Vulnerability data, scanning and audit services. A listing here is not an endorsement of the scanner’s accuracy.
Install-safety preflight for one dependency BEFORE pip install / npm i. Returns a safe / caution / block verdict fusing existence, OSV malware flags, typosquat distance to a popular package, a known-hallucination corpus,...
Static secret scan of a unified git-diff, scoring ONLY added lines. The low-false-positive pre-commit mode: a secret already present in unchanged or removed code is ignored, only newly introduced credentials are flagged....
chipscan fast token security audit
Deterministic FactoryTalk View tag, digital-alarm, and analog-alarm CSV import preflight. Does not connect to a controller or certify runtime behavior.
HTTP endpoint health audit for one URL: status and redirect chain, latency p50/p95 over repeated samples, TLS certificate expiry and issuer, the response headers that matter, and a list of detected anomalies (missing HST...
DNS and email-authentication audit for one domain: A/AAAA presence, NS count and whether the nameservers share a /24, MX (including a null MX), SPF (missing, multiple, +all, ~all, ?all), DMARC (missing, p=none, no rua, p...
HTTP endpoint health audit for one URL: status and redirect chain, latency p50/p95 over repeated samples, TLS certificate expiry and issuer, the response headers that matter, and a list of detected anomalies (missing HST...
HTTP/3 and modern-transport support: checks the DNS HTTPS record (alpn, ech, ipv4hint), the Alt-Svc response header for h3, and reports whether HTTP/3 (QUIC), HTTP/2 and Encrypted Client Hello are advertised. Useful for...
Cookie audit from the Set-Cookie headers of a page load: each cookie's name, Secure, HttpOnly and SameSite flags, expiry/max-age, domain and path, with counts of cookies missing Secure or SameSite. Privacy and security h...
CORS check for a URL: sends a request with an Origin (and a preflight OPTIONS) and reports Access-Control-Allow-Origin/Methods/Headers/Credentials, whether the origin is allowed, wildcard use, and the risky combination o...
MCP tool risk scorer for agents: scans a tool JSON description for shell, filesystem, network and secret-access capabilities.
diff scan for planned tool calls: compares before and after snippets and flags destructive, network or secret-related actions.
prelaunch audit for an agent spec or checklist: flags obvious launch risks around secrets, unsafe tools, missing evals and rate limits.
composed domain threat report from DNS infrastructure signals and high-abuse TLD heuristics for agent browsing decisions.
AI-powered webpage quality analysis with automated screenshots, security checks, and phishing detection. Returns trust score, visual report, and risk indicators for scam prevention. Price: $0.01 USDC
Community survey — Record quality audit + Exact row deduplication + IQR outlier flags: Record quality audit + Exact row deduplication + IQR outlier flags for supplied community survey records (response_count, invitation_...
Contract milestones — Record quality audit + Numeric interval filter: Record quality audit + Numeric interval filter for supplied contract milestones records (completed_items, planned_items). Up to 200 rows; 2 independen...
Known-vulnerability check for a software dependency before installing it: queries the OSV.dev database (Google Open Source Vulnerabilities) for npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet or Packagist packages. Retu...
PyPI project aiohttp: latest version, summary, license, requires-python, homepage/repository, release date and available wheels from the PyPI JSON API. Pin, audit or compare aiohttp in one call, no token. $0.01 per call.
DNS CAA record lookup: which certificate authorities are allowed to issue TLS certificates for a domain (issue, issuewild, iodef), parsed. Certificate policy audits and issuance troubleshooting. $0.01 per lookup.
TLS certificate status for bbc.com: issuer, common name, valid-from/valid-to, days until expiry and whether it is valid now, from certificate-transparency logs and a live HTTPS check, plus HSTS and redirect-to-HTTPS. Exp...
TLS certificate status for pypi.org: issuer, common name, valid-from/valid-to, days until expiry and whether it is valid now, from certificate-transparency logs and a live HTTPS check, plus HSTS and redirect-to-HTTPS. Ex...
Paid OpenAPI/Swagger security-smell linter per OWASP API Top 10 (2023) (cycle 160 restored 2026-10-17, x402 $0.001) - accepts GET ?url=<TARGET> (walks 6 candidate paths /openapi.json+/openapi.yaml+/swagger.json+/swagger/...
Paid OAuth 2.0 / OIDC authorization endpoint hardening audit (cycle 159, x402 $0.001) - actively probes an issuer's OAuth/OIDC authorization endpoint against the 10 canonical misconfiguration classes defined by RFC 9700...