1,930 services carry this tag in their source record. Tags come from the provider, not from us — a tag is a claim about what the service does, not proof that it does it well.
Paid buyer-side cost projection (cycle 187, x402 $0.001) - given a buyer's projected call volume and category mix, returns a monthly USDC spend estimate at THIS seller's catalog plus bundle-recommendation cost-reduction...
Paid x402 buyer-side wallet preflight (cycle 184, x402 $0.001) - GET ?route=<API_ROUTE>&amount=<ATOMIC> generates an ephemeral in-process key, signs a REAL EIP-3009 TransferWithAuthorization against the seller's USDC con...
Paid RFC 7807 (Problem Details for HTTP APIs) conformance probe (cycle 168, x402 $0.001) - 6 candidate API paths (/api+/api/v1+/api/v2+/v1+/v2+/graphql) each probed with 5 malformed payloads (GET bad query / POST wrong C...
Paid BIMI selector + rotation-cadence auditor (cycle 168, x402 $0.001) - probes 14 conventional BIMI selectors via Cloudflare DoH TXT (default._bimi.<d>, bimi._bimi.<d>, brand._bimi.<d>, logo._bimi.<d>, bimi1/_bimi2/_bim...
Paid W3C DID-method resolution + registry probe (cycle 165, x402 $0.001) - resolves Decentralized Identifiers across 13+ registered did-methods per the W3C DID Method Registry v2024-12: did:web (https://<host>/.well-know...
Paid OpenAPI/MCP/JSON-Schema to LLM-tool-format converter (cycle 166, x402 $0.001) - accepts GET ?url=<TARGET> OR GET ?doc=<URL_ENCODED_JSON> OR GET ?mcp=<URL> OR POST application/json {url|doc|doc_text|mcp_text}; for ea...
Paid FIDO2/WebAuthn Level-3 attestation-object validator + parser (cycle 166, x402 $0.001) - accepts GET ?attestation=<base64url> OR ?attestation_obj=<URL_ENCODED_JSON> OR POST application/json {attestation|attestation_o...
Paid Trusted Types policy enforcement audit (cycle 164, x402 $0.001) - actively audits W3C Trusted Types policy enforcement by examining 9 axes: (1) CSP require-trusted-types-for 'script' directive presence (the ENFORCEM...
Paid CDN edge-runtime fingerprint + cold-start probe (cycle 163, x402 $0.001) - actively probes for serverless edge-compute runtimes (Cloudflare Workers/Vercel Edge Functions/Fastly Compute@Edge/Akamai EdgeWorkers/CloudF...
Paid deep SPF record parser + DNS-lookup budget auditor (cycle 160 restored 2026-10-17, x402 $0.001) - parses v=spf1 into its directive list, classifies each mechanism per RFC 7208 SS5 (pass/fail/softfail/neutral/literal...
Paid DNS label & zone-naming standards-compliance audit (cycle 159, x402 $0.001) - audits every label of the zone against RFC 1035 §2.3.4 + RFC 5891 §4.2.3 + RFC 2782 SRV conventions: (1) per-label length <= 63 octets; (...
Paid OAuth 2.0 / OIDC authorization endpoint hardening audit (cycle 159, x402 $0.001) - actively probes an issuer's OAuth/OIDC authorization endpoint against the 10 canonical misconfiguration classes defined by RFC 9700...
Paid AWS S3 bucket public-read ACL + listability probe (cycle 155, x402 $0.001) - resolves target domain + derives 8 conventional bucket-name candidates (apex + hyphen_to_dot + -backup/-backups/-prod/-staging/-dev/-asset...
Paid SMTP open-relay test (cycle 154) - actually attempts MAIL FROM + RCPT TO against each MX host. Resolves MX via Cloudflare DoH, opens TCP/25, sends EHLO + MAIL FROM:<external> + RCPT TO for both local-domain and fore...
Paid JWT algorithm-confusion + kid-injection + JWKS-header-hijack probe (cycle 153) - forges 12 forged-JWT attack classes (alg:none variants + kid-injection variants + jku/jwk/x5u attacker-controlled) and (when public_ke...
Paid CORS runtime cross-origin attack trace (cycle 152, x402 $0.001) - launches real cross-origin attack requests against target URL across 5 verbs (GET/POST/PUT/DELETE/PATCH) x 5 attacker origins (https://attacker.examp...
Paid MCP server tool-list cross-discovery-surface aggregator (cycle 150, x402 $0.001) - parallel-fetch /.well-known/mcp/server.json + /mcp.json + /openapi.json + 8 health endpoints; aggregates MCP tools across surfaces (...
Paid HTTP/2 Rapid Reset (CVE-2023-44487) DoS probe (cycle 149, x402 $0.001) - opens fresh TCP+TLS 1.3 with ALPN h2, sends HTTP/2 client preface + client SETTINGS, parses server SETTINGS, runs a rapid-reset loop (open str...
Paid DNS AXFR (zone-transfer) vulnerability probe (cycle 148, x402 $0.001) — discovers authoritative NS via Cloudflare DoH, then opens raw TCP/53 to each NS and sends an RFC 1035 wire-format AXFR query (QTYPE=252) per RF...
Paid DoH trust-anchor cross-resolver agreement probe (cycle 142, x402 $0.001) - sends the same DNS query (A/AAAA/DS/DNSKEY/MX/TXT/CNAME) to 3 public DoH resolvers: Cloudflare (RFC 8484 wire-format) + Google (JSON API /re...
Paid x402 payment payload decoder + trace (cycle 142, x402 $0.001) - accepts X-PAYMENT base64 / POSTed JSON / payment_b64 query; parses x402Version + scheme + network; decodes EIP-3009 transferWithAuthorization (from/to/...
Paid CDN cache-key collision probe (cycle 139, x402 $0.001) - actively fetches target with 4 probe pairs (Accept-Language en-vs-es / Accept-Encoding gzip-vs-br / Cookie session vs no-session / User-Agent desktop-vs-mobil...
Paid OCSP Must-Staple (RFC 7633) cert-feature detector (cycle 138, x402 $0.001) - opens TLS to target host, parses leaf cert via cryptography.x509 to detect status_request TLS Feature extension (OID 1.3.6.1.5.5.7.1.24) o...
Paid DANE/TLSA + SMTP STARTTLS active probe (cycle 137, x402 $0.001) - resolves MX for domain, looks up _25._tcp.<mxhost> + _587._tcp.<mxhost> + _465._tcp.<mxhost> TLSA records (RFC 6698/7672), opens SMTP socket to MX:25...