862 services carry this tag in their source record. Tags come from the provider, not from us — a tag is a claim about what the service does, not proof that it does it well.
Paid redirect-destination classifier (cycle 123, x402 $0.001) - follows up to 10 redirect hops with loop detection, then classifies FINAL destination by TLD category (ccTLD / classic gTLD / suspicious .xyz .top .click .l...
Paid OCSP stapling live responder-reachability probe (cycle 128, x402 $0.001) - opens TLS to target host, fetches leaf cert DER via getpeercert(binary_form=True), parses via cryptography.x509 to extract Authority Informa...
Paid GraphQL introspection exposure audit (cycle 129, x402 $0.001) - accepts host OR url param, probes up to 6 conventional GraphQL endpoints (/graphql, /api/graphql, /v1/graphql, /query), sends canonical IntrospectionQu...
Paid Permissions-Policy + Feature-Policy header audit (cycle 124, x402 $0.001) - fetches target URL + iterates ALL Permissions-Policy (modern) AND Feature-Policy (legacy) headers, parses 17 tracked features (camera/micro...
Paid CSP inline-fidelity validator (cycle 130, x402 $0.001) - fetches target URL, parses CSP, extracts every inline <script>/<style> block + event handler, computes sha256 of each, reports per-block {hash_in_csp, nonce_i...
Paid internal link graph + PageRank-lite (cycle 132, x402 $0.001) - fetches target URL, extracts all same-domain <a href> anchors, fetches top 5 by anchor-text-length, builds an in-memory graph (nodes/edges), runs 20-ite...
Paid JSON-LD structured-data cross-validator (x402 $0.001) - GET ?url=<URL> parses every <script type=application/ld+json> block and cross-validates the claims, reporting block counts by @type and an A-F grade. via x402
Paid WebAssembly CSP + wasm-unsafe-eval coverage analyzer (cycle 137, x402 $0.001) - fetches target URL, scans for WASM indicators (inline WebAssembly.instantiate/compile + .wasm file references + <link rel=preload as=fe...
Paid Cross-Origin Isolation (COOP+COEP+CORP+credentialless) coherence audit (cycle 138, x402 $0.001) - fetches URL + parses Cross-Origin-Opener-Policy (same-origin/same-origin-allow-popups) + Cross-Origin-Embedder-Policy...
Paid Content Language detector (cycle 139, x402 $0.001) - fetches URL + extracts language declarations across html lang attribute + HTTP Content-Language header + og:locale/og:locale:alternate + hreflang link tags + meta...
Paid web-cache-poisoning + deception active probe (cycle 145, x402 $0.001) - 5 unkeyed-header probes (X-Forwarded-Host + X-Original-URL + X-Forwarded-Prefix + X-Host + X-Forwarded-Server + X-Forwarded-For + X-Forwarded-P...
Paid Web Bot Auth / RFC 9421 HTTP Message Signatures verifier (cycle 146, x402 $0.001) - probe /.well-known/http-message-signatures on target, extract Ed25519 public keys, parse caller-supplied signature-input + signatur...
Paid JSON-LD @id cross-reference reachability probe (cycle 143, x402 $0.001) - parses all <script type=application/ld+json> blocks, extracts every @id URL, HEAD-probes each (max 12, parallel), verifies reachability + Con...
Paid security-header mutation test (cycle 143, x402 $0.001) - fetches target URL 5x with deliberately different fingerprint headers (Chrome desktop + Firefox + Mobile Safari + python-requests bot + baseline); compares th...
Paid CSP x Subresource-Integrity (SRI) verifier (cycle 150, x402 $0.001) - fetches URL HTML, extracts every external <script src=> + <link rel=stylesheet href=>, fetches each asset (200KB cap), computes sha256 + sha384,...
Paid CORS runtime cross-origin attack trace (cycle 152, x402 $0.001) - launches real cross-origin attack requests against target URL across 5 verbs (GET/POST/PUT/DELETE/PATCH) x 5 attacker origins (https://attacker.examp...
Paid OWASP API Security Top 10 (2023) one-call composite audit (cycle 151, x402 $0.001) - fetches target URL + probes 24 conventional API paths in parallel via ThreadPoolExecutor, runs all 10 OWASP 2023 category checks:...
Paid CSP x Live-Script mapper (cycle 156, x402 $0.001) - fetches target HTML, extracts every <script src=...> URL, and maps each against the target's declared CSP script-src + default-src allow-list. Reports which runnin...
Paid AI-agent readiness card composer (cycle 157, x402 $0.001) - produces a single structured card telling an AI agent whether a target URL is safe+affordable to call. Scores 6 axes (each 0-100) with equal weight: llms.t...
Paid OpenAPI/Swagger security-smell linter per OWASP API Top 10 (2023) (cycle 160 restored 2026-10-17, x402 $0.001) - accepts GET ?url=<TARGET> (walks 6 candidate paths /openapi.json+/openapi.yaml+/swagger.json+/swagger/...
Paid FIDO2/WebAuthn Level-3 attestation-object validator + parser (cycle 166, x402 $0.001) - accepts GET ?attestation=<base64url> OR ?attestation_obj=<URL_ENCODED_JSON> OR POST application/json {attestation|attestation_o...
Paid BIMI selector + rotation-cadence auditor (cycle 168, x402 $0.001) - probes 14 conventional BIMI selectors via Cloudflare DoH TXT (default._bimi.<d>, bimi._bimi.<d>, brand._bimi.<d>, logo._bimi.<d>, bimi1/_bimi2/_bim...
Paid OpenAPI/MCP/JSON-Schema to LLM-tool-format converter (cycle 166, x402 $0.001) - accepts GET ?url=<TARGET> OR GET ?doc=<URL_ENCODED_JSON> OR GET ?mcp=<URL> OR POST application/json {url|doc|doc_text|mcp_text}; for ea...
Paid x402 cart cost-quote (cycle 185, x402 $0.001) - GET with no params returns the FULL live price list of every paid route grouped into price tiers plus api_base + payTo + network + asset, so an agent can plan a workfl...