All projects on Base matching “tls”

Reads the constraints inside a single certificate — basic constraints, key usage, extended key usage — and reports, per role, whether the certificate permits being used that way under the pinned OpenSSL build's rules. Roles covered are TLS client, TLS server, S/MIME signing and encryption, and timestamp signing. This answers the frequent confusion where a certificate is deployed for a purpose its

Domain and email security check: SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT, DNSSEC (validated by Cloudflare and Google), CAA, BIMI with its mark certificate, mail IPs on the UCEPROTECT Level 1 blocklist, TLS certificate, registrar and domain age, and Microsoft 365 tenant, each graded with the exact record to fix it, plus a 0-100 score

HTTP endpoint health audit for one URL: status and redirect chain, latency p50/p95 over repeated samples, TLS certificate expiry and issuer, the response headers that matter, and a list of detected anomalies (missing HSTS/CSP/X-Content-Type-Options, expiring cert, weak TLS, CORS wildcard, insecure cookies, version disclosure, slow p95, redirect loops). Private, loopback and link-local targets are

Domain OSINT, TLS Certificate & Security Headers Recon (/v1/domain-osint) — Inspects live IPv4/IPv6 DNS resolution, TLS certificate issuer/expiry, and HTTP security grade. (https://domain-osint.agentdiet.dev/v1/domain-osint)

Use when you need to know whether a website or mail server has a valid HTTPS certificate or when it expires: opens a live TLS connection (SNI) to the host and returns whether the chain is publicly trusted (with the exact error, e.g. CERT_HAS_EXPIRED or self-signed), whether the certificate matches the hostname, validity dates and days remaining, subject, issuer, SAN list, key type, TLS protocol, c

Measure real-world page load performance (response time) for any URL from a chosen global location. Returns total load time in seconds, HTTP response status, a phase-by-phase timing breakdown (DNS, TCP connect, TLS handshake, time-to-first-byte, content transfer), and a content preview. Useful for global latency monitoring, CDN validation, and uptime/performance checks from multiple geographic ori

Partner tier of the dns.pizza bot observatory: every network (ASN), named crawler, TLS (JA4) fingerprint and firewall rule seen in the last 7 days, refreshed hourly. The public tier is free at https://dns.pizza/bots.

Observe public DNS, TLS and baseline response headers through HTTPS HEAD / on port443; no full-path scan or global trust assessment.

Request an https URL and report whether it is reachable, its status, every redirect hop with timings, key and security headers (HSTS, CSP and others), and the TLS certificate with its issuer, the names it covers and the days until it expires. An unreachable URL is a result too, with the reason.

Email authentication check (SPF, DKIM, DMARC): Check a domain's email authentication and spoofing risk from public DNS: MX and mail provider, SPF (record, all-qualifier, DNS lookup count vs the 10 limit), DMARC policy/pct/rua, DKIM at 30 common selectors, MTA-STS, TLS-RPT, BIMI. Returns grade, spoof

Company due diligence in one call (KYB, vendor and supplier checks). Give a company name and country, a registry number, an EU VAT number, an LEI or a website domain. Returns the legal entity from the official register, LEI and parents, VAT validity, a sanctions screen (OFAC, EU, UK) of the company and officers, and the domain's age, mail and TLS, as signed pass/warn/fail checks with sources. Use

One call, whole outside view of a domain: DNS records, email authentication grade (SPF, DMARC, MTA-STS), TLS certificate expiry and chain, post-quantum key exchange (X25519MLKEM768), HTTPS security headers, and a to-do list.

Request an https URL and report whether it is reachable, its status, every redirect hop with timings, key and security headers (HSTS, CSP and others), and the TLS certificate with its issuer, the names it covers and the days until it expires. An unreachable URL is a result too, with the reason.

Trust check for any x402 pay-per-call API URL. Live-probes the target: verifies a valid 402 payment challenge, consistency between the challenge and the /.well-known/x402 manifest, payTo address validity, price sanity, Bazaar listing status, and TLS basics. Returns a GO / CAUTION / STOP verdict with reasons.

Supplier and vendor risk score for any company domain. Returns a 0-100 stability score, risk tier, and named risk flags, with subsignals: domain age/expiry (WHOIS), TLS certificate status, DNS health (A/MX/SPF/DMARC), and 30-day news sentiment. Use for supplier due diligence and third-party domain screening before purchasing from, integrating with, or paying an unfamiliar vendor or counterparty. C

Returns a 0–100 generative-engine visibility score and estimated LLM mention rate for a URL. Cost $0.01 per call. Not HTTP uptime, TLS, or a credit.

Look up a domain: registration data from RDAP (registrar, created, expires, status, nameservers), live DNS records (A, AAAA, MX, NS, TXT, CNAME), the TLS certificate served at the name (issuer, validity, alternative names, fingerprint), and the HTTP front door (status, server, redirect). One JSON answer, no API key, no rate-limited WHOIS. GET with ?name= or POST. $0.005.

Password - CASA Cybersecurity Assessment - Consolidates evidence on secure communications, including certificate validity, hostname matching, protocol and cipher strength, forward secrecy, and TLS vulnerabilities. It determines whether the service uses a secure, authentic, and correctly configured transport channel.

Call before paying an unfamiliar x402 endpoint, or to pick between providers. $0.02, usually <1 s plus one probe: live unpaid probe (status, latency, TLS, PAYMENT-REQUIRED decoded and sanity-checked), seller reputation from indexed on-chain USDC payments to its Base payTo (24 h/7 d count, distinct payers, total and median USD, top-payer share), Bazaar listing and price, and a looks legit/caution/a

Check whether a domain's TLS/SSL certificate is valid, trusted, and not expiring before connecting to it. Performs a live handshake and returns a 0–100 score and tier (VALID/WEAK/EXPIRING/EXPIRED/UNTRUSTED/INVALID) with chain trust, days-to-expiry, signature algorithm, TLS version, and cipher quality. Use before submitting credentials, posting to a webhook, or following a payment link, to catch ex

Know Your Merchant (KYM) trust score: pass a merchant domain and get a deterministic 0-100 trust score with a band (high/medium/low/very_low/avoid) and human-readable reasons. Live signals: domain age from the RDAP registry of record, malware/phishing blocklist verdict via Cloudflare Security DNS, TLS certificate health, mail capability, and refund/privacy/contact page presence. The merchant-side

Why is this host failing right now? One call, no account: Ned probes it (DNS at three resolvers, its nameservers, TCP, TLS, HTTP timings, CDN and hosting fingerprints, cache and static splits, domain registration) and returns a diagnosis an agent can act on: findings and their strength, what was ruled out, and a ready runbook prompt. Page text never leaves Ned.

Resolve ONE DNS record type for a domain -- the cheapest, narrowest domain-check endpoint. For all record types at once, use /domain/intelligence. For a bundled DNS+TLS+headers audit, use /web/audit (raw) or /security/posture (scored). For mail-security plus a scored verdict, use /domain/due-diligence.

Lightweight utility API for agents and operators: DNS lookups, RDAP/WHOIS domain data, HTTP probes, page metadata extraction, cryptographic hashing, JSON validation, scheduled webhooks, and exotic endpoints (Base transaction decode, ENS resolve, USGS earthquakes, cron next-run, TLS certificate report). No shell access; outbound URL tools enforce SSRF protections.

Website audit bundle for local business websites and lead qualification: performance (browser-measured), security headers and TLS, SEO basics, accessibility and AI-crawler visibility of one public page, with section scores, grades and prioritized findings, in one call.

Signed proof of what a web page said: give a URL, get its text, screenshot and TLS details with a timestamped cryptographic signature anyone can verify.

Pre-payment trust check of a paid API endpoint: reachability, 402 handshake, registrable-domain age (RDAP), TLS days left, seller USDC balance and ETH gas runway on Base -> trust_score 0-100 + verdict pay|caution|avoid

Fast European HTTP status and TLS preview

Full-domain intelligence report in one call: complete DNS sweep (A/AAAA/MX/NS/TXT/SOA/CNAME), RDAP registration data (registrar, dates, statuses), DNSSEC presence, mail posture summary (SPF/DMARC/DKIM selectors), TLS certificate snapshot (issuer, expiry, protocol), Certificate Transparency subdomain census, and HTTP probe (status, redirects, https enforcement, server header) — each section scored,

Domain trust report for AI agents: is this domain real, how old is it, who registered it, and is its email locked down? DNS (A/AAAA/NS/MX/CAA), DNSSEC, SPF, DMARC, DKIM (common selectors), MTA-STS, TLS-RPT, BIMI, RDAP registration date + registrar + status, parking and disposable detection, risk flags, 0-100 score and verdict. Public DNS + RDAP, no data stored.