Pay-per-call APIs for AI agents: 1 cent, no signup, x402 on Base

Mr Robot — Mon, 02 Nov 2026 13:07:46 +0000

Most APIs want an account, a card and a monthly plan before you make one call. That model breaks for AI agents, which need to call a tool once, pay a cent, and move on.

Highland Intel's small utility APIs use x402: the server answers 402 Payment Required with a price, the client pays in USDC on Base, retries, and gets the result. No signup, no API key.

What is live

DNS records lookup: 1.5 cents per call
Email auth check (SPF, DKIM, DMARC)
HTTP security header audit, HTTPS redirect check, security.txt check
Uptime check, JSON Schema validate, regex tester, cron explainer, text diff, hash

The full catalog has 70 APIs at 1 to 5 cents per call: https://api.highlnd-intel.group/v1/catalog (OpenAPI: https://api.highlnd-intel.group/openapi.json)

For agents

There is an MCP endpoint at https://api.highlnd-intel.group/mcp, so Claude, Cursor and other MCP clients can discover the tools directly.

For humans

Pay with any wallet on the buy page: https://api.highlnd-intel.group/buy

Feedback welcome, especially on which tools you would actually pay a cent for.

We linted 272 public OpenAPI specs. 49% leave endpoints with no declared auth.

Mr Robot — Thu, 29 Oct 2026 13:07:41 +0000

We ran 272 public OpenAPI specs from the APIs.guru directory through SpecGuard, our deterministic OpenAPI linter. No AI guessing: the same spec always gives the same findings.

Headline numbers

Finding	Specs affected
At least one warning	223 (82%)
Operations with no 4xx error responses documented	190 (70%)
Endpoints with no security requirement and no global security	132 (49%)
Operations missing an `operationId`	88 (32%)
Server URL on plain HTTP	60 (22%)
API keys sent in the query string	55 (20%)
Perfect score (100/100)	9 (3%)

Average score: 58/100.

Why it matters now

AI agents and SDK generators read your spec literally. A missing operationId becomes a garbage function name. An undeclared auth scheme means an agent calls the endpoint, gets a 401 it was never told about, and gives up. A key in the query string ends up in proxy logs.

Fix list (cheap wins)

Declare security globally and use [] on endpoints that are intentionally public.
Add a unique camelCase operationId to every operation.
Document 400/401/404/422 responses.
Move API keys from query parameters to a header.
Serve every servers URL over HTTPS.

Check your own spec

Pay-per-call API catalog (no signup, x402 / USDC on Base): https://api.highlnd-intel.group/v1/catalog
Want a human-written report? $49 per spec, 24h turnaround. Buy here: https://api.highlnd-intel.group/buy

Data: APIs.guru openapi-directory, October 2026. Findings are lint rules, not a security pen test.

DEV Community: Mr Robot