880 services carry this tag in their source record. Tags come from the provider, not from us — a tag is a claim about what the service does, not proof that it does it well.
Paid AI training / retrieval crawler policy audit (cycle 117) — fetches /robots.txt + /llms.txt + /llms-full.txt + /meta-robots + probes 3 ai.txt paths (/.well-known/ai.txt + /.well-known/ai-crawler-policy + /ai.txt), cl...
Paid Web Vitals INP (Interaction-to-Next-Paint) heuristic estimate (cycle 118) — static-analysis proxy for INP p75 without a real browser: counts addEventListener + onclick/oninput/onkeydown/onsubmit handlers in inline +...
Paid cookie name-prefix (__Secure-/__Host-) policy audit (cycle 115) — fetches page Set-Cookie headers, for each cookie: extracts Secure/Path/Domain/HttpOnly/SameSite attributes, flags __Secure- prefix and checks Secure...
Paid MTA-STS (RFC 8461) + TLSRPT (RFC 8460) policy audit (cycle 125, x402 $0.001) - probes _mta-sts.<domain> TXT (v=STSv1 + id) + smtp._mta-sts.<domain> HTTPS policy file (mode: enforce|testing|none + mx: + max_age: + id...
Paid web typography + font-loading audit (cycle 127, x402 $0.001) - fetches target HTML, extracts font-family from body + h1-h6 via inline style= attributes, parses inline <style> blocks for @font-face rules + font-displ...
Paid HTTP request-smuggling CL.TE/TE.CL/TE.TE tolerance evidence probe (cycle 129, x402 $0.001) - opens low-level socket (bypasses urllib header normalization) to target host, sends 6 PortSwigger-style evidence requests...
Paid HTTPS RR (RFC 9460 SVCB/HTTPS) resolver (cycle 132, x402 $0.001) - queries apex HTTPS record via Cloudflare DoH, parses SVCB wireformat per RFC 9460 §2.2 (SvcPriority + SvcParams), decodes 7 known SvcParamKeys (mand...
Paid HTTP/1.1 hop-by-hop header correctness probe (cycle 141, x402 $0.001) - opens raw TCP to host:443 + :80, sends 3 sequential GET requests with explicit Connection: keep-alive, X-Hop-Marker-A1b2c3, X-Internal-Trace-X9...
Paid Cross-Origin Isolation (COOP+COEP+CORP+credentialless) coherence audit (cycle 138, x402 $0.001) - fetches URL + parses Cross-Origin-Opener-Policy (same-origin/same-origin-allow-popups) + Cross-Origin-Embedder-Policy...
Paid Content Language detector (cycle 139, x402 $0.001) - fetches URL + extracts language declarations across html lang attribute + HTTP Content-Language header + og:locale/og:locale:alternate + hreflang link tags + meta...
Paid web-cache-poisoning + deception active probe (cycle 145, x402 $0.001) - 5 unkeyed-header probes (X-Forwarded-Host + X-Original-URL + X-Forwarded-Prefix + X-Host + X-Forwarded-Server + X-Forwarded-For + X-Forwarded-P...
Paid Web Bot Auth / RFC 9421 HTTP Message Signatures verifier (cycle 146, x402 $0.001) - probe /.well-known/http-message-signatures on target, extract Ed25519 public keys, parse caller-supplied signature-input + signatur...
Paid JSON-LD @id cross-reference reachability probe (cycle 143, x402 $0.001) - parses all <script type=application/ld+json> blocks, extracts every @id URL, HEAD-probes each (max 12, parallel), verifies reachability + Con...
Paid HTTP/2 Rapid Reset (CVE-2023-44487) DoS probe (cycle 149, x402 $0.001) - opens fresh TCP+TLS 1.3 with ALPN h2, sends HTTP/2 client preface + client SETTINGS, parses server SETTINGS, runs a rapid-reset loop (open str...
Paid CORS runtime cross-origin attack trace (cycle 152, x402 $0.001) - launches real cross-origin attack requests against target URL across 5 verbs (GET/POST/PUT/DELETE/PATCH) x 5 attacker origins (https://attacker.examp...
Paid CSP permissive-source budget scorer (cycle 154) - quantifies aggregate attack-surface allowed by the policy. Parses header + meta + report-only delivery mechanisms, classifies every source value as high (script-src...
Paid AI-agent readiness card composer (cycle 157, x402 $0.001) - produces a single structured card telling an AI agent whether a target URL is safe+affordable to call. Scores 6 axes (each 0-100) with equal weight: llms.t...
Paid AWS S3 bucket public-read ACL + listability probe (cycle 155, x402 $0.001) - resolves target domain + derives 8 conventional bucket-name candidates (apex + hyphen_to_dot + -backup/-backups/-prod/-staging/-dev/-asset...
Paid WebTransport handshake + endpoint reachability probe (cycle 165, x402 $0.001) - actively probes RFC 8441 + RFC 9290 + RFC 9221 WebTransport readiness across 8 axes: (1) Alt-Svc h3/h3-NNN advertise parse (HTTP/3 requ...
Paid W3C DID-method resolution + registry probe (cycle 165, x402 $0.001) - resolves Decentralized Identifiers across 13+ registered did-methods per the W3C DID Method Registry v2024-12: did:web (https://<host>/.well-know...
Paid RFC 7807 (Problem Details for HTTP APIs) conformance probe (cycle 168, x402 $0.001) - 6 candidate API paths (/api+/api/v1+/api/v2+/v1+/v2+/graphql) each probed with 5 malformed payloads (GET bad query / POST wrong C...
Paid x402 seller catalog-integrity audit (cycle 185, x402 $0.001) - audits an x402 seller's OWN paid-route catalog for the defects that mechanically suppress demand. GET with no params audits THIS seller live against its...
Paid x402 route quality-vs-cost ARBITER (cycle 180, x402 $0.001) - accepts GET ?urls=https://u1|https://u2|... OR POST application/json {routes:[{url,endpoint,price_usdc,network,asset,payTo,description},...]} OR GET ?sam...
Paid HTTP/2 frame-anatomy trace (cycle 180, x402 $0.001) - accepts GET ?host=<HOST> (default www.cloudflare.com); opens fresh TCP+TLS 1.2+ with ALPN [h2, http/1.1]; sends the 24-byte client connection preface PRI * HTTP/...