Security x402 offerings

Silicon DNA agent identity classification. Behavioral timing analysis: CPU jitter entropy (L0), Shannon entropy (L2), Spearman rank correlation (L3) to classify as HUMAN, LEGIT_AGENT, MALICIOUS_BOT, SYBIL, or UNKNOWN (no evidence either way). Per paper Section 5.1.

SHA-256 hash generator API. Computes the SHA-256 hex digest of any text. Deterministic and instant — an LLM cannot reliably compute real cryptographic hashes on its own.

Decodes (does not verify) a JWT by base64url-decoding its header and payload segments. Signature validity is never checked — do not use this to authenticate a token.

MD5 hash generator API. Computes the MD5 hex digest of any text. Deterministic and instant — an LLM cannot reliably compute real cryptographic hashes on its own.

Secure password generator API. Generates a cryptographically random password — true randomness an LLM cannot produce on its own. Accepts optional length (8-128), per-character-class toggles (uppercase/lowercase/numbers/symbols) with guaranteed inclusion, and a pronounceable easy-to-say mode.

Watchlist renewal: extend an existing company monitoring watchlist by 30, 90 or 365 days (?duree=, default 30, any duration whatever the original) of daily surveillance against official sources — $0.05 / $0.135 / $0.50 per target. The cibles parameter must repeat the exact watched targets: it is what the quote is computed from. Possible until 7 days after expiry, then the watch is purged. No refund, no pro rata.

Full site quality audit across SEO (titles, descriptions, canonical, Open Graph, JSON-LD…), accessibility (alt text, form labels, heading order, landmarks…) and security headers (HSTS, CSP, XCTO…) — scored 0-100 per section with a copy-paste fix for every finding. $5 per audit. Fetch-based (served HTML; SPA shells noted). The agent-readiness scan is separate and free at /api/x402/deep-scan.

Returns a trust score or assessment for a website.

Does https://<domain>/admin/ exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. An exposed admin/ is a security finding. $0.01 per check.

Does https://<domain>/apple-touch-icon.png exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. Presence of apple-touch-icon.png tells you about the site's tooling and policies. $0.01 per check.

Does https://<domain>/composer.json exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. An exposed composer.json is a security finding. $0.01 per check.

Does https://<domain>/crossdomain.xml exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. Presence of crossdomain.xml tells you about the site's tooling and policies. $0.01 per check.

Does https://<domain>/.DS_Store exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. An exposed .DS_Store is a security finding. $0.01 per check.

Does https://<domain>/.env exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. An exposed .env is a security finding. $0.01 per check.

Does https://<domain>/.git/HEAD exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. An exposed .git/HEAD is a security finding. $0.01 per check.

Does https://<domain>/keybase.txt exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. Presence of keybase.txt tells you about the site's tooling and policies. $0.01 per check.

Does https://<domain>/package.json exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. An exposed package.json is a security finding. $0.01 per check.

Does https://<domain>/phpinfo.php exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. An exposed phpinfo.php is a security finding. $0.01 per check.

Does https://<domain>/robots.txt exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. Presence of robots.txt tells you about the site's tooling and policies. $0.01 per check.

Does https://<domain>/security.txt exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. Presence of security.txt tells you about the site's tooling and policies. $0.01 per check.

Change watch for site has security txt: runs the check, compares it with the result from your previous call for the same domain (kept 90 days) and returns the current answer, changed true/false, the fields that changed with before/after values, and when it was last seen. Schedule it to be alerted when this changes. $0.02 per check.

Does https://<domain>/server-status exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. An exposed server-status is a security finding. $0.01 per check.

Does https://<domain>/.well-known/acme-challenge/ exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. Presence of .well-known/acme-challenge/ tells you about the site's tooling and policies. $0.01 per check.

Does https://<domain>/.well-known/agent-card.json exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. Presence of .well-known/agent-card.json tells you about the site's tooling and policies. $0.01 per check.