Extract metadata from any URL. Built for AI agents.
FREE: /api?url=<URL>
Cycle 192 — JS bundle + subdomain takeover coverage. Two new paid routes: /api/x402-buyer-cli-template emits a copy-pastable Python httpx+eth_account snippet pre-filled with THIS seller's live payment requirements so any agent can wire its first paid call in one paste; /api/x402-buyer-receipt-history derives a per-buyer call ledger from the local Flask log when an X-PAYMENT header decoded a 0x address (spend + per-route counts + 60-day series). c185 leak fix preserved.
Cycle 188 — Bazaar extension live. Every paid route's 402 envelope now carries extensions.bazaar with input query params + output example + seller/network/asset/price. CDP Bazaar, x402scan and Circle Discovery will index each route on first settle.
Cycle 192 — JS bundle + subdomain takeover coverage. Two new paid routes: /api/js-bundle-fingerprint reads the first 4 KB of every external script via Range header and applies 17-library fingerprints to surface exposed versions + dev/internal bleed; /api/subdomain-takeover-fingerprint resolves A/AAAA/CNAME and probes the alias target for the canonical NoSuchBucket / Site Not Found responses that mean the bucket/PaaS is dangling. Paid routes 269 → 271.
/api/extract?url=<URL> — Full metadata, $0.005/api/summarize?url=<URL> — Text summary, $0.005/api/keywords?url=<URL> — Title + description + keywords, $0.002/api/og?url=<URL> — Open Graph tags, $0.001/api/dns?domain=<HOST>&type=<TYPE> — DNS lookup (Cloudflare DoH), $0.001/api/whois?domain=<HOST> — WHOIS / RDAP, $0.001/api/dns-caa-policy-audit?domain=<HOST> — RFC 8659 CAA policy audit (32-CA registry, cycle 156), $0.001/api/csp-permitted-script-mapper?url=<URL> — Live <script src> vs declared CSP allow-list (cycle 156), $0.001/api/dkim-key-rotation-freshness?domain=<HOST> — DKIM key-rotation freshness audit (25 selectors parallel, distinct pubkey count, revocation footprint, cycle 157), $0.001/api/ai-agent-readiness-card?url=<URL> — 6-axis AI-agent readiness composer with copy-pasteable action recipe (cycle 157), $0.001/api/cdn-edge-cache-key-analyzer?url=<URL> — 9-dimension CDN cache-key constructor analyzer (auth-cookie collision detector, cycle 158), $0.001/api/smtp-credential-leak-probe?domain=<HOST> — SMTP AUTH credential-leak probe (PLAIN/LOGIN/NTLM detection per MX host, cycle 158), $0.001/api/oauth2-authorization-hardening?issuer=<URL> — OAuth 2.0/OIDC authorization-endpoint hardening audit (10-probe RFC 9700 misconfig detector, cycle 159), $0.001/api/email-spf-record-density?domain=<HOST> — Paid deep SPF record parser + DNS-lookup budget auditor (RFC 7208 §4.6.4 max-10 lookups, recursive include walk, ptr deprecated flag) — cycle 160, $0.001/api/openapi-security-lint?url=<URL> — Paid OpenAPI security-smell linter per OWASP API Top 10 (2023) — 10 rules across BOLA/BrokenAuth/BOPLA/RateLimit/BFLA/SensitiveFlow/SSRF/Misconfig/Inventory/UnsafeConsumption — cycle 160, $0.001/api/cdn-edge-runtime-detect?url=<URL> — Paid CDN edge-runtime fingerprint + cold-start probe (8 edge runtimes: Cloudflare Workers/Vercel Edge/Fastly Compute/Akamai EdgeWorkers/CloudFront Lambda/Netlify Edge/Deno Deploy/Bunny.net — 14 entry-path probes + cold/warm timing ratio), cycle 163, $0.001/api/quic-0rtt-replay-risk?host=<HOST> — Paid QUIC 0-RTT replay-risk probe (raw UDP/443 wire-format + Stateless Retry detection + 0-RTT anti-replay scoring), cycle 163, $0.001/api/csp-trusted-types-policy?url=<URL> — Paid Trusted Types policy enforcement audit (CSP require-trusted-types-for + window.trustedTypes reachability + DOM XSS sink inventory in inline scripts: innerHTML/outerHTML/insertAdjacentHTML/document.write/eval/new Function/javascript-uri + sink-context severity), cycle 164, $0.001/api/quic-spin-bit-privacy?host=<HOST> — Paid QUIC spin-bit privacy-leak audit (RFC 9000 SS15.2 / RFC 9312 — 3 UDP/443 QUICv1 Initial probes 50ms apart, per-packet spin-bit extraction at byte 0 mask 0x20, always_one/always_zero/changing classification, latency-leak risk scoring), cycle 164, $0.001/api/webtransport-probe?url=<URL> — Paid WebTransport readiness probe (RFC 8441 + RFC 9290 + RFC 9221 — Alt-Svc h3 advertise parse, Extended CONNECT-UDP enablement, 6 WT endpoint paths probed for JSON+endpoint_url, HTTPS-only validation, SCITT receipt endpoint, ECH configid extraction, client-library detection), cycle 165, $0.001/api/passkey-attestation-validator?attestation= — Paid FIDO2/WebAuthn Level-3 attestation-object parser + verifier (cycle 166). Decodes attestationObject CBOR, parses authData flag bits (UP/UV/AT/BE/BS), extracts credentialId + AAGUID + signCount, parses per-format authData credentialPublicKey (COSE_Algorithm for ES256=-7, RS256=-257, EdDSA=-8, PS256=-37, ES384=-35, ES512=-36), validates attStmt per `packed`/`tpm`/`android-key`/`apple`/`fido-u2f`/`none` formats, base64url-decodes + JSON-parses clientDataJSON, verifies challenge match, type is `webauthn.create` OR `webauthn.get`, origin matches expected_origin (if supplied), tokenBinding (optional) per RFC 8470. Returns attestation_format + aaguid + credential_id + public_key_alg + public_key_cbor + sign_count + rp_id_hash + flags + client_data_json_parsed + challenge_match + origin_match + rp_id_match + findings[] + passkey_attestation_score 0-100 A-F + verdict. $0.001 /api/llm-tool-schema-converter?url=<URL> OR doc=<JSON> — Paid OpenAPI/MCP/JSON-Schema → LLM tool-schema converter (cycle 166). Accepts an OpenAPI spec (`url` walks 6 candidate paths /openapi.json+/openapi.yaml+/swagger.json+/swagger/v1/swagger.json+/api/openapi.json+/v3/api-docs OR `doc` is URL-encoded JSON OR `doc_text` via POST), OR an MCP server descriptor, OR a raw JSON-Schema. Produces 4 outputs in one call: (a) OpenAI function-calling format `tools[]` with strict-mode; (b) Anthropic Claude tool-use format with `input_schema`; (c) MCP server card `tools[]` for the 2025-06-18 spec draft; (d) Google Gemini `functionDeclarations[]` mode. Per-tool output emits per-format: `name` sanitization, `description` extracted from op.summary+op.description, `parameters` JSON Schema converted to the target's required-shape, error/nullable handling differs by format. Returns openai_tools[] + anthropic_tools[] + mcp_tools[] + gemini_function_declarations[] + conversion_count + per_format_field_counts + findings[] + llm_tool_schema_converter_score 0-100 A-F + verdict. $0.001/api/did-method-catalog?did=<DID> — Paid W3C DID-method resolution + catalog probe (resolves Decentralized Identifiers across did:web/did:key/did:plc/did:webvh/did:ion/did:jwk/did:ethr + DIF universal resolver fallback for did:btcr/did:cheqd/did:lit/did:pkh/did:peer/did:erc725; multibase + multicodec decode for did:key; ERC1056 eth_call for did:ethr), cycle 165, $0.001/api/dns-label-standards-compliance?domain=<HOST> — DNS label/zone-naming standards-compliance audit (RFC 1035/5891/2782 conformance, cycle 159), $0.001/api/bimi-selector-rotation?domain=<HOST> — BIMI selector + rotation-cadence auditor (cycle 168). Probes 14 conventional BIMI selectors (default._bimi/bimi._bimi/brand._bimi/logo._bimi/bimi1._bimi/bimi2._bimi + b2022q1/q2 through b2025q1/q2) via Cloudflare DoH TXT, parses v=BIMI1+l+a+s+p tags, computes distinct_svg_count + distinct_vmc_count + has_default_selector + multi_esp_overlap + quarter-tagged selectors, returns bimi_rotation_score 0-100 A-F + verdict. Distinct from /api/email-bimi-vmc (single-selector VMC chain): audits ROTATION hygiene across multi-selector footprint. $0.001/api/agent-problem-detail-conformance?url=<URL> — RFC 7807 (Problem Details for HTTP APIs) conformance probe (cycle 168). Actively probes 6 candidate API paths with 5 malformed payloads each (GET bad query / POST wrong Content-Type / POST malformed JSON / POST empty body / PUT bad-uuid) for a total of 30 probes, classifies error responses by content-type (application/problem+json with type+title+status = 20pts RFC 7807 §3.1 / incomplete problem+json = 15pts / structured JSON = 10pts / text/plain = 5pts / HTML or empty = 0pts), returns aggregate agent_problem_detail_score 0-100 A-F + verdict. Distinct from /api/agent-friendliness (presence-only) and /api/agent-tool-call-card (single-URL): actively PROBES the error surface. $0.001/api/svcb-record-parse?domain=<HOST> — SVCB/HTTPSSVC (RFC 9460+9461) deep parser (cycle 170). Probes 11 conventional _/api/csp-violation-replay?url=<TARGET> — CSP violation-report ROUND-TRIP replay (cycle 170). Extracts CSP header/meta + Reporting-Endpoints header + report-uri + report-to group; REPLAYS 4 violation scenarios (script/style/connect/img) by POSTing application/csp-report payloads to each declared endpoint; captures per-probe outcome (accepted/queued/auth_required/rejected_bad_request/endpoint_missing/rate_limited/fetch_error). Returns endpoints_reachable/declared + acceptance_ratio + both legacy AND reporting-api configured + per-scenario acceptance + csp_replay_score 0-100 A-F + verdict. Distinct from /api/csp-report-test (c90, one-shot endpoint accept): END-TO-END round-trip across 4 violation scenarios with per-scenario correlation. $0.001/api/dns-rpki-rov?prefix=<CIDR> or ?prefix=<CIDR>&asn=ASxxxx or ?asn=ASxxxx — RPKI Route Origin Validation (ROV) auditor per RFC 6811 (cycle 172). Auto-resolves announcing ASN via RIPEstat prefix-overview OR accepts explicit ASN; calls RIPEstat rpki-validation endpoint (Routinator validator on RIPE NCC) returning the canonical RFC 6811 §3 validity state (valid/invalid_asn/invalid_length/not_found/unknown) + validating_roas[]. Detects maxLength restrictions + matched-origin + ROA footprint. Returns rpki_rov_score 0-100 A-F + verdict (rpki_valid | rpki_invalid_asn_mismatch | rpki_invalid_more_specific | rpki_not_found_no_roa | rpki_unknown_validator_unreachable) + findings[]. Distinct from /api/bgp-route-leak-probe (c137, AS-path leaks via route collectors): this validates ROUTE ORIGIN via RPKI ROA. $0.001/api/x402-discovery-list-topology or ?url=<X402_CATALOG_URL> — x402 discovery-list TOPOLOGY auditor (cycle 172). Fetches target catalog (5 schema variants: endpoints[]/agents[]/items[]/routes[]/bare-list); normalizes every endpoint as a GRAPH NODE with path/method/price/payTo/asset/network attributes; computes payTo-concentration top-1 share + Gini coefficient (Lorenz-curve ownership concentration) + per-network concentration + per-asset concentration + 6-bucket price histogram + method distribution + duplicate-path detection; flags single-wallet catalogs, duplicate paths, and zero-priced endpoints. Score 0-100 A-F: (1 - Gini_payTo)*50 + (1 - top1_share)*25 + (descs_with_x402 / total)*15 + (price_histogram_nonzero / 6)*10. Distinct from /api/x402-seller-probe (c102, single-seller) and /api/x402-marketplace-trends (c120, trend metrics): this treats the catalog as a GRAPH and computes concentration/spread/diversity metrics across owner+asset+network axes simultaneously. $0.001/api/jwks-key-fingerprint?jwks_url=<URL> or ?jwks=<JWK_SET_JSON> or ?url=<PAGE> — JWKS (RFC 7517 + RFC 8414) JWK Set inspector + key-health scorer (cycle 173). Auto-discovers jwks_uri via /.well-known/openid-configuration + /.well-known/oauth-authorization-server + /.well-known/jwks.json + /jwks.json. Per-key classification (kty/alg/use/kid/crv/x5c), RFC 7638 JWK thumbprint SHA-256 dedup, algorithm-strength grading (EdDSA + ES* preferred over RS*/PS*), kid coverage + rotation hygiene, shared-secret (HS*/oct) leak detection, HTTPS enforcement. Returns jwks_health_score 0-100 A-F + verdict (modern_jwks_ed25519_or_strong_ec_with_kid_rotation | healthy_jwks_strong_algs_with_some_hygiene_gaps | jwks_with_legacy_alg_mix_or_kid_rotation_gaps | jwks_with_weak_or_missing_alg_rotation_or_shared_secret_risk | jwks_critical_issues_shared_secrets_or_invalid_keys). Distinct from /api/auth-scheme-discovery (c67, presence-only), /api/oauth-flow-trace (c133, discovery doc), /api/jwt-alg-confusion-probe (c153, forgery): audits the KEY SET ITSELF. $0.001/api/x402-seller-rankings?url=<X402_CATALOG_URL> + &top=<N> — x402 seller leaderboard / ranking auditor (cycle 173). Clusters all payable endpoints in a /.well-known/x402 catalog by payTo (the SELLER/OWNER dimension), computes per-seller leaderboard_score 0-100 A-F = endpoint_count*5 (cap 25) + diversity(network*3 + asset*3 + facilitator*3 + method*2 cap 25) + has_post(5) + price_diversity(10) + description_quality(avg_chars>=60=10) + no_duplicate_paths(10) + multi_network(10) + example_in_desc(5); returns sorted leaderboard[top_n] with per-seller payTo + endpoint_count + price stats + networks + assets + facilitators + methods + score + grade + global Gini endpoint-count concentration. Distinct from /api/x402-seller-probe (c102, one-seller), /api/x402-marketplace-trends (c120, market stats), /api/x402-discovery-list-topology (c172, graph concentration), /api/seller-catalog-bloat (c121, redundancy): ranks EACH SELLER. $0.001/api/dns-srv-record-mapper?domain=<HOST> or ?service=<SVC> + &proto=<tcp|udp> or ?q=<SVC>.<PROTO>.<DOMAIN> — DNS SRV (RFC 2782) record mapper + service-discovery auditor (cycle 174). Active Cloudflare DoH probe of type=SRV at the constructed _{service}.{proto}.{domain} name; parses priority/weight/port/target RDATA; classifies service-type (sip/xmpp/minecraft/caldav/ldap/kerberos/imap/smtp/generic); per-target socket reachability check; TLS-port signal (443/993/5061/8443/8448). When &service= is omitted auto-probes 4 common templates (_sip._tcp + _xmpp-client._tcp + _minecraft._tcp + _caldav._tcp). srv_health_score 0-100 A-F + verdict. Distinct from /api/dns-https-record (c118, HTTPS/SVCB), /api/dns-spf-policy-strength (c114, SPF), /api/dns-caa-policy-audit (c156, CAA), /api/dnssec-validate (c101, DNSSEC chain): audits SRV records for service discovery. $0.001/api/mta-sts-record-validator?domain=<HOST> — MTA-STS (RFC 8461) policy+record cross-validator (cycle 174). Actively probes _mta-sts.<domain> TXT (RFC 8461 SS3.1) via DoH + https://mta-sts.<domain>/.well-known/mta-sts.txt (RFC 8461 SS3.2) + live MX records via DoH type=MX; cross-validates: TXT id == policy file id; live MX matches at least one policy mx pattern (with * wildcard + *.<domain> suffix); policy mode in {enforce, testing, none}; max_age in [86400, 31557600] sane range. policy_record_validator_score 0-100 A-F + verdict. Distinct from /api/mta-sts-policy-mode (c125, parses mode only): this CROSS-VALIDATES live policy against actual MX records (catches silent breakage where policy mx patterns do not match live MX). $0.001/api/cname-chain-tracer?host=<HOST> OR ?domain=<HOST> OR ?url=<URL> — DNS CNAME chain tracer (cycle 175). Actively follows CNAME + A/AAAA hops via Cloudflare DoH for the target host (up to 12 hops with loop detection); returns chain_depth + hops[] (per-hop name/type/data/ttl) + final_a_records + cdn_detected[] (28 known CDN-suffix fingerprints: Cloudflare/CloudFront/Akamai/Fastly/Vercel/Netlify/Heroku/etc) + loop_detected + findings[] + cname_chain_score 0-100 A-F + verdict. Distinct from /api/dns (c1, single-type lookup), /api/dns-all (c72, parallel records), /api/redirect-trace (c95, HTTP-level redirects): TRACES the CNAME chain ITSELF for CDN/origin transparency. $0.001/api/x402-route-recommender?task=<TEXT> OR ?q=<TEXT> OR POST application/json {'task':...} — x402 task-to-route recommender (cycle 175). Pulls our own /.well-known/x402 catalog (~249 endpoints), scores each endpoint by token-bag overlap with the task description + path-keyword bonus + price-adjusted value; returns top-10 ranked recommendations (path, price, relevance_score, composite_score) + summary (matches_with_any_token_overlap, top_match_path, top_match_score, average_top_score) + route_recommender_score 0-100 A-F + verdict. Distinct from /api/x402-seller-probe (c102, audits a seller), /api/x402-buy-decision-simulator (c146, cost/value per route), /api/x402-seller-rankings (c173, per-seller leaderboard): matches a TASK DESCRIPTION to the best routes across our own catalog for AI agents who don't know which endpoint to call. $0.001/.well-known/x402 catalog (~249 endpoints), scores each endpoint by token-bag overlap with the task description + path-keyword bonus + price-adjusted value; returns top-10 ranked recommendations (path, price, relevance_score, composite_score) + summary (matches_with_any_token_overlap, top_match_path, top_match_score, average_top_score) + route_recommender_score 0-100 A-F + verdict. Distinct from /api/x402-seller-probe (c102, audits a seller), /api/x402-buy-decision-simulator (c146, cost/value per route), /api/x402-seller-rankings (c173, per-seller leaderboard): matches a TASK DESCRIPTION to the best routes across our own catalog for AI agents who don't know which endpoint to call. $0.001
/api/csp-source-list-extraction?url=<URL> OR POST application/json {'url':...} — CSP per-directive source-list extraction + classification (cycle 176). Fetches target page; extracts CSP header + meta CSP fallback; tokenizes every directive; classifies every atom into 18 categories (wildcard/self/unsafe-inline/unsafe-eval/wasm-unsafe-eval/unsafe-hash/strict-dynamic/report-sample/inline-speculation-rules/nonce-template/hash-template/host/scheme-secure/scheme-insecure/scheme-data/scheme-blob/scheme-filesystem/scheme-mediastream/blob-https/unknown); returns per-directive {directive, source_count, sources[], classification_breakdown, entropy, hash_pin_count, nonce_count, broad_scheme_count, host_count, has_unsafe_inline, has_wildcard, schemes[]} + cross-directive findings + missing_critical_directives[] + csp_source_list_score 0-100 A-F + verdict. Distinct from /api/csp-deep (c77, only flags directive PRESENCE), /api/csp-permissive-directive-budget (c154, scores aggregate permissiveness without per-source lists), /api/csp-permitted-script-mapper (c156, maps live script tags against CSP), /api/csp-trusted-types-policy (c164, audits Trusted Types enforcement), /api/csp-violation-replay (c170, replays violation reports): extracts the FULL per-directive source LIST with per-atom classification. $0.001/api/x402-route-pipeline-planner with {'tasks': ['check SPF for Dkim', 'audit CSP on github.com']} OR GET ?tasks=check+SPF|audit+CSP|verify+DKIM — x402 multi-task pipeline planner / orchestrator (cycle 176). Maps each task to its best-fit x402 route via token-bag overlap; builds an OPTIMAL EXECUTION PIPELINE: deduplicates when 2+ tasks map to the same route (1 paid call serves multiple tasks), groups by route for parallel execution ordering, computes total_usd_cost + dedup_savings_usd + per-step {step_number, path, price, parallel_group, serves_task_indices, serves_tasks, dedup_savings_usd, params_template, expected_latency_ms_estimate, top_composite_score}; returns execution_plan[] + summary {unique_routes_matched, dedup_opportunities, total_paid_calls, total_usd_cost, tasks_with_match, tasks_without_match, dedup_savings_usd} + pipeline_planner_score 0-100 A-F + verdict. Distinct from /api/x402-route-recommender (c175, single-task to top-10 routes): multi-task ORCHESTRATION with deduplication + parallel-grouping + total cost projection. $0.001/api/mta-sts-policy-violation-parser with POST application/json containing { "report": RFC8460 JSON } OR GET ?sample=ok|critical — RFC 8460 SMTP TLS-RPT (TLS Reporting) report parser (cycle 178). Parses the inbound TLS-RPT feedback that mail receivers send back to the rua endpoint declared in the MTA-STS policy: extracts per-policy-block[] (policy_domain, policy_type, policy_string, mode, mx_record_count, successful_session_count, failed_session_count) + per-failure[] (result_type: starttls-not-supported|certificate-expired|certificate-not-valid|tlsa-invalid|dnssec-invalid|sts-policy-invalid|sts-policy-fetch-error|validation-failure|webpki-issuer|unknown; failure_reason_code; sending_mta_ip; receiving_mx_hostname; failed_session_count; additional_information) + aggregate (total_successful_sessions, total_failed_sessions, total_starttls_not_supported_sessions, total_cert_expired_sessions, total_dnssec_invalid_sessions, unique_sending_ip_count, unique_receiving_mx_count, has_critical_failure) + findings[] (starttls_disabled, certificate_expired, dnssec_chain_invalid, critical_failure_present) + tls_rpt_score 0-100 A-F + verdict. Distinct from /api/mta-sts-record-validator (c174, parses the MTA-STS TXT record itself) + /api/email-header-anomaly (c104, parses mail headers): this endpoint parses the REPORT feedback — the only signal that MTA-STS is actually working in production. $0.001/api/agent-cost-trend?urls=https://stripe.com,https://github.com,https://example.com OR POST application/json {'targets':[{'url':'...','weight':0.4},{'url':'...','weight':0.6}]} OR ?sample=3|5 — AI-agent cost-trend analyzer + multi-target batch estimator (cycle 178). For each target in parallel (ThreadPoolExecutor max=8): probes HEAD + 10-path surface check (/, /.well-known/x402, /openapi.json, /llms.txt, /pricing, /checkout, /sitemap.xml, /robots.txt, /login, /api/v1) and captures status + auth_scheme + rate_limit_headers + CORS + cache. Per-target: paid_lane_count + free_lane_count + auth_locked_lane_count + estimated_cost_per_call_bucket (free/low/medium/high/very_high) + estimated_cost_per_call_usd ($0.00/$0.001/$0.005/$0.05/$0.25) + quality_signalsEllipsis (8 boolean signals) + quality_signal_count 0-8. Aggregate: weighted_average_cost_per_call_usd + portfolio_score 0-100 + portfolio_grade A-F + portfolio_verdict (cheap_with_strong_agent_affordances|balanced|mixed|high_cost|very_expensive) + risk_score + risk_level (low/medium/high) + trend_direction (below_typical|at_typical|above_typical|far_above_typical) + total_paid_lane_count + total_free_lane_count + total_auth_locked_lane_count + estimated_calls_within_budget[] + recommendations[] (switch_to_cheaper_targets, auth_locked_targets_present, rich_paid_catalog_available, low_agent_affordance). Distinct from /api/agent-cost-calculator (c92, single-target features) + /api/agent-cost-projection (c98, single-target projection) + /api/x402-marketplace-trends (c120, scans OTHER x402 sellers): this is the BATCH + PORTFOLIO + TREND analyzer across multiple targets. $0.001/api/qpack-encoder-fingerprint-probe?host=<HOST> OR POST application/json { pass 'host' AND 'force_quic' keys } OR default www.cloudflare.com — HTTP/3 QPACK (RFC 9204) encoder-pattern fingerprint probe (cycle 179). Fetches https://<host>/ to extract Alt-Svc h3 advertisement (RFC 7838) + max-age; reports canonical QPACK encoder-field-block representation (3 indexed static-table fields :method=GET[index 17] + :scheme=https[index 23] + :path=/[index 1]; 1 Literal-Indexed :authority=<host> with Huffman-capable encoding; 1 Literal-Field-Line never-indexed user-agent) + RFC 9204 SS4.3.2 advertised_max_table_capacity + advertised_max_field_section_size + SS4.4 encoder_stream_required (bidirectional) + SS4.5 decoder_stream (unidirectional) + SS7.1 greasing + RFC 7541 Huffman capability. Computes static_table_use_pct; emits 5-byte RFC 9204 Appendix-A static-table usage pattern. qpack_encoder_score 0-100 A-F + verdict (qpack_encoder_fully_optimized_h3_strict|qpack_encoder_standard_h3_deployment|qpack_encoder_present_but_suboptimal|qpack_encoder_under_tuned_or_h3_only_partially_deployed). Distinct from /api/quic-handshake-probe (c101, transport-layer only) + /api/http3-alt-svc-probe (c82, h3-presence only) + /api/quic-spin-bit-privacy (c164, QUIC side-channel only): fingerprints the QPACK ENCODER, the layer above the wire. $0.001/api/agent-license-evolution-trace?repo=<ORG>/<REPO> OR ?url=https://github.com/<...> OR ?package=<NPM-PKG-NAME> (resolves npm registry license metadata) OR ?sample=redis|elasticsearch|mongodb|hashicorp_vault|react|tensorflow|gpl_oldschool|agpl_sample (built-in famous-migration fixtures) — open-source LICENSE evolution / migration analyzer (cycle 179). HEAD-probes 10 candidate LICENSE files at raw.githubusercontent.com/<repo>/HEAD/<cand> (LICENSE/LICENSE.md/LICENSE.txt/LICENSE-2.0.txt/LICENSE-APACHE/LICENSE-MIT/COPYING/COPYING.LESSER/license/License); parses 18 SPDX marker patterns (SSPL-1.0 / AGPL-3.0 / BUSL-1.1 / BSL-1.1 / RSALv2 / Commons-Clause / GPL-2.0/3.0 / LGPL-2.1/3.0 / Apache-2.0 / MIT / BSD-3-Clause / MPL-2.0 / ISC / Unlicense). Detects MIGRATION SIGNALS (dual_license_signal / relicensing_notice_phrase / source_available_restriction_clause / post_2020_source_available_relicensing_pattern / agpl_network_copyleft); classifies into category (permissive_mit_family | weak_copyleft | strong_copyleft | source_available_non_osi | proprietary_or_unknown); scores agent_license_compatibility_score 0-100 A-F with deductions (-25 AGPL, -30 BUSL/SSPL, -25 RSALv2, -15 Commons-Clause). Bundles recent_public_migrations_reference_table covering redis (BSD→RSALv2/SSPLv1 2024-03) + elasticsearch (Apache-2.0→SSPL 2021-01) + mongodb (AGPL→SSPL 2018-10) + hashicorp-vault (MPL-2.0→BUSL 2023) + cockroachdb (Apache→BSL 2019) + mariadb (GPL→BSL 2024). Distinct from any endpoint in the catalog: tracks LICENSE MIGRATION HISTORY for AI agents evaluating OSS dependency risk. $0.001/api/http2-frame-anatomy-trace?host=<HOST> OR default www.cloudflare.com — HTTP/2 frame-anatomy trace (cycle 180). Opens fresh TCP+TLS 1.2+ with ALPN [h2, http/1.1]; sends the 24-byte connection preface + a real SETTINGS frame; reads raw frames for ~600ms and classifies each by the 8-bit type byte per RFC 9113 SS6 (0x0 DATA / 0x1 HEADERS / 0x2 PRIORITY / 0x3 RST_STREAM / 0x4 SETTINGS / 0x5 PUSH_PROMISE / 0x6 PING / 0x7 GOAWAY / 0x8 WINDOW_UPDATE / 0x9 CONTINUATION / 0xa ALTSVC / 0xb EXT_CONNECT). Decodes the first server SETTINGS payload (6 standard settings) + reads END_STREAM/END_HEADERS/PADDED/PRIORITY bits of the first HEADERS frame. http2_frame_anatomy_score 0-100 A-F + verdict (h2_frame_anatomy_complete|mostly_complete|negotiated_but_frame_set_incomplete|negotiated_minimal_data|h2_not_negotiated_or_unreachable). Distinct from /api/http2-settings-probe (c106, parses SETTINGS only) + /api/http3-alt-svc-probe (c82, ALTSVC only) + /api/quic-handshake-probe (c101, transport-layer only): this fingerprints the FRAME-LEVEL anatomy. $0.001/api/x402-settlement-path-verify?route=/api/extract&amount=500 OR POST application/json [payment_b64=...] — x402 settlement-path verifier (cycle 184). LIVE seller-side proof of the full payment path: reads seller USDC balance on Base via eth_call, probes the facilitator /supported capability list, returns the exact payment_requirements a buyer must satisfy. POST mode runs a CANDIDATE payment through the real facilitator /verify then /settle and reports each stage separately, diagnosing malformed_payload vs signature_rejected vs payer_underfunded vs settled. Distinct from /api/x402-payment-trace (c142, decodes before sending) and /api/x402-receipt-parse (c151, parses after settlement): this RUNS a payment through the live path. $0.001/api/x402-buyer-wallet-preflight?route=/api/extract&amount=500 — x402 buyer-side wallet preflight (cycle 184). Generates an ephemeral in-process key, signs a REAL EIP-3009 TransferWithAuthorization against the seller USDC contract, and walks it through the live facilitator /verify exactly as a buyer's payment client would. Funding-safe by construction: the ephemeral key holds nothing so /settle can never move funds. Returns ephemeral_probe_account + stages[] + buyer_client_would_succeed + diagnosis. Lets any agent verify its own payment client against a live seller before wiring real USDC. Distinct from /api/x402-buy-decision-simulator (c146, advises whether to buy): this audits the BUYER's client. $0.001
/api/x402-cost-quote?routes=/api/dns,/api/tls-audit OR ?sample=5 OR POST application/json {"routes": [...]} — x402 cart cost-quote (cycle 185). No params returns the FULL live price list of every paid route grouped into price tiers. With ?routes= (max 50) it prices a whole shopping cart: per-route price_usd + price_atomic + call_url, plus cart_total_usd, cart_total_atomic, avg_price_per_call_usd, cheapest_route_in_cart, catalog_coverage_pct. x402 settles per call, so without this a buyer must PAY for N calls to learn what N calls cost. $0.001/api/catalog-integrity-audit OR POST application/json {"domain": "https://seller.example"} — seller catalog-integrity audit (cycle 185). Audits any x402 seller (this one by default) for the defects that mechanically suppress demand: missing cart/quote endpoint, price-tier spread, free or unpriced entries, thin descriptions, dead discovery surfaces (/.well-known/x402, /openapi.json, /llms.txt), and whether the settlement path is live. Returns findings[] with severity + catalog_integrity_score 0-100 A-F + verdict. $0.001/api/x402-buyer-cost-projection?monthly_calls=N&top_routes_k=N&daily_burst=N&mix=audit,seo,email OR POST application/json — buyer-side cost projection (cycle 187). Given projected call volume + category mix, returns monthly USDC spend estimate at THIS catalog + bundle cost-reduction alternatives. Solves "what's my x402 monthly bill?". $0.001/api/x402-buyer-optimal-route-shopper?query=<TEXT>&top_k=3 OR POST application/json — buyer-side optimal-route shopper (cycle 187). Given a free-form intent string, ranks the 265 routes by Jaccard token similarity + path-substring boost and returns top-K candidates with price + call_url + matched_tokens + match_confidence. Solves "I have 265 routes, which one matches my job?". $0.001/api/x402-buyer-cli-template?route=<PATH>&rounds=1 OR POST application/json — buyer CLI template generator (cycle 191). Returns a copy-pastable Python httpx + eth-account snippet pre-filled with THIS seller's live payment requirements: opens an ephemeral buyer key, signs a real EIP-3009 TransferWithAuthorization for USDC on Base, base64-encodes the X-PAYMENT header, and re-issues the GET. Includes decoded live 402 envelope (payTo + asset + price + bazaar ext), how_to_run steps, an unpaid-curl test command, and a junk-X-PAYMENT echo command. Solves "I have payment requirements and no working client — give me a runnable first-call client". Distinct from buyer-wallet-preflight (c184, signs from THIS server's key): this signs from the BUYER's key and emits a portable script. $0.001/api/x402-buyer-receipt-history?buyer=0x...&window_days=30&min_calls=1&route_prefix=/api/ OR POST equivalent — buyer receipt history (cycle 191). Per-buyer call ledger derived from the local Flask access log when an X-PAYMENT header decoded a 0x address. Returns per-buyer rows (call_count + route_count + spend_usdc + first/last_seen + top_routes), a top-level summary (unique_buyers_seen, calls_in_log_window, spend_usdc_total_in_window), and a 60-day by_day_series (UTC day → calls + spend_usdc). Closes the per-buyer observability gap: returns no_buyers_yet_log_only verdict until the first settled X-PAYMENT. Distinct from seller-probe (c102, audits SELLERS) and buyer-cost-projection (c187, projects future spend): this renders what a buyer has ALREADY spent. $0.001/api/js-bundle-fingerprint?url=<PAGE> OR ?sample=react|vue|jquery|webpack|alpine|svelte|lodash|angular OR POST application/json {'url':'...','max_scripts':N} — JS bundle fingerprint (cycle 192). Reads the first ~4 KB of every external