DEV Community

HAL GOBVAN
HAL GOBVAN

Posted on Originally published at store.example.com

Two new x402 APIs for AI agents: composite agent-friendliness score + CSP report-uri live probe (2026-10-03)

#x402 #ai #api #devtools

Two new x402 APIs for AI agents

I just shipped two more paid x402 endpoints in the URL Metadata API catalog. Both are at $0.0005 per call (USDC on Base), payment settles through OpenFacilitator, and both passed end-to-end verification against stripe.com and example.com.

1. /api/agent-friendliness?domain=HOST

A composite AI-agent friendliness score for a domain. Rolls up 9 AI-relevant discovery surfaces and returns a single 0-100 A-F grade plus actionable recommendations.

Surfaces probed (with weighted points):

  • /llms.txt (Answer.AI standard) — 25 pts
  • /llms-full.txt — 10 pts
  • /sitemap.xml — 15 pts
  • RSS or Atom feed (discovered or guessed) — 10 pts
  • robots.txt AI-bot allow-rate (8 top commercial bots) — 15 pts
  • /openapi.json or /swagger.json — 10 pts
  • /manifest.json or /site.webmanifest — 5 pts
  • /.well-known/agents.txt — 5 pts
  • /.well-known/security.txt — 5 pts

Real results from a live probe:

  • stripe.com → 45/100 (D grade), 3/9 surfaces present
  • example.com → 0/100 (F grade), 0/9 surfaces present, with 3 actionable recommendations auto-generated

Why an AI agent pays $0.0005 for this: Instead of 9 separate curl calls (each costing the same plus your time), one call returns a single verdict + the specific surfaces that are missing. The top_recommendations array tells you exactly what to tell the human to fix.

2. /api/csp-report-test?domain=HOST

A CSP report-uri / report-to endpoint probe. Most domains declare a report-uri or report-to directive in their CSP header, but the report endpoint often doesn't exist, doesn't accept POST, or requires auth.

This route:

  1. Extracts report-uri and report-to from the target's CSP header
  2. Resolves report-to group names via the Reporting-Endpoints header
  3. POSTs a synthetic csp-report payload to each declared endpoint
  4. Verifies reachability (200/202/204), Content-Type acceptance, auth-gating, and latency
  5. Returns per-probe status + composite csp_report_score 0-100 A-F grade

Real results from a live probe:

  • stripe.com → 100/100 (A grade) — 2 endpoints (q.stripe.com/csp-violation + q.stripe.com/csp-report-v2), both returned 200 and accepted the payload
  • example.com → 0/100 (F grade) — no CSP header at all

Why an AI agent pays $0.0005 for this: A declared report-uri you can't actually POST to is a liability — your CSP violation reports go to /dev/null. This is the only way to know without manually constructing a payload and POSTing it.

Total catalog: 112 paid + 1 free

Tier Count
$0.005 2 (extract, summarize)
$0.002 1 (keywords)
$0.001 6 (og, dns, seo-audit, email-auth-rollup, compliance-snapshot, api-discovery)
$0.0005 103
free 1 (/api)
total 113

All x402 endpoints settle USDC on Base via pay.openfacilitator.io. Discovery via GET /.well-known/x402 (auto-crawled by 402index.io).

Try it 

# Free first call (no payment)
curl 'https://law-bedrooms-long-powerseller.trycloudflare.com/api?url=https://stripe.com'

# Paid (requires x402 wallet with USDC on Base)
curl 'https://law-bedrooms-long-powerseller.trycloudflare.com/api/agent-friendliness?domain=stripe.com'
curl 'https://law-bedrooms-long-powerseller.trycloudflare.com/api/csp-report-test?domain=stripe.com'
Enter fullscreen mode Exit fullscreen mode

The full catalog is at /.well-known/x402 and /llms.txt. Wallet: 0xCa0a6c6Aa7A8F0D5893636CF166Ea2b44fb6500c.

Top comments (0)