48 services carry this tag in their source record. Tags come from the provider, not from us — a tag is a claim about what the service does, not proof that it does it well.
Paid web-cache-poisoning + deception active probe (cycle 145, x402 $0.001) - 5 unkeyed-header probes (X-Forwarded-Host + X-Original-URL + X-Forwarded-Prefix + X-Host + X-Forwarded-Server + X-Forwarded-For + X-Forwarded-P...
Paid security-header mutation test (cycle 143, x402 $0.001) - fetches target URL 5x with deliberately different fingerprint headers (Chrome desktop + Firefox + Mobile Safari + python-requests bot + baseline); compares th...
Paid Cross-Origin Isolation (COOP+COEP+CORP+credentialless) coherence audit (cycle 138, x402 $0.001) - fetches URL + parses Cross-Origin-Opener-Policy (same-origin/same-origin-allow-popups) + Cross-Origin-Embedder-Policy...
Paid composite AI-agent onboardability summary (cycle 120, x402 $0.001) - single-call composite that answers 'could an AI agent onboard to use this URL as a paid tool?' - fetches target URL + probes /openapi.json + /.wel...
Paid AI training / retrieval crawler policy audit (cycle 117) — fetches /robots.txt + /llms.txt + /llms-full.txt + /meta-robots + probes 3 ai.txt paths (/.well-known/ai.txt + /.well-known/ai-crawler-policy + /ai.txt), cl...
Paid clickjacking-protection audit (cycle 115) — fetches the page headers + body, audits (a) X-Frame-Options presence + value (DENY/SAMEORIGIN valid, ALLOW-FROM deprecated per Chrome/Edge), (b) CSP frame-ancestors policy...
Paid hreflang <-> sitemap.xml cross-validator (cycle 94) — extracts page hreflang tags, validates BCP47 + self-reference + x-default + canonical agreement, locates sitemap (sitemap.xml + sitemap_index.xml + robots.txt Si...
Paid CAPTCHA + bot-management vendor detection (cycle 94) — page-level fingerprint of 11 vendors (reCAPTCHA v2/v3/enterprise + hCaptcha + Cloudflare Turnstile + Cloudflare challenge page + Arkose Labs + GeeTest + DataDom...
Paid deep HTTP header policy audit — 30+ headers across 12 groups: CSP (Content-Security-Policy + Report-Only) + HSTS (max-age + includeSubDomains) + COOP/COEP/CORP/Origin-Agent-Cluster + Permissions-Policy (feature list...
Paid composite AI-agent friendliness score — rolls up 9 AI-relevant discovery surfaces (llms.txt + llms-full.txt + sitemap.xml + RSS/Atom + robots.txt AI-bot allow-rate + openapi.json + webmanifest + .well-known/agents.t...
Paid AI/LLM crawl-policy synthesis (x402 $0.001) - GET ?domain=<DOMAIN> reads robots.txt, llms.txt, agents.txt and ai.txt, resolves policy for 40+ AI-bot User-Agents, and returns allow/block counts plus an A-F llm_crawl_...
Paid robots.txt vs meta robots vs X-Robots-Tag conflict detector — 4 conflict types (robots-disallow-vs-meta-index, robots-allow-vs-meta-noindex, X-Robots-Tag-noindex-vs-meta-index, X-Robots-Tag-index-vs-meta-noindex) +...
Paid cache-freshness strategy audit — probes HTML page + /favicon.ico + /robots.txt + /sitemap.xml + first stylesheet URL + first script URL; for each captures Cache-Control directives + ETag + Last-Modified + Age + Vary...
Paid HTTP-method policy + dangerous-method exposure audit — OPTIONS Allow/DAV/ACAO/ACAM + TRACE echo-back + CONNECT + PUT/DELETE/PATCH write exposure + 4 method-override header sniffing (X-HTTP-Method-Override/X-Method-O...
Paid security exposure-surface audit — HSTS preload-list membership via hstspreload.org API + HSTS header detection, RFC 9116 security.txt presence+format-validity (Contact/Expires/Canonical/Preferred-Languages), 18-path...
Paid exhaustive meta-tag coverage audit — title + meta_description + meta_robots + meta_keywords + meta_author + meta_generator + meta_theme_color + meta_viewport + 17 OG fields (og:title/description/image/url/type/site_...
Paid deep robots.txt audit — per-UA directive counts, sitemap, 34 AI-bot directive detection (GPTBot/ClaudeBot/Google-Extended/CCBot/PerplexityBot/Meta-ExternalAgent/Bytespider/etc), crawl-delay, anti-pattern flags, robo...
Paid HTTP cache-control audit — probes favicon/robots/sitemap headers (Cache-Control+max-age+s-maxage+immutable+stale-while-revalidate / ETag / Last-Modified / Vary / Surrogate-Control / CDN-specific) returns cache_valid...
Paid deep sitemap audit — format validity + lastmod coverage % + lastmod ISO 8601 validity + image/video/news/xhtml extension support + sitemap index nesting depth + robots.txt Sitemap directive + changefreq/priority dep...
Paid composite agent-trustworthiness score — security headers (HTTPS/HSTS/CSP/XFO/XCTO/RP/PP) + discoverability (robots/sitemap/llms.txt/security.txt) + standards (structured data/lang/cookie consent) rollup with A-F gra...
Paid third-party embed/iframe/object inventory — YouTube/Vimeo/Wistia/GoogleMaps/Stripe/Calendly/Typeform/Spotify/Soundcloud/Twitch/Figma/Canva/Loom/Twitter/IG/CodePen/JSFiddle/CodeSandbox/Replit/SlideShare/SpeakerDeck/I...
Paid AI bot policy audit via x402
Paid robots.txt audit via x402
Paid comprehensive SEO audit (title length, meta description, canonical, robots, viewport, OG/Twitter, JSON-LD, hreflang, favicon, sitemap + A-F grade) via x402