Browse indexable security x402 offerings, including provider, method, and service details.
4139 indexable offerings in this category.
Link safety check: is this URL malware or phishing? Checks Cloudflare's security DNS blocklist, domain age, look-alike and brand-impersonation tricks, shorteners and the redirect chain, then gives a verdict and risk score.
Check declared citation coverage of up to 64 claims against bounded source and locator inventories. Reject duplicate IDs and dangling references. Coverage is structural, not proof that a source supports a claim. New modular adapter: retained result recovery for 24 hours, minimal receipt metadata for 90 days. Existing live route unchanged.
Fingerprints a domain's cloud infrastructure — DNS records, HTTP headers, a TLS handshake and PTR lookups — to detect CDN, WAF, hosting, DNS and email provider, plus cert issuer/wildcard/SAN count, with confidence scores and a security grade (A–F). Hosts that resolve but answer nothing on 80/443 return http_reachable:false, score null and grade insufficient_data — never a grade inferred from an unanswered probe.
Cloudflare Evidence Check — Judges whether a check someone ran on a Cloudflare-hosted site really proves what they claim, and answers as JSON with a verdict, the reason and the one check that would decide. Knows the instruments that answer for the wrong thing - the command-line object read that serves a cached copy after a delete, a delivery log that records neither test mail, a zero-row log search that looks the same as code that never ran, a local migration run, a staging secret, the free pre…
Cloudflare Rate Limit Review: WAF, Workers, 429 — Reviews a rate-limiting setup on Cloudflare (a WAF rate limiting rule, a Workers Rate Limiting binding, or a counter in your own code) and lists every reason it will not limit what its author thinks it limits. It flags free-plan rules that use the client address or a header field, which the plan refuses, windows the plan does not offer, an address key for callers that are themselves Workers and share one outbound address, a binding number treate…
Inspect the site's TLS/SSL certificate: whether it is currently valid and how many days remain until it expires. Use to catch soon-to-expire or already-expired certificates before they break HTTPS for visitors.
Resolve the site's IP and check it against 15 major DNSBL spam/abuse blacklists. Use before sending mail from, or trusting, a host. WARN = listed on 1–2 lists; DOWN = listed on 3 or more.
Revisión de seguridad de un paquete de ficheros (Python, web, JSON) sin ejecutar nada: importaciones y llamadas prohibidas, escritura, red y credenciales. Un tipo de fichero que el gate no sabe leer se declara como no verificable, no como aprobado.
Static application-security scan of a single code blob for CWE Top-25 logic bugs (SQL injection, XSS, command injection, SSRF, path traversal, insecure deserialization, weak crypto and more). Pass the code and its language; returns a verdict with per-finding CWE, severity and line. Static indicators, not a guarantee.
Static application-security scan of a single code blob for CWE Top-25 logic bugs (SQL injection, XSS, command injection, SSRF, path traversal, insecure deserialization, weak crypto and more). Pass the code and its language; returns a verdict with per-finding CWE, severity and line. Static indicators, not a guarantee.
Static application-security scan of source code or a git-diff for CWE Top-25 logic bugs: SQL injection, XSS, command injection, code and template injection, SSRF, path traversal, insecure deserialization, weak crypto, insecure randomness, open redirect and XXE across Python, JavaScript, TypeScript, Java and Go. Returns a go/no-go verdict with per-finding CWE, severity, file and line. Static indicators, not a guarantee.
Static application-security scan of source code or a git-diff for CWE Top-25 logic bugs: SQL injection, XSS, command injection, code and template injection, SSRF, path traversal, insecure deserialization, weak crypto, insecure randomness, open redirect and XXE across Python, JavaScript, TypeScript, Java and Go. Returns a go/no-go verdict with per-finding CWE, severity, file and line. Static indicators, not a guarantee.
Offline deterministic checks (no ML, no scraping) for business identifiers and rental due-diligence, paid per call via x402 (gasless EIP-3009 USDC on Base). Checksum-verifiable (IBAN, LEI, VAT, ABA, ISBN, SEDOL…) vs format-only (EIN, IFSC, SWIFT/BIC…) — every response returns a scope field. Non-custodial, signed receipts. First 3 calls/day free.
Package security scanner — CVEs, license check, typosquat detection.
Queries target URL headers to score security configurations (HSTS, CSP, X-Frame-Options).
Queries target URL headers to score security configurations (HSTS, CSP, X-Frame-Options).
Check an email address: RFC syntax, live MX records via DNS-over-HTTPS, and disposable-domain screening. POST { email } or { emails: [...] } (max 20).
Is it real or fake? Collectible authentication & counterfeit check for autographs, memorabilia, watches, cards and art. Returns red flags for fakes, trusted authentication services, DIY verification checks, and how to buy safely for any collectible. Worldwide. For collector and investor agents.
Provenance & ownership history check: research the chain of ownership, Art Loss Register / stolen-art checks, and authenticity documentation for art, antiques and memorabilia. Worldwide. For collector and appraiser agents.
Company verification and legitimacy score: checks whether a company or organization is real and returns a 0-99 legitimacy score with AI-generated reasoning. For KYB, vendor and supplier onboarding, fraud prevention, and B2B signup screening.
Screen a website URL or domain against OFAC SDN and other global sanctions lists. Call before paying, advertising on, or integrating with a website to check for sanctions associations. Returns per-list matches with source URLs.
Review a built-in risky Docker Compose control-plane service for privileged execution, host namespaces, broad capabilities, an unconfined seccomp profile, literal environment secrets, a public Docker API port, a mounted runtime socket, missing limits, and mutable images without starting containers
Passive HTTP security header review for an authorized external target (no exploitation; platform hosts blocked)
Decode a JWT — parse header and payload claims without a key (no signature verification).