Permissions Policy x402 REST
Paid Permissions-Policy header audit (browser feature gating, high-risk feature detection, source allowlist) via x402
0 USDC per call
per call
Security
1,157 services carry this tag in their source record. Tags come from the provider, not from us — a tag is a claim about what the service does, not proof that it does it well.
Cookie Flags x402 REST
Paid Set-Cookie security-attribute audit (per-cookie Secure/HttpOnly/SameSite/Max-Age/Size/Priority/Partitioned + issue flags + A-F grade) via x402
0 USDC per call
per call
API Discovery x402 REST
Paid machine-API discovery rollup — link rel=alternate (oembed/atom/rss/jsonfeed) + HTTP Link header + JSON-LD Action/EntryPoint/Service + declared-spec-path probes (/llms.txt, /openapi.json, /swagger.json, /graphql, /.w...
0 USDC per call
per call
Compliance Snapshot x402 REST
Paid composite agent-trustworthiness score — security headers (HTTPS/HSTS/CSP/XFO/XCTO/RP/PP) + discoverability (robots/sitemap/llms.txt/security.txt) + standards (structured data/lang/cookie consent) rollup with A-F gra...
0 USDC per call
per call
Disclosure Quality x402 REST
Paid legal/ethical disclosure completeness audit — Terms/Privacy/Cookie/Affiliate/AI-policy links + FTC affiliate language detection + EU AI Act Art. 50 AI-disclosure detection + CCPA 'Do Not Sell' link + gdpr_legal_comp...
0 USDC per call
per call
Affiliate Program x402 REST
Paid affiliate-program presence detection — 17-path landing-page probe with content signals + 16-network fingerprint (ShareASale/CJ/Impact/PartnerStack/Awin/Rakuten/ClickBank/Refersion/FirstPromoter/Tolt/LemonSqueezy/Gum...
0 USDC per call
per call
Cookie Banner Shade x402 REST
Paid cookie banner UX + dark-pattern audit — 19-CMP fingerprint + Accept/Reject parity + Manage-preferences link + pre-ticked toggles + cookie-wall + Reject click-depth + CCPA Do-Not-Sell + granular categories, cookie_ba...
0 USDC per call
per call
Server Headers x402 REST
Paid server/fingerprint/debug/cache response-header audit — Server + X-Powered-By info-leak detection, framework-version-disclosed (X-AspNet-Version/X-Generator/X-Drupal-Cache), debug-headers-in-prod (X-Debug/X-Runtime),...
0 USDC per call
per call
WCAG Audit x402 REST
Paid deep WCAG 2.1/2.2 AA accessibility audit — forms+inputs (label/aria-label/aria-labelledby/placeholder), autocomplete token validity, button+link accessible-name, heading hierarchy (skip-level + multiple-h1 detection...
0 USDC per call
per call
Exposure Surface x402 REST
Paid security exposure-surface audit — HSTS preload-list membership via hstspreload.org API + HSTS header detection, RFC 9116 security.txt presence+format-validity (Contact/Expires/Canonical/Preferred-Languages), 18-path...
0 USDC per call
per call
Markdown Extract x402 REST
Paid main-content markdown extractor for RAG ingestion — strips noise (script/style/nav/aside/header/footer/ads/comments), picks <main>/<article>/content div, converts headings/paragraphs/lists/code/links/images/tables t...
0 USDC per call
per call
Cookie Samesite x402 REST
Paid per-cookie security-flags deep audit — parses every Set-Cookie individually for SameSite (Strict/Lax/None/missing/Lax-by-default-heuristic) + Secure + HttpOnly + Path + Domain (broad-domain detection) + Max-Age + Ex...
0 USDC per call
per call
Redirect Trace x402 REST
Paid deep HTTP redirect chain analyzer — per-hop latency_ms + headers (server/content-type/cache-control/x-cache/cf-ray/cf-ipcountry/vary/set-cookie count/hsts) + status sub-type classification (301/302/303/307/308) + cr...
0 USDC per call
per call
Security TXT Audit x402 REST
Paid security.txt RFC 9116 deep audit — path discovery tries /.well-known/security.txt then /security.txt, parses all fields with line-continuation support, strict Contact format validation (mailto: + https://), strict E...
0 USDC per call
per call
Waf Detector x402 REST
Paid WAF/IDS/CDN-edge fingerprint detector — 28-vendor catalog (Cloudflare/Fastly/Akamai/Imperva/Sucuri/CloudFront/ALB/Azure-FrontDoor/Vercel/Netlify/StackPath/KeyCDN/BunnyCDN/F5-BIGIP/Barracuda/Citrix-NetScaler/ModSecur...
0 USDC per call
per call
HTTP Method Policy x402 REST
Paid HTTP-method policy + dangerous-method exposure audit — OPTIONS Allow/DAV/ACAO/ACAM + TRACE echo-back + CONNECT + PUT/DELETE/PATCH write exposure + 4 method-override header sniffing (X-HTTP-Method-Override/X-Method-O...
0 USDC per call
per call
Cache Freshness x402 REST
Paid cache-freshness strategy audit — probes HTML page + /favicon.ico + /robots.txt + /sitemap.xml + first stylesheet URL + first script URL; for each captures Cache-Control directives + ETag + Last-Modified + Age + Vary...
0 USDC per call
per call
Sourcemap Exposure x402 REST
Paid JavaScript sourcemap exposure audit — fetches every external <script src> + probes inline-script //# sourceMappingURL= references + tries each .map URL via HEAD to surface public source-leak risk, sourcemaps_referen...
0 USDC per call
per call
Cdn Detector x402 REST
Paid CDN-edge fingerprint detector — 24-vendor catalog (Cloudflare/CloudFront/Fastly/Akamai/Vercel/Netlify/Google Cloud CDN/Azure Front Door/StackPath/BunnyCDN/KeyCDN/Cloudflare Workers/F5/WordPress VIP/Rackspace/Edgecas...
0 USDC per call
per call
CSP Deep x402 REST
Paid deep Content-Security-Policy analyzer — parses ALL 4 CSP delivery mechanisms (header + meta + report-only variants), classifies each source value (wildcard/scheme/host/nonce/hash/unsafe-inline/unsafe-eval/strict-dyn...
0 USDC per call
per call
Forms Check x402 REST
Paid form security + accessibility audit — per-form action analysis (empty/#/javascript:/data:/mixed-content http-on-https), method (GET with passwords = credential-in-URL), enctype (text/plain CRLF injection), target=_b...
0 USDC per call
per call
Auth Scheme Discovery x402 REST
Paid auth-method discovery — WWW-Authenticate header + RFC 8414 oauth-authorization-server + OpenID Connect discovery + JWKS + RFC 8705 oauth-protected-resource + login-form introspection, surfaces bearer/basic/oauth2/oi...
0 USDC per call
per call
Redirect Security x402 REST
Paid redirect-chain security audit — full chain traversal (max 10 hops), open-redirect detection (//, @, javascript:), cross-domain count, https-only check, meta-refresh detection, redirect-security_score A-F grade via x...
0 USDC per call
per call
Error Page Fingerprint x402 REST
Paid error-response fingerprint + leakiness audit — 12-probe matrix (api-404/admin-path/.env/phpmyadmin/debug/wp-admin/graphql-invalid/internal-api/bad-json/wrong-accept/long-path/spoofed-loopback), captures per-probe st...
0 USDC per call
per call