Fx

Paid social-share preview image audit — parses og:image / og:image:url / og:image:secure_url / twitter:image / twitter:image:src / twitter:image:alt / link rel=image_src / link rel=icon / largest inline <img>, HEAD-validates each candidate (200/404/MIME/content-length), computes per-platform chosen preview (Facebook/Twitter/LinkedIn/Slack/Discord fallback chains), reports alt text + declared dimen

Paid auth-method discovery — WWW-Authenticate header + RFC 8414 oauth-authorization-server + OpenID Connect discovery + JWKS + RFC 8705 oauth-protected-resource + login-form introspection, surfaces bearer/basic/oauth2/oidc/jwt/session-cookie methods + auth_scheme_score A-F grade via x402

Paid JavaScript framework + build-tool fingerprint — 11 detection surfaces (generator meta + data-* attrs + __NEXT_DATA__/__NUXT__/__remixContext + SPA root mount points + build-output paths /_next/_nuxt/_astro/build + JS-filename fingerprints react/vue/svelte/alpine/htmx/preact/stimulus/lit/qwik + CSS framework class signatures bootstrap/tailwind/bulma/foundation/materialize + Server header X-Pow

Paid AI/LLM crawl-policy synthesis (x402 $0.001) - GET ?domain=<DOMAIN> reads robots.txt, llms.txt, agents.txt and ai.txt, resolves policy for 40+ AI-bot User-Agents, and returns allow/block counts plus an A-F llm_crawl_score. via x402

Paid Certificate Transparency log auditor (cycle 85, x402 $0.001) - GET ?domain=<DOMAIN> queries crt.sh for issued certificates and reports issuer distribution, certificate records, first/last-seen timestamps and an A-F graded ct_score. via x402

Paid PWA Web App Manifest audit via x402

Paid error-response fingerprint + leakiness audit — 12-probe matrix (api-404/admin-path/.env/phpmyadmin/debug/wp-admin/graphql-invalid/internal-api/bad-json/wrong-accept/long-path/spoofed-loopback), captures per-probe status/content-type/body-fingerprint + 25-pattern leak-signal catalog (Python/JS/PHP/Ruby stack traces, framework versions, internal IPs, filesystem paths, SQL syntax errors, db bran

Paid composite AI-agent friendliness score — rolls up 9 AI-relevant discovery surfaces (llms.txt + llms-full.txt + sitemap.xml + RSS/Atom + robots.txt AI-bot allow-rate + openapi.json + webmanifest + .well-known/agents.txt + security.txt), per-surface status+size+points + composite agent_friendly_score 0-100 A-F + agent_friendly bool + top_recommendations[] for the surfaces with 0 points via x402

Paid deep HTTP header policy audit — 30+ headers across 12 groups: CSP (Content-Security-Policy + Report-Only) + HSTS (max-age + includeSubDomains) + COOP/COEP/CORP/Origin-Agent-Cluster + Permissions-Policy (feature list parsing) + X-Frame-Options + X-Content-Type-Options + Referrer-Policy + Cache-Control + Clear-Site-Data + X-DNS-Prefetch-Control + X-Download-Options + X-Permitted-Cross-Domain-Po

Paid CDN edge-coverage audit — 5 anycast probe points (Cloudflare/Google/Quad9/OpenDNS/CIRA), per-tenant reachability + edge diversity + PoP region detection + cdn_coverage_score A-F grade via x402

Paid SRI readiness audit - probes every <script src=...> tag on a page, classifies each as same-origin vs third-party, checks for presence of integrity= + crossorigin= attributes, HEAD-probes each script for reachability + content-type + cache-control, returns per-script status + composite sri_readiness_score 0-100 A-F + unprotected_third_party_script_count + recommendations for adding integrity a

Paid redirect-chain map (cycle 95) — follows 3xx chain up to 15 hops without auto-follow (custom HTTPRedirectHandler); per-hop status+location+scheme_change+latency_ms+content_length; detects redirect loops, cross-domain hops, https-downgrade; returns redirect_map_score 0-100 A-F + chain[] + loop_detected + final_url + cross_domain_hops + https_downgraded via x402

Paid llms.txt grader (cycle 95) — probes /llms.txt + /llms-full.txt + /agents.txt per Answer.AI proposed LLM-discovery spec; parses H1 + blockquote summary + markdown list of [Name](URL): description; validates per-line format; HEAD-probes each link (max 25) for reachability; returns llms_txt_score 0-100 A-F + section_presence map + link_count + dead_link_count + recommendations via x402

Paid CSP report-uri/report-to endpoint probe — extracts report-uri + report-to from CSP header + Reporting-Endpoints header lookup, then POSTs a synthetic csp-report payload to each declared endpoint to verify reachability + Content-Type acceptance + auth-gating + latency; returns per-probe status+content_type+accepts_csp_report bool + csp_report_score 0-100 A-F grade via x402

Paid /.well-known/* inventory probe - enumerates 30 standard + proposed well-known paths (security.txt RFC 9116 + openid-configuration + webfinger + nodeinfo + agents.txt + llms.txt + llms-full.txt + apple-app-site-association + assetlinks.json + openid-federation + oauth-authorization-server + manifest.json + ...), probes each at both /.well-known/<path> AND /<path> fallbacks, returns per-path fo

Paid CAPTCHA + bot-management vendor detection (cycle 94) — page-level fingerprint of 11 vendors (reCAPTCHA v2/v3/enterprise + hCaptcha + Cloudflare Turnstile + Cloudflare challenge page + Arkose Labs + GeeTest + DataDome + HUMAN/PerimeterX + Akamai Bot Manager) + 6 challenge-page indicators + bot-management cookies; returns captcha_vendors + bot_managers + challenge_page_indicators + is_protected

Paid agent cost calculator — detects auth scheme (Bearer/ApiKey/session_cookie/none) + rate-limit headers + CORS policy + cache max-age + compression + paid-API indicators (Stripe/Gumroad/pricing/checkout); returns estimated_cost_per_call_usd (free/low/medium/high) + agent_cost_score 0-100 A-F + findings[] via x402

Paid hreflang <-> sitemap.xml cross-validator (cycle 94) — extracts page hreflang tags, validates BCP47 + self-reference + x-default + canonical agreement, locates sitemap (sitemap.xml + sitemap_index.xml + robots.txt Sitemap:), extracts URL set + xhtml:link hreflang inside, HEAD-probes declared hreflang targets, detects 7 mismatch types (page_not_in_sitemap + hreflang_url_not_in_sitemap + invalid

Paid page-archaeology — detects parked domains, thin content, stale copyright (>5y), auto-generated patterns, missing author bylines; returns is_parked + is_thin + is_stale + classification (human_curated/auto_generated/parked/thin/stale/unknown) + page_archaeology_score 0-100 A-F + findings[] via x402

Paid API-freshness probe (cycle 96) — HEAD-probes 10 conventional health/version endpoints (/health, /healthz, /ready, /readyz, /livez, /api/health, /api/version, /api/status, /api/ping, /api/info); per-probe status + latency_ms + content_type; attempts to extract version_hint from /api/version JSON; returns api_freshness_score 0-100 A-F + alive_count + findings[] via x402

Paid multi-formula readability analysis — 5 formulas (Flesch Reading Ease + Flesch-Kincaid Grade + Gunning Fog + Coleman-Liau + SMOG) computed from extracted main-content text, returns main_text_preview + word/sentence/syllable/character counts + complex_word_pct + avg_words_per_sentence + target_audience_verdict (child/middle_school/high_school/undergraduate/graduate/academic) + reading_time_minu

Paid DNT/GPC policy probe (cycle 96) — fetches target URL 3x (baseline, with DNT:1, with Sec-GPC:1); compares Set-Cookie count + body size to detect server-side honoring of privacy signals; probes 5 common privacy-policy paths for DNT/GPC keyword mentions; returns dnt{cookies,echoed,reduced} + gpc{cookies,echoed,reduced} + privacy_policy{reachable,mentions_dnt,mentions_gpc} + policy_score 0-100 A-

Paid Client Hints + Permissions-Policy probe (cycle 97) — captures Accept-CH (RFC 7231 §5.3.7) + Critical-CH (RFC 9981) request lines for Server Hints, parses Permissions-Policy header for feature gating intent; per-hint high_entropy flag for W3C high-entropy identifiers; requested_hints[] + requested_permissions[] + hint_count + critical_hint_count + permission_count + entropy_score 0-10 + finger

Paid mixed-content body scanner (cycle 97) — parses HTML body for http:// subresources on https:// pages across 12 element types (img/script/link/iframe/source/object/embed/video/audio/form + CSS url() + inline event handlers); per-type count + sample URLs + total_mixed_content_count + blocked_active_count + total_http_link_count; mixed_content_score 0-100 A-F grade + findings[] via x402

Paid RFC822 email-header forensics (cycle 101) — POST text/plain raw email source OR pass ?header=<RFC822> (256KB cap); folds continuation lines, parses per-Received hop (from/by/with-protocol/id/for-address/ips/delay/timestamp), extracts Authentication-Results per RFC 7601 (spf/dkim/dmarc/arc/bimi/iprev/smtp.tls verdicts), DKIM-Signature tag parse per RFC 6376, ARC chain instance counter + cv= ch

Paid OpenAPI/Swagger/AsyncAPI/GraphQL/Postman/JSON-Schema spec format + version detector (cycle 98) — probes 9 conventional spec paths (/openapi.json + /openapi.yaml + /swagger.json + /swagger.yaml + /.well-known/openapi.json + /api/openapi.json + /v1/2/3/openapi.json), detects format (openapi-3.x / swagger-2.0 / asyncapi-2.x / graphql-sdl / postman-2.1 / insomnia-4 / json-schema / api-blueprint)

Paid subdomain-takeover risk audit (cycle 100) — discovers subdomains via HackerTarget hostsearch, resolves CNAME chain (max 8 hops) via Cloudflare DoH, fingerprints 30+ known-vulnerable service providers (AWS S3, CloudFront, Elastic Beanstalk, Heroku, GitHub Pages, Azure Web Apps, Shopify, Fastly, Pantheon, Tumblr, WordPress.com, Zendesk, HelpScout, StatusPage, UserVoice, Webflow, Mashery, Netlif

Paid prompt-safe URL preview (cycle 99) — fetches a URL and returns a plain-text preview with ALL scripts/styles/iframes/objects/embeds/event-handlers/javascript:-URLs/data:-URLs STRIPPED before text extraction; reports stripped_counts{scripts/styles/iframes/event_handlers/hidden_inputs/forms}, risk_flags[] (meta_refresh_redirect/form_with_external_action/open_redirect_link/iframe_with_srcdoc/nosc

Paid full HTTP response header inventory (cycle 99) — DUMPS every response header and classifies each into 5 categories (security / caching / cors / content-negotiation / custom-vendor-prefixed); reports legacy_disclosure_count (Server/X-Powered-By/X-AspNet-Version/etc.), custom_vendor_prefixes[] (X-Amz-*/X-Vercel-*/X-Cloudflare-*/X-CF-*/X-FB-*/X-Google-*/X-Akamai-*/etc.), duplicates[] (Set-Cookie

Paid bulk-sender email-deliverability verdict (cycle 100) — composes MX + SPF + DKIM + DMARC + MTA-STS + TLS-RPT + provider fingerprint into a single 0-100 deliverability score with A-F grade and findings[]. Different from /api/dns-all (raw records) and /api/email-auth-rollup (auth-only): this returns a deliverability VERDICT aimed at senders who need to know whether mail from the target domain wi

Paid SVCB/HTTPSSVC (RFC 9460+9461) deep parser (cycle 170, x402 $0.001) - probes 11 conventional _<port>._<proto>.<domain> SVCB endpoints (_443._tcp + _443._tcp.www + _443._tcp.api + _80._tcp + _25._tcp + _587._tcp + _853._tcp + _8443._tcp + _4433._tcp + _5223._tcp + _596._tcp) via Cloudflare DoH type=64 (SVCB) and type=65 (HTTPSSVC). For each endpoint parses RFC 9460 §6 SvcParams (alpn / port / i

Paid CSP violation-report ROUND-TRIP replay (cycle 170, x402 $0.001) - fetches target page; extracts CSP header + meta CSP + Reporting-Endpoints header + report-uri + report-to group; for each declared endpoint REPLAYS 4 violation scenarios (script_violation + style_violation + connect_violation + img_violation) by POSTing authentic application/csp-report payloads with realistic blocked_url / disp

Paid x402 discovery-list topology auditor (cycle 172, x402 $0.001) - accepts ?url=<X402_CATALOG_URL> (defaults to our own /.well-known/x402); fetches target catalog (handles 5 schema variants: endpoints[] / agents[] / items[] / routes[] / bare-list); normalizes every endpoint as a graph node with path / method / price_usd / pay_to / asset / network attributes; computes payTo-concentration top-1 sh

Paid RPKI Route Origin Validation (ROV) auditor per RFC 6811 (cycle 172, x402 $0.001) - accepts ?prefix=<CIDR> [auto-resolves announcing ASN via RIPEstat prefix-overview] OR ?prefix=<CIDR>&asn=ASxxxx OR ?asn=ASxxxx; calls RIPEstat rpki-validation endpoint (Routinator validator on RIPE NCC) which returns the canonical RPKI validity state per RFC 6811 §3 (valid / invalid_asn / invalid_length / not_f

Paid x402 seller leaderboard / ranking auditor (cycle 173, x402 $0.001) - accepts ?url=<X402_CATALOG_URL> (defaults to our /.well-known/x402) + ?top=<N> (default 25, max 100); clusters all payable endpoints by payTo, computes per-seller leaderboard_score 0-100 A-F = endpoint_count*5cap25 + diversity(network*3 + asset*3 + facilitator*3 + method*2)cap25 + has_post(5) + price_diversity(10) + descript

Paid JWKS (RFC 7517 + RFC 8414) JWK Set inspector (cycle 173, x402 $0.001) - accepts ?jwks_url=<URL> OR ?jwks=<JWK_SET_JSON> OR ?url=<PAGE> (auto-discovers jwks_uri via /.well-known/openid-configuration + /.well-known/oauth-authorization-server or probes /.well-known/jwks.json + /jwks.json); per-key classification (kty/alg/use/kid/crv/x5c), RFC 7638 JWK thumbprint SHA-256 dedup, algorithm-strength

Paid DNS SRV (RFC 2782) record mapper + service-discovery auditor (cycle 174, x402 $0.001) - accepts ?domain=<DOMAIN> + ?service=<SVC> + ?proto=<tcp|udp|tls> OR shorthand ?q=<SVC>.<PROTO>.<DOMAIN>; actively probes Cloudflare DoH for type=SRV at the constructed name; when ?service= is omitted auto-probes 4 common templates (_sip._tcp + _xmpp-client._tcp + _minecraft._tcp + _caldav._tcp); parses RFC

Paid MTA-STS (RFC 8461) policy+record cross-validator (cycle 174, x402 $0.001) - accepts ?domain=<DOMAIN>; actively probes _mta-sts.<domain> TXT (RFC 8461 SS3.1) via DoH + https://mta-sts.<domain>/.well-known/mta-sts.txt (RFC 8461 SS3.2) + live MX records via DoH type=MX; cross-validates: TXT id == policy file id; live MX matches at least one policy mx pattern (with *. wildcard + *.<domain> suffix

Paid META-API cost projector for THIS service (cycle 98) — given calls_per_day + route list (or "all") + period (daily|weekly|monthly), pulls the live x402 price catalog and projects aggregate_daily_cost_usd + aggregate_weekly + aggregate_monthly + aggregate_yearly + period_total; returns per-route cost breakdown + cheapest_route + most_expensive_route + verdict (pennies/affordable/moderate/expens

Paid RFC 8460 SMTP TLS-RPT (TLS Reporting) report parser (cycle 178, x402 $0.001) - accepts POST application/json {'report':<RFC 8460 JSON object>} OR POST application/json {'report_text':<JSON string>} OR GET ?report=<urlencoded JSON> OR GET ?report_b64=<base64(JSON)> OR GET ?sample=ok|critical (built-in fixtures for testing); extracts per-policy-block {policy_domain, policy_type, policy_string,

Paid DNS CNAME chain tracer (cycle 175, x402 $0.001) - accepts ?host=<HOST> OR ?domain=<HOST> OR ?url=<URL>; actively follows CNAME + A/AAAA hops via Cloudflare DoH for the target host (up to 12 hops with loop detection); returns chain_depth + hops[] (per-hop {hop, name, type CNAME|A|AAAA|NXDOMAIN|LOOP, data, ttl}) + final_a_records + cdn_detected[] (28 known CDN-suffix fingerprints: Cloudflare/Cl

Paid CSP per-directive source-list extraction + classification (cycle 176, x402 $0.001) - accepts GET ?url=<URL> OR POST application/json {'url':...}; fetches target page; extracts CSP header + meta CSP fallback; tokenizes every directive; classifies every atom into 18 categories (wildcard/self/unsafe-inline/unsafe-eval/wasm-unsafe-eval/unsafe-hash/strict-dynamic/report-sample/inline-speculation-r

Paid AI-agent cost-trend analyzer + multi-target batch estimator (cycle 178, x402 $0.001) - accepts POST application/json {'targets':[{'url':...,'weight':..}, ...]} OR POST application/json {'urls':[...],'weighting':'equal|price'} OR POST application/json {'url':...} (single) OR GET ?urls=u1,u2,u3 OR GET ?sample=3|5 (built-in test URLs); per-target parallel probes (HEAD + 10-path surface check via

Paid HTTP/3 QPACK (RFC 9204) encoder-pattern fingerprint probe (cycle 179, x402 $0.001) - accepts GET ?host=<HOST> (default www.cloudflare.com) OR POST application/json {'host':...,'force_quic':...}; fetches https://<host>/ via urllib over TCP+TLS first to extract Alt-Svc header h3 advertisement (RFC 7838) + parse max-age; then reports a canonical QPACK encoder-field-block representation (3 indexe

Paid open-source LICENSE evolution / migration analyzer (cycle 179, x402 $0.001) - accepts GET ?repo=<ORG>/<REPO> (e.g. elasticsearch/elasticsearch) OR ?url=https://github.com/<...> OR ?package=<NPM-PKG-NAME> (resolves npm registry license metadata) OR ?sample=redis|elasticsearch|mongodb|hashicorp_vault|react|tensorflow|gpl_oldschool|agpl_sample (built-in famous-migration fixtures). For github rep

Paid Model Context Protocol (MCP) server discovery (cycle 103) — fetches a target's MCP descriptor from 6 candidate paths (/.well-known/mcp.json, /mcp.json, /.well-known/model-context-protocol.json, /model-context-protocol.json, /mcp-server.json, /.well-known/ai-plugin.json); validates the schema per the MCP 2025-06-18 spec draft; extracts capabilities{tools, resources, prompts, sampling, roots};

Paid llms.txt provenance / author fingerprint (cycle 102) — extracts H1 + byline + contact emails + @-handles from llms.txt body, cross-references the same email against /.well-known/security.txt Contact: field (RFC 9116), probes default._domainkey.<domain> DKIM TXT record, distinguishes generic H1 ("llms.txt" alone, raw domain) from real organization claim. Returns author_confidence 0-100 (cross_

Paid x402 SELLER probe (cycle 102) — fetches a target domain's /.well-known/x402 discovery doc, parses several schema variants (object.endpoints / object.items / object.routes / bare-list / line-delimited), returns raw_endpoint_count + endpoints[] (capped at 50) + price_range_usdc {min, max, median, mean} + price_histogram_usdc (4 buckets) + unique_payTo_count (catalog-ownership-concentration prox

Paid live QUIC (HTTP/3) handshake probe (cycle 101) — actively opens UDP/443 QUIC Initial packets to the resolved A/AAAA, tests 10 candidate versions (draft-29/30/31/32/33/34 + h3 + h3-Q050 + v2); parses server reply to detect Retry packets, Handshake packets, Version Negotiation; reports per-version RTT, server_replied, supported_versions[], handshake_rtt_ms, zero_rtt_supported, retry_required, p

Paid BIMI (Brand Indicators for Message Identification) + VMC (Verified Mark Certificate) validator (cycle 105) — probes default._bimi.<domain> TXT per RFC 8848; parses v=BIMI1; l=<SVG URL>; a=<VMC URL>; s=<selector>; HEAD-probes SVG (must be image/svg+xml + <512KB) and VMC (must be application/pkcs7-mime or PEM); parses VMC X.509 via cryptography; verifies chain to public CA via truststore + Vali