Development x402 offerings

Compare two OpenAPI 3.x or Swagger 2.x documents and return a structured diff: added / removed / changed endpoints, with a conservative "is any change breaking?" flag. Breaking = an endpoint or required-2xx status was removed, a required parameter was added, an optional param became required, a param type changed, or a JSON body field became required. Pure CPU - deterministic, no network, no $ref dereferencing (resolve refs upstream if needed).

Inspects an OpenAPI spec and returns agent-readiness scores, risks, recommendations, and x402 Bazaar candidates.

Score an OpenAPI 3.x or Swagger 2.x spec on agent-readiness - i.e. does an LLM-driven caller have what it needs to call the API correctly without guessing. Returns a 0..100 score, severity counts, and a structured list of violations with stable rule codes. Checks: documented title/servers/paths, per-operation summary/description/operationId/tags, documented 2xx + error responses, param descriptions/schemas/examples, response descriptions, JSON response schemas.

Flatten an OpenAPI 3.x or Swagger 2.x spec into a structured list of callable endpoints - one row per operation with method, path, operationId, summary, tags, parameters (name / in / required / type), JSON-body flag, and documented response codes. Includes per-method and per-tag counts so an agent can pick what to call next without parsing the full spec. Output is sorted by path then method for stable, agent-friendly grouping. Pure CPU - deterministic, no network, no $ref dereferencing.

See which operations were added, removed, deprecated or renamed between two OpenAPI documents. Flags a removal that was never preceded by a deprecation, an operationId change that renames the method in every generated client, and a duplicated operationId that no generator can resolve.

Synthesize a JSON response body for one operation + status code in an OpenAPI 3.x or Swagger 2.x spec. Locate the operation by operationId or method+path. Pick the response by explicit `status`, else the first 2xx, else the first documented response. Generation precedence: operation-level `example`/`examples` > schema `example` > recursive type-inferred walk (objects walk properties, arrays return [mock(items)], enums return the first value, $ref is surfaced literally).

OpenAPI Operation Object From An Example Call — Writes one OpenAPI 3.1 operation object, as bare JSON, from an example request, an example response and rules given in words - parameters with the right location, requirement flag and type, a request body, and a response per status the person actually showed. Uses the 3.1 forms, not the 3.0 ones - a field that may be null is a type list with "null" (never nullable), a path parameter is always required, a status is a quoted key, an identifier writt…

Search operations in an OpenAPI 3.x or Swagger 2.x spec against a free-text query. Tokenizes the query (lowercase, alphanumeric runs), scores each operation by which fields the tokens match - operationId +3, path +3, tags +2, summary +2, description +1 per matched token - and returns ranked results with a `matches` array naming the contributing fields. Sort: score descending, then path ascending for stability. Limit defaults to 10 (max 100).

Validate a JSON payload against the request or response schema for one operation in an OpenAPI 3.x or Swagger 2.x spec. Locate the operation by operationId or method+path; choose `part: "request"` or `part: "response"` (status defaults to the first 2xx). Deterministic subset of JSON Schema: type, required, enum, properties, items, additionalProperties:false, oneOf/anyOf/allOf, $ref-detection (not dereferenced).

Audit a real request against the OpenAPI document it should satisfy. Matches the operation the way a router would, checks every path, query and header parameter against its declared schema, validates the body against the declared media type, and reports whether the credential the declared security scheme expects is present. You supply the request, so this works against an API nothing external can reach.

For one operation, return the minimum set of inputs an agent must provide to make a successful call. Locate the op by `operationId` (preferred) or by `method`+`path`. Output is a single flat array tagged by `in`: `path` (always required), `query` / `header` / `cookie` (only when `required: true`), and `body.field` entries naming the top-level required fields of a required JSON request body.

Audit a real response against what the OpenAPI document promises for that operation. Resolves the declared status exactly, by range such as 2XX, or through default, checks declared response headers are present, and validates the body against the declared schema for its media type. Catches an implementation that has drifted from its own published contract.

Resolve authentication requirements across an OpenAPI 3.x or Swagger 2.x document. Returns the catalog of security schemes (`components.securitySchemes` in OpenAPI 3, `securityDefinitions` in Swagger 2) verbatim, the document-level default, and the *effective* security for each operation after layering.

Shrink an OpenAPI 3.x or Swagger 2.x document for LLM context by stripping verbose meta-fields (examples, descriptions, summaries, tags, externalDocs, deprecated). Categories are explicit; default is `["examples", "descriptions"]`. User-defined property names under `properties: { ... }` are protected - only the meta-field `example` keyword inside a property schema is removed, not a user property literally named "example".

Fetch an OpenAPI/Swagger spec (JSON or YAML) and summarize it for an agent: title, version, servers, authentication schemes and every endpoint with method, path, summary and required parameters.

Build a runnable curl command for one operation in an OpenAPI 3.x or Swagger 2.x spec. Locate the operation by operationId (preferred) or by method + path, substitute path parameters using the spec's example values, include required query and header parameters with their example values, and attach a JSON body when the operation defines one. Returns the structured request (method, url, headers, body) alongside the assembled curl string with POSIX single-quote escaping.

Checks whether a domain is trustworthy enough to interact with by combining live DNS/TLS/HTTP header inspection, optional page-content analysis, and cached reputation lookups. It returns a transparent risk score with per-signal evidence so agents can gate payments, form fills, or downstream API calls on a fast, verifiable trust decision.

A lightweight, verifiable web search proxy that accepts a natural-language query and returns ranked, cited results. It is designed for agent-to-agent and x402-metered traffic: one paid call yields one clean search response with title, URL, snippet, and a stable rank. Use it when your agent needs cheap, low-latency public web search without managing multiple upstream providers. Requests are validated, executed against a real search backend, and normalized so downstream agents can parse, deduplica

Audit an agent-facing service for machine usability. Actually calls the endpoints: MCP (Streamable HTTP initialize + tools/list, schema checks), A2A agent card, x402 payment challenge, llms.txt, Open…

Turns a URL or topic into a field-by-field annotated walkthrough: it fetches the target (a receipt, an API flow, a board of criteria), identifies every element, and explains what each one is, who authored it, what it binds, and — wherever possible — performs the actual verification (recompute hashes, check sequences, compare timestamps, trace sources) rather than asserting it. Output is strict JSON: an ordered list of annotated blocks, each with the quoted element, its location/reference, a plai

Current npm package health snapshot: latest version and release age, weekly downloads, maintainer/dependency counts, license, deprecation, repository/homepage and deterministic maintenance-risk flags. Not a security audit.

Ranks packages with disclosed advisories, silent maintainers, and many dependents as orphan-patch candidates, deterministically, from public inputs alone.

Serialize a JSON value into a compact MessagePack or CBOR byte stream, returned as a base64 (default), base64url or hex string, along with the byte length.

Decode a MessagePack or CBOR byte stream (supplied as a base64/base64url/hex string) back into a JSON value. A malformed envelope, malformed bytes, or a value that is not JSON-representable is reject…