251 services carry this tag in their source record. Tags come from the provider, not from us — a tag is a claim about what the service does, not proof that it does it well.
Paid BIMI selector + rotation-cadence auditor (cycle 168, x402 $0.001) - probes 14 conventional BIMI selectors via Cloudflare DoH TXT (default._bimi.<d>, bimi._bimi.<d>, brand._bimi.<d>, logo._bimi.<d>, bimi1/_bimi2/_bim...
Paid SMTP open-relay test (cycle 154) - actually attempts MAIL FROM + RCPT TO against each MX host. Resolves MX via Cloudflare DoH, opens TCP/25, sends EHLO + MAIL FROM:<external> + RCPT TO for both local-domain and fore...
Paid MCP server tool-list cross-discovery-surface aggregator (cycle 150, x402 $0.001) - parallel-fetch /.well-known/mcp/server.json + /mcp.json + /openapi.json + 8 health endpoints; aggregates MCP tools across surfaces (...
Paid DNS AXFR (zone-transfer) vulnerability probe (cycle 148, x402 $0.001) — discovers authoritative NS via Cloudflare DoH, then opens raw TCP/53 to each NS and sends an RFC 1035 wire-format AXFR query (QTYPE=252) per RF...
Paid OCSP Must-Staple (RFC 7633) cert-feature detector (cycle 138, x402 $0.001) - opens TLS to target host, parses leaf cert via cryptography.x509 to detect status_request TLS Feature extension (OID 1.3.6.1.5.5.7.1.24) o...
Paid CDN cache-key probe via 4-variant request burst (cycle 134, x402 $0.001) - fetches target 4x with different dimensions (baseline, ?cb=12345, Accept-Language: fr, Accept-Encoding: identity), captures X-Cache/CF-Cache...
Paid OAuth 2.0 / OpenID Connect discovery + flow-capability analyzer (cycle 133, x402 $0.001) - probes 4 RFC 8414 + OIDC discovery endpoints at target domain (/.well-known/openid-configuration + /oauth-authorization-serv...
Paid cookie partition consistency audit (cycle 130, x402 $0.001) - probes 6 conventional paths (apex/login/signup/api/cart/account), parses Set-Cookie from each, groups by cookie name across responses, flags inconsistenc...
Paid live SMTP STARTTLS opportunistic-TLS probe (cycle 128, x402 $0.001) - resolves MX hosts via Cloudflare DoH, opens TCP to each on ports 25 + 587, reads SMTP banner, sends EHLO and parses capability list (STARTTLS/SIZ...
Paid BGP route-leak + prefix-hijack exposure probe (cycle 126, x402 $0.001) - resolves target host via Cloudflare DoH, queries RIPEstat prefix-overview for each IP, classifies announcing ASNs + holders, computes consensu...
Paid seller x402 catalog bloat + consolidation scoring (cycle 121, x402 $0.001) - fetches a target /s /.well-known/x402 catalog (GET) or accepts raw catalog as POST body; computes thin-descriptions count (<60 chars), ver...
Paid x402 marketplace trend scanner (cycle 120, x402 $0.001) - fetches a target /s /.well-known/x402 catalog (GET) or accepts raw catalog as POST body; computes per-asset + per-network + per-facilitator + per-scheme dist...
Paid x402 price-per-call optimizer (cycle 119, x402 $0.001) - fetches a target seller /s /.well-known/x402 catalog (or accepts raw catalog as POST body), extracts price-per-call from atomic-string or decimal forms, compu...
Paid Web Vitals INP (Interaction-to-Next-Paint) heuristic estimate (cycle 118) — static-analysis proxy for INP p75 without a real browser: counts addEventListener + onclick/oninput/onkeydown/onsubmit handlers in inline +...
Paid WebAuthn / Passkey policy audit (cycle 117) — non-authenticated scan of a sites passkey posture: (a) detects 13 vendor SDKs in HTML (SimpleWebAuthn/Corbado/Hanko/Stytch/Clerk/WorkOS/Auth0/Okta/Descope/Keycloak/Bitwa...
Paid CDN / edge-provider detection from response headers (cycle 116) — fetches target URL, inspects 25+ CDN-specific response headers (CF-Ray/CF-Cache-Status/CF-Request-Id + X-Amz-Cf-Id/X-Amz-Cf-Pop + X-Vercel-Id/X-Verce...
Paid JavaScript syntax-validity probe (cycle 114) — fetches the page HTML, extracts every inline <script> block + every external <script src=> (parallel fetch with 8s timeout + 500KB cap per script, max 20 externals), fo...
Paid OpenAPI / Swagger 2.0 best-practices quality audit (cycle 114) — accepts GET ?url=<openapi.json URL> OR POST application/json with {spec:{...}} or {spec_text:"<YAML or JSON>"}; scores 12 quality dimensions: (a) Open...
Paid readability + per-paragraph reading-time estimator (cycle 110) — fetches URL, extracts paragraph-level text, then computes 6 readability formulas (Flesch, Flesch-Kincaid, Gunning Fog, SMOG, Coleman-Liau, ARI) + tota...
Paid JSONPath extraction (cycle 108) — accepts GET ?url=<URL>&path=<JSONPATH> OR GET ?json=<urlencoded JSON>&path=<JSONPATH> OR POST application/json {url|json, path}; fetches the URL (or parses inline JSON) and applies...
Paid AI-agent tool-call card generator (cycle 105) — accepts GET ?url=<TARGET> OR POST application/json {url: <TARGET>}; probes /.well-known/x402 + 4 OpenAPI candidate paths + /llms.txt; aggregates into a single structur...
Paid Model Context Protocol (MCP) server discovery (cycle 103) — fetches a target's MCP descriptor from 6 candidate paths (/.well-known/mcp.json, /mcp.json, /.well-known/model-context-protocol.json, /model-context-protoc...
Paid x402 SELLER probe (cycle 102) — fetches a target domain's /.well-known/x402 discovery doc, parses several schema variants (object.endpoints / object.items / object.routes / bare-list / line-delimited), returns raw_e...
Paid x402 task-to-route recommender (cycle 175, x402 $0.001) - accepts GET ?task=<TEXT> OR GET ?q=<TEXT> OR POST application/json {'task':...}; pulls our own /.well-known/x402 catalog (~249 endpoints), scores each endpoi...