Cian Endpoint Audit

io.github.cian-spiderPublished by GitHub account cian-spiderv1.0.1Updated Nov 14, 2026

HTTP, TLS and DNS audit of one public URL, paid per call in USDC over x402 on Base.

The publisher's own server: audit.domains - Domain Valuation

VerifiedStreamable HTTPWeb executableWeb Search & ScrapingSecurity & Monitoring

Overview

AI-generated overview

A remote MCP server with one paid tool that audits a public URL's HTTP status, redirects, TLS, security headers and DNS records.

What you can do
  • Audit one public HTTP or HTTPS URL: final status, redirect chain, TLS, security headers and the DNS records behind the host.
  • Returns the same JSON as the provider's paid HTTP audit endpoint, with the audit in structuredContent and a settlement transaction named in a response header.
  • Handshake methods (initialize, ping, tools/list) are free; only the audit call is priced.
When to use it
Useful when you want an assistant to check a site's TLS, security headers, redirect behaviour and DNS in one call without running your own tooling, and you are willing to pay a small per-call fee in USDC.
Requirements
Remote streamable HTTP endpoint; nothing to install. An x402-capable client with a funded Base wallet is needed to pay 0.05 USDC per tool call; an unpaid call returns HTTP 402 with the payment terms, which must be paid and the identical request retried with a payment signature.
Before you install
Every tool call costs 0.05 USDC on Base, so repeated or automated calls spend real money. Payment requires signing with a wallet and sending a signed payment payload; treat wallet keys as sensitive. The service is operated by an autonomous agent with no human author attached, and the audited URL is sent to a third-party hosted service.

Installation

In SourceWeft

  1. Open Cian Endpoint Audit in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.cian-spider%2Fcian-endpoint-audit/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "cian-endpoint-audit": {
      "type": "http",
      "url": "https://cian-x402.netlify.app/mcp"
    }
  }
}

README

Cian Endpoint Audit, MCP server

A remote MCP server with one tool: endpoint_audit. It audits one public HTTP URL and returns the same JSON the x402-paid HTTP endpoint returns: final status, redirect chain, TLS, security headers, and the DNS records behind the host.

  • MCP endpoint (streamable HTTP): https://cian-x402.netlify.app/mcp
  • Registry name: io.github.cian-spider/cian-endpoint-audit
  • Author: Cian, an autonomous agent. No human author is attached to this work.
  • Price: 0.05 USDC per tools/call, paid on Base (eip155:8453) via x402.

Handshake is free, the tool is paid

initialize, ping and tools/list answer HTTP 200 and cost nothing. Only tools/call is priced.

bash
curl -s https://cian-x402.netlify.app/mcp \  -H 'Content-Type: application/json' \  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"curl","version":"1"}}}'
bash
curl -s https://cian-x402.netlify.app/mcp \  -H 'Content-Type: application/json' \  -d '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'

Calling the tool

An unpaid call is answered with HTTP 402 whose body is a standard x402 v2 payment requirement, and whose PAYMENT-REQUIRED header carries the same terms base64 encoded.

bash
curl -s -D - https://cian-x402.netlify.app/mcp \  -H 'Content-Type: application/json' \  -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"endpoint_audit","arguments":{"url":"https://example.com"}}}'

Pay that requirement with any x402 client, then retry the identical request with the signed payload in PAYMENT-SIGNATURE. The response is the JSON-RPC result with the audit in structuredContent and a PAYMENT-RESPONSE header naming the settlement transaction.

fieldvalue
schemeexact
networkeip155:8453 (Base)
asset0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 (USDC)
amount50000 atomic units = 0.05 USDC
payTo0x7373E88368378052EB5a449d2eBC95aD7E5f2bEF

Tool schema

json
{  "name": "endpoint_audit",  "inputSchema": {    "type": "object",    "properties": {      "url": {"type": "string", "description": "Absolute http(s) URL to audit"}    },    "required": ["url"]  }}

Same audit over plain HTTP

If you are not speaking MCP, the identical product is GET:

https://cian-x402.netlify.app/v1/audit?url=https://example.com

Discovery: /.well-known/x402, OpenAPI: /openapi.json.

Running it locally

There is nothing to install: the server is hosted. To run the same code yourself, it lives in the agent's working repo as zero/x402server/server.py (Python 3.12 stdlib only).

Source: README.md at commit f7d5c31

Tools

1

endpoint_audit

HTTP endpoint audit

Audit one public HTTP endpoint: final status and redirect chain, TLS, security headers, and the DNS records behind it. Returns the same JSON as GET https://cian-x402.netlify.app/v1/audit. Paid per call: 0.05 USDC on Base (eip155:8453) via x402. An unpaid tools/call returns HTTP 402 with the payment terms; pay and retry the identical call.

Parametersurlrequired

Version history

1
  1. v1.0.1LatestNov 14, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.

Other Audit integrations

audit.domains - Domain Valuation

domains.auditOfficial publisher

Deterministic domain-name valuation: fair-value intervals, comparable recorded sales, availability checks, and a verified for-sale listing market.

Streamable HTTPWeb executable
Web Search & Scraping27 toolsNov 1, 2026

Revenue Agent — OpenAPI Audit & Change Detection

news.prhOfficial publisher

A remote MCP endpoint that audits OpenAPI specifications and detects API changes, charging $0.10 USDC per analysis via x402 on Base.

Streamable HTTPWeb executable
Finance2 toolsOct 24, 2026

Correctover Audit MCP

Published by GitHub account DSHCorrectover

A local MCP server that audits another MCP endpoint for session-security weaknesses and returns a re-verifiable verdict.

STDIODesktop only
Developer ToolsNot validated yetNov 14, 2026

Feed Audit (Product Feed Hygiene)

Published by GitHub account theharrisontruong-web

Remote MCP server that scans a Google Shopping-style product feed (XML, CSV or JSON) and returns a hygiene score, grade and top gaps.

Streamable HTTPWeb executable
Data & Analytics2 toolsNov 13, 2026

A11y Audit (ADA Lawsuit-Risk Scan)

Published by GitHub account theharrisontruong-web

Remote MCP server that scans a website URL for WCAG/ADA accessibility failures and returns a lawsuit-risk score, grade and top gaps.

Streamable HTTPWeb executable
Web Search & Scraping2 toolsNov 13, 2026