Security x402 offerings

Current TLS certificates for a domain from Certificate Transparency logs (via CertSpotter): issuer, validity dates and days left, DNS names (up to 100 per certificate), and the distinct subdomains seen. Keyless tier: one request per call; answers are cached an hour.

Fetches a site's security.txt from /.well-known/security.txt (fallback /security.txt) and parses the RFC 9116 fields: contacts, expiry (and whether it has expired), encryption, policy, acknowledgments, languages, canonical, hiring. Reports whether it is PGP-signed and lists RFC problems found. Public http(s) hosts only.

Generates lookalike domains of a brand (omission, transposition, repetition, bit-flip, homoglyph, vowel swap, hyphenation, TLD swap; technique list after dnstwist), checks up to 30 of them in DNS (A records), and reads MX records for up to 8 that resolve. Resolving in DNS is not proof of registration or abuse.

Mail and DNS hygiene of a domain over DNS over HTTPS: A, AAAA, MX, NS, TXT and CAA records; SPF parsed (mechanisms, the all qualifier, a lookup estimate, a warning above 10 lookups); the DMARC policy; DKIM keys under common selectors; MTA-STS, TLS-RPT and BIMI; an issues list and a mail grade from A to F.

TLS certificate expiry for up to 10 hostnames: the issuer, validity dates, days left, all DNS names and a status (ok, expiring within 14 days, expired, none found). Read from Certificate Transparency logs (CertSpotter, crt.sh as fallback), so it is the newest valid certificate issued for each name, not the one the server presents; the answer also says whether https answers and its HSTS header. Public hostnames only.

Hashes of a text or base64 input (up to 1 MB): MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC-32, and HMAC-SHA-256 or HMAC-SHA-512 when a key is given. Hex and base64 output. MD5 and CRC-32 are implemented here and checked against RFC 1321 and the standard CRC test vector. Body { input, encoding, algorithms, key }. Pure code and WebCrypto, no outside request.

Who owns an IP address: network name, CIDR, owner, abuse contact (RDAP), ASN and holder (RIPEstat), and reverse DNS. Private, reserved and documentation addresses are refused with 400. Public registry data only.

Identifiers and secrets from the Web Crypto random source: UUID v4 and v7, ULID, nanoid (size and alphabet), random passwords (length and character classes) and passphrases (words from the EFF large wordlist, CC BY 3.0 US), up to 100 per call. mode=parse validates a UUID or ULID and reports its version, variant and the time embedded in v1, v6, v7 and ULID. Nothing is stored.

E-mail pre-check without SMTP: syntax, whether the domain can receive mail (MX or implicit MX, null MX, non-existent domain), disposable domain (9,000+ domain CC0 list), role account (info@, sales@...), free provider and a typo suggestion (gmial.com -> gmail.com). Verdict invalid / risky / unknown. Up to 50 addresses per call with emails=.

Known vulnerabilities of one package version in the OSV database: npm, PyPI, crates.io, Go or Maven. Each advisory has its id, CVE aliases, summary, severity, fixed versions and a link. The count is the full number; up to 20 are listed.

Security headers of a URL's final response: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options (or CSP frame-ancestors), X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy, each with present, value, ok and advice. Also cookies missing Secure, HttpOnly or SameSite (names only), version leaks in Server or X-Powered-By, and a grade from A to F.

Decodes a JWT (up to 16 KB): header, payload, registered claims as ISO dates, expired and not-yet-valid flags, algorithm and signature length. With jwksUrl (public https) the signature is checked with WebCrypto for RS, PS and ES algorithms against the matching key. 'none' is never accepted; HMAC needs the secret. Tokens are secrets: this tool does not store or log them.

Safety check of a text or a chat turn with Llama Guard 3: safe or unsafe, and the violated categories (S1 to S14, named in plain words). Send text, or messages (up to 20 turns). Classifies only; it does not change or block anything.

Third-party script and iframe hosts on a page, each classified (analytics, ads, tag manager, chat, session replay, social, consent, CDN), the cookies its first response sets (names and flags only, never values) and whether a known consent manager is present. Static HTML only: scripts added at run time are not seen.

Replaces personal data in a text with placeholders: e-mail addresses, phone numbers, IBANs (mod 97 checked), payment card numbers (Luhn checked only), IPv4 addresses and, with names true, person names found by the chat model. Returns the redacted text and counts per type. Original values are never returned.

Audit text for malicious AI-skill patterns. Requires `content`. Nothing to audit — crawling, or discovering this endpoint cold? POST /audit/registry runs the same scanner over the newest servers in the official MCP registry: no input required, $0.005.

Scan the newest servers in the official MCP registry for supply-chain risk — no input required

Fetch a URL and audit its content. Requires `url`. No URL to hand? POST /audit/registry runs the same scanner over the newest servers in the official MCP registry: no input required, $0.005.

Vet an x402 server or any URL for scam/phishing/trust in ONE call: transport, content-safety, domain, metadata + x402-compliance sub-scores, each with transparent evidence

Fetch a URL and grade its HTTP security headers (HSTS, CSP, X-Frame-Options, etc.)

Scan an entire public GitHub repo for malicious AI-skill/supply-chain patterns. Requires `repo`. No repo in mind? POST /audit/registry runs this same scanner over the newest servers in the official MCP registry: no input required, $0.005.

Is this domain legitimate? WHOIS age, DNS resolution, scam/phishing search results, and HTTP headers for a quick trust assessment. Brand protection skill pack: one x402 payment runs 4 underlying tools (whois, dns-lookup, search, http-headers); partial-success per step.

What's a competitor using? Tech stack, HTTP headers, WHOIS, and page metadata in one call. Competitor scan skill pack: one x402 payment runs 4 underlying tools (tech-stack, http-headers, whois, meta); partial-success per step.

Verify an email address is deliverable - syntax validation plus MX record check on the domain. Contact verification skill pack: one x402 payment runs 3 underlying tools (email-validate, dns-lookup, spf-check); partial-success per step.