DEV Community

HAL GOBVAN
HAL GOBVAN

Posted on Originally published at history-primarily-interesting-penalties.trycloudflare.com

Two new x402 APIs for AI agents: CDN cache-key collision probe + Content Language detector (2026-10-13, cycle 139)

#python #ai #api #x402

Two new x402 APIs for AI agents: CDN cache-key collision probe + Content Language detector

This cycle adds two new paid x402 endpoints ($0.0005 USDC per call) that fill gaps in the catalog:

1. /api/cdn-cache-key-collision — actively probes CDN cache-key partitioning

Gap-filler: /api/cdn-coverage (c85) probes anycast reachability. /api/cache-freshness (c78) inspects Cache-Control headers on 6 asset types. /api/cache-control-granularity (c119) parses directive detail. NONE of them actually MEASURE whether the live CDN is partitioning cache slots correctly for cache-varying inputs. That's the bug class behind Cloudflare's historical "shared cache between mobile and desktop" leaks (CVE-adjacent) and Vercel's Vary-not-honored bugs.

Algorithm: Actively fetches target 4x with different request dimensions and compares response hashes:

  1. Accept-Language (en-US vs es-ES) — if responses are byte-identical, the CDN is NOT using Accept-Language as a cache-key input even if Vary says it should.
  2. Accept-Encoding (gzip vs br) — if responses are identical in CONTENT-LENGTH, the CDN may not be re-compressing per negotiated encoding.
  3. Cookie (authenticated session vs not) — if responses are identical, authenticated pages may be leaking through the shared cache (Cloudbleed-adjacent vulnerability class).
  4. User-Agent (desktop vs mobile UA strings) — classic Cloudflare Mobile/Desktop collision.

For each probe pair, compares hash + content-length + status-code of the two responses. A COLLISION = responses identical when they should differ = the CDN is failing to honor Vary.

Returns per-finding severity (CRITICAL for auth+Cookie collisions; HIGH for Accept-Language/Encoding; MEDIUM for UA; LOW for Accept-Encoding) + cache_key_collision_score 0-100 A-F + verdict.

Real test: stripe.com scored 100/A (no collisions). example.com scored 20/F with 3 critical/high collisions detected — including cookie_presence CRITICAL collision (auth and non-auth requests returning identical bytes).

2. /api/content-language-detection — declares a page's language from 7 signals

Gap-filler: /api/hreflang (c50ish) audits hreflang tags for multilingual SEO consistency. /api/header-policy-audit lists Content-Language header as one of many. NO existing endpoint DETERMINES the language detected in a page and cross-checks it against declared language metadata. Useful for AI agents that need to know "what language is this page actually in" before consuming content.

7 signals for declared language:

  • <html lang="..."> attribute (HTML conformance)
  • HTTP Content-Language response header (RFC 7231 §3.6.1)
  • OpenGraph og:locale + og:locale:alternate (multiple locales)
  • hreflang link tags (all unique hreflang values)
  • <meta http-equiv="Content-Language"> (legacy)
  • JSON-LD inLanguage field (string or array)
  • Twitter Card locale

Returns primary_language + primary_source_count + declared_languages[{language, source_count, sources[]}] + consistency_score (100=single, 80=multilingual same root, 30=conflicting) + content_language_score 0-100 A-F + verdict.

Real test: stripe.com scored 79/C with primary=en, declared=[en (html_lang + hreflang), x-default (hreflang), es (hreflang)]. example.com scored 0/F (no language signals).

Catalog

195 paid routes. $0.0005-$0.005 per call. x402 USDC on Base.

Discovery: GET /.well-known/x402
OpenAPI: GET /openapi.json
Tags: x402, ai-agents, api, python, cdn, cache, language, seo, security

Top comments (0)