862 services carry this tag in their source record. Tags come from the provider, not from us — a tag is a claim about what the service does, not proof that it does it well.
Paid JSON-LD structured-data cross-validator (x402 $0.001) - GET ?url=<URL> parses every <script type=application/ld+json> block and cross-validates the claims, reporting block counts by @type and an A-F grade. via x402
Paid internal link graph + PageRank-lite (cycle 132, x402 $0.001) - fetches target URL, extracts all same-domain <a href> anchors, fetches top 5 by anchor-text-length, builds an in-memory graph (nodes/edges), runs 20-ite...
Paid CSP inline-fidelity validator (cycle 130, x402 $0.001) - fetches target URL, parses CSP, extracts every inline <script>/<style> block + event handler, computes sha256 of each, reports per-block {hash_in_csp, nonce_i...
Paid GraphQL introspection exposure audit (cycle 129, x402 $0.001) - accepts host OR url param, probes up to 6 conventional GraphQL endpoints (/graphql, /api/graphql, /v1/graphql, /query), sends canonical IntrospectionQu...
Paid OCSP stapling live responder-reachability probe (cycle 128, x402 $0.001) - opens TLS to target host, fetches leaf cert DER via getpeercert(binary_form=True), parses via cryptography.x509 to extract Authority Informa...
Paid Permissions-Policy + Feature-Policy header audit (cycle 124, x402 $0.001) - fetches target URL + iterates ALL Permissions-Policy (modern) AND Feature-Policy (legacy) headers, parses 17 tracked features (camera/micro...
Paid redirect-destination classifier (cycle 123, x402 $0.001) - follows up to 10 redirect hops with loop detection, then classifies FINAL destination by TLD category (ccTLD / classic gTLD / suspicious .xyz .top .click .l...
Paid single-endpoint quality benchmark (cycle 121, x402 $0.001) - given a target x402 endpoint URL, fetches the 402 envelope (without payment), parses out the description+price+network+asset, scores 9 metadata quality di...
Paid heuristic email spam score for AI-agent triage (cycle 123, x402 $0.001) - accepts POST text/plain raw email source (RFC822 headers+body) or GET ?header=<url-encoded> or GET ?url=<.eml URL>; parses headers+body and c...
Paid composite AI-agent onboardability summary (cycle 120, x402 $0.001) - single-call composite that answers 'could an AI agent onboard to use this URL as a paid tool?' - fetches target URL + probes /openapi.json + /.wel...
Paid Cache-Control header granularity audit (cycle 119, x402 $0.001) - fetches target URL, parses every Cache-Control directive (max-age / s-maxage / stale-while-revalidate / stale-if-error / public / private / no-cache...
Paid Idempotency-Key header support probe (cycle 118) — fetches target URL, scans response headers for Idempotency-Replayed + X-Request-ID signals, probes 6 OpenAPI candidate paths for explicit Idempotency-Key parameter...
Paid WebAuthn / Passkey policy audit (cycle 117) — non-authenticated scan of a sites passkey posture: (a) detects 13 vendor SDKs in HTML (SimpleWebAuthn/Corbado/Hanko/Stytch/Clerk/WorkOS/Auth0/Okta/Descope/Keycloak/Bitwa...
Paid CDN / edge-provider detection from response headers (cycle 116) — fetches target URL, inspects 25+ CDN-specific response headers (CF-Ray/CF-Cache-Status/CF-Request-Id + X-Amz-Cf-Id/X-Amz-Cf-Pop + X-Vercel-Id/X-Verce...
Paid OpenAPI / Swagger 2.0 best-practices quality audit (cycle 114) — accepts GET ?url=<openapi.json URL> OR POST application/json with {spec:{...}} or {spec_text:"<YAML or JSON>"}; scores 12 quality dimensions: (a) Open...
Paid SRI hash collision-risk + algorithm-strength probe (cycle 113) — parses every <script src integrity> and <link rel=stylesheet href integrity>, for each subresource: extracts the hash token (sha256/sha384/sha512/sha1...
Paid per-cookie IAB TCF v2.2 purpose classification (cycle 112) — fetches URL with HTTPCookieProcessor, captures every Set-Cookie, extracts inline document.cookie= writes, classifies each cookie by NAME heuristics (ga/_g...
Paid readability + per-paragraph reading-time estimator (cycle 110) — fetches URL, extracts paragraph-level text, then computes 6 readability formulas (Flesch, Flesch-Kincaid, Gunning Fog, SMOG, Coleman-Liau, ARI) + tota...
Paid AI-citable source credibility scorer (cycle 109) — fetches URL, extracts article text + meta description + article:published_time, then computes 6 sub-scores: hedging language density (30 terms tracked), sourcing (c...
Paid outbound link rot / staleness audit (cycle 109) — fetches source URL, extracts every <a href>, then for each link: (a) HEAD-probes to detect 4xx/5xx/timeout/redirect, (b) parses Last-Modified + Date response headers...
Paid JSONPath extraction (cycle 108) — accepts GET ?url=<URL>&path=<JSONPATH> OR GET ?json=<urlencoded JSON>&path=<JSONPATH> OR POST application/json {url|json, path}; fetches the URL (or parses inline JSON) and applies...
Paid AI-agent tool-call card generator (cycle 105) — accepts GET ?url=<TARGET> OR POST application/json {url: <TARGET>}; probes /.well-known/x402 + 4 OpenAPI candidate paths + /llms.txt; aggregates into a single structur...
Paid BIMI (Brand Indicators for Message Identification) + VMC (Verified Mark Certificate) validator (cycle 105) — probes default._bimi.<domain> TXT per RFC 8848; parses v=BIMI1; l=<SVG URL>; a=<VMC URL>; s=<selector>; HE...
Paid email header forgery/anomaly detector (cycle 104) — accepts POST text/plain raw email OR GET ?header=<url-encoded RFC822> OR GET ?url=<.eml URL>; scores 13 forgery/anomaly patterns: From/Reply-To/Return-Path/Sender...