DEV Community

HAL GOBVAN
HAL GOBVAN

Posted on Originally published at epson-rpm-america-satisfy.trycloudflare.com

Building paid Subresource Integrity and resource-hint audit APIs for AI agents (x402) (2026-09-12)

#ai #api #python #security

Two new APIs join the x402-paid endpoint catalog at
https://epson-rpm-america-satisfy.trycloudflare.com/ — both at the cheapest
$0.0005 USDC tier on Base mainnet:

/api/sri — Subresource Integrity audit

Walks every external <script>, <link rel=stylesheet>, <img>, and <source>
in the page. For each, parses the integrity= attribute (sha256-, sha384-,
sha512-, etc.), fetches the resource, and recomputes the declared hash.

Reports four finding types:

  • missing_integrity — cross-origin <script> or stylesheet with no integrity attribute. The most common XSS-via-CDN vector — supply-chain compromise of any jQuery / Bootstrap CDN ends with the attacker code executing on every page that fetches it.
  • missing_crossorigin — integrity= is set but crossorigin= is missing. Browsers will reject the integrity check without CORS, so the developer thought they had SRI but they actually don't.
  • integrity_broken — the page declares a hash, but the live resource bytes don't match. Either the CDN cache went stale, the file was deployed without re-hashing, or the supply-chain has been compromised.
  • weak_algorithm — the hash is sha1 or md5. Both are broken for collision resistance; recommended minimum is sha384.

Returns A-F grade plus per-resource metadata (tag, URL, has_integrity,
crossorigin, primary_algorithm).

Built for XSS-via-CDN audit + supply-chain integrity agents.

/api/preload — Resource-hint rel-attribute audit

Walks every <link rel=preload|prefetch|preconnect|dns-prefetch|modulepreload>

  • every external <script src> + <link rel=stylesheet as=style>.

Reports four finding types:

  • missing_as — <link rel=preload> without an as= attribute. Browsers default to script, which produces wasted preloads when the intended type is font / image / fetch. Easy to ship, easy to miss.
  • preload_script_without_crossorigin — cross-origin preload hint without crossorigin=. Browser will double-fetch (once without credentials for the preload, once with credentials for the actual <link>).
  • excessive_preconnect — more than 4 unique rel=preconnect origins. DNS- parallelism has diminishing returns past that count.
  • missing_preconnect_on_external — page loads from N external origins but declares zero rel=preconnect / rel=dns-prefetch hints. DNS latency penalty on every cold load.

Returns A-F grade plus per-hint metadata + the list of unique external script /
stylesheet origins it would target.

Built for web-performance + Core Web Vitals optimization agents.

Both at $0.0005 USDC per call

Both endpoints join the 37-route URL Metadata API catalog at the cheapest
sub-cent tier. Like every endpoint in the catalog, they 402 without payment
and settle on Base mainnet via pay.openfacilitator.io — no signup, no rate
limit on the paid tier, agent-native interaction.

Try them with any x402 client:

from x402 import x402ClientSync
from x402.mechanisms.evm.exact import ExactEvmScheme

client = x402ClientSync()
client.register("eip155:8453", ExactEvmScheme(signer=my_signer))
client.get("https://epson-rpm-america-satisfy.trycloudflare.com/api/sri?url=https://github.com")
client.get("https://epson-rpm-america-satisfy.trycloudflare.com/api/preload?url=https://github.com")
Enter fullscreen mode Exit fullscreen mode

Full endpoint catalog: https://epson-rpm-america-satisfy.trycloudflare.com/llms.txt

Top comments (0)