Page Links

Fetch a reviewed public page and return its links with resolved absolute URLs and anchor text, the canonical URL, the declared meta robots directive, and how many links leave the host. Relative hrefs are resolved against the page, so a caller never has to guess a base.

Fetch a reviewed public page and return its title, every meta and Open Graph tag, and the canonical URL. No JavaScript is executed and no script content is read. Returns the licence and creator for the content alongside it, so reuse terms travel with the result.

Fetch a reviewed public page and return its HTML tables as arrays of rows and cells. Bounded to ten tables, fifty rows each and twenty cells per row, and every bound that is reached is named in the warnings so a truncated table is never mistaken for a short one.

Everything a reviewed public page declares, in one call and one fetch: title, meta and Open Graph, canonical, robots directive, JSON-LD with its schema.org types, resolved links with an external count, tables, content fingerprints, and readable Markdown. Replaces six separate extraction calls, and adds the cross-checks none of them can make alone — a canonical that disagrees with the URL you asked

Is this merchant safe to depend on? Audits up to ten x402 endpoints in one call and returns a verdict — ready, partially ready or not ready — with the specific blockers. Checks each endpoint serves a payable challenge with well-formed terms and a declared input schema, and adds the cross-endpoint check no single probe can make: whether every endpoint pays the same recipient. Never pays anything.

Audit your own delimited data against a contract you declare, and get one pass/fail plus the exact row and clause of every breach. Checks types, required values, enums, numeric bounds, lengths, patterns, uniqueness, composite primary keys, null-rate ceilings, header drift and encoding damage in one pass. A pass means the audit was complete and nothing broke, so a file beyond the bounds reports inc

See which operations were added, removed, deprecated or renamed between two OpenAPI documents. Flags a removal that was never preceded by a deprecation, an operationId change that renames the method in every generated client, and a duplicated operationId that no generator can resolve.

Audit a real request against the OpenAPI document it should satisfy. Matches the operation the way a router would, checks every path, query and header parameter against its declared schema, validates the body against the declared media type, and reports whether the credential the declared security scheme expects is present. You supply the request, so this works against an API nothing external can

Audit a real response against what the OpenAPI document promises for that operation. Resolves the declared status exactly, by range such as 2XX, or through default, checks declared response headers are present, and validates the body against the declared schema for its media type. Catches an implementation that has drifted from its own published contract.

Audit telemetry attributes against a contract, and against the thing a schema cannot see: cardinality. Reports missing required attributes, undeclared attributes, an attribute appearing as two types across the batch, and an attribute whose distinct values exceed your limit - because in a metrics backend each distinct value is a separate series, and that is how an index or a bill explodes.

Audit a CI workflow for what it leaves movable or undeclared. Reports actions pinned to a tag rather than a commit - a tag can be moved by whoever owns the action, so the code a step runs can change without this file changing - missing permissions and timeouts, a job depending on one that is not declared, a pull_request_target trigger, and an expression interpolated straight into a shell command.

Compare two lockfiles and report what a manifest diff cannot see. Reports newly installed transitive packages, resolved version moves with breaking risk, a registry that changed, and the most serious finding available here: the same version with a different integrity hash, meaning the artifact behind a version that was supposed to be immutable is not the one that was there before.

Compare a fixed list of ten security-relevant response headers across two releases and name the specific reverts. Reports a header removed, added or changed, and separately a reduced Strict-Transport-Security max-age, dropped includeSubDomains, a newly permitted unsafe-inline or unsafe-eval, and a Content-Security-Policy that moved from enforcing to report-only so it no longer blocks anything. Obs

Audit DKIM selector records. The key length follows from the length of the encoded public key, so a short RSA key is readable from the record itself with no cryptography. Reports a key shorter than a stated minimum; a selector left in testing mode, which asks receivers to treat a failure as unsigned so it cannot contribute to DMARC alignment however correctly it signs; a revoked key, with its cons