Every agent-payable API.

Checks MTA-STS for a mail domain: the _mta-sts TXT record (v=STSv1 and id) and the HTTPS policy file (mode enforce, testing or none, the MX patterns and max_age). Reports whether the record and the policy are both present and whether the policy's version is valid. Does not test the mail servers themselves.

For a brand domain, generates up to 24 lookalike names (letter omission, doubling and swapping, plus .co/.net/.org/.io swaps) and checks which ones have name servers in DNS right now. Registered-looking names are listed with their name servers. A lookalike with no name servers may still be registered without DNS, and this is not a trademark or phishing verdict.

For an autonomous system (e.g. AS13335): how many upstream (transit) and downstream neighbours RIPEstat sees in BGP, the top upstreams ranked by 'power' with their IPv4 and IPv6 peer counts, and the top downstreams. Built from RIS route collector paths, so it is an observed view, not the contract.

Checks whether an email address's domain (or a domain you give) is on the community disposable and temporary email blocklist (about 9,900 domains). Only the domain is checked, never the mailbox, and a domain missing from the list is not proven to be permanent.

Public product metadata of a Shopify store from its storefront products.json feed (no key): title, handle, vendor, product type, tags, publish and update times, price range, variant and image counts and product link. Only stores that expose products.json; stores that block it return 404.

Reports whether Shodan's pre-collected passive scan data shows TCP port 53 (DNS) open on an IPv4 address. It is a passive port fact only: it does not send a query, so it cannot say whether the server answers recursively for outside names. Absence means not seen, not closed.

Internet Archive Wayback Machine CDX index: archived snapshots of a URL or domain (timestamp, original URL, MIME type, HTTP status, length) with a link to each capture. Public, no key; the index lists captures, not page text.

Checks an IPv4 address against the public X4BNet list of commercial VPN provider address ranges (about 11,000 CIDR blocks, refreshed by the list's maintainer). Returns whether the address falls in a listed VPN range and which range. A miss does not prove a direct connection, and IPv6 is not covered.

Reports whether Shodan's pre-collected passive scan data shows SNMP (UDP port 161) seen open on an IPv4 address. Passive and possibly old; no community string is tried, so default or public community access is not tested.

DNSSEC check for a domain: whether a DS record exists at the parent zone (the domain is signed), and whether two public validating resolvers (AdGuard DNS, NextDNS) return its A answer with the AD (authenticated) flag. It reads the resolvers' verdict; it does not validate the signature chain itself.

Checks an IPv4 address against the abuse.ch Feodo Tracker botnet C2 blocklist (Emotet, QakBot and similar). A hit returns the port, online status, malware family, country, AS and first and last seen dates. Covers only the C2 servers this feed tracks.

USDA AMS Market News (official MyMarketNews API): search the catalogue of livestock, grain, dairy, fruit/vegetable and other market reports by title, or pass a report slug id to get its latest published rows (prices, volumes, report date). Data straight from USDA; needs the owner's free MARS API key.

Checks Shodan's passive scan records for TCP port 445 (SMB) on an IPv4 address. Says whether SMB was seen open and when the record was last refreshed by the host data (not a live test). An address with no Shodan record returns seen=false with known=false; that is not proof the port is closed.

Censys host view for an IPv4 address: the services, ports and protocols Censys has observed on it with their last scan time and detected software, plus autonomous system, location, network owner and reverse DNS, from the Censys Platform API.

Lists the CAA (Certification Authority Authorization) records published on a domain: which CAs may issue certificates (issue), wildcard certificates (issuewild) and the incident-report address (iodef). Shows the records on the exact name only; CAA is inherited from parent domains when a name has none, which this tool does not walk.

PR Newswire latest news-release list from its public RSS feed (keyword filter on title/summary). Press release headlines and summaries. Public feed, no key.

Checks an IPv4 mail-sending address against the Barracuda Reputation Block List (b.barracudacentral.org) through public DNS. Listed addresses return a 127.0.0.x code; unlisted ones return no record. The list is updated continuously, so this is a point-in-time answer. Domain reputation is not covered.

gCaptain maritime news from its public RSS feed (keyword filter on title/summary/categories). Latest items only. Public feed, no key.

HTTPS certificate chain and cipher audit for a host (port 443) from Qualys SSL Labs' cached report: grade, number of certificates in the chain, trust store, TLS versions, weak-cipher count, Heartbleed/POODLE/BEAST flags and HSTS. Only reads reports SSL Labs already has, so a host that was never scanned returns a retry error instead of a new scan.

For an IPv4 prefix (e.g. 8.8.8.0/24): the origin AS seen announcing it now across RIPE RIS peers, its RPKI status for that origin (valid, invalid or unknown), route objects, visibility, and how many more-specific and less-specific prefixes are seen. An 'invalid' RPKI status is a hijack warning sign; it is not proof of a hijack.

PR Newswire health-category press releases from its public RSS feed (keyword filter on title/summary). Latest items only. Public feed, no key.

Checks Shodan's passive scan records for TCP port 3389 (RDP) on an IPv4 address. Says whether RDP was seen open (not a live test, and the record can be days old). An address with no Shodan record returns seen=false with known=false; that is not proof the port is closed.

Reads the Impressum (legal notice required on German websites, §5 TMG/DDG) at the page URL you give: e-mail addresses, phone numbers, postal address lines and the notice text as Markdown. Values are read from the page as published; no check that the operator is correct.

CNBC top news from CNBC's public RSS feed (keyword filter on title/summary). Latest items only. Public feed, no key.

WordPress.org news posts from the official WordPress news RSS feed (keyword filter on title/summary/categories). Latest posts only. Public feed, no key.

Checks how a site's home page answers a cross-origin request from a made-up origin: whether it echoes that origin back, sends a wildcard (*), and whether credentials are allowed with it. Echoing an arbitrary origin together with credentials is the risky case. One GET of the home page; it does not test API routes or the null origin.

Lists the cookies a site sets on its public home page (one anonymous GET, no login) with their Secure, HttpOnly and SameSite flags, and flags the ones missing a flag. Cookies set later, after login or on other pages, are not seen.

PubMed article metadata by PMID (NCBI E-utilities esummary, public, no key): title, journal, publication date, authors and DOI for up to 20 ids. Summary fields only, no abstracts.

Has this place been built on or cleared in the last 12 months? Sentinel-2 satellite change detection for any lat/lon: NDVI/NDBI deltas, change direction, confidence and the scene-by-scene evidence.

Domain -> security letter grade (0-100, A-F) from HTTPS reachability, security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy), and CAA records. Reports HTTPS connect success/failure, not raw cert expiry -- Workers can't read a remote server's cert metadata directly. For registration facts use /domain-intel; for URL reputation use /linkcheck.

Enumerate a site's URLs from robots.txt + sitemap.xml (sitemap-index aware) — map a domain before crawling it

Enumerate a site's URLs from robots.txt + sitemap.xml (sitemap-index aware) — map a domain before crawling it

Prüft am Objekt sitemap den Befund Zahl der Adressparameter.

Prüft am Objekt sitemap den Befund deklarierte Crawl-Verzögerung.

Prüft am Objekt sitemap den Befund HTTP-Status der Sitemap.

Prüft am Objekt sitemap den Befund Wert des X-Robots-Tags.

Prüft am Objekt sitemap den Befund Freigabe durch robots.txt.

Prüft am Objekt sitemap den Befund Wert der Meta-Robots-Angabe.

Prüft am Objekt sitemap den Befund ausgelieferten Inhaltstyp.

Prüft am Objekt sitemap den Befund technische Indexierbarkeit.

Prüft am Objekt sitemap den Befund Vorkommen in der Sitemap.

Prüft am Objekt sitemap den Befund selbstreferenzierende kanonische Adresse.

Sitemap extractor: find a domain's sitemaps through robots.txt and the standard location, then list the page addresses they declare

Sitemap reader: list a site's URLs with lastmod (handles sitemap indexes) — Genesis402 / UnyKorn Operator Network

Read one public XML sitemap or sitemap index as structured URLs and source-reported dates. Supports gzip, substring filtering and pagination. Maximum 512 KiB expanded input and 1000 entries. Does not crawl pages or follow child sitemaps. Invalid XML and execution errors are not charged; a valid empty match is charged. Use to find which pages of a docs site to read before calling /extract.

Six cited owner-action lanes for one US address: curated and derived programs, exact program dates, the state appeal rule, state tax framing plus county source pointer, FEMA LOMA point-elevation screen when applicable, and the parcel special-valuation screen. Returns charged:false unless at least two sections are substantive. Lists programs and rules only; no eligibility or action recommendation. npx @velinussage/locus-agent-skill add.

Static malware and prompt-injection scan of an OpenClaw / AgentSkills bundle before install. Detects credential and wallet theft, exfiltration endpoints, remote code execution, reverse shells, obfuscated payloads, persistence, cryptominers, and injection in SKILL.md. Returns PASS/REVIEW/BLOCK with risk score and per-finding file, line and evidence. bundle = {files:[{path,content}]} or {github:'owner/repo/path'} or {content:'...'}.

Skill Scan by Agentropolis: static Consensus Scan of an MCP server or agent skill before you install it. Pass a GitHub repo, npm:/pypi: package or pasted code + tools/list/SKILL.md. Flags tool poisoning, hidden instructions, credential/env exfiltration, remote code exec, obfuscation, install hooks; 2 rule families + 2 LLM reviewers vote; cross-checks Agentropolis seller trust data. Returns allow/review/block with evidence. Read-only, never executes the code. Advisory.

Bundled execution of the API health check workflow - Is this API endpoint healthy? Liveness check, response headers, and TLS certificate status in one pass. One x402 payment runs 3 underlying tools (http-check, http-headers, tls-cert); partial-success per step.

Bundled execution of the Article digest workflow - Quick research brief on any topic - web search results plus an AI-generated answer in one pass. One x402 payment runs 3 underlying tools (search, answer, search-news); partial-success per step.