All projects matching “headers”

Audit a URL's HTTP security headers over a single body-free (HEAD) request. Grades Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, flags information-leak headers (Server, X-Powered-By), and returns the parsed values plus advisory warnings. Clean JSON for security and pentest automation.

Sends a real request to any URL you provide, attaches an Origin header, and reads back all six standard cross-origin permission headers the server returns. Tells you whether cross-origin requests are enabled at all, whether your specific origin is permitted, and shows every permission value exactly as the server sent it. Useful for finding why a browser is blocking a request, confirming a new depl

Sends a request to a web address you provide and reports back everything the server said in response: the status code, all the response headers, how many times it got redirected, and how long the whole thing took.

Fetch a site's robots.txt and evaluate crawl permissions: given a URL (plus optional extra paths) and a user-agent, return whether each path is allowed or disallowed, the rule that matched, the user-agent group, the crawl-delay and any declared sitemaps. Implements the Robots Exclusion Protocol (RFC 9309) with longest-match-wins, Allow-over-Disallow tie-breaking and * / $ wildcards.

Fetches a public http(s) URL (GET, up to 5 redirects, 10s timeout, body never read) and grades its security headers A+ to F. Returns score, present and missing headers, per-header findings with copy-paste fix values, and cookie flag issues.

Fetch a public https CSV URL and parse it into headers + rows ($0.005 USDC via x402). https only — http, file, data, localhost, and private IPs are rejected. Caps: 1 MB body, ~10s timeout, max 5 redirects, max 5000 data rows (truncated with warning). Optional has_header (default true). Returns JSON { url, final_url, content_type, headers, rows, row_count, warnings }.

Response headers and security-header report for a URL

Fetch one URL from a residential IP and get the raw response as JSON: status, final URL, headers and body (text or base64), up to 10 MB. GET, HEAD or POST, your own headers, an optional country. No JavaScript rendering. You pay for the megabytes delivered; a fetch that fails is not charged. Pay per call in stablecoins.

Extract tables from a PDF ($0.01 USDC via x402). Pass pdf_base64 or a https pdf_url. Optional schema maps headers. Optional max_pages (1-10). Returns JSON { pages, tables: [{ page, headers, rows }], warnings }. Text PDFs are parsed in-worker; scans require HOSTED_PARSER_URL.

Fetch a page and return content, headers, and metadata. $0.01 per request.

Cheapest real end-to-end test of your pay-per-call (HTTP 402) client: pay US$0.002, get back what was paid (payer, amount, network, timestamp) and the text you sent; the settlement receipt is in the PAYMENT-RESPONSE header. A free trial call returns paid_usd 0. Use it to check a wallet, a client library or a facilitator before buying something bigger.

POST any JSON payload to any webhook URL with custom headers and method. Let your agent trigger downstream systems in one call. Pay per call with USDC (x402) or credits - archtools.dev

Inspect a public URL: HEAD redirect trace, DNS A/AAAA observations and security headers in one report. At most 4 targets, no page body. Includes timestamps, partial-result warnings and factual findings; no safety or reputation verdict.

x402 pre-listing QA probe: validate your endpoint's 402 challenge, header sizes, and payment schema before listing

URL preflight - status, redirect chain, key headers, response time, robots.txt rules for the path and sitemap location

SSRF-safe public GET with status, headers, and size-capped JSON/text body for agent tool use

Does a website use Beaver Builder? Fetches the page (homepage for a bare domain) and matches Beaver Builder's fingerprints in the HTML and response headers, returning yes/no with the evidence snippet and the category (page-builder). Technographics for sales, competitor research and migration planning, one technology per call. $0.01 per check.

Observe public DNS, TLS and baseline response headers through HTTPS HEAD / on port443; no full-path scan or global trust assessment.

Request an https URL and report whether it is reachable, its status, every redirect hop with timings, key and security headers (HSTS, CSP and others), and the TLS certificate with its issuer, the names it covers and the days until it expires. An unreachable URL is a result too, with the reason.

Queries target URL headers to score security configurations (HSTS, CSP, X-Frame-Options).

Audits a website for AI agent and AI crawler readiness from caller-supplied inputs: robots.txt, HTML, headers, llms.txt, sitemap lastmod, /.well-known. Names the policy per AI token (GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, Claude-SearchBot, Claude-User, PerplexityBot, Perplexity-User, Google-Extended, Gemini-User, KagiBot, Kagi-User, Applebot-Extended, Bytespider, CCBot, Amazonbot, meta-ex

Library sources that are new or updated in an inclusive date window. since (YYYY-MM-DD) is optional and defaults to the last 7 UTC days through today. Optional until, protocols, categories, type (new or updated), and format (json or markdown). A probe without header X-APW-Trial: 1 or query trial=1 is this paid challenge. One request is 0.01 USDC.

One call, whole outside view of a domain: DNS records, email authentication grade (SPF, DMARC, MTA-STS), TLS certificate expiry and chain, post-quantum key exchange (X25519MLKEM768), HTTPS security headers, and a to-do list.

Checks an x402 API origin the way x402scan, the CDP Bazaar and agents read it: fetches /openapi.json and /.well-known/x402, then calls each paid route without paying (up to 30) and decodes its 402. Reports routes that do not answer 402, missing or v1-only PAYMENT-REQUIRED headers, prices that differ from the OpenAPI document, resource URLs that differ from the route, wrong USDC EIP-712 domains, mi

Builder tool for agents: FREE GET /product/bazaar-check.json?url= → indexed yes/nein + issues_found count (teaser). PAID GET/POST /product/bazaar-check/report.json?url= ($0.05 USDC Base) → 402 header compliance, extensions.bazaar schema validation, CDP quality fields, concrete Fix-JSON. Fail-soft. English-first. Brand: geld machen.

Request an https URL and report whether it is reachable, its status, every redirect hop with timings, key and security headers (HSTS, CSP and others), and the TLS certificate with its issuer, the names it covers and the days until it expires. An unreachable URL is a result too, with the reason.

Pay $0.01 USDC to make an outbound HTTP request through the proxy. Supports all standard HTTP methods, custom headers (including auth), and JSON or raw bodies. Responses are returned as text or base64-encoded binary. Max response size 10 MB, timeout 30s. Each request performs one upstream fetch and returns the final URL plus response metadata.

Schedules a delayed HTTP callback: give a public URL, an optional JSON body, optional headers and a delay of 60 seconds to 7 days (or an absolute time), and this host calls the URL at that time (POST when a body was given, otherwise GET), with one retry and a 10-second timeout. GET /later/<id> reports whether it fired and the status code the callee answered. A request that is refused is not charge

Performs comprehensive URL health checks, measuring response time, status code, security headers, and TLS/SSL certificate validity. Route: GET /paid/health-check?url=https://example.com. Ideal for automated monitoring and endpoint auditing.

Is this x402 endpoint safe to pay? Vet an unknown seller BEFORE paying: pay/avoid verdict, 0-100 trust score, live 402 probe, scam flags (payTo hijack, bait-and-switch pricing, honeypot, wrong asset) and an on-chain check of the receiver on Base. Reads x402 v1 (body) AND v2 (PAYMENT-REQUIRED header) — body-only checkers call live v2 services dead. ?endpoint=url; omit for a trust-ranked catalog.