X402 Paid Checks

Check a domain's SSL/TLS certificate expiry and renewal from CT logs. $0.01 USDC on Base per call. Returns issuer, validity, days left, % of lifetime used, renewal cadence and a renewal-stall heuristic from Certificate Transparency logs, plus a live HTTPS pass/fail probe. Don't use this for inspecting the exact certificate served live; details come from CT logs. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Check a domain's DNS records, DNSSEC, CAA, SPF and DMARC. $0.01 USDC on Base per call. Returns NS, A/AAAA/CNAME, MX, SPF, DMARC, CAA and DNSSEC via Cloudflare DoH, with plain-English findings and paste-ready fixes with dig verify commands. Don't use this for DKIM, MTA-STS or BIMI; use /v1/email-auth. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

When does a domain expire? Registration expiry and registrar via RDAP. $0.01 USDC on Base per call. Returns registrar, registration and expiry dates, days left, EPP status and nameservers. Within 60 days of expiry, fixes[] gives auto-renew steps for the registrar. Don't use this for SSL certificate expiry; use /v1/cert. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Check a domain's email authentication: SPF, DMARC, DKIM, MTA-STS, TLS-RPT and BIMI. $0.01 USDC on Base per call. Returns SPF validity and lookup count (limit 10), DMARC policy/pct/rua, DKIM on common selectors, MTA-STS mode, TLS-RPT, BIMI, a rough 0-100 score and plain-English findings. Don't use this for DKIM on custom selectors; only common selectors are checked. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Check a website's HTTP security headers and redirect chain. $0.01 USDC on Base per call. One HTTPS GET returns the redirect chain, final status, HSTS, CSP, X-Frame-Options and other headers, a simple A-F grade and plain-English findings. Don't use this for a full site security audit; use /v1/audit-report. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Get a domain security grade A-F with a per-category breakdown. $0.03 USDC on Base per call. Returns one A-F grade, a 0-100 score, points per category (TLS 25, email auth 25, headers 20, DNS 15, expiry 15) and the top fixes. Don't use this for raw cert, DNS and expiry data without a grade; use /v1/site-health. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Run a full website security audit with a prioritized fix list for a client or vendor review. $2 USDC on Base per call. Runs every OrionCMD check plus HTTPS redirect, www/apex, security.txt, robots.txt and sitemap. Returns the A-F grade, score and an action plan sorted critical to low. Don't use this for one quick check; single checks start at $0.01. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Check a domain's certificate, DNS and expiry together in one call. $0.03 USDC on Base per call. Returns a summary, the renewal-stall heuristic, the Let's Encrypt 64-day (2027-02-10) note and fixes[] with paste-ready DNS records and auto-renew steps, each with a verify command. Partial results if one source fails. Don't use this for an A-F grade; use /v1/domain-grade. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Is this domain malicious or named by ransomware? Domain threat check. $0.02 USDC on Base per call. Matches the hostname, parent domains and resolved IPv4 against ThreatCluster's high-confidence 30-day IOC feed and looks up ransomware leak-site claims. Returns one verdict: listed, claimed, listed_and_claimed or no_known_threat. Don't use this for many domains; use /v1/bulk-threat-check. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Check up to 100 domains or IPv4 addresses against a threat IOC feed in one call. $0.5 USDC on Base per call. Resolves each domain and matches names, parent domains and IPv4 against ThreatCluster's high-confidence 30-day IOC feed. Stale feed answers 503 before payment. Don't use this for ransomware claim lookups; use /v1/threat-check. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Set up monitoring for a list of domains (items) and get updates sent to your webhook_url. POST /v1/watch. $0.30 USDC on Base per call. Covers up to 25 domains for 30 days, each re-checked about once a day, with HMAC-signed webhook alerts. Use it when you want ongoing alerts; for a one-time check, call the matching single-check tool instead. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Is a vendor down right now? Current outage status for one SaaS vendor. $0.01 USDC on Base per call. Returns status, active-incident summary, last-checked time, source URL and freshness fields, read live from 60SecMonitor. Unknown vendors return 404, not charged. Don't use this for past incidents; use /v1/incidents. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

List recent outages and incidents for one SaaS vendor. $0.01 USDC on Base per call. Returns up to 10 most recent incidents (title, status, severity, start and resolve times) from 60SecMonitor. Unknown vendors return 404, not charged. Don't use this for live up/down status; use /v1/status. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Check whether up to 25 SaaS vendors are down in one call. $0.05 USDC on Base per call. Returns current status per vendor (comma-separated input) at one flat price, plus a list of vendors that are not operational. Not charged if no vendor is tracked or every lookup fails. Don't use this for a single vendor; /v1/status costs less. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Was this company hit by ransomware? Leak-site claim lookup by company name or domain. $0.01 USDC on Base per call. Returns matching ransomware-group claims with group, dates, country, sector and sources. Don't use this as proof of a breach; these are unverified claims from criminal leak sites. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Get the newest ransomware leak-site victim claims, optionally for one group. $0.01 USDC on Base per call. Returns up to 10 of the newest claims. Country and sector are often null. Commercially reusable sources only. Don't use this for checking a specific company; use /v1/lookup. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Look up a ransomware group profile: aliases, first seen and newest claims. $0.02 USDC on Base per call. Returns aliases, first observation by RansomLook and a sample of newest claims. Unknown groups return 404, not charged. Don't use this for tools, TTPs or momentum; use /v1/group-intel. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Check up to 25 vendor domains for ransomware leak-site claims in one call. $0.05 USDC on Base per call. Returns any matching claims per domain. found:false is not proof of absence. Don't use this for company names or more than 25; use /v1/bulk-check. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Build a third-party ransomware risk report for up to 100 vendors. $3 USDC on Base per call. Returns matching leak-site claims, a risk level per vendor (high = claim in last 90 days, elevated = last 12 months, historical, none_found, unknown), groups involved, a portfolio summary and follow-up actions. Don't use this for claims only; /v1/bulk-check costs less. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Check up to 100 vendors (domains or company names) for ransomware leak-site claims. $0.5 USDC on Base per call. Returns matching claims per vendor with group, dates and sources. Don't use this for risk levels and actions; use /v1/vendor-report. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Watch a list of company or vendor domains (items) for new ransomware leak-site claims, sent to your webhook_url. POST /v1/watch. $0.30 USDC on Base per call. Covers up to 25 vendors for 30 days, each re-checked about once a day. For a one-time lookup, use dragonseye lookup ($0.01) instead. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Is this domain or IP malicious? Check against a 30-day high-confidence IOC feed. $0.01 USDC on Base per call. Returns listed or not_listed, match type, stated reason, linked reports, ThreatCluster clusters and feed freshness. If the feed is older than 3 hours it returns 503, not charged. Don't use this as proof a domain is safe; no match is not proof of absence. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Check up to 100 domains or IPv4 addresses against a threat IOC feed in one call. $0.25 USDC on Base per call. Same check as /v1/indicator-check at one flat price. Stale feed returns 503, not charged. Don't use this for one indicator; /v1/indicator-check costs less. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Is this CVE exploited? CVE lookup with KEV, ransomware use, EPSS and public exploits. $0.03 USDC on Base per call. Returns CVSS, affected products, advisories, CISA KEV and ransomware use, EPSS, public exploit repos, an AI-generated ATT&CK attack flow (flagged) and D3FEND countermeasures. Uncached CVEs return 404, not charged. Don't use this for CVEs not yet cached; they return 404 and are queued. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Look up up to 50 CVEs in one call: KEV, EPSS, exploits and ATT&CK. $0.5 USDC on Base per call. Returns the /v1/cve record for each. Charged only if every CVE is covered; otherwise 404 before payment listing uncovered and covered ids. Don't use this for one CVE; /v1/cve costs less. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Get intel on a ransomware group: activity trend, tools, malware, ATT&CK and CVEs. $0.05 USDC on Base per call. Returns leak-site listing counts with a momentum status (30-day vs lifetime), reported tools, co-mentioned malware, campaigns, ATT&CK techniques and CVEs (not attribution), headlines and D3FEND defenses. Don't use this for attribution; co-mentions are not proof. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Write a late-fee reminder email for an overdue invoice. $0.01 USDC on Base per call. Calculates the late fee and returns a ready-to-send subject and body in a polite, firm or final tone. Bad input returns 400 and is not charged. Don't use this for sending email; it only returns text. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Turn a list of line items into a priced customer quote, with optional tax, discount, deposit, valid-days, currency, business name and better/best markup tiers. POST /v1/quote-pack. $0.05 USDC on Base per call. For plain totals only, use the free quote tool. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Pick free or freemium software for a small business by business type. $1 USDC on Base per call. Returns one tool per need from freesmallbiztools.com's checked listings (vendor quote and check date), with alternatives and caveats. Types: service, trades, retail, online_store, creator, consultant, agency, nonprofit. Don't use this for paid enterprise software comparisons. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Test why a real sent email lands in spam: SPF, DKIM, DMARC and deliverability report. $0.05 USDC on Base per call. Get a free test address via POST /v1/tests, send one email to it, then call this with test_id and X-Read-Token. Returns SPF, DKIM, DMARC, ARC, BIMI, rDNS, SpamCop, unsubscribe and content checks, a 0-100 score and top fixes. Don't use this for checking a domain without sending mail; use /v1/fix-plan. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Validate an email address before sending: syntax, MX, disposable and role account. $0.005 USDC on Base per call. Returns a verdict of ok, risky or undeliverable with syntax, MX, disposable (CC0 list), role account and free provider flags. Bad syntax returns 400, not charged. Don't use this for confirming a mailbox exists; no SMTP probe is made. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Get the exact SPF, DKIM and DMARC DNS records to publish for a domain. $1 USDC on Base per call. Reads live MX, NS, SPF, DKIM and DMARC, detects the mail provider and DNS host, and returns records in order (create, replace or keep) with one merged SPF and a staged DMARC policy. Don't use this for testing a real sent message; use /v1/report. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Grade a domain's email security: SPF, DMARC, DKIM and MX score. $0.01 USDC on Base per call. Returns a 0-100 score and A-F grade (SPF 30, DMARC 40, DKIM 25, MX 5) from live DNS, with findings and the top 3 fixes. Bad input 400, unknown domain 404, not charged. Don't use this for the exact records to publish; use /v1/fix-plan. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Validate an email address: syntax, MX, disposable and role account. $0.01 USDC on Base per call. Returns a verdict of ok, risky or undeliverable without sending mail. Bad syntax returns 400, not charged. Don't use this for confirming a mailbox exists; no SMTP probe is made. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Get the exact SPF, DKIM and DMARC records to publish, with steps for your DNS host. $1 USDC on Base per call. Reads live MX, NS, SPF, DKIM and DMARC, detects the mail provider and DNS host, and returns records in order with a staged DMARC rollout. Non-sending domains get a lock-down set. Bad input 400, unknown domain 404, not charged. Don't use this for a quick grade; use /v1/score. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Score email security (SPF, DMARC, DKIM, MX) for up to 100 domains in one call. $0.5 USDC on Base per call. Returns per-domain score, grade and issues plus a summary: grade counts, missing DMARC/SPF and worst 10. Bad input 400 and widespread DNS failure 502, not charged. Don't use this for one domain; /v1/score costs less. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Monitor the email security setup of a list of domains (items) and send updates to your webhook_url. POST /v1/watch. $0.30 USDC on Base per call. Covers up to 25 domains for 30 days; SPF, DMARC, DKIM, MX and score are re-checked about once a day. For a one-time score, use /v1/score ($0.01). [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Generate an invoice PDF from JSON. $0.02 USDC on Base per call. Computes line items, tax, discount and totals server-side; 12 currencies; multi-page. Validate free first at POST /v1/invoice/validate. Don't use this for sending the invoice; it only returns the PDF. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Write a payment reminder email for an unpaid invoice (friendly, firm or final notice). $0.01 USDC on Base per call. Returns subject and plain-text body, days overdue, the recommended tone and the next step. Template-based and deterministic. Don't use this for sending email; it only drafts. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Calculate a late fee on an overdue invoice. $0.01 USDC on Base per call. Flat, monthly % or annual %, simple or compounding, with grace days. Returns days late, fee, new total and a paste-ready invoice line. Don't use this for legal advice; state caps are not looked up. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Work out an invoice due date and early-pay discount from terms like Net 30 or 2/10 Net 30. $0.01 USDC on Base per call. Parses Net N, D/N Net M, Due on receipt, EOM and Net N EOM. Returns due date, days until due or overdue, discount and deadline, the annualized cost of skipping it and reminder dates. Don't use this for late fees; use /v1/late-fee. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Turn timesheet entries into invoice JSON. $0.02 USDC on Base per call. Hours x rate, optional rounding, grouping, expenses, tax and terms become a validated invoice JSON with totals, ready for /v1/invoice.pdf. Don't use this for the PDF itself; send the result to /v1/invoice.pdf. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Analyze accounts receivable aging from an invoice CSV or JSON export. $1 USDC on Base per call. Takes up to 1000 open invoices (QuickBooks, Xero, FreshBooks, Wave, Stripe or custom). Returns an A-F health grade, 0-100 score, aging buckets, overdue %, DSO and a collection priority list. Don't use this for a single invoice; use /v1/reminder-draft or /v1/late-fee. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Is a vendor down right now? Current outage status for one SaaS vendor. $0.01 USDC on Base per call. Returns status, active-incident summary, last-checked time, source URL and freshness fields, read live from PulseWatch. Unknown vendors return 404, not charged. Don't use this for past incidents; use /v1/incidents. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

List recent outages and incidents for one SaaS vendor. $0.01 USDC on Base per call. Returns up to 10 most recent incidents (title, status, severity, start and resolve times) from PulseWatch. Unknown vendors return 404, not charged. Don't use this for live up/down status; use /v1/status. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Audit one domain for website security and AI search visibility (AEO) in one call. $2 USDC on Base per call. Returns a site security grade, an AEO grade and one priority-sorted fixes[] list with paste-ready DNS, robots.txt, llms.txt and JSON-LD fixes and verify commands. Don't use this for asking AI engines whether they mention the brand; use /report. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Check if ChatGPT, Gemini, Claude, Perplexity and 12 other AI engines mention or cite a website. $9 USDC on Base per call. Returns per-engine answers to 5 category questions asked 3 times (240 answers), mention rate, citation rate, a visibility score and competitor share of mentions. Don't use this for technical crawl fixes; use /api/v1/scan. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Find why AI crawlers can't read a website, with paste-ready fixes. $0.05 USDC on Base per call. Crawls the homepage and up to 9 sitemap pages. Returns a score, grade and fixes covering robots.txt for 21 AI crawlers, AI bot blocks, browser vs crawler fetch gaps and JSON-LD checks. Don't use this for measuring brand mentions in AI answers; use /api/v1/report. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Check if ChatGPT, Gemini, Claude, Perplexity and 12 other AI engines mention or cite a website, as JSON. $9 USDC on Base per call. Same as /report: per-engine answers (240 total), mention rate, citation rate, visibility score and competitor share of mentions. Don't use this for a one-off crawl check; /api/v1/scan costs less. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Track a website's AI search visibility every week for 4 weeks. $19 USDC on Base per call. Runs the 16-engine report now, then each Monday until 4 successful runs. Returns a private tracking_url with a trend chart and competitor shifts, plus emails. Settles only if the first run succeeds (12+ of 16 engines). Don't use this for a single snapshot; use /api/v1/report. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Create a Dragons Eye watchlist from a list of entries (such as vendor domains), with a delivery target like a webhook_url, for ransomware claim alerts. POST /v1/watchlists. $2.00 USDC on Base per call. Covers up to 25 domains for 30 days; the response shows manage_token and webhook_secret once. For a one-time check, use the Dragons Eye lookup or bulk-check tools. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Renew an existing Dragons Eye watchlist by watchlist_id. You need the Authorization: Bearer manage_token you got when it was created. POST /v1/watchlists/renew. $2.00 USDC on Base per call. Adds 30 days. Don't use this to create a new watchlist; use /v1/watchlists. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Should we trust this vendor? One-call vendor safety check for a domain. $0.04 USDC on Base per call. Combines TLS certificate, DNS/DMARC, email-security score, ransomware leak-site claims (claims, not confirmed) and live outage status into a safe/caution/risk/incomplete verdict with reasons. Charged only if at least one check returns real data. Don't use this as proof of a breach. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]