1,159 services carry this tag in their source record. Tags come from the provider, not from us — a tag is a claim about what the service does, not proof that it does it well.
Install-safety preflight for one dependency BEFORE pip install / npm i. Returns a safe / caution / block verdict fusing existence, OSV malware flags, typosquat distance to a popular package, a known-hallucination corpus,...
Static scan of source code or config for hardcoded secrets and credentials. Detects cloud keys, VCS and CI tokens, payment keys, messaging tokens, AI-provider keys, database URIs with passwords, private keys and high-ent...
Static secret scan of a unified git-diff, scoring ONLY added lines. The low-false-positive pre-commit mode: a secret already present in unchanged or removed code is ignored, only newly introduced credentials are flagged....
Static misconfiguration scan of an infrastructure-as-code config: Terraform (plan JSON or HCL), Kubernetes / Helm, Dockerfile, docker-compose or CloudFormation. Detects public storage, open security groups, unencrypted d...
Static misconfiguration scan of a SINGLE infrastructure resource or config snippet (Terraform, Kubernetes, Dockerfile, docker-compose or CloudFormation). The lightweight per-resource form of /iac/scan: returns a verdict...
Static application-security scan of source code or a git-diff for CWE Top-25 logic bugs: SQL injection, XSS, command injection, code and template injection, SSRF, path traversal, insecure deserialization, weak crypto, in...
Static application-security scan of a single code blob for CWE Top-25 logic bugs (SQL injection, XSS, command injection, SSRF, path traversal, insecure deserialization, weak crypto and more). Pass the code and its langua...
Static security scan of a CI/CD pipeline config: GitHub Actions, GitLab CI or CircleCI. Detects unpinned actions / images / orbs, template and environment injection, dangerous triggers, over-broad workflow-token permissi...
Static security scan of a SINGLE CI/CD job or step snippet (GitHub Actions, GitLab CI or CircleCI). The lightweight per-object form of /ci/scan: returns a verdict (pass, caution, block), a risk score and findings with ru...
Standing-state audit of a wallet's live ERC-20 token approvals. Indexes every approval the address ever granted, filters to those still live on-chain, flags unlimited, stale, scam-listed and canonical spenders, estimates...
Standing-state audit of a wallet's live NFT operator approvals. Indexes every ApprovalForAll the address granted, filters to operators still live on-chain via isApprovedForAll, flags scam-listed, stale and canonical oper...
One merge-safety verdict for a public GitHub pull request. Fetches the PR diff and runs it through code, secret, CI/CD pipeline and dependency scanners, returning a single verdict (pass, caution, block), a risk score and...
Use when you only need a go/no-go before trading a Solana token, at the lowest price: SAFE/CAUTION/DANGER, 0-100 risk score and flags for one mint, read from chain state. Skip DANGER, reduce size on CAUTION. Query: ?addr...
Audit a public HTTPS x402 API without payment: HTTP 402 challenge metadata, Bazaar and well-known discovery, OpenAPI 3.1 operation schemas and payment declarations, redirects, latency, and security headers.
HTTP endpoint health audit for one URL: status and redirect chain, latency p50/p95 over repeated samples, TLS certificate expiry and issuer, the response headers that matter, and a list of detected anomalies (missing HST...
DNS and email-authentication audit for one domain: A/AAAA presence, NS count and whether the nameservers share a /24, MX (including a null MX), SPF (missing, multiple, +all, ~all, ?all), DMARC (missing, p=none, no rua, p...
HTTP endpoint health audit for one URL: status and redirect chain, latency p50/p95 over repeated samples, TLS certificate expiry and issuer, the response headers that matter, and a list of detected anomalies (missing HST...
DNS and email-authentication audit for one domain: A/AAAA presence, NS count and whether the nameservers share a /24, MX (including a null MX), SPF (missing, multiple, +all, ~all, ?all), DMARC (missing, p=none, no rua, p...
Paid Set-Cookie × shared-cache disclosure scanner (cycle 148, x402 $0.001) — probes 8 sensitive paths on target origin (/login + /api/me + /api/session + /account + /profile + /dashboard + /me + /api/user, + optional ext...
CORS check for a URL: sends a request with an Origin (and a preflight OPTIONS) and reports Access-Control-Allow-Origin/Methods/Headers/Credentials, whether the origin is allowed, wildcard use, and the risky combination o...
MCP tool risk scorer for agents: scans a tool JSON description for shell, filesystem, network and secret-access capabilities.
diff scan for planned tool calls: compares before and after snippets and flags destructive, network or secret-related actions.
Typosquat and quality signals for an npm package before installing it: weekly downloads, latest version, license, deprecation notice, repository link, and computed risk flags (low_downloads, deprecated, no_repository, no...
Known-vulnerability check for a software dependency before installing it: queries the OSV.dev database (Google Open Source Vulnerabilities) for npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet or Packagist packages. Retu...