860 services carry this tag in their source record. Tags come from the provider, not from us — a tag is a claim about what the service does, not proof that it does it well.
Paid SRI hash collision-risk + algorithm-strength probe (cycle 113) — parses every <script src integrity> and <link rel=stylesheet href integrity>, for each subresource: extracts the hash token (sha256/sha384/sha512/sha1...
Paid per-cookie IAB TCF v2.2 purpose classification (cycle 112) — fetches URL with HTTPCookieProcessor, captures every Set-Cookie, extracts inline document.cookie= writes, classifies each cookie by NAME heuristics (ga/_g...
Paid Open Graph + Twitter Card metadata freshness + reachability probe (cycle 112) — fetches URL, extracts og:* + twitter:* meta tags, HEAD-probes each og:image / og:image:secure_url / twitter:image, returns per-image st...
Paid readability + per-paragraph reading-time estimator (cycle 110) — fetches URL, extracts paragraph-level text, then computes 6 readability formulas (Flesch, Flesch-Kincaid, Gunning Fog, SMOG, Coleman-Liau, ARI) + tota...
Paid CDN / edge-provider detection from response headers (cycle 116) — fetches target URL, inspects 25+ CDN-specific response headers (CF-Ray/CF-Cache-Status/CF-Request-Id + X-Amz-Cf-Id/X-Amz-Cf-Pop + X-Vercel-Id/X-Verce...
Paid Idempotency-Key header support probe (cycle 118) — fetches target URL, scans response headers for Idempotency-Replayed + X-Request-ID signals, probes 6 OpenAPI candidate paths for explicit Idempotency-Key parameter...
Paid OpenAPI / Swagger 2.0 best-practices quality audit (cycle 114) — accepts GET ?url=<openapi.json URL> OR POST application/json with {spec:{...}} or {spec_text:"<YAML or JSON>"}; scores 12 quality dimensions: (a) Open...
Paid WebAuthn / Passkey policy audit (cycle 117) — non-authenticated scan of a sites passkey posture: (a) detects 13 vendor SDKs in HTML (SimpleWebAuthn/Corbado/Hanko/Stytch/Clerk/WorkOS/Auth0/Okta/Descope/Keycloak/Bitwa...
Paid Cache-Control header granularity audit (cycle 119, x402 $0.001) - fetches target URL, parses every Cache-Control directive (max-age / s-maxage / stale-while-revalidate / stale-if-error / public / private / no-cache...
Paid composite AI-agent onboardability summary (cycle 120, x402 $0.001) - single-call composite that answers 'could an AI agent onboard to use this URL as a paid tool?' - fetches target URL + probes /openapi.json + /.wel...
Paid single-endpoint quality benchmark (cycle 121, x402 $0.001) - given a target x402 endpoint URL, fetches the 402 envelope (without payment), parses out the description+price+network+asset, scores 9 metadata quality di...
Paid redirect-destination classifier (cycle 123, x402 $0.001) - follows up to 10 redirect hops with loop detection, then classifies FINAL destination by TLD category (ccTLD / classic gTLD / suspicious .xyz .top .click .l...
Paid heuristic email spam score for AI-agent triage (cycle 123, x402 $0.001) - accepts POST text/plain raw email source (RFC822 headers+body) or GET ?header=<url-encoded> or GET ?url=<.eml URL>; parses headers+body and c...
Paid Permissions-Policy + Feature-Policy header audit (cycle 124, x402 $0.001) - fetches target URL + iterates ALL Permissions-Policy (modern) AND Feature-Policy (legacy) headers, parses 17 tracked features (camera/micro...
Paid OCSP stapling live responder-reachability probe (cycle 128, x402 $0.001) - opens TLS to target host, fetches leaf cert DER via getpeercert(binary_form=True), parses via cryptography.x509 to extract Authority Informa...
Paid internal link graph + PageRank-lite (cycle 132, x402 $0.001) - fetches target URL, extracts all same-domain <a href> anchors, fetches top 5 by anchor-text-length, builds an in-memory graph (nodes/edges), runs 20-ite...
Paid GraphQL introspection exposure audit (cycle 129, x402 $0.001) - accepts host OR url param, probes up to 6 conventional GraphQL endpoints (/graphql, /api/graphql, /v1/graphql, /query), sends canonical IntrospectionQu...
Paid CSP inline-fidelity validator (cycle 130, x402 $0.001) - fetches target URL, parses CSP, extracts every inline <script>/<style> block + event handler, computes sha256 of each, reports per-block {hash_in_csp, nonce_i...
Paid JSON-LD structured-data cross-validator (x402 $0.001) - GET ?url=<URL> parses every <script type=application/ld+json> block and cross-validates the claims, reporting block counts by @type and an A-F grade. via x402
Paid Content Language detector (cycle 139, x402 $0.001) - fetches URL + extracts language declarations across html lang attribute + HTTP Content-Language header + og:locale/og:locale:alternate + hreflang link tags + meta...
Paid Cross-Origin Isolation (COOP+COEP+CORP+credentialless) coherence audit (cycle 138, x402 $0.001) - fetches URL + parses Cross-Origin-Opener-Policy (same-origin/same-origin-allow-popups) + Cross-Origin-Embedder-Policy...
Paid WebAssembly CSP + wasm-unsafe-eval coverage analyzer (cycle 137, x402 $0.001) - fetches target URL, scans for WASM indicators (inline WebAssembly.instantiate/compile + .wasm file references + <link rel=preload as=fe...
Paid Web Bot Auth / RFC 9421 HTTP Message Signatures verifier (cycle 146, x402 $0.001) - probe /.well-known/http-message-signatures on target, extract Ed25519 public keys, parse caller-supplied signature-input + signatur...
Paid JSON-LD @id cross-reference reachability probe (cycle 143, x402 $0.001) - parses all <script type=application/ld+json> blocks, extracts every @id URL, HEAD-probes each (max 12, parallel), verifies reachability + Con...