Fx

Paid JSON-LD structured-data cross-validator (x402 $0.001) - GET ?url=<URL> parses every <script type=application/ld+json> block and cross-validates the claims, reporting block counts by @type and an A-F grade. via x402

Paid rate-limit header surface + live burst probe (cycle 134, x402 $0.001) - fetches target 4x in a burst, parses 7 known rate-limit header families (IETF RFC 9239 draft, X-RateLimit-*, Twitter, Stripe, Shopify, GitHub, Retry-After + misc), tracks first/last remaining values, detects saturation_observed, computes reset_in_seconds, returns rate_limit_health_score 0-100 A-F. Distinct from /api/heade

Paid SSL-pinning / HPKP policy probe (x402 $0.001) - GET ?domain=<DOMAIN> checks for deprecated HPKP (RFC 7469) headers, CSP public-key-pins directives and pinning-related security headers, returning a pinning posture grade. via x402

Paid CDN cache-key probe via 4-variant request burst (cycle 134, x402 $0.001) - fetches target 4x with different dimensions (baseline, ?cb=12345, Accept-Language: fr, Accept-Encoding: identity), captures X-Cache/CF-Cache-Status/X-Vercel-Cache/Akamai/Vary/ETag/Last-Modified/Age headers per call, hashes first 8KB of each body, reports per-dimension cache_split/cache_unified verdicts, baseline cache-

Paid DANE/TLSA + SMTP STARTTLS active probe (cycle 137, x402 $0.001) - resolves MX for domain, looks up _25._tcp.<mxhost> + _587._tcp.<mxhost> + _465._tcp.<mxhost> TLSA records (RFC 6698/7672), opens SMTP socket to MX:25, sends EHLO+STARTTLS, validates TLSA association against observed leaf cert (matching type 0/1/2, selector 0/1, usage 0-3). Returns per_mx[] + dane_present + smtp_starttls_support

Paid Content Language detector (cycle 139, x402 $0.001) - fetches URL + extracts language declarations across html lang attribute + HTTP Content-Language header + og:locale/og:locale:alternate + hreflang link tags + meta http-equiv=Content-Language + JSON-LD inLanguage (string or array). Returns primary_language + primary_source_count + declared_languages[{language,source_count,sources}] + consist

Paid CDN cache-key collision probe (cycle 139, x402 $0.001) - actively fetches target with 4 probe pairs (Accept-Language en-vs-es / Accept-Encoding gzip-vs-br / Cookie session vs no-session / User-Agent desktop-vs-mobile) and compares response hashes to detect cache-key partitioning failures. CRITICAL severity for auth+cookie collisions (cache-leak vulnerability class), HIGH for Accept-Language w

Paid Cross-Origin Isolation (COOP+COEP+CORP+credentialless) coherence audit (cycle 138, x402 $0.001) - fetches URL + parses Cross-Origin-Opener-Policy (same-origin/same-origin-allow-popups) + Cross-Origin-Embedder-Policy (require-corp/credentialless/unsafe-none) + Cross-Origin-Resource-Policy (same-origin/same-site/cross-origin) + Origin-Agent-Cluster (?0/?1) + SAB-API indicators (SharedArrayBuffe

Paid WebAssembly CSP + wasm-unsafe-eval coverage analyzer (cycle 137, x402 $0.001) - fetches target URL, scans for WASM indicators (inline WebAssembly.instantiate/compile + .wasm file references + <link rel=preload as=fetch type=application/wasm> + library mentions emscripten/AssemblyScript/Blazor/Pyodide/wasm-bindgen), HEAD-probes first 6 .wasm URLs, parses CSP for script-src directive, detects '

Paid HTTP/1.1 hop-by-hop header correctness probe (cycle 141, x402 $0.001) - opens raw TCP to host:443 + :80, sends 3 sequential GET requests with explicit Connection: keep-alive, X-Hop-Marker-A1b2c3, X-Internal-Trace-X9y8z7 headers; probes whether the response honors RFC 7230 §6.1 (Connection-listed headers consumed by intermediate, NOT forwarded to back-end). Detects caching/forward/reverse prox

Paid OCSP Must-Staple (RFC 7633) cert-feature detector (cycle 138, x402 $0.001) - opens TLS to target host, parses leaf cert via cryptography.x509 to detect status_request TLS Feature extension (OID 1.3.6.1.5.5.7.1.24) or status_request_v2 (OID 1.3.6.1.5.5.7.1.25); detects must-staple commitment at the certificate level; pairs with /api/ocsp-staple-verify (c128, responder reachability) for end-to-

Paid Content-Encoding integrity + compression-bomb detector (cycle 141, x402 $0.001) - fetches URL 3x: no Accept-Encoding baseline + Accept-Encoding: gzip + Accept-Encoding: br, gzip; records raw bytes + Content-Length + Content-Encoding header per request; decompresses via zlib + brotli; compares against identity. Detects 4 failure classes: compression bomb (decompressed >> compressed + > 5MB), d

Paid DoH trust-anchor cross-resolver agreement probe (cycle 142, x402 $0.001) - sends the same DNS query (A/AAAA/DS/DNSKEY/MX/TXT/CNAME) to 3 public DoH resolvers: Cloudflare (RFC 8484 wire-format) + Google (JSON API /resolve) + Quad9 (RFC 8484 wire-format); compares ANSWER fingerprints; detects resolver_disagreement (poisoning / BGP hijack / stale cache), one_resolver_failed, all_agree; pulls IAN

Paid x402 payment payload decoder + trace (cycle 142, x402 $0.001) - accepts X-PAYMENT base64 / POSTed JSON / payment_b64 query; parses x402Version + scheme + network; decodes EIP-3009 transferWithAuthorization (from/to/value/validAfter/validBefore/nonce + signature v/r/s); reports expiry status (valid/expired/not_yet_valid) + signature length diagnostics + well_formed bool + per-field findings; x

Paid x402 marketplace trend scanner (cycle 120, x402 $0.001) - fetches a target /s /.well-known/x402 catalog (GET) or accepts raw catalog as POST body; computes per-asset + per-network + per-facilitator + per-scheme distributions, price-per-call histogram (5 buckets from under_$0.001 to above_$0.05), unique_payTo count (concentration/fragmentation signal), price_atomic min/max/mean/median stats, m

Paid seller x402 catalog bloat + consolidation scoring (cycle 121, x402 $0.001) - fetches a target /s /.well-known/x402 catalog (GET) or accepts raw catalog as POST body; computes thin-descriptions count (<60 chars), version-variant groups (/v1 vs /v2 etc.), high-similarity description pairs (Jaccard >0.45 on 3+ char tokens), price-band fragmentation (# distinct atomic price points), name-overlap

Paid Web Bot Auth / RFC 9421 HTTP Message Signatures verifier (cycle 146, x402 $0.001) - probe /.well-known/http-message-signatures on target, extract Ed25519 public keys, parse caller-supplied signature-input + signature, verify alg/keyid/created/expires, return discovery + verification + web_bot_auth_score 0-100. Useful for AI agents verify rate that a claimed bot is actually that bot. Distinct

Paid JSON-LD @id cross-reference reachability probe (cycle 143, x402 $0.001) - parses all <script type=application/ld+json> blocks, extracts every @id URL, HEAD-probes each (max 12, parallel), verifies reachability + Content-Type; bi-directional check (does the linked page reference the target back?); orphan @id detection (declared but unreachable); per_link[] + dead_links[] + orphan_ids[] + reach

Paid security-header mutation test (cycle 143, x402 $0.001) - fetches target URL 5x with deliberately different fingerprint headers (Chrome desktop + Firefox + Mobile Safari + python-requests bot + baseline); compares the set of 12 security-relevant response headers (CSP/HSTS/X-Frame-Options/X-Content-Type-Options/Referrer-Policy/Permissions-Policy/COOP/COEP/CORP/etc) across all 5 responses; flags

Paid deep CORS preflight OPTIONS audit (cycle 145, x402 $0.001) - 6 sequenced CORS probes (baseline GET + simple-Origin preflight + post+contenttype+auth preflight + multi-header preflight x-custom-1/x-custom-2 + credentials preflight + DELETE-method preflight) + per-probe full Access-Control-* response capture (ACAO + ACAC + ACAM + ACEH + ACRPN + ACEX + ACMA + ACPN) + Vary tracking + method_allow

Paid web-cache-poisoning + deception active probe (cycle 145, x402 $0.001) - 5 unkeyed-header probes (X-Forwarded-Host + X-Original-URL + X-Forwarded-Prefix + X-Host + X-Forwarded-Server + X-Forwarded-For + X-Forwarded-Proto + X-Original-Host + X-Rewrite-URL) checking body-hash divergence WITHOUT Vary disclosure; 4 cachebuster-query probes (cb + nocache + utm_source + gclid) checking query-keying;

Paid Set-Cookie × shared-cache disclosure scanner (cycle 148, x402 $0.001) — probes 8 sensitive paths on target origin (/login + /api/me + /api/session + /account + /profile + /dashboard + /me + /api/user, + optional extra) in parallel, for each: captures Set-Cookie count + cookie names classified as sensitive (session/auth/jwt/token/csrf/__Secure-/etc.) + Cache-Control + Vary, classifies cache di

Paid HTTP/2 Rapid Reset (CVE-2023-44487) DoS probe (cycle 149, x402 $0.001) - opens fresh TCP+TLS 1.3 with ALPN h2, sends HTTP/2 client preface + client SETTINGS, parses server SETTINGS, runs a rapid-reset loop (open stream HEADERS :method=GET :scheme=https :path=/ :authority=host, then immediately RST_STREAM, repeat n_streams times default 200 max 1000). Returns streams_opened + streams_reset + s

Paid llms.txt multi-target drift monitor (cycle 149, x402 $0.001) - up to 20 domains in parallel via ThreadPoolExecutor; per_host H1 + first-5-URLs + sha256 fingerprint; compares to /tmp/llms_txt_monitor_state.json to detect first_observation / changed / fresh / no_llms_txt + added_urls[] + removed_urls[] + llms_txt_churn_score 0-100 A-F.

Paid DNS AXFR (zone-transfer) vulnerability probe (cycle 148, x402 $0.001) — discovers authoritative NS via Cloudflare DoH, then opens raw TCP/53 to each NS and sends an RFC 1035 wire-format AXFR query (QTYPE=252) per RFC 5936; returns per_nameserver {reachable, axfr_status_code, record_count, first_records, elapsed_ms} + zone_is_publicly_transferable bool + nameservers_probed_count + axfr_allowed

Paid CSP x Subresource-Integrity (SRI) verifier (cycle 150, x402 $0.001) - fetches URL HTML, extracts every external <script src=> + <link rel=stylesheet href=>, fetches each asset (200KB cap), computes sha256 + sha384, cross-references page's integrity= attribute. Detects csp_require_sri_for directive (CSP + meta). Per-asset {src, declared_integrity, computed_sha256, computed_sha384, integrity_ma

Paid OWASP API Security Top 10 (2023) one-call composite audit (cycle 151, x402 $0.001) - fetches target URL + probes 24 conventional API paths in parallel via ThreadPoolExecutor, runs all 10 OWASP 2023 category checks: API1 BOLA (compare /api/users/1 vs /api/users/2), API2 Broken Auth, API3 BOPLA (PII keywords + over-exposure), API4 Unrestricted Consumption (no RateLimit-* + huge response), API5

Paid CORS runtime cross-origin attack trace (cycle 152, x402 $0.001) - launches real cross-origin attack requests against target URL across 5 verbs (GET/POST/PUT/DELETE/PATCH) x 5 attacker origins (https://attacker.example / null / https://<target>.attacker.example subdomain-confusion / https://localhost / http://<target> http-downgrade), captures per-probe {acao_echo, acac_true, status, body_prev

Paid CSP permissive-source budget scorer (cycle 154) - quantifies aggregate attack-surface allowed by the policy. Parses header + meta + report-only delivery mechanisms, classifies every source value as high (script-src *, unsafe-inline, unsafe-eval, wasm-unsafe-eval, data:, blob:, filesystem:), medium (https: scheme-only, http: scheme-only, strict-dynamic nonce-propagation trust, host lists >=5,

Paid x402 payment receipt parser + on-chain tx verifier (cycle 151, x402 $0.001) - accepts a server-returned X-PAYMENT-RESPONSE base64 (the canonical x402 settlement receipt) OR a raw transaction hash (0x + 64 hex) which it fetches via the Base public RPC (base.gateway.tenderly.co, with 1rpc.io/base + base.drpc.org fallbacks), then decodes the USDC Transfer event from the receipt logs (USDC contra

Paid JWT HS256 signature-timing sidechannel probe (cycle 152, x402 $0.001) - forges 32 HS256 JWTs varying the LAST signature byte, sends each (default 12 iterations) against target's Authorization: Bearer header, measures per-byte response timing via stdlib time.monotonic, detects non-constant-time HMAC verification (a classic JWT forgery primitive). Returns per_byte_stats {min_ms,max_ms,median_ms

Paid JWT algorithm-confusion + kid-injection + JWKS-header-hijack probe (cycle 153) - forges 12 forged-JWT attack classes (alg:none variants + kid-injection variants + jku/jwk/x5u attacker-controlled) and (when public_key supplied) RS256->HS256 key confusion. Per-attack response-status check (success = 200/201/202/203/204/302/304/307). Returns jwt_alg_confusion_score 0-100 A-F + verdict...

Paid AWS S3 bucket public-read ACL + listability probe (cycle 155, x402 $0.001) - resolves target domain + derives 8 conventional bucket-name candidates (apex + hyphen_to_dot + -backup/-backups/-prod/-staging/-dev/-assets variants), for each candidate attempts ANONYMOUS GET against https://<bucket>.s3.amazonaws.com/?list-type=2 and follows region redirects to the region-specific endpoint (https://

Paid DNS CAA (Certification Authority Authorization) policy audit (cycle 156, x402 $0.001) - parses a domain's CAA records per RFC 8659, classifies each authorized CA token against a 32-CA registry (Let's Encrypt/DigiCert/GlobalSign/Sectigo/GoDaddy/Comodo/RapidSSL/Thawte/GeoTrust/VeriSign/Entrust/Amazon/Google/Microsoft/SSL.com/Certum/Actalis/UserTrust/Buypass/etc + ISRG alias + the special 0-valu

Paid DKIM key-rotation freshness audit (cycle 157, x402 $0.001) - probes 25 common DKIM selectors in parallel via DoH, parses per-selector v/k/p/h/s/t/n tags, computes SHA-256 fingerprint of each public key, and scores rotation hygiene: distinct pubkey count (1=no rotation, >=2=rotation footprint), revoked-key detection (p= empty), weak-key detection (decoded DER < 128 bytes = RSA < 1024-bit), ver

Paid SMTP open-relay test (cycle 154) - actually attempts MAIL FROM + RCPT TO against each MX host. Resolves MX via Cloudflare DoH, opens TCP/25, sends EHLO + MAIL FROM:<external> + RCPT TO for both local-domain and foreign-domain recipients. Verdict mapping per RFC 5321: open_relay (250/250 critical), relay_denied (550/553 good), requires_auth (530/535 good), greylist_or_throttle (421/452), sende

Paid CSP x Live-Script mapper (cycle 156, x402 $0.001) - fetches target HTML, extracts every <script src=...> URL, and maps each against the target's declared CSP script-src + default-src allow-list. Reports which running scripts ARE allowed (in-policy, on-origin, hash match, scheme match) and which are NOT (CSP would block them in a real browser). Also detects inline scripts violating script-src

Paid CDN edge cache-key constructor analyzer (cycle 158, x402 $0.0005) - actively probes the CDN edge cache across 9 variation dimensions (Accept-Language, Accept-Encoding, User-Agent, Cookie, Authorization, Origin, Referer, Accept, Query param) via paired baseline+variant cachebuster requests, hashes body responses with SHA-256 (truncated 16), and reports which dimensions ARE differentiated by th

Paid SMTP credential-leak probe (cycle 158, x402 $0.0005) - actively probes each MX host on ports [25, 465, 587] for credential-handling vulnerabilities. Per-port: opens TCP, reads banner, sends EHLO, captures AUTH mechanisms offered (PLAIN/LOGIN/CRAM-MD5/XOAUTH2/NTLM), detects PLAIN/LOGIN offered pre-STARTTLS on cleartext ports (CRITICAL credential leak vector), detects AUTH NTLM (known MS Exchan

Paid AI-agent readiness card composer (cycle 157, x402 $0.001) - produces a single structured card telling an AI agent whether a target URL is safe+affordable to call. Scores 6 axes (each 0-100) with equal weight: llms.txt presence (documentation), robots.txt AI-bot allowance (8 top commercial crawlers), OpenAPI/Swagger schema presence, /.well-known/x402 paid-API discoverability, auth-scheme clari

Paid OAuth 2.0 / OIDC authorization endpoint hardening audit (cycle 159, x402 $0.001) - actively probes an issuer's OAuth/OIDC authorization endpoint against the 10 canonical misconfiguration classes defined by RFC 9700 (OAuth 2.0 Security BCP) and the historical CVE pattern: (1) discovery endpoint presence on /.well-known/openid-configuration + /.well-known/oauth-authorization-server; (2) PAR (RF

Paid OAuth 2.0 / OpenID Connect discovery + flow-capability analyzer (cycle 133, x402 $0.001) - probes 4 RFC 8414 + OIDC discovery endpoints at target domain (/.well-known/openid-configuration + /oauth-authorization-server + /oauth-protected-resource + /openid-federation); parses grant_types_supported + response_types_supported + scopes_supported + token_endpoint_auth_methods + code_challenge_meth

Paid deep SPF record parser + DNS-lookup budget auditor (cycle 160 restored 2026-10-17, x402 $0.001) - parses v=spf1 into its directive list, classifies each mechanism per RFC 7208 SS5 (pass/fail/softfail/neutral/literal/query/redirect), tracks DNS-lookup budget (RFC 7208 SS4.6.4 maximum 10 lookups - over returns permerror), recursively resolves nested include: targets via Cloudflare DoH, flags pt

Paid DNS label & zone-naming standards-compliance audit (cycle 159, x402 $0.001) - audits every label of the zone against RFC 1035 §2.3.4 + RFC 5891 §4.2.3 + RFC 2782 SRV conventions: (1) per-label length <= 63 octets; (2) total zone name <= 253 octets; (3) LDH charset only (letters/digits/hyphen) - non-LDH chars flagged high; (4) leading/trailing hyphen disallowed (RFC 5891 §4.2.3.1); (5) xn-- pu

Paid OpenAPI/Swagger security-smell linter per OWASP API Top 10 (2023) (cycle 160 restored 2026-10-17, x402 $0.001) - accepts GET ?url=<TARGET> (walks 6 candidate paths /openapi.json+/openapi.yaml+/swagger.json+/swagger/v1/swagger.json+/api/openapi.json+/v3/api-docs) OR GET ?doc=<URL_ENCODED_JSON> OR POST application/json {url|doc|doc_text}; runs 10 rules (BOLA/BrokenAuth/BOPLA/RateLimit/BFLA/Sens

Paid WebTransport handshake + endpoint reachability probe (cycle 165, x402 $0.001) - actively probes RFC 8441 + RFC 9290 + RFC 9221 WebTransport readiness across 8 axes: (1) Alt-Svc h3/h3-NNN advertise parse (HTTP/3 required for WebTransport); (2) Extended CONNECT-UDP enablement probe (RFC 9221, :protocol=connect-udp pseudo-header) to 3 candidate paths; (3) WebTransport-specific endpoint discovery

Paid CDN edge-runtime fingerprint + cold-start probe (cycle 163, x402 $0.001) - actively probes for serverless edge-compute runtimes (Cloudflare Workers/Vercel Edge Functions/Fastly Compute@Edge/Akamai EdgeWorkers/CloudFront Lambda@Edge/Netlify Edge/Deno Deploy/Bunny.net Edge) by examining 8 probe axes: (1) vendor header signature (CF-Ray/X-Vercel-Id/X-Amz-Cf-Id/X-Akamai-Request-ID/X-Netlify-Reque

Paid QUIC spin-bit privacy-leak audit (cycle 164, x402 $0.001) - actively probes RFC 9000 SS15.2 / RFC 9312 spin-bit privacy behavior. Per RFC 9312 SS3.2 the spin bit is the second-most-significant bit of byte 0 of long-header packets (mask 0x20 for QUICv1); implementations that reflect latency on every packet enable on-path observers to measure one-way delay (privacy-hostile). Steps: (1) Alt-Svc

Paid Trusted Types policy enforcement audit (cycle 164, x402 $0.001) - actively audits W3C Trusted Types policy enforcement by examining 9 axes: (1) CSP require-trusted-types-for 'script' directive presence (the ENFORCEMENT signal); (2) CSP trusted-types directive + declared policy-name list; (3) window.trustedTypes global reachability in inline JS; (4) trustedTypes.createPolicy() availability + d

Paid W3C DID-method resolution + registry probe (cycle 165, x402 $0.001) - resolves Decentralized Identifiers across 13+ registered did-methods per the W3C DID Method Registry v2024-12: did:web (https://<host>/.well-known/did.json per DID Web v1.0), did:key (multibase 'z' base58btc + multicodec prefix decode 0xed=ed25519 / 0xe7=secp256k1 / 0x80=p256 / 0x24=x25519 - no network), did:plc (AT Protoco