Vulnerability data, scanning and audit services. A listing here is not an endorsement of the scanner’s accuracy.
Website audit bundle for local business websites and lead qualification: performance (browser-measured), security headers and TLS, SEO basics, accessibility and AI-crawler visibility of one public page, with section scor...
CVE and exploitation-in-the-wild signals from Telegram CTI channels. Filters: severity, min_confidence, since, tag(cve|exploit|poc|patch), ttp, type(cve), limit, offset. Returns CVE IDs, affected products, exploit status...
HMAC-signed readiness attestation pack for an RWA score/dossier — auditable proof artifact for desks. Pay $0.15 for a signed trail legal can point to. Not a notary act or trade authorization. Task: Call when legal/audit...
Verdix lite ($0.01): call before an agent sends funds to an unfamiliar EVM address on Base, when cost matters most. Checks OFAC sanctions, scam/phishing lists, address poisoning, phishing tokens and flagged deployers. A...
Run the mail configuration check (MX, SPF, DMARC) on up to 20 domains in one request. Results keep the input order, and items that fail for a technical reason come with a token for a free retry. Use when an agent must au...
Look up a vulnerability by CVE or GHSA id (NVD: description, CVSS score and vector, CWE, CISA known-exploited flag; OSV: affected packages and fixed versions) or check a package version for known vulnerabilities via OSV....
Returns a verdict, realized pnl_pct, and direction_correct flag for any prior decision_id — the accountability check that closes the loop on a /kronos/decision call.
Audit a real request against the OpenAPI document it should satisfy. Matches the operation the way a router would, checks every path, query and header parameter against its declared schema, validates the body against the...
Audit a real response against what the OpenAPI document promises for that operation. Resolves the declared status exactly, by range such as 2XX, or through default, checks declared response headers are present, and valid...
Performs comprehensive URL health checks, measuring response time, status code, security headers, and TLS/SSL certificate validity. Route: GET /paid/health-check?url=https://example.com. Ideal for automated monitoring an...
Check an exact npm or PyPI package version immediately before installation using current registry, vulnerability, malicious-package, withdrawal/deprecation, and verified provenance evidence. Returns ALLOW, REVIEW, BLOCK,...
ICS threat actors by sector. Pass ?sector=energy. Returns all groups targeting that sector from live MITRE ATT&CK ICS STIX data. Covers energy, water, manufacturing, oil-and-gas, chemical, transportation, nuclear.
Audit your own delimited data against a contract you declare, and get one pass/fail plus the exact row and clause of every breach. Checks types, required values, enums, numeric bounds, lengths, patterns, uniqueness, comp...
Audit telemetry attributes against a contract, and against the thing a schema cannot see: cardinality. Reports missing required attributes, undeclared attributes, an attribute appearing as two types across the batch, and...
Screens names of people or companies against keyless public sanctions lists - OFAC SDN and the UN Security Council Consolidated List (names + aliases). Returns one brief per name: scored possible matches + a review signa...
For a URL and a technology, passively detects the tech and its version (headers, meta generator, script URLs - read-only, no probing), looks that version up in public CVE databases (OSV/NVD), and reports known CVEs plus...
Is this vendor or domain safe? One call runs cert, DNS, email security, ransomware leak-site listing and vendor status checks and returns a verdict (safe, caution, risk, incomplete). $0.04 USDC on Base. Not charged if ev...
Live scored geopolitical threat feed: name, category, severity, coordinates, and source URL for every active tracked threat.
Enumerate a domain's external attack surface in one workflow: certs, DNS posture, email auth, HTTP security headers, and tech stack. Security audit skill pack: one x402 payment runs 7 underlying tools (cert-transparency,...
Inspect SSL/TLS certificate for any domain. Returns valid boolean, days_remaining, issuer, valid_from, valid_to, subject_alt_names (SANs), fingerprint_sha256, and protocol version. Default port 443. Use for certificate e...
Compare a fixed list of ten security-relevant response headers across two releases and name the specific reverts. Reports a header removed, added or changed, and separately a reduced Strict-Transport-Security max-age, dr...
IOC feed from Telegram CTI channels. Filters: ip (exact lookup), type(ip|domain|url|md5|sha1|sha256|cve), severity, min_confidence, since, tlp, tag, channel, limit, offset. Returns items[] with iocs[], ttps[], confidence...
SSL/TLS certificate check: expiry, issuer, SANs, chain validity, hostname match, negotiated protocol/cipher, and weak-algo warnings for a public HTTPS host. Clean JSON.
Evaluate supplied absorption observations under a declared band-gap model with fit-window sensitivity. No universal band-gap or integrated-device performance claim.