Every agent-payable API.

Public product metadata of a Shopify store from its storefront products.json feed (no key): title, handle, vendor, product type, tags, publish and update times, price range, variant and image counts and product link. Only stores that expose products.json; stores that block it return 404.

NHS England primary-care prescribing for a drug (official NHSBSA English Prescribing Dataset, monthly, ~2 months behind; the raw data behind OpenPrescribing.net): items, actual cost (GBP) and quantity, grouped by region, ICB, GP practice or product presentation, largest first. Match on BNF chemical substance or presentation name. Open Government Licence, no key.

npm registry search for MCP servers that convert Markdown to PDF (public npm search API, no key): package name, version, description, publisher, last publish date, monthly and weekly downloads, and npm link. Lists packages as npm reports them; quality is not checked.

Asks two independent public DNS resolvers (AdGuard DNS and NextDNS) for the same name and record type right now and reports whether they agree, with each answer set and its lowest TTL. It shows cache and geo-DNS differences between resolvers; it is two vantage points, not a worldwide propagation survey.

CNBC top news from CNBC's public RSS feed (keyword filter on title/summary). Latest items only. Public feed, no key.

TLS versions a host accepts (SSL 3, TLS 1.0 and 1.1 flagged as deprecated) and its cipher-suite strength from Qualys SSL Labs' cached report: suite count per protocol, weak suites (RC4, 3DES, NULL, EXPORT, DES, anonymous), and whether forward secrecy is offered. Reads existing reports only; a host that was never scanned returns a retry error.

Vulnerability trend for a vendor (optionally one product) from the NIST NVD: CVEs published in the last N days (default 7, up to 120; a big vendor over a long window can take NVD 30+ seconds) naming the vendor (or mapped to its CPE with match=cpe), counts by severity, average and maximum CVSS score, CVEs per week, top CWE weaknesses and the highest-scored CVEs with score, severity, vector, date and description.

FIFA men's national team world ranking (FIFA public ranking API, no key): position, team, country code, total points, previous points and previous rank for one ranking date. Default date is the latest one listed on FIFA's site when built (2026-10-20); pass dateId to read another listed date. Men's ranking only.

PubMed article metadata by PMID (NCBI E-utilities esummary, public, no key): title, journal, publication date, authors and DOI for up to 20 ids. Summary fields only, no abstracts.

Email authentication DNS records for a domain: DMARC policy (p, sp, pct, rua), SPF record and its all-mechanism, and DKIM public keys for a selector you give or for 8 common selectors (revoked keys and CNAME-delegated keys are reported). Reads the published DNS records only; it does not check alignment against a real message.

Checks an IPv4 address against the public X4BNet list of commercial VPN provider address ranges (about 11,000 CIDR blocks, refreshed by the list's maintainer). Returns whether the address falls in a listed VPN range and which range. A miss does not prove a direct connection, and IPv6 is not covered.

Reads a site's Referrer-Policy header and its <meta name=referrer> tag from the home page, works out the policy a browser would apply, and rates how much of the URL it sends to other sites (strict, moderate or leaky). One GET; links on other pages can set their own policy.

Looks up one MITRE ATT&CK technique (e.g. T1059 or T1059.001) on its official public page: its name, the tactic-level summary text and the page title. Reads one page per call; it does not return the whole matrix or a technique's sub-techniques list.

Checks an IPv4 address against the CI Army (CINS Score) bad-IP list, a collective-intelligence list of addresses that recently showed hostile activity across a sensor network (about 15,000 entries). Listed means it is on the current list; the list is a snapshot.

Wikimedia Commons image search (MediaWiki API, public, no key): file title, direct image URL, size, MIME type, license, author and description for free-licensed files. Returns file metadata only, not image bytes.

Searches abuse.ch ThreatFox for indicators of compromise matching a term (IP, IP:port, domain, URL or file hash): IOC, type, malware family, threat type, confidence, first/last seen, reporter, tags and Malpedia link. Optional exact match and a first-seen window in days.

USDA AMS Market News (official MyMarketNews API): search the catalogue of livestock, grain, dairy, fruit/vegetable and other market reports by title, or pass a report slug id to get its latest published rows (prices, volumes, report date). Data straight from USDA; needs the owner's free MARS API key.

Checks an IPv4 mail-sending address against the Barracuda Reputation Block List (b.barracudacentral.org) through public DNS. Listed addresses return a 127.0.0.x code; unlisted ones return no record. The list is updated continuously, so this is a point-in-time answer. Domain reputation is not covered.

For a brand domain, generates up to 24 lookalike names (letter omission, doubling and swapping, plus .co/.net/.org/.io swaps) and checks which ones have name servers in DNS right now. Registered-looking names are listed with their name servers. A lookalike with no name servers may still be registered without DNS, and this is not a trademark or phishing verdict.

Lists the CAA (Certification Authority Authorization) records published on a domain: which CAs may issue certificates (issue), wildcard certificates (issuewild) and the incident-report address (iodef). Shows the records on the exact name only; CAA is inherited from parent domains when a name has none, which this tool does not walk.

One CVE record from the NIST National Vulnerability Database: description, published and last-modified dates, NVD status, primary CVSS score and severity (v4.0, 3.1, 3.0 or 2.0, whichever NVD marks primary first), CWE weakness IDs and up to 5 reference URLs. It does not say whether the CVE is being exploited (use cisa-known-exploits or epss-exploit-score for that).

PR Newswire health-category press releases from its public RSS feed (keyword filter on title/summary). Latest items only. Public feed, no key.

Europe PMC literature search (public REST API, no key): PMID or source id, title, authors, journal, year, DOI, cited-by count and Europe PMC link. Covers life-science papers including preprints; abstracts are not included.

Checks whether a host (domain or IP) is known to abuse.ch URLhaus as a malware distribution host: first seen, number of malware URLs, Spamhaus DBL / SURBL status and the latest URLs with status (online/offline), threat type, tags, reporter and URLhaus reference.

Defector articles from its public RSS feed (keyword filter on title/summary/tags). Latest items only; excerpts are as published in the feed. Public feed, no key.

Maps an IPv4 address to its origin AS number, the BGP prefix that covers it, the country, the registry and the allocation date, using Team Cymru's public IP-to-ASN DNS service. Returns no origin when Cymru has no mapping for the address.

For a mail domain: lists up to 3 MX hosts with their IPv4 addresses and, from Shodan's pre-collected passive scan data, which SMTP ports (25, 465, 587) were seen open on each address. Passive and possibly old; no SMTP conversation, banner, STARTTLS or certificate test is made.

Checks how a site's home page answers a cross-origin request from a made-up origin: whether it echoes that origin back, sends a wildcard (*), and whether credentials are allowed with it. Echoing an arbitrary origin together with credentials is the risky case. One GET of the home page; it does not test API routes or the null origin.

Reads a site's public crossdomain.xml (Adobe Flash) and clientaccesspolicy.xml (Silverlight) if they exist, lists the origins they allow, and flags wildcard grants ('*'). Old policies are rarely needed now, so a wildcard here mostly means leftovers; absence is the normal case.

New York Times home page headlines from the public NYT RSS feed (latest items; keyword filter on title/summary/categories). Headlines and abstracts only. Public feed, no key.

FreightWaves latest news from its public RSS feed (keyword filter on title/summary/categories). Feed carries only the latest few items. Public feed, no key.

DNSSEC check for a domain: whether a DS record exists at the parent zone (the domain is signed), and whether two public validating resolvers (AdGuard DNS, NextDNS) return its A answer with the AD (authenticated) flag. It reads the resolvers' verdict; it does not validate the signature chain itself.

DataCite DOI search (public REST API, no key): DOI, title, publication year, resource type, publisher, creators and landing page for datasets, software and other research outputs. Metadata only.

Reverse DNS (PTR) names for an IPv4 address, and forward-confirmed reverse DNS: whether each PTR name resolves back (A record) to the same address. Up to 3 PTR names are checked. Many addresses have no PTR record; that is a normal answer.

Checks the live HTTP response headers of a site's home page (one GET, https) for Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy and Cross-Origin-Opener-Policy. Returns present/missing headers with their values and a score out of 7. It does not judge the quality of the values.

US Department of Justice press releases from the justice.gov public RSS feed (keyword filter on title/summary). Latest items only. Public feed, no key.

Reads the Impressum (legal notice required on German websites, §5 TMG/DDG) at the page URL you give: e-mail addresses, phone numbers, postal address lines and the notice text as Markdown. Values are read from the page as published; no check that the operator is correct.

Reports whether Shodan's pre-collected passive scan data shows SNMP (UDP port 161) seen open on an IPv4 address. Passive and possibly old; no community string is tried, so default or public community access is not tested.

Lists the TCP ports Shodan has seen open on an IPv4 address, from its pre-collected passive scan data (not a live scan: nothing connects to the address now). The record can be days old, and an address with no record returns known=false, which does not prove the ports are closed.

Checks Shodan's passive scan records for TCP port 3389 (RDP) on an IPv4 address. Says whether RDP was seen open (not a live test, and the record can be days old). An address with no Shodan record returns seen=false with known=false; that is not proof the port is closed.

Checks an IPv4 address against the Blocklist.de 'all' list of IPs reported for attacks such as failed logins, SSH and mail abuse (about 24,000 addresses). A hit means it was reported recently; the list keeps only current reports.

EPSS (Exploit Prediction Scoring System) for one CVE from FIRST's public API: the estimated probability (0 to 1) of exploitation in the next 30 days, its percentile among all scored CVEs and the scoring date. EPSS predicts; it does not say an exploit exists (see cisa-known-exploits).

Checks a domain against SURBL's multi-list (multi.surbl.org): whether it appears in spam or phishing URI lists. Listed domains return a 127.0.0.x code. Not listed means not in SURBL's current lists, not that the domain is safe.

Figshare public article search (public API, no key): id, title, DOI, publication date, item type and public page link for research articles, datasets and figures. Searches titles and metadata; file contents are not returned.

Reuters latest articles from Reuters' public news sitemap (no key): headline, article URL and publication time, newest first. Covers only the most recent items in the sitemap; headlines and links only, no article text. Optional keyword filter on the headline.

Hacker News story search through the official HN Search API (Algolia, public, no key): title, article URL, author, points, comment count and discussion link. Returns stories only, most relevant first.

Semafor articles from its public RSS feed (keyword filter on title/summary/categories). Latest items only. Public feed, no key.

Decodes a JWT you supply (header and payload, base64url JSON) and reports its algorithm, key id, claims, and time checks (exp, nbf, iat). Flags alg none, symmetric HS algorithms, missing exp and a jku/x5u key reference. It does not verify the signature, because no key is given, and it does not fetch the key URL.

Unpaywall open-access lookup by DOI (free API; it requires a contact e-mail set in UNPAYWALL_EMAIL, not a key): is the paper open access, OA status, best free full-text link, journal and publisher. Returns metadata and links only, not the PDF.

For an autonomous system (e.g. AS13335): how many upstream (transit) and downstream neighbours RIPEstat sees in BGP, the top upstreams ranked by 'power' with their IPv4 and IPv6 peer counts, and the top downstreams. Built from RIS route collector paths, so it is an observed view, not the contract.