Fx

Paid live QUIC (HTTP/3) handshake probe (cycle 101) — actively opens UDP/443 QUIC Initial packets to the resolved A/AAAA, tests 10 candidate versions (draft-29/30/31/32/33/34 + h3 + h3-Q050 + v2); parses server reply to detect Retry packets, Handshake packets, Version Negotiation; reports per-version RTT, server_replied, supported_versions[], handshake_rtt_ms, zero_rtt_supported, retry_required, p

Paid AI discovery surface cross-validator (cycle 104) — fetches 4 surfaces (llms.txt + /.well-known/security.txt + openapi.json + agents.txt); extracts the contact claim from each (H1 title / RFC 9116 Contact / openapi.info.title / agents.txt H1); cross-compares domains + org-names + openapi servers[]; reports agreements/disagreements + identity_consensus bool + consistency_score 0-100 A-F. Differ

Paid HTTP/3 QPACK (RFC 9204) encoder-pattern fingerprint probe (cycle 179, x402 $0.001) - accepts GET ?host=<HOST> (default www.cloudflare.com) OR POST application/json {'host':...,'force_quic':...}; fetches https://<host>/ via urllib over TCP+TLS first to extract Alt-Svc header h3 advertisement (RFC 7838) + parse max-age; then reports a canonical QPACK encoder-field-block representation (3 indexe

Paid AI-agent tool-call card generator (cycle 105) — accepts GET ?url=<TARGET> OR POST application/json {url: <TARGET>}; probes /.well-known/x402 + 4 OpenAPI candidate paths + /llms.txt; aggregates into a single structured "tool card" object: {card_id, target_url, name, description, vendor, kind, is_paid, x402{pay_to,asset,network,endpoint_count,min/max/median_price_usdc,sample_endpoints}, openapi

Paid active TLS 1.3 + PQC + ECH probe (cycle 108) — opens TLS 1.3 connection, advertises 13 named groups including PQC hybrids (X25519Kyber768Draft00/Draft01, X25519Kyber768, SecP256r1Kyber768Draft00/Draft01, P256Kyber768Draft00) + classical (X25519/P-256/P-384/P-521) + FFDHE groups; queries HTTPS/SVCB DNS for ECHConfig (Encrypted Client Hello) presence; reports pqc_group_used + pqc_group_name + e

Paid JSONPath extraction (cycle 108) — accepts GET ?url=<URL>&path=<JSONPATH> OR GET ?json=<urlencoded JSON>&path=<JSONPATH> OR POST application/json {url|json, path}; fetches the URL (or parses inline JSON) and applies a subset of JSONPath ($.foo.bar / $.foo[0] / $.foo[*] / $..bar / $.foo[?(@.price<10)] with key-comparison filters) to extract matching values; returns match_count + matches[] (capp

Paid brand-impersonation risk synthesis (cycle 106) — aggregates 8 signals (domain age via crt.sh, BIMI RFC 8848 record, RFC 9116 security.txt, llms.txt presence, /.well-known/x402 honest declaration, https→http redirect sanity, DMARC TXT, brand-lookalike string-similarity of page title/H1/domain SLD against 50 most-impersonated brands with Levenshtein-1 detection) into a single 0-100 trust_score

Paid outbound link rot / staleness audit (cycle 109) — fetches source URL, extracts every <a href>, then for each link: (a) HEAD-probes to detect 4xx/5xx/timeout/redirect, (b) parses Last-Modified + Date response headers for staleness, (c) checks archive.org Wayback availability for a historical snapshot. Returns per_link[] (capped 30) with status + redirect_target + last_modified + staleness_age_

Paid deep DMARC policy forensic analyzer (cycle 110) — fetches _dmarc.<domain> TXT via Cloudflare DoH and parses ALL DMARC tags (p, sp, pct, rua, ruf, adkim, aspf, rf, ri, fo) per RFC 7489. Returns policy_strength (none/quarantine/reject) + policy_score + pct enforcement + subdomain policy + alignment mode (relaxed/strict) + reporting URI count + fo forensic options + a 0-100 dmarc_strength_score

Paid active HTTP/2 SETTINGS frame probe (cycle 106) — opens fresh TCP, performs TLS 1.3 handshake with ALPN ["h2", "http/1.1"], sends the HTTP/2 client connection preface (PRI * HTTP/2.0 + 24-byte magic + client SETTINGS frame), reads the server SETTINGS frame (2s timeout), parses 6 standard settings (HEADER_TABLE_SIZE, ENABLE_PUSH, MAX_CONCURRENT_STREAMS, INITIAL_WINDOW_SIZE, MAX_FRAME_SIZE, MAX_

Paid AI-citable source credibility scorer (cycle 109) — fetches URL, extracts article text + meta description + article:published_time, then computes 6 sub-scores: hedging language density (30 terms tracked), sourcing (citation markers + realistic citation-link count per 1000 words), sensationalism (caps density + exclamation rate + 20 urgency terms), one-sidedness (22 counterpoint terms), freshne

Paid SRI hash collision-risk + algorithm-strength probe (cycle 113) — parses every <script src integrity> and <link rel=stylesheet href integrity>, for each subresource: extracts the hash token (sha256/sha384/sha512/sha1/md5), validates HASH LENGTH against expected base64 char count (sha256=44/sha384=64/sha512=88/sha1=28/md5=24 — anything shorter = TRUNCATED = SRI USELESS), flags WEAK HASH ALGORIT

Paid per-cookie IAB TCF v2.2 purpose classification (cycle 112) — fetches URL with HTTPCookieProcessor, captures every Set-Cookie, extracts inline document.cookie= writes, classifies each cookie by NAME heuristics (ga/_ga = Google Analytics, _fbp/fr = Facebook, _gcl_au = Google Ads, _hj = Hotjar, _pk_ = Matomo, li_/lidc = LinkedIn, _ttp = TikTok, twid = Twitter/X, ide/_gads = DoubleClick, csrf/sid

Paid Open Graph + Twitter Card metadata freshness + reachability probe (cycle 112) — fetches URL, extracts og:* + twitter:* meta tags, HEAD-probes each og:image / og:image:secure_url / twitter:image, returns per-image status+content_type+content_length+last_modified+age_days+cache_control+server+cdn_status (CF-Cache-Status/X-Cache/X-Vercel-Cache/X-Amz-Cf-Id/Akamai-Cache-Status) + is_reachable/is_s

Paid deep WAI-ARIA accessibility audit (cycle 113) — parses every element with role= or aria-*, checks INTERACTIVE ROLES MISSING ACCESSIBLE NAMES (button/checkbox/combobox/img/link/listbox/menu/menuitem/option/progressbar/radio/scrollbar/search/slider/spinbutton/switch/tab/tabpanel/textbox/tree/treeitem — must have aria-label/aria-labelledby/inner-text), REQUIRED PARENT ROLES (combobox-in-listbox,

Paid readability + per-paragraph reading-time estimator (cycle 110) — fetches URL, extracts paragraph-level text, then computes 6 readability formulas (Flesch, Flesch-Kincaid, Gunning Fog, SMOG, Coleman-Liau, ARI) + total reading_time_minutes + per_paragraph[{word_count, reading_time_seconds, flesch, grade_estimate}] + target_audience_verdict + is_dense/is_easy/is_long_form flags + 0-100 content_r

Paid x402 multi-task pipeline planner / orchestrator (cycle 176, x402 $0.001) - accepts POST application/json {'tasks': ['task1', 'task2', ...]} OR GET ?tasks=task1|task2|task3 OR GET ?q=...; maps each task to its best-fit x402 route via token-bag overlap; builds an OPTIMAL EXECUTION PIPELINE: deduplicates when 2+ tasks map to the same route (1 paid call serves multiple tasks), groups by route for

Paid DNS nameserver vendor fingerprint (cycle 116) — queries NS records via Cloudflare DoH, classifies each NS hostname against a 28-provider heuristic table (Cloudflare/AWS-Route53/Google-Cloud-DNS/NS1/Azure/Akamai-Edge-DNS/DNSimple/GoDaddy/Namecheap/Dyn/DNSPod/Alidns/Hurricane-Electric/ClouDNS/deSEC/Bunny/Vultr/Hetzner/OVH/ConoHa/Gandi/Hover/Porkbun/Squarespace/Name.com/DreamHost/IONOS/InternetX

Paid AI training / retrieval crawler policy audit (cycle 117) — fetches /robots.txt + /llms.txt + /llms-full.txt + /meta-robots + probes 3 ai.txt paths (/.well-known/ai.txt + /.well-known/ai-crawler-policy + /ai.txt), classifies per-UA policy for 19 AI crawlers across 4 categories: training (GPTBot/ClaudeBot/Claude-Web/anthropic-ai/Google-Extended/CCBot/PerplexityBot/Bytespider/cohere-ai/Applebot-

Paid CDN / edge-provider detection from response headers (cycle 116) — fetches target URL, inspects 25+ CDN-specific response headers (CF-Ray/CF-Cache-Status/CF-Request-Id + X-Amz-Cf-Id/X-Amz-Cf-Pop + X-Vercel-Id/X-Vercel-Cache + X-Served-By/X-Fastly-Request-Id + X-Akamai-Request-Id/Akamai-Request-Bcst + CDN-Pullzone-Id/Bunny + X-NF-Request-Id + Via: chain + Server/X-Powered-By); returns detected_

Paid clickjacking-protection audit (cycle 115) — fetches the page headers + body, audits (a) X-Frame-Options presence + value (DENY/SAMEORIGIN valid, ALLOW-FROM deprecated per Chrome/Edge), (b) CSP frame-ancestors policy across all CSP headers incl. report-only, classifies policy as none/self/wildcard/domain_list/domain_list_with_wildcard, (c) meta http-equiv X-Frame-Options (insecure — header is

Paid Idempotency-Key header support probe (cycle 118) — fetches target URL, scans response headers for Idempotency-Replayed + X-Request-ID signals, probes 6 OpenAPI candidate paths for explicit Idempotency-Key parameter declarations, issues synthetic POST + replay POST with same Idempotency-Key but different bodies to 8 write-endpoint candidates (Stripe/Adyen/PayPal-style probe). Returns idempoten

Paid OpenAPI / Swagger 2.0 best-practices quality audit (cycle 114) — accepts GET ?url=<openapi.json URL> OR POST application/json with {spec:{...}} or {spec_text:"<YAML or JSON>"}; scores 12 quality dimensions: (a) OpenAPI version compliance (openapi 3.0/3.1/Swagger 2.0), (b) info object completeness (title/version/description/contact/license — 5 sub-checks), (c) operationId coverage (every get/p

Paid Web Vitals INP (Interaction-to-Next-Paint) heuristic estimate (cycle 118) — static-analysis proxy for INP p75 without a real browser: counts addEventListener + onclick/oninput/onkeydown/onsubmit handlers in inline + external JS (cap 8 scripts, 200KB each), estimates JS parse/execute cost from total bytes (>400KB/+60ms, >800KB/+130ms, >1.5MB/+220ms penalties), detects framework cost (React/Vue

Paid JavaScript syntax-validity probe (cycle 114) — fetches the page HTML, extracts every inline <script> block + every external <script src=> (parallel fetch with 8s timeout + 500KB cap per script, max 20 externals), for each script runs an AST-based syntax check (esprima or pyjsparser if installed, else heuristic). Detects: (a) unclosed string literals (" or unmatched), (b) unclosed template lit

Paid cookie name-prefix (__Secure-/__Host-) policy audit (cycle 115) — fetches page Set-Cookie headers, for each cookie: extracts Secure/Path/Domain/HttpOnly/SameSite attributes, flags __Secure- prefix and checks Secure attribute is set (browser drops otherwise), flags __Host- prefix and checks Secure + Path=/ + no Domain (browser drops otherwise — strongest cookie scoping), classifies cookie as s

Paid WebAuthn / Passkey policy audit (cycle 117) — non-authenticated scan of a sites passkey posture: (a) detects 13 vendor SDKs in HTML (SimpleWebAuthn/Corbado/Hanko/Stytch/Clerk/WorkOS/Auth0/Okta/Descope/Keycloak/Bitwarden/1Password), (b) extracts WebAuthn ceremony hints from inline JS — navigator.credentials.create + .get, userVerification, residentKey, attestation level, allowCredentials, rpId

Paid Cache-Control header granularity audit (cycle 119, x402 $0.001) - fetches target URL, parses every Cache-Control directive (max-age / s-maxage / stale-while-revalidate / stale-if-error / public / private / no-cache / no-store / immutable / must-revalidate / proxy-revalidate), inspects Vary header for advisory-low patterns (User-Agent / 0 entries / >6 entries), reads Age/X-Cache/cf-cache-statu

Paid x402 price-per-call optimizer (cycle 119, x402 $0.001) - fetches a target seller /s /.well-known/x402 catalog (or accepts raw catalog as POST body), extracts price-per-call from atomic-string or decimal forms, computes min/max/mean/median/stdev + 5-bucket histogram (<$0.001 / $0.001-$0.005 / $0.005-$0.01 / $0.01-$0.05 / >$0.05) + network + asset + payTo diversity breakdowns + suggested entry-

Paid x402 task-to-route recommender (cycle 175, x402 $0.001) - accepts GET ?task=<TEXT> OR GET ?q=<TEXT> OR POST application/json {'task':...}; pulls our own /.well-known/x402 catalog (~249 endpoints), scores each endpoint by token-bag overlap with the task description + path-keyword bonus + price-adjusted value, returns top-10 ranked recommendations {path, price, relevance_score, composite_score}

Paid composite AI-agent onboardability summary (cycle 120, x402 $0.001) - single-call composite that answers 'could an AI agent onboard to use this URL as a paid tool?' - fetches target URL + probes /openapi.json + /.well-known/x402 + /llms.txt + /.well-known/security.txt + /.well-known/mcp.json + /.well-known/agents.txt + /robots.txt AI-bot policy; computes 7 weighted sub-checks (machine_readable

Paid single-endpoint quality benchmark (cycle 121, x402 $0.001) - given a target x402 endpoint URL, fetches the 402 envelope (without payment), parses out the description+price+network+asset, scores 9 metadata quality dimensions (description_length 0-10 + action_verb 0-10 + example_response 0-10 + error_code_doc 0-10 + input_param_doc 0-10 + distinctiveness 0-10 + price_documented 0-10 + network_a

Paid TLS server-cert trust chain inspection (cycle 126, x402 $0.001) - opens TLS via ssl.create_default_context, pulls full DER chain via get_verified_chain(), parses each cert (subject/issuer/not_before/not_after/key_type/key_size/sig_alg/pathLenConstraint/nameConstraints/EKU), validates chain build (each cert issuer = next cert subject), verifies root against system trust store, flags expired ce

Paid SPF (RFC 7208) policy forensic analyzer (cycle 125, x402 $0.001) - parses every mechanism (+/-/~/? qualifiers) and modifier (redirect/exp), counts total_lookups (a=1, mx=1, ptr=5, exists=1, include=recursive) vs RFC 4.6.4 limit of 10, flags missing_terminal_all + terminal_plus_all (allows ALL senders!) + lookup_limit_exceeded + ptr_deprecated (RFC 7208 §5.5) + softfail_only + many_includes_ch

Paid BGP route-leak + prefix-hijack exposure probe (cycle 126, x402 $0.001) - resolves target host via Cloudflare DoH, queries RIPEstat prefix-overview for each IP, classifies announcing ASNs + holders, computes consensus (max ASNs per prefix), holder_match_ratio (fuzzy match vs target domain), crowded_prefix (RFC 7908 hijack indicator), single-ASN announcements vs multi-homed redundancy, returns

Paid redirect-destination classifier (cycle 123, x402 $0.001) - follows up to 10 redirect hops with loop detection, then classifies FINAL destination by TLD category (ccTLD / classic gTLD / suspicious .xyz .top .click .link .loan .win .bid .review .wtf etc.) + domain profile (punycode xn--, digit-ratio>30%, hyphen-count>=5, subdomain-depth>=4, IDN homoglyph) + SSL cert issuer class + parking-vendo

Paid heuristic email spam score for AI-agent triage (cycle 123, x402 $0.001) - accepts POST text/plain raw email source (RFC822 headers+body) or GET ?header=<url-encoded> or GET ?url=<.eml URL>; parses headers+body and computes a 0-100 spam score combining (a) HEADER signals: List-Unsubscribe missing, Precedence: bulk/list/junk, X-Mailer = bulk-sender lib (PHPMailer/Mailchimp/SendGrid/Mailgun/Amaz

Paid MTA-STS (RFC 8461) + TLSRPT (RFC 8460) policy audit (cycle 125, x402 $0.001) - probes _mta-sts.<domain> TXT (v=STSv1 + id) + smtp._mta-sts.<domain> HTTPS policy file (mode: enforce|testing|none + mx: + max_age: + id:) + _smtp._tls.<domain> TXT (v=TLSRPTv1 + rua=); verifies policy id matches TXT id, flags no_mta_sts_txt / no_policy_file / mode_none / mode_testing / policy_id_mismatch / no_tlsr

Paid CT-log certificate pre-fingerprint (cycle 124, x402 $0.001) - queries crt.sh for the target domain, parses every returned certificate record, and aggregates total_certs_observed + unique_sha256_count + duplicate_cert_count + self_signed_count + soon_to_expire_30d + issuer_distribution (top 5 CAs) + key_type_distribution (RSA/ECDSA/Ed25519) + signature_algorithm_distribution (SHA-1/SHA-256/SHA

Paid Permissions-Policy + Feature-Policy header audit (cycle 124, x402 $0.001) - fetches target URL + iterates ALL Permissions-Policy (modern) AND Feature-Policy (legacy) headers, parses 17 tracked features (camera/microphone/geolocation/payment/usb/accelerometer/gyroscope/magnetometer/midi/encrypted-media/display-capture/fullscreen/autoplay/picture-in-picture/xr-spatial-tracking/clipboard-read/cl

Paid web typography + font-loading audit (cycle 127, x402 $0.001) - fetches target HTML, extracts font-family from body + h1-h6 via inline style= attributes, parses inline <style> blocks for @font-face rules + font-display value + src origin domain, detects <link rel=preconnect> + <link rel=preload as=font crossorigin>, computes font-size range + line-height ratio distribution + letter-spacing sam

Paid dev-portal / VCS-dotfile / debug-surface exposure probe (cycle 127, x402 $0.001) - probes 39 conventional dev/debug/VCS-leak paths (/swagger-ui.html + /graphiql + /actuator + /.git/HEAD + /.env + /server-status + /phpinfo.php etc), classifies per-path is_exposed (200 + non-empty + JSON-or-leak-tokens) + is_sensitive (matches DB_PASSWORD/AKIA/SECRET_KEY/BEGIN PRIVATE/bearer_token/swagger/graph

Paid OCSP stapling live responder-reachability probe (cycle 128, x402 $0.001) - opens TLS to target host, fetches leaf cert DER via getpeercert(binary_form=True), parses via cryptography.x509 to extract Authority Information Access OCSP URLs (RFC 6960 §4.2.4.2), probes each OCSP responder URL for reachability + DER-response handling. Returns per_cert[] (ocsp_url, response_status, response_status_s

Paid live SMTP STARTTLS opportunistic-TLS probe (cycle 128, x402 $0.001) - resolves MX hosts via Cloudflare DoH, opens TCP to each on ports 25 + 587, reads SMTP banner, sends EHLO and parses capability list (STARTTLS/SIZE/8BITMIME/AUTH/PIPELINING/ENHANCEDSTATUSCODES), sends STARTTLS if offered, completes TLS handshake, re-sends EHLO over TLS, parses cert (subject/issuer/SAN/expiry). Returns per_mx

Paid internal link graph + PageRank-lite (cycle 132, x402 $0.001) - fetches target URL, extracts all same-domain <a href> anchors, fetches top 5 by anchor-text-length, builds an in-memory graph (nodes/edges), runs 20-iteration PageRank (damping=0.85). Returns top_pages_by_pagerank[] (top 10) + per_url {in_degree, out_degree, anchors_to_us[]} + target_metrics + findings[] + link_graph_score 0-100 A

Paid HTTPS RR (RFC 9460 SVCB/HTTPS) resolver (cycle 132, x402 $0.001) - queries apex HTTPS record via Cloudflare DoH, parses SVCB wireformat per RFC 9460 §2.2 (SvcPriority + SvcParams), decodes 7 known SvcParamKeys (mandatory=0, alpn=1, ipv4hint=2, ech=3, ipv6hint=4, dohpath=5, port=6). Returns per-priority[] entries with parsed svc_params + alpn_set + has_ipv4hint + has_ipv6hint + has_ech + has_d

Paid GraphQL introspection exposure audit (cycle 129, x402 $0.001) - accepts host OR url param, probes up to 6 conventional GraphQL endpoints (/graphql, /api/graphql, /v1/graphql, /query), sends canonical IntrospectionQuery per graphql.org/October2021 spec, parses __schema response, returns per_endpoint[] (url, introspection_enabled, types_count, kind_counts{scalar/object/interface/union/enum/inpu

Paid cookie partition consistency audit (cycle 130, x402 $0.001) - probes 6 conventional paths (apex/login/signup/api/cart/account), parses Set-Cookie from each, groups by cookie name across responses, flags inconsistencies in Secure/HttpOnly/SameSite/Path/Domain/Partitioned flags. Returns per_cookie[] + conflict_count + high_severity_conflict_count + partition_consistency_score 0-100 A-F. Catches

Paid CSP inline-fidelity validator (cycle 130, x402 $0.001) - fetches target URL, parses CSP, extracts every inline <script>/<style> block + event handler, computes sha256 of each, reports per-block {hash_in_csp, nonce_in_csp, covered} + orphan counts + policy_verdict (strict/hash/nonce/mixed/strict-dynamic/unsafe-inline/none) + csp_inline_fidelity_score 0-100 A-F. Distinct from /api/csp-deep (par

Paid HTTP request-smuggling CL.TE/TE.CL/TE.TE tolerance evidence probe (cycle 129, x402 $0.001) - opens low-level socket (bypasses urllib header normalization) to target host, sends 6 PortSwigger-style evidence requests per https://portswigger.net/web-security/request-smuggling: (1) CL.TE — both Content-Length + Transfer-Encoding: chunked, (2) TE.CL — reversed priority, (3-6) TE.TE with 4 obfuscat