639 services carry this tag in their source record. Tags come from the provider, not from us — a tag is a claim about what the service does, not proof that it does it well.
Paid HTTP request-smuggling CL.TE/TE.CL/TE.TE tolerance evidence probe (cycle 129, x402 $0.001) - opens low-level socket (bypasses urllib header normalization) to target host, sends 6 PortSwigger-style evidence requests...
Paid GraphQL introspection exposure audit (cycle 129, x402 $0.001) - accepts host OR url param, probes up to 6 conventional GraphQL endpoints (/graphql, /api/graphql, /v1/graphql, /query), sends canonical IntrospectionQu...
Paid dev-portal / VCS-dotfile / debug-surface exposure probe (cycle 127, x402 $0.001) - probes 39 conventional dev/debug/VCS-leak paths (/swagger-ui.html + /graphiql + /actuator + /.git/HEAD + /.env + /server-status + /p...
Paid BGP route-leak + prefix-hijack exposure probe (cycle 126, x402 $0.001) - resolves target host via Cloudflare DoH, queries RIPEstat prefix-overview for each IP, classifies announcing ASNs + holders, computes consensu...
Paid Permissions-Policy + Feature-Policy header audit (cycle 124, x402 $0.001) - fetches target URL + iterates ALL Permissions-Policy (modern) AND Feature-Policy (legacy) headers, parses 17 tracked features (camera/micro...
Paid heuristic email spam score for AI-agent triage (cycle 123, x402 $0.001) - accepts POST text/plain raw email source (RFC822 headers+body) or GET ?header=<url-encoded> or GET ?url=<.eml URL>; parses headers+body and c...
Paid composite AI-agent onboardability summary (cycle 120, x402 $0.001) - single-call composite that answers 'could an AI agent onboard to use this URL as a paid tool?' - fetches target URL + probes /openapi.json + /.wel...
Paid Cache-Control header granularity audit (cycle 119, x402 $0.001) - fetches target URL, parses every Cache-Control directive (max-age / s-maxage / stale-while-revalidate / stale-if-error / public / private / no-cache...
Paid Idempotency-Key header support probe (cycle 118) — fetches target URL, scans response headers for Idempotency-Replayed + X-Request-ID signals, probes 6 OpenAPI candidate paths for explicit Idempotency-Key parameter...
Paid cookie name-prefix (__Secure-/__Host-) policy audit (cycle 115) — fetches page Set-Cookie headers, for each cookie: extracts Secure/Path/Domain/HttpOnly/SameSite attributes, flags __Secure- prefix and checks Secure...
Paid clickjacking-protection audit (cycle 115) — fetches the page headers + body, audits (a) X-Frame-Options presence + value (DENY/SAMEORIGIN valid, ALLOW-FROM deprecated per Chrome/Edge), (b) CSP frame-ancestors policy...
Paid per-cookie IAB TCF v2.2 purpose classification (cycle 112) — fetches URL with HTTPCookieProcessor, captures every Set-Cookie, extracts inline document.cookie= writes, classifies each cookie by NAME heuristics (ga/_g...
Paid brand-impersonation risk synthesis (cycle 106) — aggregates 8 signals (domain age via crt.sh, BIMI RFC 8848 record, RFC 9116 security.txt, llms.txt presence, /.well-known/x402 honest declaration, https→http redirect...
Paid active HTTP/2 SETTINGS frame probe (cycle 106) — opens fresh TCP, performs TLS 1.3 handshake with ALPN ["h2", "http/1.1"], sends the HTTP/2 client connection preface (PRI * HTTP/2.0 + 24-byte magic + client SETTINGS...
Paid AI discovery surface cross-validator (cycle 104) — fetches 4 surfaces (llms.txt + /.well-known/security.txt + openapi.json + agents.txt); extracts the contact claim from each (H1 title / RFC 9116 Contact / openapi.i...
Paid email header forgery/anomaly detector (cycle 104) — accepts POST text/plain raw email OR GET ?header=<url-encoded RFC822> OR GET ?url=<.eml URL>; scores 13 forgery/anomaly patterns: From/Reply-To/Return-Path/Sender...
Paid llms.txt provenance / author fingerprint (cycle 102) — extracts H1 + byline + contact emails + @-handles from llms.txt body, cross-references the same email against /.well-known/security.txt Contact: field (RFC 9116...
Paid HTTP/3 QPACK (RFC 9204) encoder-pattern fingerprint probe (cycle 179, x402 $0.001) - accepts GET ?host=<HOST> (default www.cloudflare.com) OR POST application/json {'host':...,'force_quic':...}; fetches https://<hos...
Paid CSP per-directive source-list extraction + classification (cycle 176, x402 $0.001) - accepts GET ?url=<URL> OR POST application/json {'url':...}; fetches target page; extracts CSP header + meta CSP fallback; tokeniz...
Paid CSP violation-report ROUND-TRIP replay (cycle 170, x402 $0.001) - fetches target page; extracts CSP header + meta CSP + Reporting-Endpoints header + report-uri + report-to group; for each declared endpoint REPLAYS 4...
Paid RFC822 email-header forensics (cycle 101) — POST text/plain raw email source OR pass ?header=<RFC822> (256KB cap); folds continuation lines, parses per-Received hop (from/by/with-protocol/id/for-address/ips/delay/ti...
Paid full HTTP response header inventory (cycle 99) — DUMPS every response header and classifies each into 5 categories (security / caching / cors / content-negotiation / custom-vendor-prefixed); reports legacy_disclosur...
Paid Client Hints + Permissions-Policy probe (cycle 97) — captures Accept-CH (RFC 7231 §5.3.7) + Critical-CH (RFC 9981) request lines for Server Hints, parses Permissions-Policy header for feature gating intent; per-hint...
Paid DNT/GPC policy probe (cycle 96) — fetches target URL 3x (baseline, with DNT:1, with Sec-GPC:1); compares Set-Cookie count + body size to detect server-side honoring of privacy signals; probes 5 common privacy-policy...