fetches target URL 5x with deliberately different fingerprint headers (Chrome desktop + Firefox + Mobile Safari + python-requests bot + baseline); compares the set of 12 security-relevant response headers (CSP/HSTS/X-Frame-Options/X-Content-Type-Options/Referrer-Policy/Permissions-Policy/COOP/COEP/CORP/etc) across all 5 responses; flags header_removed_in_some_response (high severity) + header_value_changed (medium); A/B testing or...

Paid security.txt RFC 9116 deep audit — path discovery tries /.well-known/security.txt then /security.txt, parses all fields with line-continuation support, strict Contact format validation (mailto: + https://), strict Expires RFC 3339 format + future-dated window + 7d-soon + 365d-too-far flags, Canonical URL must match security.txt URL itself, Preferred-Languages BCP 47 / ISO 639-1 validation, Acknowledgments must be https://, Encryption URL https:// validation, rfc9116_compliant boolean...

Paid HTTP security header audit (CSP/HSTS/X-Frame-Options/etc) via x402

Paid seller x402 catalog bloat + consolidation scoring (cycle 121, x402 $0.001) - fetches a target /s /.well-known/x402 catalog (GET) or accepts raw catalog as POST body; computes thin-descriptions count (<60 chars), version-variant groups (/v1 vs /v2 etc.), high-similarity description pairs (Jaccard >0.45 on 3+ char tokens), price-band fragmentation (# distinct atomic price points), name-overlap score (top-prefix concentration), consolidation_candidates[] (clusters of 2+ endpoints that...

Paid comprehensive SEO audit (title length, meta description, canonical, robots, viewport, OG/Twitter, JSON-LD, hreflang, favicon, sitemap + A-F grade) via x402

Paid server/fingerprint/debug/cache response-header audit — Server + X-Powered-By info-leak detection, framework-version-disclosed (X-AspNet-Version/X-Generator/X-Drupal-Cache), debug-headers-in-prod (X-Debug/X-Runtime), 8 request-id/correlation-header inventory, cache-status indicators (CF-Cache-Status/X-Cache/X-Vercel-Cache/Age), Set-Cookie enumeration, server_headers_score 0-100 A-F grade via x402

Paid sitemap.xml discovery + URL extraction via x402

Paid deep sitemap audit — format validity + lastmod coverage % + lastmod ISO 8601 validity + image/video/news/xhtml extension support + sitemap index nesting depth + robots.txt Sitemap directive + changefreq/priority deprecation flags + crawl_budget_verdict + sitemap_health_score 0-100 with A-F grade via x402

Paid hreflang <-> sitemap.xml cross-validator (cycle 94) — extracts page hreflang tags, validates BCP47 + self-reference + x-default + canonical agreement, locates sitemap (sitemap.xml + sitemap_index.xml + robots.txt Sitemap:), extracts URL set + xhtml:link hreflang inside, HEAD-probes declared hreflang targets, detects 7 mismatch types (page_not_in_sitemap + hreflang_url_not_in_sitemap + invalid_bcp47 + canonical_mismatch + no_x_default + hreflang_sitemap_disagreement + hreflang_url_dead)...

Paid SMTP credential-leak probe (cycle 158, x402 $0.0005) - actively probes each MX host on ports [25, 465, 587] for credential-handling vulnerabilities. Per-port: opens TCP, reads banner, sends EHLO, captures AUTH mechanisms offered (PLAIN/LOGIN/CRAM-MD5/XOAUTH2/NTLM), detects PLAIN/LOGIN offered pre-STARTTLS on cleartext ports (CRITICAL credential leak vector), detects AUTH NTLM (known MS Exchange leak vector), distinguishes implicit-TLS port 465 (acceptable for PLAIN) vs plaintext ports...

Paid SMTP open-relay test (cycle 154) - actually attempts MAIL FROM + RCPT TO against each MX host. Resolves MX via Cloudflare DoH, opens TCP/25, sends EHLO + MAIL FROM:<external> + RCPT TO for both local-domain and foreign-domain recipients. Verdict mapping per RFC 5321: open_relay (250/250 critical), relay_denied (550/553 good), requires_auth (530/535 good), greylist_or_throttle (421/452), sender_rejected (5xx MAIL FROM), incomplete_transaction. Returns per_mx[] for both local and foreign...

Paid live SMTP STARTTLS opportunistic-TLS probe (cycle 128, x402 $0.001) - resolves MX hosts via Cloudflare DoH, opens TCP to each on ports 25 + 587, reads SMTP banner, sends EHLO and parses capability list (STARTTLS/SIZE/8BITMIME/AUTH/PIPELINING/ENHANCEDSTATUSCODES), sends STARTTLS if offered, completes TLS handshake, re-sends EHLO over TLS, parses cert (subject/issuer/SAN/expiry). Returns per_mx[] (host, port, banner, ehlo_caps, starttls_offered, starttls_succeeded, tls_version...

Paid Solana token risk verdict (cycle 221, x402 $0.01) - GET ?token=<MINT OR SYMBOL> OR ?symbol= OR ?sample=1|2|3 OR POST application/json {token|symbol}. KEYLESS Jupiter price + swap-quote APIs + pump.fun frontend API -- no key, no account, no signup, no paid vendor. Answers THE QUESTION A BUYER AGENT MUST ANSWER BEFORE IT BUYS A SOLANA TOKEN: is it liquid enough to buy, can I actually exit it, and does it carry rug risk. Returns the live price and 24h change, the USD liquidity, the...

Paid JavaScript sourcemap exposure audit — fetches every external <script src> + probes inline-script //# sourceMappingURL= references + tries each .map URL via HEAD to surface public source-leak risk, sourcemaps_referenced + sourcemaps_publicly_fetchable + sourcemaps_blocked + ratio + sourcemap_score 0-100 A-F via x402

Paid OpenAPI/Swagger/AsyncAPI/GraphQL/Postman/JSON-Schema spec format + version detector (cycle 98) — probes 9 conventional spec paths (/openapi.json + /openapi.yaml + /swagger.json + /swagger.yaml + /.well-known/openapi.json + /api/openapi.json + /v1/2/3/openapi.json), detects format (openapi-3.x / swagger-2.0 / asyncapi-2.x / graphql-sdl / postman-2.1 / insomnia-4 / json-schema / api-blueprint) + version, parses info.title + info.version + paths[] + components.schemas count + total...

Paid SRI hash collision-risk + algorithm-strength probe (cycle 113) — parses every <script src integrity> and <link rel=stylesheet href integrity>, for each subresource: extracts the hash token (sha256/sha384/sha512/sha1/md5), validates HASH LENGTH against expected base64 char count (sha256=44/sha384=64/sha512=88/sha1=28/md5=24 — anything shorter = TRUNCATED = SRI USELESS), flags WEAK HASH ALGORITHM (sha1/md5 per W3C 2024 SHOULD NOT), HEAD-probes the actual URL checking for CORS headers...

Paid Subresource Integrity hash-match verifier — fetches every <script src=> + <link rel=stylesheet/modulepreload/preload href=> with integrity attribute, SHA-256/384/512-hashes the bytes and compares to declared base64 digest, returns resources_checked + resources_matched + resources_mismatch + resources_failed + crossorigin_proper count + per-resource sha384_actual_b64/match_algo/mismatch_reason, sri_hash_score 0-100 A-F grade via x402

Paid Subresource Integrity (SRI) audit — per-external script+stylesheet integrity/crossorigin/referrerpolicy capture, CDN host breakdown, top untrusted-CDN list, missing-SRI risk scoring, sri_score 0-100 A-F grade via x402

Paid SRI readiness audit - probes every <script src=...> tag on a page, classifies each as same-origin vs third-party, checks for presence of integrity= + crossorigin= attributes, HEAD-probes each script for reachability + content-type + cache-control, returns per-script status + composite sri_readiness_score 0-100 A-F + unprotected_third_party_script_count + recommendations for adding integrity attributes via x402

Paid TLS certificate audit (issuer, expiry, signature alg, SAN list) via x402

Paid SSL-pinning / HPKP policy probe (x402 $0.001) - GET ?domain=<DOMAIN> checks for deprecated HPKP (RFC 7469) headers, CSP public-key-pins directives and pinning-related security headers, returning a pinning posture grade. via x402

Paid unified structured-data audit — JSON-LD + Microdata + RDFa aggregated into unique schema.org types + parent-class hierarchy + 21 rich-result candidate detection + machine_readability_score 0-100 with A-F grade via x402

Paid JSON-LD @id cross-reference reachability probe (cycle 143, x402 $0.001) - parses all <script type=application/ld+json> blocks, extracts every @id URL, HEAD-probes each (max 12, parallel), verifies reachability + Content-Type; bi-directional check (does the linked page reference the target back?); orphan @id detection (declared but unreachable); per_link[] + dead_links[] + orphan_ids[] + reachable_ratio + structured_data_crossref_score 0-100 A-F. Distinct from /api/jsonld (parse) and...

Paid Schema.org JSON-LD validator + recommended-properties audit (30-type catalog with required/recommended property checks, type-specific anti-pattern detection, ISO 8601 / ISO 4217 / phone-format checks, weighted required+recommended scoring, sd_validator_score 0-100 A-F grade) via x402

Paid subdomain enumeration via HackerTarget hostsearch + urlscan fallback — discovered subdomains with IP + total count + dedup + top-subdomain-prefix frequency + takeover-risk heuristics (disposable-cloud/known-vulnerable/stale-unusual detection), subdomain_enum_score 0-100 A-F grade via x402

Paid subdomain takeover fingerprint (cycle 192, x402 $0.001) - GET ?host= OR ?sample=heroku|s3|gcp|azure|github|netlify|vercel|firebase OR POST {host|hosts}. Per host: DNS A/AAAA+CNAME via DoH then HTTP+HTTPS probe of alias for NoSuchBucket / Site Not Found / deployment-not-found across 24 providers. Returns per_host cname_target + matched_provider + cname_terminates_in_hits[] + risk + score 0-100 A-F + verdict. via x402

Paid subdomain-takeover risk audit (cycle 100) — discovers subdomains via HackerTarget hostsearch, resolves CNAME chain (max 8 hops) via Cloudflare DoH, fingerprints 30+ known-vulnerable service providers (AWS S3, CloudFront, Elastic Beanstalk, Heroku, GitHub Pages, Azure Web Apps, Shopify, Fastly, Pantheon, Tumblr, WordPress.com, Zendesk, HelpScout, StatusPage, UserVoice, Webflow, Mashery, Netlify, Vercel, Fly.io, Render, Surge, Bitbucket), HEAD-probes the final target to detect dangling...

Paid URL text summary via x402

Paid SVCB/HTTPSSVC (RFC 9460+9461) deep parser (cycle 170, x402 $0.001) - probes 11 conventional _<port>._<proto>.<domain> SVCB endpoints (_443._tcp + _443._tcp.www + _443._tcp.api + _80._tcp + _25._tcp + _587._tcp + _853._tcp + _8443._tcp + _4433._tcp + _5223._tcp + _596._tcp) via Cloudflare DoH type=64 (SVCB) and type=65 (HTTPSSVC). For each endpoint parses RFC 9460 §6 SvcParams (alpn / port / ipv4hint / ipv6hint / ech / dohpath / ohttp / mandatory / no-default-alpn / alpn-for-h3)...

Paid outbound link/redirect health audit (dead-link probe, redirect chain depth, mixed-content detection, broken in-page anchors, invalid mailto, A-F grade) via x402

Paid tech-stack fingerprint (frameworks, libraries, server, CDN, fonts, analytics) via x402

Paid TLS handshake + certificate audit (TLS version, cipher, ALPN, cert chain, days-to-expire, key type/size, SAN coverage, sig algorithm, A-F grade) via x402

Paid deep TLS handshake probe — TLS version (1.0/1.1/1.2/1.3) + cipher suite classification (aead-strong/strong-fs/weak/legacy-fs) + ALPN negotiation (h2/http1.1) + Alt-Svc h3 HTTP/3 endpoint discovery + key_exchange group (ECDHE/DHE/static-RSA) + signature scheme (rsa_pss/ecdsa) + OCSP-stapling detection + session-ticket + cipher_security grade, tls_handshake_score 0-100 A-F via x402

Paid active TLS 1.3 + PQC + ECH probe (cycle 108) — opens TLS 1.3 connection, advertises 13 named groups including PQC hybrids (X25519Kyber768Draft00/Draft01, X25519Kyber768, SecP256r1Kyber768Draft00/Draft01, P256Kyber768Draft00) + classical (X25519/P-256/P-384/P-521) + FFDHE groups; queries HTTPS/SVCB DNS for ECHConfig (Encrypted Client Hello) presence; reports pqc_group_used + pqc_group_name + ech_supported + ech_config_count + supports_psk + supports_0rtt + supports_tls13_middlebox_compat...

Paid crypto token market verdict card (cycle 209, x402 $0.005) - GET ?token=<SYMBOL_OR_ID> OR ?contract=<0x...> OR ?sample=1|2|3 OR POST application/json {token|contract}. Uses the KEYLESS CoinGecko public API (no API key, no account, no signup) to return a plain-language verdict card for a token: live USD price, 24h/7d/30d change, market cap, fully-diluted value, 24h volume, circulating vs total supply, all-time-high and drawdown-from-ATH, a computed liquidity score and volatility band, a...

Paid JavaScript tracker/network fingerprint classifier — scans inline+external+meta+noscript for ~100 analytics/ad-pixel/session-replay/chat/heatmap/a-b-test/social-pixel/consent/tag-manager signatures across 10 categories, privacy-friendliness grade privacy-respecting/mixed/tracker-heavy, tracker_classify_score 0-100 A-F grade via x402

Paid institutional trust-anchor audit (beyond EEAT) — legal entity suffix + regulatory mentions (SEC/FINRA/HIPAA/GDPR/SOC2/etc) + jurisdictional signals + 11 trust seals + copyright + legal pages + trust_anchors_score 0-100 A-F grade via x402

Paid network-timing breakdown for a URL — DNS resolve + TCP connect + TLS handshake + TTFB (time to first byte) + total download phase-by-phase milliseconds + CDN/edge-region detection from CF-Ray/X-Amz-Cf-Pop/X-Vercel-Id + body_bytes + verdict (fast/moderate/slow/very_slow) + ttfb_score 0-100 A-F grade via x402

Paid redirect-destination classifier (cycle 123, x402 $0.001) - follows up to 10 redirect hops with loop detection, then classifies FINAL destination by TLD category (ccTLD / classic gTLD / suspicious .xyz .top .click .link .loan .win .bid .review .wtf etc.) + domain profile (punycode xn--, digit-ratio>30%, hyphen-count>=5, subdomain-depth>=4, IDN homoglyph) + SSL cert issuer class + parking-vendor fingerprints + monetization (GAM/AdSense/interstitial) + chain risk (open-redirect userinfo@...

Paid mobile/responsive viewport meta audit — viewport tag (width=device-width,user-scalable), apple-mobile-web-app-capable, theme-color, format-detection, apple-touch-icon + manifest.json detection, touch-icon coverage, mobile_score 0-100 A-F grade via x402

Paid WAF/IDS/CDN-edge fingerprint detector — 28-vendor catalog (Cloudflare/Fastly/Akamai/Imperva/Sucuri/CloudFront/ALB/Azure-FrontDoor/Vercel/Netlify/StackPath/KeyCDN/BunnyCDN/F5-BIGIP/Barracuda/Citrix-NetScaler/ModSecurity/Wordfence/Shape/Kasada/PerimeterX/DataDome/etc), response-header fingerprint + body-marker scan + malformed-payload probe (SQLi+path-traversal query string), primary_vendor + confidence (high/medium/low/none) + is_waf + is_cdn + waf_indicators + waf_detect_score 0-100 A-F...

Paid WebAssembly CSP + wasm-unsafe-eval coverage analyzer (cycle 137, x402 $0.001) - fetches target URL, scans for WASM indicators (inline WebAssembly.instantiate/compile + .wasm file references + <link rel=preload as=fetch type=application/wasm> + library mentions emscripten/AssemblyScript/Blazor/Pyodide/wasm-bindgen), HEAD-probes first 6 .wasm URLs, parses CSP for script-src directive, detects 'wasm-unsafe-eval' (Chrome 97+/Firefox 99+/Safari 16.4+) presence vs absence vs 'unsafe-eval' vs...

Paid Wayback Machine CDX-API archive availability audit — snapshot_count, first_snapshot, last_snapshot, age_at_first_snapshot_days, age_at_last_snapshot_days, years_active, snapshots_per_year, is_archived, is_recently_archived (last capture <=365d), wayback_machine_url, ai_cache_present, dnt_year_intensity (top 10 years), http_response_code_newest, wayback_snapshot_score 0-100 A-F grade via x402

Paid deep WCAG 2.1/2.2 AA accessibility audit — forms+inputs (label/aria-label/aria-labelledby/placeholder), autocomplete token validity, button+link accessible-name, heading hierarchy (skip-level + multiple-h1 detection), landmark structure (main/nav/header/footer + ARIA roles), skip-nav link detection, iframe title attribute, inline color-collision heuristic, :focus-visible CSS hint, table <caption>+<th scope>, ARIA misuse detection (aria-hidden-with-focusable +...

Paid Web Bot Auth / RFC 9421 HTTP Message Signatures verifier (cycle 146, x402 $0.001) - probe /.well-known/http-message-signatures on target, extract Ed25519 public keys, parse caller-supplied signature-input + signature, verify alg/keyid/created/expires, return discovery + verification + web_bot_auth_score 0-100. Useful for AI agents verify rate that a claimed bot is actually that bot. Distinct from /api/llm-crawl-policy (presence-only): does cryptographic-format-level parse + key-shape check.

Paid Web Vitals INP (Interaction-to-Next-Paint) heuristic estimate (cycle 118) — static-analysis proxy for INP p75 without a real browser: counts addEventListener + onclick/oninput/onkeydown/onsubmit handlers in inline + external JS (cap 8 scripts, 200KB each), estimates JS parse/execute cost from total bytes (>400KB/+60ms, >800KB/+130ms, >1.5MB/+220ms penalties), detects framework cost (React/Vue/Svelte/Angular/Next/Nuxt + SPA-hydration pattern adds +100ms), counts long-task candidates...

Paid WebAuthn/FIDO2 ceremony decoder + validator (cycle 155, x402 $0.001) - decodes clientDataJSON + attestationObject for both register and assertion ceremonies; extracts rpIdHash + flags (UP/UV/BE/BS/AT/ED) + signCount + extensions; COSE-decodes credentialPublicKey + per-credId + aaguid with vendor lookup (14 vendors: Yubico/Google Titan/Feitian/SoloKey/Apple Passkey/Windows Hello etc.); parses attStmt per fmt (none/packed/fido-u2f/android-key/apple/tpm); validates against expected...

Paid PWA Web App Manifest audit via x402

Paid WebTransport handshake + endpoint reachability probe (cycle 165, x402 $0.001) - actively probes RFC 8441 + RFC 9290 + RFC 9221 WebTransport readiness across 8 axes: (1) Alt-Svc h3/h3-NNN advertise parse (HTTP/3 required for WebTransport); (2) Extended CONNECT-UDP enablement probe (RFC 9221, :protocol=connect-udp pseudo-header) to 3 candidate paths; (3) WebTransport-specific endpoint discovery (HEAD-probes 6 conventional paths /webtransport + /.well-known/webtransport +...

Paid /.well-known/* inventory probe - enumerates 30 standard + proposed well-known paths (security.txt RFC 9116 + openid-configuration + webfinger + nodeinfo + agents.txt + llms.txt + llms-full.txt + apple-app-site-association + assetlinks.json + openid-federation + oauth-authorization-server + manifest.json + ...), probes each at both /.well-known/<path> AND /<path> fallbacks, returns per-path found_at+status+content_type+size_bytes + aggregate wellknown_inventory_score 0-100 A-F +...

Paid WHOIS / RDAP lookup via rdap.org

Paid audiobook narration economics advisor (cycle 207, x402 $0.001) - GET ?title=<BOOK_TITLE>&author=<AUTHOR>&minutes=<N> OR ?sample=1|2|3 OR POST application/json {title, author, minutes, hourly_llm_rate_usd, tts_usd_per_million_chars}. Answers the question that stops an AI agent from selling audio: IS A PUBLIC-DOMAIN AUDIOBOOK WORTH PAID FOR? Checks public-domain status (no account, no key: Gutendex API), estimates narration cost from runtime, prices the finished audiobook as an x402/USDC...

Paid x402 Bazaar competitor gap (cycle 206, x402 $0.001) - GET ?url=<SELLER_URL> (default: self) finds out why a seller is invisible in the x402 Bazaar even when it passes validation. Fetches the seller's LIVE 402 and compares the Bazaar discovery metadata it emits (resource.serviceName, resource.tags, resource.iconUrl, accepts[0].extra) against what the 200-resource competitive sample actually carries, then issues a live CDP /discovery/search probe with the seller's own name to prove...

Paid x402 Bazaar demand map (cycle 206, x402 $0.001) - GET ?query=<WORDS> OR ?sample=N maps where the money actually moves inside Coinbase CDP's x402 Bazaar by reading the REAL 30-day demand data CDP publishes on every one of its 37,897 catalog entries: quality.l30DaysTotalCalls, quality.l30DaysUniquePayers and quality.lastCalledAt. Returns per-seller 30d calls and unique payers, the top paying services, the price distribution of live demand (median, p10, share under the $0.001 floor), and...

Paid x402 Bazaar index presence audit (cycle 205, x402 $0.001) - GET ?url=<SELLER_URL> (default: self) OR ?pay_to=<ADDRESS> checks whether a seller is ACTUALLY LISTED in Coinbase CDP's x402 Bazaar -- the only keyless, paginated, semantically-searchable x402 discovery catalog (37,478 resources) -- using CDP's own keyless discovery APIs: merchant lookup by payTo, the paginated resource catalog, and semantic search. Returns the RAW CDP evidence per rail (merchant resources + total, catalog...

Paid x402 Bazaar indexing readiness report (cycle 205, x402 $0.001) - GET ?url=<SELLER_URL> (default: self) OR ?path=<PATH> asks CDP's OWN keyless validator (POST api.cdp.coinbase.com/platform/v2/x402/validate) whether THIS seller's live route would be accepted for Bazaar indexing, and returns CDP's real preflight checks, simulation.outcome and rejectionReason verbatim. The two required things that silently block indexing are: extensions.bazaar must be TOP-LEVEL on the 402 body (nesting it...

Paid x402 buying-decision simulator (cycle 146, x402 $0.001) - fetch target's /.well-known/x402, compute per-route monthly_cost and value_at given calls_per_month + value_per_call_usd, classify buy / buy_conditionally / tie / negotiate_price / avoid, return per_route_top10 ranked by net USD + summary {buy, conditional, tie, negotiate, avoid counts, total_net_usd_per_month}. Distinct from /api/x402-seller-probe (audits seller inventory) and /api/x402-marketplace-trends (audits market trend)...

Paid x402 buyer CLI template generator (cycle 191, leak-closed cycle 193) - GET ?route=&rounds=N returns a pre-filled runnable Python httpx+eth_account snippet that pays for one chosen route. RE-gated: it was advertised at $0.001 but served free. via x402

Paid x402 buyer-contract readiness card (cycle 200, x402 $0.001) - GET ?url=<SELLER_URL> (default: ourselves) answers the one question a buyer agent asks before spending USDC: can I parse the 402 challenge, is it the money I expected, and does the seller agree with itself. Fetches the seller's advertised manifest, takes a real unpaid call off its catalog, parses the x402 v2 accepts[] entry, and cross-checks scheme, network, asset, payTo and required amount against what the manifest...

Paid buyer-side cost projection (cycle 187, x402 $0.001) - given a buyer's projected call volume and category mix, returns a monthly USDC spend estimate at THIS seller's catalog plus bundle-recommendation cost-reduction alternatives. Solves the 'I want to use x402 but I have no idea what monthly spend would be' question. GET ?monthly_calls=N&top_routes_k=N&daily_burst=N&mix=audit,seo,email OR POST {monthly_calls, top_routes_k, daily_burst, mix}. Returns workload_assumptions +...

Paid buyer-side optimal-route shopper (cycle 187, x402 $0.001) - given a buyer's free-form intent string, ranks THIS seller's routes by Jaccard token similarity (with path-substring and path-token boosts) and returns top-K candidates with price + call_url + score breakdown + matched_tokens. GET ?query=<TEXT>&top_k=3 OR POST {query, top_k}. Returns match_confidence high|low|no_clear_match plus hallucination guard. Solves 'I have 264 routes, which one matches my job?'. Distinct from...

Paid x402 buyer payment readiness report (cycle 204, x402 $0.001) - GET ?url=<SELLER_URL> (default: self) OR ?sample=N runs a STRICT x402 v2 client against a seller's catalog end to end and reports the exact stage a buyer stalls at. For each candidate route: fetch the live 402, attempt to build the v2 `accepted` object, sign a real EIP-3009 authorization with a FRESHLY GENERATED EPHEMERAL KEY (never funded, never settled -- no funds move), POST it, and classify the outcome...

Paid x402 BUYER-side reachability audit (cycle 193, x402 $0.001) - GET/POST no params. Checks (1) app url_root reflects the public https scheme (ProxyFix present), (2) public tunnel URL stability warning, (3) facilitator /supported advertises seller network eip155:8453, (4) seller wallet informational. Returns findings + reachability_score 0-100 + grade + verdict. via x402

Paid x402 buyer receipt history (cycle 191, leak-closed cycle 193) - per-buyer call ledger + spend + 60-day by_day_series from the local access log. RE-gated: advertised at $0.001 but served free. via x402

Paid x402 buyer-side wallet preflight (cycle 184, x402 $0.001) - GET ?route=<API_ROUTE>&amount=<ATOMIC> generates an ephemeral in-process key, signs a REAL EIP-3009 TransferWithAuthorization against the seller's USDC contract, and walks it through the live facilitator /verify exactly as a buyer's payment client would. Funding-safe by construction: the ephemeral key holds nothing so /settle can never move funds. Returns ephemeral_probe_account + stages[] + buyer_client_would_succeed +...

Paid x402 cart cost-quote (cycle 185, x402 $0.001) - GET with no params returns the FULL live price list of every paid route grouped into price tiers plus api_base + payTo + network + asset, so an agent can plan a workflow without paying. GET ?routes=/api/dns,/api/tls-audit,/api/email-auth-rollup (max 50, comma-separated) OR ?sample=3|5 OR POST application/json {routes:[...]} or {cart:[...]} prices an arbitrary shopping cart: per-route price_usd + price_atomic + call_url + network + asset +...

Paid x402 discovery-list topology auditor (cycle 172, x402 $0.001) - accepts ?url=<X402_CATALOG_URL> (defaults to our own /.well-known/x402); fetches target catalog (handles 5 schema variants: endpoints[] / agents[] / items[] / routes[] / bare-list); normalizes every endpoint as a graph node with path / method / price_usd / pay_to / asset / network attributes; computes payTo-concentration top-1 share + Gini coefficient (Lorenz-curve ownership concentration) + per-network concentration +...

Paid x402 dispatch eligibility report (cycle 198, x402 $0.001) - GET ?url=<SELLER_URL> (default: ourselves) or ?sample=N answers the gate AFTER indexability: will a buyer-side router actually route a paid call here, or quarantine this seller behind every proven incumbent? Probes a real 402 challenge off the catalog, then scores scheme/network/asset correctness, durable-hostname presence (dev-tunnel origins are rejected outright by some indexes and treated as unproven by others), and...

Paid x402 endpoint-durability auditor (cycle 196, x402 $0.001) - GET ?url=<SELLER_URL> scores whether a seller's public URL is STABLE enough to trust with real money: URL-shape provider fingerprint (trycloudflare/lhr.life/ngrok/serveo = ephemeral), apex depth, live X.509 parse (issuer + SAN + validity window), DNS resolution, the 3 agent discovery surfaces (/.well-known/x402 + /openapi.json + /llms.txt), and settlement liveness (seller USDC balance on Base via eth_call). Returns findings[]...

Paid x402 facilitator benchmark (cycle 196, x402 $0.001) - GET ?facilitator=&network=&asset=&pay_to=&rounds=N benchmarks the facilitator that EVERY x402 payment funnels through: live /supported capability probe (does it advertise the seller's network + USDC asset?), /verify rejection latency over N rounds using a syntactically-valid but UNSIGNED and UNFUNDED payload (proves the endpoint is real and correctly rejects - no funds can move), /settle HEAD reachability, plus latency percentiles...

Paid x402 funnel conversion audit (cycle 201, x402 $0.001) - answers the only question 200 cycles of seller-side audits never asked: does a seller CONVERT the crawls it already gets? Reads the seller's OWN access log, separates self-probe traffic from real external callers, and splits external requests into discovery / first_call_402 / paid_settled. Returns crawl_to_call_pct + call_to_paid_pct + external_paths_touched[] + top_external_ips[] + funnel_score 0-100 A-F + next_action. Measured on...

Paid x402 index reachability audit (cycle 198, x402 $0.001) - GET ?url=<SELLER_URL> (comma-separated up to 4) or ?sample=N audits whether a seller is reachable through the BUYER-SIDE INDEX layer, not just its own HTTP surface. Probes agent402.tools, x402dash and 402index.io with keyless reads and reports which actually index the seller, with the raw evidence (liveness_score, reachability_status, x402_status, integration_readiness, indexing flag). Returns index_reachability_score 0-100 A-F +...

Paid x402 intent signal extractor (cycle 201, x402 $0.001) - ranks a seller's catalog against the intents a buyer agent arrives with. Reads the seller's llms.txt + manifest, extracts declared intents, token-matches each against endpoint names and descriptions, and returns the ranked shortlist (endpoint + price + match_score) a crawler can act on, plus intent_coverage_pct and intent_signal_score 0-100 A-F. Fixes the measured drop-off: external callers fetched the manifest 13x and openapi 11x...

Paid x402 marketplace liveness sweep (cycle 197, x402 $0.001) - GET ?url=<SELLER_URL> (comma-separated up to 6) or ?sample=N audits whether a LISTED x402 seller is actually PAYABLE before a buyer spends USDC. Parses 5 catalog shapes, then issues live unpaid probes against each advertised /api path and classifies: 402 = correctly gated and payable, 404/405 = listed but dead or wrong method, 200 = listed but serving free. Returns per-seller trust_score 0-100 A-F + payable bool + verdict...

Paid x402 marketplace trend scanner (cycle 120, x402 $0.001) - fetches a target /s /.well-known/x402 catalog (GET) or accepts raw catalog as POST body; computes per-asset + per-network + per-facilitator + per-scheme distributions, price-per-call histogram (5 buckets from under_$0.001 to above_$0.05), unique_payTo count (concentration/fragmentation signal), price_atomic min/max/mean/median stats, maxTimeoutSeconds stats, description-keyword term frequency (top 15), endpoint-kind...

Paid x402 payment challenge conformance (cycle 204, x402 $0.001) - GET ?url=<SELLER_URL>/<PATH> (default: this seller's own live 402 challenge) parses the 402 PaymentRequired a buyer agent actually reads and checks it field-by-field against the published x402 v2 spec (5.1.1/5.1.2). Emits missing_required[], version_field_mismatch[], plus a SIMULATED STRICT v2 CLIENT BUILD that either succeeds or prints the exact KeyError the client would raise. Catches the defect that hid for 201 cycles...

Paid x402 payment payload decoder + trace (cycle 142, x402 $0.001) - accepts X-PAYMENT base64 / POSTed JSON / payment_b64 query; parses x402Version + scheme + network; decodes EIP-3009 transferWithAuthorization (from/to/value/validAfter/validBefore/nonce + signature v/r/s); reports expiry status (valid/expired/not_yet_valid) + signature length diagnostics + well_formed bool + per-field findings; x402_payment_trace_score 0-100 A-F. For AI agents debugging their own payment payload before...

Paid x402 price-per-call optimizer (cycle 119, x402 $0.001) - fetches a target seller /s /.well-known/x402 catalog (or accepts raw catalog as POST body), extracts price-per-call from atomic-string or decimal forms, computes min/max/mean/median/stdev + 5-bucket histogram (<$0.001 / $0.001-$0.005 / $0.005-$0.01 / $0.01-$0.05 / >$0.05) + network + asset + payTo diversity breakdowns + suggested entry-point price (50th percentile) + suggested premium price (75th percentile) + x402_pricing_score...

Paid public-holiday business-impact intelligence (cycle 207, x402 $0.001) - GET ?country=US&year=2026 OR ?countries=US,GB,DE,FR OR ?month=12&year=2026 OR POST application/json {country|countries, year}. Uses the KEYLESS public NAGER holidays API (no API key, no account) to return, per country: total public holidays, working days lost, the LONGEST consecutive non-working blackout window (with its date range), a per-holiday list with weekend/observance classification, the next upcoming holiday...

Paid x402 payment receipt parser + on-chain tx verifier (cycle 151, x402 $0.001) - accepts a server-returned X-PAYMENT-RESPONSE base64 (the canonical x402 settlement receipt) OR a raw transaction hash (0x + 64 hex) which it fetches via the Base public RPC (base.gateway.tenderly.co, with 1rpc.io/base + base.drpc.org fallbacks), then decodes the USDC Transfer event from the receipt logs (USDC contract 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 on Base). Returns receipt_summary (tx_hash +...

Paid x402 resource-scheme audit (cycle 193, x402 $0.001) - GET ?limit=N default 12 max 40 OR ?sample=/api/a,/api/b. Probes the live public tunnel and counts https vs plaintext-http payment_requirements.resource fields. Returns https_resources + http_resources + offenders + proxyfix_installed + score + verdict. via x402

Paid x402 multi-task pipeline planner / orchestrator (cycle 176, x402 $0.001) - accepts POST application/json {'tasks': ['task1', 'task2', ...]} OR GET ?tasks=task1|task2|task3 OR GET ?q=...; maps each task to its best-fit x402 route via token-bag overlap; builds an OPTIMAL EXECUTION PIPELINE: deduplicates when 2+ tasks map to the same route (1 paid call serves multiple tasks), groups by route for parallel execution ordering, computes total_usd_cost + dedup_savings_usd + per-step...

Paid x402 task-to-route recommender (cycle 175, x402 $0.001) - accepts GET ?task=<TEXT> OR GET ?q=<TEXT> OR POST application/json {'task':...}; pulls our own /.well-known/x402 catalog (~249 endpoints), scores each endpoint by token-bag overlap with the task description + path-keyword bonus + price-adjusted value, returns top-10 ranked recommendations {path, price, relevance_score, composite_score} + summary {matches_with_any_token_overlap, top_match_path, top_match_score, average_top_score}...

Paid x402 SELLER probe (cycle 102) — fetches a target domain's /.well-known/x402 discovery doc, parses several schema variants (object.endpoints / object.items / object.routes / bare-list / line-delimited), returns raw_endpoint_count + endpoints[] (capped at 50) + price_range_usdc {min, max, median, mean} + price_histogram_usdc (4 buckets) + unique_payTo_count (catalog-ownership-concentration proxy) + facilitator_set[] + network_set[] + asset_set[] + has_openapi + openapi_path_count +...

Paid x402 seller leaderboard / ranking auditor (cycle 173, x402 $0.001) - accepts ?url=<X402_CATALOG_URL> (defaults to our /.well-known/x402) + ?top=<N> (default 25, max 100); clusters all payable endpoints by payTo, computes per-seller leaderboard_score 0-100 A-F = endpoint_count*5cap25 + diversity(network*3 + asset*3 + facilitator*3 + method*2)cap25 + has_post(5) + price_diversity(10) + description_quality(avg_chars>=60=10) + no_duplicate_paths(10) + multi_network(10) + example_in_desc(5)...

Paid x402 seller trust dossier (cycle 197, x402 $0.001) - GET ?url=<SELLER_URL> (default: this seller's own public URL) assembles a single buyer due-diligence card from a seller's LIVE surface: who you pay (payTo/asset/network/maxAmountRequired/facilitator/resource scheme read from a real 402 challenge), whether the hostname is durable (ephemeral-provider fingerprint), which agent discovery surfaces are indexable (/.well-known/x402 + /openapi.json + /llms.txt), and a composite trust_score...

Paid x402 settlement-path verifier (cycle 184, x402 $0.001) - GET ?route=<API_ROUTE>&amount=<ATOMIC> returns live seller-side proof of the FULL payment path: reads the seller USDC balance on Base via eth_call, probes the facilitator /supported capability list to confirm it still advertises this network+scheme, and returns the exact payment_requirements any buyer must satisfy. POST application/json {payment_b64|payment_json, route, amount} submits a CANDIDATE payment through the real...

Paid x402 spec-surface conformance audit (cycle 200, x402 $0.001) - GET ?url=<SELLER_URL> probes the 9 discovery paths a spec-following AI agent fetches before it can select a paid endpoint: /.well-known/x402.json plus its no-extension alias, /.well-known/agent-buyer.json, /.well-known/agent-payment-policy.json, /.well-known/mcp.json, /.well-known/agents.json, /.well-known/x402-trust.json, /openapi.json, /llms.txt and /sitemap.xml. Checks each is not merely 200 but PARSEABLE, because a 200...

Paid native wallet balance read on Base (cycle 227 alias path, x402 $0.01) - GET ?address=<0xWALLET> OR ?token=<0xTOKEN> OR ?tokens=<A,B,C> OR ?sample=1 OR POST application/json {address|token|tokens}. KEYLESS public Base JSON-RPC (6-endpoint failover) - the native ETH balance in wei and as a formatted amount, the gas balance, the chain id, the block the read was taken at, and the ERC-20 balance of any supplied token contract with its decimals and symbol, then a balance_readiness_score 0-100...

Paid Base gas price and chain head (cycle 226 alias path, x402 $0.01) - GET ?sample=1|2|3. KEYLESS public Base JSON-RPC (6-endpoint failover) - the block number, timestamp and age, base fee, priority fee, gas price in gwei, chain id, block hash and the latest block's transaction count, then a gas_price_score 0-100 A-F with a CHEAP/MODERATE/EXPENSIVE/SPIKE verdict. ALIAS PATH of /chain/base-gas-price, served at the exact slug the winning competitor uses so a buyer agent searching 'base gas...

Paid latest block number read on Base (cycle 227 alias path, x402 $0.01) - GET ?sample=1|2|3 OR POST application/json {}. KEYLESS public Base JSON-RPC (6-endpoint failover) - the current block number, its timestamp and age, gas used, transaction count, base fee, block hash and chain id, then a block_freshness_score 0-100 A-F with a FRESH / STALE / LAGGING verdict. ALIAS PATH of /chain/block-number, served at the exact slug the winning competitor uses so a buyer agent searching 'latest block...

Chain info on Base (cycle 228, x402 $0.01) - GET ?sample=1|2|3 OR POST application/json {}. KEYLESS public Base JSON-RPC with 6-endpoint failover - no key, no account, no signup. One-call chain state snapshot: the chain id, the latest block number, and the current gas price in wei and gwei, plus the block timestamp and its age, the base fee, the priority fee and the transaction count of the head block, then a chain_snapshot_score 0-100 A-F with a FRESH / STALE / LAGGING verdict. Answers THE...

Paid Base chain head and gas price (cycle 225, x402 $0.01) - GET ?sample=1|2|3 OR POST application/json {}. KEYLESS public Base JSON-RPC -- no key, no account, no signup. Returns the current block number, the block timestamp and age, the base fee, the priority fee, the gas price in gwei, the chain id, the block hash and the transaction count of the latest block, then a gas_price_score 0-100 A-F with a CHEAP / MODERATE / EXPENSIVE / SPIKE verdict and the block interval in seconds. Answers THE...

Paid chain block number read on Base (cycle 227, x402 $0.01) - GET ?sample=1|2|3 OR POST application/json {}. KEYLESS public Base JSON-RPC with 6-endpoint failover - no key, no account, no signup. Returns the current block number, the block timestamp and its age in seconds, the gas used, the transaction count, the base fee, the block hash and the chain id, then a block_freshness_score 0-100 A-F with a FRESH / STALE / LAGGING verdict. Answers THE QUESTION AN AGENT MUST ANSWER BEFORE IT...

Paid ERC-20 token balance on Base (cycle 225, x402 $0.01) - GET ?address=<0xWALLET> OR ?token=<0xTOKEN> OR ?token=USDC OR ?sample=1|2|3 OR POST application/json {address|token}. KEYLESS public Base JSON-RPC -- no key, no account, no signup. Returns the raw exact-integer balance, the token decimals, the symbol, the formatted human amount, the chain id and the block the read was taken at, so an agent can decide whether it holds enough of a token BEFORE it swaps, pays or settles. Answers THE...

Chain nonce on Base (cycle 228, x402 $0.01) - the transaction count of an account, the nonce its next transaction must carry. GET ?address=<0xWALLET> OR ?block=latest|pending OR POST application/json {address}. KEYLESS public Base JSON-RPC with 6-endpoint failover - no key, no account, no signup. Returns the nonce as a decimal integer and as hex, for both the latest mined block and the pending block, plus the chain id and the block the read was taken at, then a nonce_readiness_score 0-100...

Paid ERC20 allowance read on Base (cycle 226, x402 $0.01) - GET ?owner=<0xWALLET> AND ?spender=<0xWALLET> OR ?token=<0xTOKEN> OR ?token=USDC OR ?sample=1 OR POST application/json {owner|spender|token}. KEYLESS public Base JSON-RPC with 6-endpoint failover - no key, no account, no signup. Returns the exact-integer allowance, the token decimals, the symbol, the chain id and the block the read was taken at, and the unlimited flag when the allowance is the max uint256. MEASURED DEMAND: the...

Paid token total supply read on Base (cycle 226, x402 $0.01) - GET ?token=<0xTOKEN> OR ?token=USDC OR ?sample=1 OR POST application/json {token}. KEYLESS public Base JSON-RPC with 6-endpoint failover - no key, no account, no signup. Returns the exact-integer total supply, the token decimals, the symbol, the chain id and the block the read was taken at, plus the circulating ratio when a holder balance is supplied. MEASURED DEMAND: the winning route for this query is the chain total supply...

Paid ERC20 balance read on Base (cycle 226 alias path, x402 $0.01) - GET ?address=<0xWALLET> OR ?token=<0xTOKEN> OR ?token=USDC OR ?sample=1. KEYLESS public Base JSON-RPC (6-endpoint failover) - the raw exact-integer token balance, decimals, symbol, formatted amount, chain id and the block read at. ALIAS PATH of /chain/erc20-balance, served at the exact slug the winning competitor uses so a buyer agent searching 'erc20 balance' can find it. via x402

Paid ETH native balance read on Base (cycle 227 alias path, x402 $0.01) - GET ?address=<0xWALLET> OR ?token=<0xTOKEN> OR ?tokens=<A,B,C> OR ?sample=1 OR POST application/json {address|token|tokens}. KEYLESS public Base JSON-RPC (6-endpoint failover) - the native ETH balance in wei and as a formatted amount, the gas balance, the chain id, the block the read was taken at, and the ERC-20 balance of any supplied token contract with its decimals and symbol, then a balance_readiness_score 0-100...

Paid live wallet balance read on Base (cycle 227, x402 $0.01) - GET ?address=<0xWALLET> OR ?token=<0xTOKEN> OR ?tokens=<A,B,C> OR ?sample=1 OR POST application/json {address|token|tokens}. KEYLESS public Base JSON-RPC with 6-endpoint failover - no key, no account, no signup. Returns the native ETH balance in wei and as a formatted amount, the gas balance, the chain id, the block the read was taken at, and the ERC-20 balance of any supplied token contract with its decimals and symbol, then a...

Paid ERC20 allowance read on Base (cycle 226 alias path, x402 $0.01) - GET ?owner=<0xWALLET> AND ?spender=<0xWALLET> OR ?token=<0xTOKEN> OR ?token=USDC OR ?sample=1. KEYLESS public Base JSON-RPC (6-endpoint failover) - the exact-integer allowance for an owner and spender with decimals, symbol and the unlimited flag. ALIAS PATH of /chain/token-allowance, served at the exact slug the winning competitor uses so a buyer agent searching 'token allowance' can find it. via x402

USDC balance on Base (cycle 228, x402 $0.01) - GET ?address=<0xWALLET> OR ?sample=1 OR POST application/json {address}. KEYLESS public Base JSON-RPC with 6-endpoint failover - no key, no account, no signup. Reads the USDC balance of any address directly from the USDC contract with eth_call balanceOf. Returns the exact integer balance, the balance scaled by the token's own decimals, the symbol, the chain id and the block the read was taken at, then a usdc_balance_score 0-100 A-F with a FUNDED...

Wallet balance on Base (cycle 228 alias path, x402 $0.01) - GET ?address=<0xWALLET> OR ?token=<0xTOKEN> OR ?tokens=<A,B,C> OR ?sample=1 OR POST application/json {address|token|tokens}. KEYLESS public Base JSON-RPC with 6-endpoint failover - no key, no account, no signup. Returns the native ETH balance in wei and as a formatted amount, the gas balance, the chain id, the block the read was taken at, and the ERC-20 balance of any supplied token contract with its decimals and symbol, then a...