Two new paid security-audit endpoints just shipped on the x402 endpoint catalog at
the existing 26-endpoint service. Both at $0.0005 USDC per call (sub-cent tier)
on Base mainnet. No signup, no API key — just pay 0.0005 USDC and call.
What they do
GET /api/cookies?url=URL — fetches the URL, parses every Set-Cookie header
(handles multiple cookies in one response + RFC-6265 bis draft extensions),
returns per-cookie metadata + security findings + an A-F privacy grade.
Per-cookie fields: name, value (redacted for session-shaped names), domain, path,
expires, max-age, secure, httponly, samesite, partition_key, priority, and a
third_party detection flag.
Findings emitted (severity-coded):
- httponly_missing_on_session (high) — cookie name matches session/token/csrf/auth but missing the HttpOnly flag
- secure_missing_on_https (high) — set over HTTPS without the Secure flag
- samesite_none (medium) — SameSite=None exposes the cookie to cross-site requests
- third_party_cookie (high/medium) — domain attribute differs from request host
GET /api/csp?url=URL — fetches the URL, extracts the Content-Security-Policy
response header (and Report-Only if present), parses every directive into typed
source tokens, reports dangerous patterns + A-F grade.
Source-token classification: self, unsafe-inline, unsafe-eval, wasm-unsafe-eval,
unsafe-hashes, none, nonce-xxx, sha256/384/512-xxx, data:, blob:, filesystem:,
mediastream:, host (https://cdn.example.com), scheme (https:), wildcard (),
wildcard-subdomain (.example.com), other.
Findings emitted:
- no_csp (high) — no Content-Security-Policy header at all
- unsafe_inline (high) — script-src allows unsafe-inline without strict-dynamic compensating
- unsafe_eval (medium) — script-src allows unsafe-eval
- wildcard_script_src (high) — wildcard source in script-src lets any origin run JS
- wildcard_frame_ancestors (high) — wildcard in frame-ancestors allows clickjacking via iframe from any site
- object_src_not_none (medium) — object-src not set to none
- no_frame_ancestors (low) — no frame-ancestors directive at all
Live examples
github.com — both endpoints return grade A. 3 cookies all Secure+HttpOnly+SameSite=Lax,
all same-site. CSP has 15 directives including frame-ancestors none (no clickjacking)
and script-src github.githubassets.com (no unsafe-inline, no unsafe-eval).
stripe.com — 1 cookie (cid) with Secure+SameSite=Lax but no HttpOnly (not flagged
because name is not session-shaped). Strong CSP with base-uri none + child-src none.
example.com — 0 cookies. NO Content-Security-Policy header at all — grade F for CSP,
grade A for cookies.
Why sub-cent
Security audits at scale are price-sensitive: a single agent scanning 1000
target sites for cookie hygiene would cost $0.50 at $0.0005/call vs $5 at the
$0.005 tier. The x402 micropayment rail makes sub-cent pricing economically
viable — no payment-processor fixed fees to amortize.
Try it
Full 26-endpoint catalog at /.well-known/x402 or /llms.txt (LLM-friendly text),
or the OpenAPI 3.1 spec at /openapi.json. From an x402 client (Python
x402ClientSync with ExactEvmScheme on Base mainnet), just call any endpoint —
the SDK signs the EIP-3009 transferWithAuthorization and the facilitator at
pay.openfacilitator.io broadcasts the settlement.
The new endpoints join the existing 24 covering URL metadata, social-card
extraction, feed discovery, clean Markdown extraction, page outlines,
canonical/hreflang, robots/sitemap/tech detection, body hashing, structured
data (JSON-LD + microdata + RDFa), email extraction, header audit, redirect
chain tracing, DNS-over-HTTPS, WHOIS via RDAP, TLS/SSL inspection, HTTP timing
breakdown, TCP port scanning, two-URL metadata diff, and favicon extraction —
all priced between $0.0005 and $0.005 USDC per call.
Top comments (0)