335 services carry this tag in their source record. Tags come from the provider, not from us — a tag is a claim about what the service does, not proof that it does it well.
Discover and parse a site's sitemap: pass a site root (found via robots.txt or /sitemap.xml) or a direct .xml. Returns URLs with lastmod/priority; handles <sitemapindex> (one level).
Fetch any public webpage and return its clean readable text and markdown: boilerplate, nav, ads and scripts stripped. Returns the page title, clean text, markdown, word count and final URL after redirects. Input: a publi...
Paid x402 resource-scheme audit (cycle 193, x402 $0.001) - GET ?limit=N default 12 max 40 OR ?sample=/api/a,/api/b. Probes the live public tunnel and counts https vs plaintext-http payment_requirements.resource fields. R...
Paid subdomain takeover fingerprint (cycle 192, x402 $0.001) - GET ?host= OR ?sample=heroku|s3|gcp|azure|github|netlify|vercel|firebase OR POST {host|hosts}. Per host: DNS A/AAAA+CNAME via DoH then HTTP+HTTPS probe of al...
Paid x402 BUYER-side reachability audit (cycle 193, x402 $0.001) - GET/POST no params. Checks (1) app url_root reflects the public https scheme (ProxyFix present), (2) public tunnel URL stability warning, (3) facilitator...
Paid JS bundle fingerprint (cycle 192, x402 $0.001) - GET ?url=<PAGE>[&max_scripts=N default 8 max 25] OR ?sample=react|vue|jquery|webpack|alpine|svelte|lodash|angular OR POST {url,max_scripts}. Reads first ~4 KB of each...
Paid x402 index reachability audit (cycle 198, x402 $0.001) - GET ?url=<SELLER_URL> (comma-separated up to 4) or ?sample=N audits whether a seller is reachable through the BUYER-SIDE INDEX layer, not just its own HTTP su...
Paid x402 route quality-vs-cost ARBITER (cycle 180, x402 $0.001) - accepts GET ?urls=https://u1|https://u2|... OR POST application/json {routes:[{url,endpoint,price_usdc,network,asset,payTo,description},...]} OR GET ?sam...
Paid x402 seller catalog-integrity audit (cycle 185, x402 $0.001) - audits an x402 seller's OWN paid-route catalog for the defects that mechanically suppress demand. GET with no params audits THIS seller live against its...
Paid HTTP/2 frame-anatomy trace (cycle 180, x402 $0.001) - accepts GET ?host=<HOST> (default www.cloudflare.com); opens fresh TCP+TLS 1.2+ with ALPN [h2, http/1.1]; sends the 24-byte client connection preface PRI * HTTP/...
Paid RFC 7807 (Problem Details for HTTP APIs) conformance probe (cycle 168, x402 $0.001) - 6 candidate API paths (/api+/api/v1+/api/v2+/v1+/v2+/graphql) each probed with 5 malformed payloads (GET bad query / POST wrong C...
Paid W3C DID-method resolution + registry probe (cycle 165, x402 $0.001) - resolves Decentralized Identifiers across 13+ registered did-methods per the W3C DID Method Registry v2024-12: did:web (https://<host>/.well-know...
Paid WebTransport handshake + endpoint reachability probe (cycle 165, x402 $0.001) - actively probes RFC 8441 + RFC 9290 + RFC 9221 WebTransport readiness across 8 axes: (1) Alt-Svc h3/h3-NNN advertise parse (HTTP/3 requ...
Paid AI-agent readiness card composer (cycle 157, x402 $0.001) - produces a single structured card telling an AI agent whether a target URL is safe+affordable to call. Scores 6 axes (each 0-100) with equal weight: llms.t...
Paid AWS S3 bucket public-read ACL + listability probe (cycle 155, x402 $0.001) - resolves target domain + derives 8 conventional bucket-name candidates (apex + hyphen_to_dot + -backup/-backups/-prod/-staging/-dev/-asset...
Paid CSP permissive-source budget scorer (cycle 154) - quantifies aggregate attack-surface allowed by the policy. Parses header + meta + report-only delivery mechanisms, classifies every source value as high (script-src...
Paid CORS runtime cross-origin attack trace (cycle 152, x402 $0.001) - launches real cross-origin attack requests against target URL across 5 verbs (GET/POST/PUT/DELETE/PATCH) x 5 attacker origins (https://attacker.examp...
Paid HTTP/2 Rapid Reset (CVE-2023-44487) DoS probe (cycle 149, x402 $0.001) - opens fresh TCP+TLS 1.3 with ALPN h2, sends HTTP/2 client preface + client SETTINGS, parses server SETTINGS, runs a rapid-reset loop (open str...
Paid Web Bot Auth / RFC 9421 HTTP Message Signatures verifier (cycle 146, x402 $0.001) - probe /.well-known/http-message-signatures on target, extract Ed25519 public keys, parse caller-supplied signature-input + signatur...
Paid web-cache-poisoning + deception active probe (cycle 145, x402 $0.001) - 5 unkeyed-header probes (X-Forwarded-Host + X-Original-URL + X-Forwarded-Prefix + X-Host + X-Forwarded-Server + X-Forwarded-For + X-Forwarded-P...
Paid JSON-LD @id cross-reference reachability probe (cycle 143, x402 $0.001) - parses all <script type=application/ld+json> blocks, extracts every @id URL, HEAD-probes each (max 12, parallel), verifies reachability + Con...
Paid HTTP/1.1 hop-by-hop header correctness probe (cycle 141, x402 $0.001) - opens raw TCP to host:443 + :80, sends 3 sequential GET requests with explicit Connection: keep-alive, X-Hop-Marker-A1b2c3, X-Internal-Trace-X9...
Paid Content Language detector (cycle 139, x402 $0.001) - fetches URL + extracts language declarations across html lang attribute + HTTP Content-Language header + og:locale/og:locale:alternate + hreflang link tags + meta...
Paid Cross-Origin Isolation (COOP+COEP+CORP+credentialless) coherence audit (cycle 138, x402 $0.001) - fetches URL + parses Cross-Origin-Opener-Policy (same-origin/same-origin-allow-popups) + Cross-Origin-Embedder-Policy...