Security x402 offerings

Domain security check: SSL certificate, DMARC/SPF, DNSSEC, security headers and blocklist status with a score

IP reputation check: is this IPv4 address on a public threat blocklist (Tor exit nodes, botnets, spam networks)

Wallet address risk check: sanctioned address and phishing check for a crypto wallet or contract before you send funds, with theft, scam, mixer and blacklist flags

Extract up to 200 normalized safe links. Only public HTTP(S) targets are accepted; JavaScript is not executed. Pass url as an absolute public HTTP(S) URL. Keep fresh=false to reuse cache; set fresh=t…

Check a public HTTP or HTTPS URL before expensive browsing or AI processing. Returns availability, redirects, content type, page metadata, language, cache state, content hash, robots policy, and acce…

Compare a public HTTP or HTTPS URL with its previously stored normalized content hash. Creates a baseline on first use, then reports whether content changed and returns current and previous hashes wi…

Report heuristic authentication, paywall and JavaScript access flags. Only public HTTP(S) targets are accepted; JavaScript is not executed. Pass url as an absolute public HTTP(S) URL. Keep fresh=fals…

Fetch bounded public security.txt text without following contacts. Only public HTTP(S) targets are accepted; JavaScript is not executed. Pass url as an absolute public HTTP(S) URL. Keep fresh=false t…

Report the robots.txt policy decision applied to the requested URL. Only public HTTP(S) targets are accepted; JavaScript is not executed. Pass url as an absolute public HTTP(S) URL. Keep fresh=false …

Return the safely validated redirect chain. Only public HTTP(S) targets are accepted; JavaScript is not executed. Pass url as an absolute public HTTP(S) URL. Keep fresh=false to reuse cache; set fres…

Compute a versioned SHA-256 of normalized content. Only public HTTP(S) targets are accepted; JavaScript is not executed. Pass url as an absolute public HTTP(S) URL. Keep fresh=false to reuse cache; s…

Use when an agent must vet or research a website in one call (lead research, security or SEO check, is this site legit). Input: url or bare domain. Output: JSON page metadata, HTTP status, HTTPS and HTTP-to-HTTPS redirect, server and hosting hints, 7 security headers, robots.txt (sitemaps, AI-crawler rules), llms.txt presence, plus domain DNS, mail provider, SPF/DMARC and RDAP registrar, age and expiry. Example: ?url=stripe.com

TLD registry intelligence and public-suffix analysis. Mode 1 (tld=io): IANA root-zone metadata — type (generic / country-code / sponsored), managing organization, unicode form for IDN TLDs. Mode 2 (domain=shop.example.co.uk): full Public Suffix List algorithm — the effective public suffix (co.uk), the registrable domain (example.co.uk), the subdomain part, the matched PSL rule, and whether the suffix is ICANN (registry) or private (corporate, e.g. github.io / s3.amazonaws.com) — plus the root-zone metadata for its TLD. Correctly handles wildcard and exception rules and IDN/punycode input. Use for cookie scoping, per-registrant rate limiting, URL dedup, and abuse/phishing analysis. Data: IANA root zone + Mozilla PSL, refreshed weekly.

Fetch a URL and grade its HTTP security headers. Pass url (scheme optional — defaults to https). Returns an overall letter grade + score, the list of present/missing headers, and a per-header analysis with the live value and specific issues for: Strict-Transport-Security (HSTS max-age/includeSubDomains), Content-Security-Policy (flags 'unsafe-inline'/'unsafe-eval'/missing default-src), X-Frame-Options or CSP frame-ancestors (clickjacking), X-Content-Type-Options (nosniff), Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener/Resource-Policy. Also flags Server/X-Powered-By info disclosure. Analyzed from the target's LIVE response headers through an SSRF-guarded fetch (private/loopback targets refused) — an LLM cannot see a site's current headers. For web-app security review, vendor assessment, and CI gates.

Multi-source IP reputation with one combined authority score (0-100). Polls four independent reputation sources in parallel and blends them: AbuseIPDB (crowd-sourced abuse confidence), abuse.ch threat-lists (Feodo botnet C2 + ThreatFox + Spamhaus DROP + Tor exit nodes), blocklist.de (fail2ban attack-report network), and StopForumSpam. Returns combinedScore, a verdict (clean / low / suspicious / malicious), which sources flagged it, per-source opinions (score + weight + detail), and enrichment (ISP, usage type, country, ASN, Tor). An authoritative threat-list hit (botnet/malware/hijacked netblock) hard-floors the verdict at malicious. Per-source isolation: a down feed degrades that opinion only. The one-call answer for 'should I trust this IP?' instead of trusting a single feed.

Resolve a single IPv4/IPv6 address to its full network identity in one call: the Autonomous System number, the authoritative AS holder/operator (RIPEstat), the ISP + organization, whether the AS is currently announced, the RIR/IANA allocation block the AS sits in, and country/region/city + coordinates + timezone. One join that turns an IP into "who runs this network and where" -- the lookup network-forensics, abuse triage, and fraud agents otherwise stitch together from a geo API plus a separate BGP source. Composes geo IP data + RIPEstat (RIPE NCC, CC BY 4.0); the routing/holder block degrades independently, with per-source status returned. Distinct from net.asn (AS-number first) and geo.ip (geo only): this is IP-first and joins both.

Grade a domain's email-authentication and DNS-security posture from live DNS in one call: SPF, DMARC (policy + alignment), DKIM (for the supplied or common selectors), MTA-STS, TLS-RPT, DNSSEC, CAA, and BIMI. Pass domain (and optional dkimSelector). Returns an overall letter grade, a summary (spf/dmarcPolicy/dkim/mtaSts/dnssec/caa/bimi + spoofingProtected), and a per-mechanism block with the raw record, parsed tags, and specific issues (e.g. 'DMARC p=none — monitor only', 'SPF ~all soft-fail', 'no MTA-STS'). Sourced from live public DNS via DNS-over-HTTPS — an LLM cannot know a domain's current records. For deliverability/anti-spoofing audits, vendor security review, and phishing-resistance checks. DKIM is selector-based (selectors aren't enumerable), so 'not found' only means none of the checked selectors resolved.

Security and provenance for an open-source package, composed live from three authoritative sources in one call. Pass ecosystem (npm, pypi, go, maven, cargo, nuget) + name (+ optional version; defaults to latest). Returns: known vulnerabilities from OSV (osv.dev — aggregates GitHub Security Advisories, PyPA, RustSec, Go vuln DB, etc.) each with its id, CVE aliases, summary, severity, and references; the resolved license and deprecation status (deps.dev); and the source repo's OpenSSF Scorecard health score (overall + per-check) plus stars/forks/open-issues. All live — newly-disclosed advisories appear within hours. Distinct from registry.npm-lookup / pypi-lookup (metadata only): this answers "is this dependency safe to add, what license does it carry, and how well-maintained is it."

Cryptographically verifiable random integer generated from the public drand Quicknet randomness beacon. Choose inclusive min and max values. The response includes the drand round, randomness and signature so the result can be independently checked.

Bulk domain and company check: domain age, registrar and legitimacy for up to 5 business domains in one call. Screen a prospect or lead list, qualify companies before outreach, check vendor and supplier lists, or clear invoice batches. Same checks as /verify/business per domain (RDAP domain age, DNS, SPF/DMARC, HTTPS) with a verdict and 0-100 trust score each, as one ES256-signed attestation. Flat $0.15 per batch: 40% below the per-domain price of single calls at a full batch.

Is this company or domain legit? Business and domain verification (KYB) for vendor screening, supplier checks and scam or fraud review: domain age and registrar from RDAP, DNS (A/MX/NS), email security (SPF/DMARC) and HTTPS. Returns a verdict and a 0-100 trust score with evidence URLs, and flags newly registered or thin-infrastructure domains, a common scam signal. Use it before your agent pays an invoice, onboards a vendor or trusts a site. Signed attestation. Bulk: /verify/business/batch.

Is this company or domain legit? Business and domain verification (KYB) for vendor screening, supplier checks and scam or fraud review: domain age and registrar from RDAP, DNS (A/MX/NS), email securi…

Catalog snapshot: every site in the 402registry catalog of sites verified visible to AI crawlers, as one JSON file rendered at purchase, every record dated. Basic fields are free at https://402registry.com/registry.json; this adds per site the findings by name and severity, the stack, the title and what the crawler saw without JavaScript (AI bot status codes, robots, sitemap, llms.txt). No input: one GET, one payment, $0.005.

A pay / review / do-not-pay verdict before sending funds on base: contract-vs-wallet, funding, USDC balance, activity and risk, phrased as a decision an agent can act on. Optional ?amount=<usd> context.