654 services carry this tag in their source record. Tags come from the provider, not from us — a tag is a claim about what the service does, not proof that it does it well.
Static scan of source code or config for hardcoded secrets and credentials. Detects cloud keys, VCS and CI tokens, payment keys, messaging tokens, AI-provider keys, database URIs with passwords, private keys and high-ent...
Static secret scan of a unified git-diff, scoring ONLY added lines. The low-false-positive pre-commit mode: a secret already present in unchanged or removed code is ignored, only newly introduced credentials are flagged....
Static misconfiguration scan of an infrastructure-as-code config: Terraform (plan JSON or HCL), Kubernetes / Helm, Dockerfile, docker-compose or CloudFormation. Detects public storage, open security groups, unencrypted d...
Static misconfiguration scan of a SINGLE infrastructure resource or config snippet (Terraform, Kubernetes, Dockerfile, docker-compose or CloudFormation). The lightweight per-resource form of /iac/scan: returns a verdict...
Static application-security scan of source code or a git-diff for CWE Top-25 logic bugs: SQL injection, XSS, command injection, code and template injection, SSRF, path traversal, insecure deserialization, weak crypto, in...
Static application-security scan of a single code blob for CWE Top-25 logic bugs (SQL injection, XSS, command injection, SSRF, path traversal, insecure deserialization, weak crypto and more). Pass the code and its langua...
Static security scan of a CI/CD pipeline config: GitHub Actions, GitLab CI or CircleCI. Detects unpinned actions / images / orbs, template and environment injection, dangerous triggers, over-broad workflow-token permissi...
Static security scan of a SINGLE CI/CD job or step snippet (GitHub Actions, GitLab CI or CircleCI). The lightweight per-object form of /ci/scan: returns a verdict (pass, caution, block), a risk score and findings with ru...
Standing-state audit of a wallet's live ERC-20 token approvals. Indexes every approval the address ever granted, filters to those still live on-chain, flags unlimited, stale, scam-listed and canonical spenders, estimates...
Standing-state audit of a wallet's live NFT operator approvals. Indexes every ApprovalForAll the address granted, filters to operators still live on-chain via isApprovedForAll, flags scam-listed, stale and canonical oper...
One merge-safety verdict for a public GitHub pull request. Fetches the PR diff and runs it through code, secret, CI/CD pipeline and dependency scanners, returning a single verdict (pass, caution, block), a risk score and...
Use when you only need a go/no-go before trading a Solana token, at the lowest price: SAFE/CAUTION/DANGER, 0-100 risk score and flags for one mint, read from chain state. Skip DANGER, reduce size on CAUTION. Query: ?addr...
Audit a public HTTPS x402 API without payment: HTTP 402 challenge metadata, Bazaar and well-known discovery, OpenAPI 3.1 operation schemas and payment declarations, redirects, latency, and security headers.
HTTP endpoint health audit for one URL: status and redirect chain, latency p50/p95 over repeated samples, TLS certificate expiry and issuer, the response headers that matter, and a list of detected anomalies (missing HST...
DNS and email-authentication audit for one domain: A/AAAA presence, NS count and whether the nameservers share a /24, MX (including a null MX), SPF (missing, multiple, +all, ~all, ?all), DMARC (missing, p=none, no rua, p...
HTTP endpoint health audit for one URL: status and redirect chain, latency p50/p95 over repeated samples, TLS certificate expiry and issuer, the response headers that matter, and a list of detected anomalies (missing HST...
DNS and email-authentication audit for one domain: A/AAAA presence, NS count and whether the nameservers share a /24, MX (including a null MX), SPF (missing, multiple, +all, ~all, ?all), DMARC (missing, p=none, no rua, p...
Paid Set-Cookie × shared-cache disclosure scanner (cycle 148, x402 $0.001) — probes 8 sensitive paths on target origin (/login + /api/me + /api/session + /account + /profile + /dashboard + /me + /api/user, + optional ext...
CORS check for a URL: sends a request with an Origin (and a preflight OPTIONS) and reports Access-Control-Allow-Origin/Methods/Headers/Credentials, whether the origin is allowed, wildcard use, and the risky combination o...
MCP tool risk scorer for agents: scans a tool JSON description for shell, filesystem, network and secret-access capabilities.
diff scan for planned tool calls: compares before and after snippets and flags destructive, network or secret-related actions.
Typosquat and quality signals for an npm package before installing it: weekly downloads, latest version, license, deprecation notice, repository link, and computed risk flags (low_downloads, deprecated, no_repository, no...
Known-vulnerability check for a software dependency before installing it: queries the OSV.dev database (Google Open Source Vulnerabilities) for npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet or Packagist packages. Retu...
database migration risk scan for SQL migrations: flags destructive statements, unbounded updates and risky NOT NULL column additions.