Every agent-payable API.

Vulnerability trend for a vendor (optionally one product) from the NIST NVD: CVEs published in the last N days (default 7, up to 120; a big vendor over a long window can take NVD 30+ seconds) naming the vendor (or mapped to its CPE with match=cpe), counts by severity, average and maximum CVSS score, CVEs per week, top CWE weaknesses and the highest-scored CVEs with score, severity, vector, date and description.

DEV Community (dev.to) latest articles for one tag (public DEV API, no key): title, author, publish time, reactions, comments, reading time and link. Search by tag only; the public API has no free-text search.

Checks whether an email address's domain (or a domain you give) is on the community disposable and temporary email blocklist (about 9,900 domains). Only the domain is checked, never the mailbox, and a domain missing from the list is not proven to be permanent.

From Shodan's pre-collected passive scan data: whether TCP port 22 was seen open on an IPv4 address and any OpenSSH version identified in its software (CPE) list. This is passive and may be days old; it is not a live SSH banner grab or algorithm audit.

Shodan InternetDB summary for an IPv4 address (free, no key): open TCP ports, host names seen, CPE software identifiers, tags and CVE IDs Shodan associates with the host. Data is from Shodan's last scan, so it can be days old; an IP with no data returns empty lists with known=false.

Checks an IPv4 mail-sending address against the SpamEatingMonkey DNS blocklist (bl.spameatingmonkey.net) through public DNS. A listed address returns its 127.0.0.x return code; an unlisted one returns no record. Listings change often; this is a point-in-time answer.

Cisco Talos reputation for an IPv4 address: threat level (favorable, neutral, poor, untrusted), web reputation score, forward/reverse DNS match, hostname, owner, location, email volume magnitude (daily, monthly and last 30 days), the /24 network's average magnitude and how many neighbouring addresses in that /24 Talos rates untrusted, poor, neutral or favorable.

Medscape eMedicine (Medscape Reference) clinical articles by specialty: title, topic category, article id and URL from the public specialty index, filtered by words in the title. With details=true the first 5 matches also get summary, author, last-reviewed date and paywall flag from the article page. Metadata only, no article text (Medscape articles need a free login).

The Intercept articles from its public RSS feed (keyword filter on title/summary/categories). Latest items only. Public feed, no key.

TechCrunch latest articles from its public RSS feed (keyword filter on title/summary/tags). Headlines and excerpts only. Public feed, no key.

Domain registration facts via RDAP (IANA bootstrap, then the registry's own server): registration, last change and expiry dates, days left, registrar name, status flags, nameservers and DNSSEC delegation flag. Registrant contact data is usually redacted by registries and is not returned.

ShanghaiRanking Global Ranking of Academic Subjects (GRAS): for a subject (55, e.g. Mathematics, Computer Science, Clinical Medicine, Economics) and year, ranked universities with rank or band, total score, the five indicator scores, country and institution URL. Filter by country or university name. Without a subject, lists the subjects and their codes.

Checks an IPv4 address against the CI Army (CINS Score) bad-IP list, a collective-intelligence list of addresses that recently showed hostile activity across a sensor network (about 15,000 entries). Listed means it is on the current list; the list is a snapshot.

Public product metadata of a Shopify store from its storefront products.json feed (no key): title, handle, vendor, product type, tags, publish and update times, price range, variant and image counts and product link. Only stores that expose products.json; stores that block it return 404.

TLS versions a host accepts (SSL 3, TLS 1.0 and 1.1 flagged as deprecated) and its cipher-suite strength from Qualys SSL Labs' cached report: suite count per protocol, weak suites (RC4, 3DES, NULL, EXPORT, DES, anonymous), and whether forward secrecy is offered. Reads existing reports only; a host that was never scanned returns a retry error.

Asks two independent public DNS resolvers (AdGuard DNS and NextDNS) for the same name and record type right now and reports whether they agree, with each answer set and its lowest TTL. It shows cache and geo-DNS differences between resolvers; it is two vantage points, not a worldwide propagation survey.

Post archive of a beehiiv newsletter (by beehiiv subdomain, e.g. superhuman, or the newsletter's own domain if hosted on beehiiv): newsletter name, total posts, and per post title, subtitle, URL, publish time, authors, free/premium audience, tags and reading time, 10 per page, newest first. Optional word filter within the page. Public archive data, no key; post bodies are not returned.

Checks a URL or host against the OpenPhish public phishing feed (about 300 currently active phishing URLs, updated continuously). Returns whether the exact URL or any URL on the same host is listed, the feed size and up to 5 example URLs. Not listed does not mean safe; the feed is short and changes fast.

CISA's Known Exploited Vulnerabilities catalog (public JSON). With cveId: whether that CVE is on the list, with vendor, product, date added, federal due date, required action and ransomware-use flag. Without it: catalog size, release date and the newest additions (up to 50). Listing means exploitation was reported, not a risk score.

Looks up one MITRE ATT&CK technique (e.g. T1059 or T1059.001) on its official public page: its name, the tactic-level summary text and the page title. Reads one page per call; it does not return the whole matrix or a technique's sub-techniques list.

One CVE record from the NIST National Vulnerability Database: description, published and last-modified dates, NVD status, primary CVSS score and severity (v4.0, 3.1, 3.0 or 2.0, whichever NVD marks primary first), CWE weakness IDs and up to 5 reference URLs. It does not say whether the CVE is being exploited (use cisa-known-exploits or epss-exploit-score for that).

Looks up a file hash (SHA-256, SHA-1 or MD5) in abuse.ch MalwareBazaar: whether the sample is known, its other hashes, file name, type, size, signature (malware family), first/last seen, reporter, origin country, delivery method, tags, download count and code-signing info. Metadata only; the sample itself is never downloaded.

Has this place been built on or cleared in the last 12 months? Sentinel-2 satellite change detection for any lat/lon: NDVI/NDBI deltas, change direction, confidence and the scene-by-scene evidence.

Domain -> security letter grade (0-100, A-F) from HTTPS reachability, security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy), and CAA records. Reports HTTPS connect success/failure, not raw cert expiry -- Workers can't read a remote server's cert metadata directly. For registration facts use /domain-intel; for URL reputation use /linkcheck.

Crawls the sitemap of the given domain and returns all discovered page URLs. Supports sitemap index files (recursive), parallel fetching with concurrency control, deduplication, and filters out non-page resources (images, PDFs, etc.).

Prüft am Objekt sitemap den Befund Zahl der Adressparameter.

Prüft am Objekt sitemap den Befund technische Indexierbarkeit.

Prüft am Objekt sitemap den Befund deklarierte Crawl-Verzögerung.

Prüft am Objekt sitemap den Befund Vorkommen in der Sitemap.

Prüft am Objekt sitemap den Befund Freigabe durch robots.txt.

Prüft am Objekt sitemap den Befund Wert des X-Robots-Tags.

Prüft am Objekt sitemap den Befund selbstreferenzierende kanonische Adresse.

Prüft am Objekt sitemap den Befund HTTP-Status der Sitemap.

Prüft am Objekt sitemap den Befund ausgelieferten Inhaltstyp.

Prüft am Objekt sitemap den Befund Wert der Meta-Robots-Angabe.

Sitemap extractor: find a domain's sitemaps through robots.txt and the standard location, then list the page addresses they declare

Sitemap reader: list a site's URLs with lastmod (handles sitemap indexes) — Genesis402 / UnyKorn Operator Network

Read one public XML sitemap or sitemap index as structured URLs and source-reported dates. Supports gzip, substring filtering and pagination. Maximum 512 KiB expanded input and 1000 entries. Does not crawl pages or follow child sitemaps. Invalid XML and execution errors are not charged; a valid empty match is charged. Use to find which pages of a docs site to read before calling /extract.

Six cited owner-action lanes for one US address: curated and derived programs, exact program dates, the state appeal rule, state tax framing plus county source pointer, FEMA LOMA point-elevation screen when applicable, and the parcel special-valuation screen. Returns charged:false unless at least two sections are substantive. Lists programs and rules only; no eligibility or action recommendation. npx @velinussage/locus-agent-skill add.

Match exact recipient and amount for a confirmed native USDC transfer.

Download PDF evidence of USDC transfer, not an invoice.

Read-only native Circle USDC transfers across six EVM chains and Solana.

Ranked web search results with real source URLs from DeepSeek Search. No synthesis, no fabricated hits.

Deterministic structured extraction of one public page: title, headings, readable blocks, metadata and source evidence. No model inference.

Deterministic extraction plus bounded DeepSeek Flash JSON analysis with source citation and prompt-injection isolation.

Bounded retrieval of one public page as Markdown or text with byte counters and truncation flags. Raw HTML is never returned.

Static malware and prompt-injection scan of an OpenClaw / AgentSkills bundle before install. Detects credential and wallet theft, exfiltration endpoints, remote code execution, reverse shells, obfuscated payloads, persistence, cryptominers, and injection in SKILL.md. Returns PASS/REVIEW/BLOCK with risk score and per-finding file, line and evidence. bundle = {files:[{path,content}]} or {github:'owner/repo/path'} or {content:'...'}.

Skill Scan by Agentropolis: static Consensus Scan of an MCP server or agent skill before you install it. Pass a GitHub repo, npm:/pypi: package or pasted code + tools/list/SKILL.md. Flags tool poisoning, hidden instructions, credential/env exfiltration, remote code exec, obfuscation, install hooks; 2 rule families + 2 LLM reviewers vote; cross-checks Agentropolis seller trust data. Returns allow/review/block with evidence. Read-only, never executes the code. Advisory.

Bundled execution of the API health check workflow - Is this API endpoint healthy? Liveness check, response headers, and TLS certificate status in one pass. One x402 payment runs 3 underlying tools (http-check, http-headers, tls-cert); partial-success per step.

Bundled execution of the Article digest workflow - Quick research brief on any topic - web search results plus an AI-generated answer in one pass. One x402 payment runs 3 underlying tools (search, answer, search-news); partial-success per step.