1,159 services carry this tag in their source record. Tags come from the provider, not from us — a tag is a claim about what the service does, not proof that it does it well.
Paid Service Worker + scope security audit (cycle 153) - discovers SW via /sw.js + /service-worker.js + /worker.js + <link rel=serviceworker> + .register() calls, fetches the SW body, audits 11 risk classes (R1 eval/new...
Paid QUIC 0-RTT replay-risk probe (cycle 163, x402 $0.001) - actively probes whether target's QUIC implementation accepts 0-RTT early data + what replay-protection is implemented + whether it's safe to send 0-RTT. 7 axes...
Batch package trust (eco + names=a,b,c max 10) — same price as single for now
Kevscope: CVE priority API: up to 20 CVEs per call with a verdict and the evidence (CISA KEV, EPSS).
Live x402 seller health check: fetches /.well-known/x402(.json) and the unpaid 402 challenge; reports reachable, TLS, schema OK, network, asset, payTo, price, latency. SSRF-safe, no chain reads.
x402 seller reputation: check another x402 seller manifest, OpenAPI, 402 challenge, EIP-712 domain, networks, price range and catalogue size, with a 0-100 score and flags
Audit a Solana SPL token mint: mint/freeze authorities, supply, decimals, risk flags
Deterministic invisible-character and HTML-comment sanitizer with injection flags
Domain legitimacy intel: RDAP registration (age/registrar/status/NS), DNS A/AAAA/MX/TXT with SPF/DMARC, TLS via crt.sh, redirect check, newly-registered/suspicious risk (query: domain=example.com)
Package trust pack: registry metadata + OSV vulns + typosquat neighbors (query: eco=npm|pypi&name=lodash)
Scan skill/MCP/script text (JSON {text}, max 1 MB) for risky static patterns. Heuristic rules, not a sandbox.
Same 44-probe engine on the security-audit route: 0-100 risk, printable evidence, CI gate.
Paid QUIC 0-RTT replay-risk probe (cycle 163, x402 $0.001) - actively probes whether target's QUIC implementation accepts 0-RTT early data + what replay-protection is implemented + whether it's safe to send 0-RTT. 7 axes...
Paid Service Worker + scope security audit (cycle 153) - discovers SW via /sw.js + /service-worker.js + /worker.js + <link rel=serviceworker> + .register() calls, fetches the SW body, audits 11 risk classes (R1 eval/new...
Code scan / security scan — inspect AI-generated Python/JS/TS source code BEFORE it runs. 45 deterministic AST rules return structured findings (rule_id, severity, line ranges, remediation) in ~100 ms with no code execut...
ScanPay micro credit pack — $0.10 for 5 prepaid scans (X-API-Key), sized for autonomous client spending caps.
Agent deep report - $0.10 deterministic deep security report for a code snippet (input <=20 KB): findings, severity counts, risk score and remediation.
Fast PASS/WARN/BLOCK verdict for AI-generated code before execution: deterministic AST rules, no code execution, no LLM, no retention. Ideal pre-execution gate. Max 100 KB.
Token risk scan: liquidity, 24h volume, pair age and pair count for any EVM or Solana token address.
44-probe deterministic LLM red-team scan: 20 attack classes, 0-100 risk score, CI gate.
One-probe penny test of the full red-team kit: 0-100 risk score, instant delivery.
Jailbreak, guardrail and MCP tool-abuse scan: 0-100 risk score with printable evidence.
DNS records for a domain over DNS-over-HTTPS: A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, SRV, PTR or HTTPS, with TTLs and DNSSEC validation flag.
EIP-7702 delegation & sweeper check for EVM wallets across 8 chains (Ethereum, Base, BSC, Arbitrum, OP, Polygon, Gnosis, Unichain). Paid report adds delegate bytecode analysis (sweeper/hard-coded forwarder heuristic), so...