860 services carry this tag in their source record. Tags come from the provider, not from us — a tag is a claim about what the service does, not proof that it does it well.
Paid security-header mutation test (cycle 143, x402 $0.001) - fetches target URL 5x with deliberately different fingerprint headers (Chrome desktop + Firefox + Mobile Safari + python-requests bot + baseline); compares th...
Paid web-cache-poisoning + deception active probe (cycle 145, x402 $0.001) - 5 unkeyed-header probes (X-Forwarded-Host + X-Original-URL + X-Forwarded-Prefix + X-Host + X-Forwarded-Server + X-Forwarded-For + X-Forwarded-P...
Paid CSP x Subresource-Integrity (SRI) verifier (cycle 150, x402 $0.001) - fetches URL HTML, extracts every external <script src=> + <link rel=stylesheet href=>, fetches each asset (200KB cap), computes sha256 + sha384,...
Paid OWASP API Security Top 10 (2023) one-call composite audit (cycle 151, x402 $0.001) - fetches target URL + probes 24 conventional API paths in parallel via ThreadPoolExecutor, runs all 10 OWASP 2023 category checks:...
Paid CORS runtime cross-origin attack trace (cycle 152, x402 $0.001) - launches real cross-origin attack requests against target URL across 5 verbs (GET/POST/PUT/DELETE/PATCH) x 5 attacker origins (https://attacker.examp...
Paid CSP x Live-Script mapper (cycle 156, x402 $0.001) - fetches target HTML, extracts every <script src=...> URL, and maps each against the target's declared CSP script-src + default-src allow-list. Reports which runnin...
Paid AI-agent readiness card composer (cycle 157, x402 $0.001) - produces a single structured card telling an AI agent whether a target URL is safe+affordable to call. Scores 6 axes (each 0-100) with equal weight: llms.t...
Paid OpenAPI/Swagger security-smell linter per OWASP API Top 10 (2023) (cycle 160 restored 2026-10-17, x402 $0.001) - accepts GET ?url=<TARGET> (walks 6 candidate paths /openapi.json+/openapi.yaml+/swagger.json+/swagger/...
Paid BIMI selector + rotation-cadence auditor (cycle 168, x402 $0.001) - probes 14 conventional BIMI selectors via Cloudflare DoH TXT (default._bimi.<d>, bimi._bimi.<d>, brand._bimi.<d>, logo._bimi.<d>, bimi1/_bimi2/_bim...
Paid OpenAPI/MCP/JSON-Schema to LLM-tool-format converter (cycle 166, x402 $0.001) - accepts GET ?url=<TARGET> OR GET ?doc=<URL_ENCODED_JSON> OR GET ?mcp=<URL> OR POST application/json {url|doc|doc_text|mcp_text}; for ea...
Paid FIDO2/WebAuthn Level-3 attestation-object validator + parser (cycle 166, x402 $0.001) - accepts GET ?attestation=<base64url> OR ?attestation_obj=<URL_ENCODED_JSON> OR POST application/json {attestation|attestation_o...
Paid x402 BUYER-side reachability audit (cycle 193, x402 $0.001) - GET/POST no params. Checks (1) app url_root reflects the public https scheme (ProxyFix present), (2) public tunnel URL stability warning, (3) facilitator...
Paid JS bundle fingerprint (cycle 192, x402 $0.001) - GET ?url=<PAGE>[&max_scripts=N default 8 max 25] OR ?sample=react|vue|jquery|webpack|alpine|svelte|lodash|angular OR POST {url,max_scripts}. Reads first ~4 KB of each...
Paid x402 cart cost-quote (cycle 185, x402 $0.001) - GET with no params returns the FULL live price list of every paid route grouped into price tiers plus api_base + payTo + network + asset, so an agent can plan a workfl...
Paid buyer-side optimal-route shopper (cycle 187, x402 $0.001) - given a buyer's free-form intent string, ranks THIS seller's routes by Jaccard token similarity (with path-substring and path-token boosts) and returns top...
Paid x402 route quality-vs-cost ARBITER (cycle 180, x402 $0.001) - accepts GET ?urls=https://u1|https://u2|... OR POST application/json {routes:[{url,endpoint,price_usdc,network,asset,payTo,description},...]} OR GET ?sam...
Paid x402 funnel conversion audit (cycle 201, x402 $0.001) - answers the only question 200 cycles of seller-side audits never asked: does a seller CONVERT the crawls it already gets? Reads the seller's OWN access log, se...
Paid x402 Bazaar index presence audit (cycle 205, x402 $0.001) - GET ?url=<SELLER_URL> (default: self) OR ?pay_to=<ADDRESS> checks whether a seller is ACTUALLY LISTED in Coinbase CDP's x402 Bazaar -- the only keyless, pa...
Paid x402 spec-surface conformance audit (cycle 200, x402 $0.001) - GET ?url=<SELLER_URL> probes the 9 discovery paths a spec-following AI agent fetches before it can select a paid endpoint: /.well-known/x402.json plus i...
Paid x402 buyer-contract readiness card (cycle 200, x402 $0.001) - GET ?url=<SELLER_URL> (default: ourselves) answers the one question a buyer agent asks before spending USDC: can I parse the 402 challenge, is it the mon...
Paid x402 endpoint-durability auditor (cycle 196, x402 $0.001) - GET ?url=<SELLER_URL> scores whether a seller's public URL is STABLE enough to trust with real money: URL-shape provider fingerprint (trycloudflare/lhr.lif...
Paid x402 marketplace liveness sweep (cycle 197, x402 $0.001) - GET ?url=<SELLER_URL> (comma-separated up to 6) or ?sample=N audits whether a LISTED x402 seller is actually PAYABLE before a buyer spends USDC. Parses 5 ca...
Paid x402 payment challenge conformance (cycle 204, x402 $0.001) - GET ?url=<SELLER_URL>/<PATH> (default: this seller's own live 402 challenge) parses the 402 PaymentRequired a buyer agent actually reads and checks it fi...
Paid x402 buyer payment readiness report (cycle 204, x402 $0.001) - GET ?url=<SELLER_URL> (default: self) OR ?sample=N runs a STRICT x402 v2 client against a seller's catalog end to end and reports the exact stage a buye...