1,014 services carry this tag in their source record. Tags come from the provider, not from us — a tag is a claim about what the service does, not proof that it does it well.
Paid deep HTTP header policy audit — 30+ headers across 12 groups: CSP (Content-Security-Policy + Report-Only) + HSTS (max-age + includeSubDomains) + COOP/COEP/CORP/Origin-Agent-Cluster + Permissions-Policy (feature list...
Paid bulk-sender email-deliverability verdict (cycle 100) — composes MX + SPF + DKIM + DMARC + MTA-STS + TLS-RPT + provider fingerprint into a single 0-100 deliverability score with A-F grade and findings[]. Different fr...
Paid RPKI Route Origin Validation (ROV) auditor per RFC 6811 (cycle 172, x402 $0.001) - accepts ?prefix=<CIDR> [auto-resolves announcing ASN via RIPEstat prefix-overview] OR ?prefix=<CIDR>&asn=ASxxxx OR ?asn=ASxxxx; call...
Paid SVCB/HTTPSSVC (RFC 9460+9461) deep parser (cycle 170, x402 $0.001) - probes 11 conventional _<port>._<proto>.<domain> SVCB endpoints (_443._tcp + _443._tcp.www + _443._tcp.api + _80._tcp + _25._tcp + _587._tcp + _85...
Paid DNS CNAME chain tracer (cycle 175, x402 $0.001) - accepts ?host=<HOST> OR ?domain=<HOST> OR ?url=<URL>; actively follows CNAME + A/AAAA hops via Cloudflare DoH for the target host (up to 12 hops with loop detection)...
Paid MTA-STS (RFC 8461) policy+record cross-validator (cycle 174, x402 $0.001) - accepts ?domain=<DOMAIN>; actively probes _mta-sts.<domain> TXT (RFC 8461 SS3.1) via DoH + https://mta-sts.<domain>/.well-known/mta-sts.txt...
Paid DNS SRV (RFC 2782) record mapper + service-discovery auditor (cycle 174, x402 $0.001) - accepts ?domain=<DOMAIN> + ?service=<SVC> + ?proto=<tcp|udp|tls> OR shorthand ?q=<SVC>.<PROTO>.<DOMAIN>; actively probes Cloudf...
Paid RFC 8460 SMTP TLS-RPT (TLS Reporting) report parser (cycle 178, x402 $0.001) - accepts POST application/json {'report':<RFC 8460 JSON object>} OR POST application/json {'report_text':<JSON string>} OR GET ?report=<u...
Paid llms.txt provenance / author fingerprint (cycle 102) — extracts H1 + byline + contact emails + @-handles from llms.txt body, cross-references the same email against /.well-known/security.txt Contact: field (RFC 9116...
Paid brand-impersonation risk synthesis (cycle 106) — aggregates 8 signals (domain age via crt.sh, BIMI RFC 8848 record, RFC 9116 security.txt, llms.txt presence, /.well-known/x402 honest declaration, https→http redirect...
Paid active TLS 1.3 + PQC + ECH probe (cycle 108) — opens TLS 1.3 connection, advertises 13 named groups including PQC hybrids (X25519Kyber768Draft00/Draft01, X25519Kyber768, SecP256r1Kyber768Draft00/Draft01, P256Kyber76...
Paid DNS nameserver vendor fingerprint (cycle 116) — queries NS records via Cloudflare DoH, classifies each NS hostname against a 28-provider heuristic table (Cloudflare/AWS-Route53/Google-Cloud-DNS/NS1/Azure/Akamai-Edge...
Paid CT-log certificate pre-fingerprint (cycle 124, x402 $0.001) - queries crt.sh for the target domain, parses every returned certificate record, and aggregates total_certs_observed + unique_sha256_count + duplicate_cer...
Paid SPF (RFC 7208) policy forensic analyzer (cycle 125, x402 $0.001) - parses every mechanism (+/-/~/? qualifiers) and modifier (redirect/exp), counts total_lookups (a=1, mx=1, ptr=5, exists=1, include=recursive) vs RFC...
Paid HTTPS RR (RFC 9460 SVCB/HTTPS) resolver (cycle 132, x402 $0.001) - queries apex HTTPS record via Cloudflare DoH, parses SVCB wireformat per RFC 9460 §2.2 (SvcPriority + SvcParams), decodes 7 known SvcParamKeys (mand...
Paid DoH trust-anchor cross-resolver agreement probe (cycle 142, x402 $0.001) - sends the same DNS query (A/AAAA/DS/DNSKEY/MX/TXT/CNAME) to 3 public DoH resolvers: Cloudflare (RFC 8484 wire-format) + Google (JSON API /re...
Paid DNS AXFR (zone-transfer) vulnerability probe (cycle 148, x402 $0.001) — discovers authoritative NS via Cloudflare DoH, then opens raw TCP/53 to each NS and sends an RFC 1035 wire-format AXFR query (QTYPE=252) per RF...
Paid DNS CAA (Certification Authority Authorization) policy audit (cycle 156, x402 $0.001) - parses a domain's CAA records per RFC 8659, classifies each authorized CA token against a 32-CA registry (Let's Encrypt/DigiCer...
Paid DNS label & zone-naming standards-compliance audit (cycle 159, x402 $0.001) - audits every label of the zone against RFC 1035 §2.3.4 + RFC 5891 §4.2.3 + RFC 2782 SRV conventions: (1) per-label length <= 63 octets; (...
Paid deep SPF record parser + DNS-lookup budget auditor (cycle 160 restored 2026-10-17, x402 $0.001) - parses v=spf1 into its directive list, classifies each mechanism per RFC 7208 SS5 (pass/fail/softfail/neutral/literal...
Paid DKIM key-rotation freshness audit (cycle 157, x402 $0.001) - probes 25 common DKIM selectors in parallel via DoH, parses per-selector v/k/p/h/s/t/n tags, computes SHA-256 fingerprint of each public key, and scores r...
Paid x402 cart cost-quote (cycle 185, x402 $0.001) - GET with no params returns the FULL live price list of every paid route grouped into price tiers plus api_base + payTo + network + asset, so an agent can plan a workfl...
Paid x402 endpoint-durability auditor (cycle 196, x402 $0.001) - GET ?url=<SELLER_URL> scores whether a seller's public URL is STABLE enough to trust with real money: URL-shape provider fingerprint (trycloudflare/lhr.lif...
Paid subdomain takeover fingerprint (cycle 192, x402 $0.001) - GET ?host= OR ?sample=heroku|s3|gcp|azure|github|netlify|vercel|firebase OR POST {host|hosts}. Per host: DNS A/AAAA+CNAME via DoH then HTTP+HTTPS probe of al...