Vulnerability data, scanning and audit services. A listing here is not an endorsement of the scanner’s accuracy.
Paid web-cache-poisoning + deception active probe (cycle 145, x402 $0.001) - 5 unkeyed-header probes (X-Forwarded-Host + X-Original-URL + X-Forwarded-Prefix + X-Host + X-Forwarded-Server + X-Forwarded-For + X-Forwarded-P...
Paid security-header mutation test (cycle 143, x402 $0.001) - fetches target URL 5x with deliberately different fingerprint headers (Chrome desktop + Firefox + Mobile Safari + python-requests bot + baseline); compares th...
Paid OWASP API Security Top 10 (2023) one-call composite audit (cycle 151, x402 $0.001) - fetches target URL + probes 24 conventional API paths in parallel via ThreadPoolExecutor, runs all 10 OWASP 2023 category checks:...
Paid OAuth 2.0 / OIDC authorization endpoint hardening audit (cycle 159, x402 $0.001) - actively probes an issuer's OAuth/OIDC authorization endpoint against the 10 canonical misconfiguration classes defined by RFC 9700...
Paid OpenAPI/Swagger security-smell linter per OWASP API Top 10 (2023) (cycle 160 restored 2026-10-17, x402 $0.001) - accepts GET ?url=<TARGET> (walks 6 candidate paths /openapi.json+/openapi.yaml+/swagger.json+/swagger/...
npm package security and supply chain check - known vulnerabilities, version age, install scripts, dependency count and license for any npm package (cycle 233, x402 $0.01) - GET ?package=<NAME> OR ?name=<NAME> OR ?packag...
CVE vulnerability lookup by id - full CVE record with description, CVSS base score and severity, CWE weakness, affected products and versions, references, published and modified dates, and the fix. Security vulnerability...
CVE vulnerability lookup by id - full CVE record with description, CVSS base score and severity, CWE weakness, affected products and versions, references, published and modified dates, and the fix. ALIAS PATH of /api/cve...
CISA known exploited vulnerabilities KEV check for a CVE - is this CVE in CISA's Known Exploited Vulnerabilities catalog, the date it was added, the federal remediation due date, whether it is used in a known ransomware...
CISA known exploited vulnerabilities KEV check for a CVE - is this CVE in CISA's Known Exploited Vulnerabilities catalog, the date it was added, the federal remediation due date, whether it is used in a known ransomware...
Paid Service Worker + scope security audit (cycle 153) - discovers SW via /sw.js + /service-worker.js + /worker.js + <link rel=serviceworker> + .register() calls, fetches the SW body, audits 11 risk classes (R1 eval/new...
Institutional Flash-Loan Simulation & Atomic Safe-Harbor Rescue ($45.00 Floor / $9.50 Triage + 5%-10% Atomic Split on Saved Capital)
Batch package trust (eco + names=a,b,c max 10) — same price as single for now
Agent verification tools: CSV quality, citation checks, AI-readiness audits, requirement extraction
Checks a site built with AI tools for security problems and gives the fix in plain English.
Free CVE lookup, dependency vulnerability checks, and CVE updates. No signup or API key.
Find what to fix on a site, check if changes worked, see how AI reads it. Free audit, no account.
Security advisories for one open-source package version (npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist, Pub, Hex...). Returns a verdict (vulnerable yes/no, vuln count, max severity, max CVSS v3 score, count...
MCP gateway: one connection for your AI apps, with tool policies, PII redaction and audit logs.
Live security incidents, updated hourly: fix status, fixed versions, lockfile and repo checks.
Threat intelligence for AI agents: checks URLs, domains, phones, emails, wallets and IBANs for scams
Hallucination auditor (Bazaar tool #13): LLM-as-a-judge checks an agent's draft answer against source data; flags synthetic claims. Structured verdict.
Deep HTTP inspection of a host: status, redirect chain (every hop with codes), TLS/security headers snapshot, server banner. Deterministic web-intel.
Fetch a host's TLS certificate and return issuer, subject, validity dates, days remaining and the SAN list. Live network check. Use to catch an expiring certificate before it breaks a client.