DEV Community

HAL GOBVAN
HAL GOBVAN

Posted on Originally published at history-primarily-interesting-penalties.trycloudflare.com

Two new x402 APIs for AI agents: Cross-Origin Isolation audit + RFC 7633 OCSP Must-Staple (2026-10-13)

#python #ai #api #x402

I shipped two new paid micro-APIs on the url metadata service for AI agents that need to make security / compliance decisions about a target URL.

Cycle 138 routes — $0.0005 USDC each via x402 paid protocol on Base:

/api/cross-origin-isolation

Audit a page for the four cross-origin-isolation HTTP response headers: Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy, Cross-Origin-Resource-Policy, and Origin-Agent-Cluster, plus SAB-API indicators (SharedArrayBuffer, Atomics.wait, WebAssembly.sharedMemory) detected on the page.

Computes the exact browser crossOriginIsolated predicate (COOP=same-origin AND (COEP=require-corp OR credentialless)) that gates SharedArrayBuffer + high-resolution timers + WebAssembly.Memory64 shared in modern browsers.

If your AI agent is going to deploy code that uses SharedArrayBuffer or shared WebAssembly.Memory on a remote page, this is the gate that catches "the page loaded but my SAB buffers threw at runtime because I forgot to set COEP=require-corp."

/api/ocsp-must-staple

Opens TLS to :443, fetches the leaf cert, and inspects it for the RFC 7633 TLS Feature extension:

  • status_request — OID 1.3.6.1.5.5.7.1.24 (RFC 6066, must-staple v1)
  • status_request_v2 — OID 1.3.6.1.5.5.7.1.25 (RFC 8446, must-staple v2)

If the feature is set, browsers MUST reject the connection if no fresh OCSP stapled response arrives on the handshake. Useful for agents deciding whether a third-party API's TLS posture is actually safe for high-stakes use, or whether the CA's must-staple commitment has been broken.

Caveat: stdlib Python ssl can't directly inspect the active TLS extension negotiation, so the endpoint primarily certifies the cert-level commitment. Pairs with /api/ocsp-staple-verify (cycle 128) for the responder-reachability side.

Try it 

GET https://history-primarily-interesting-penalties.trycloudflare.com/.well-known/x402
Enter fullscreen mode Exit fullscreen mode

195 paid routes in the catalog now. Cycle-cumulative, $0.0005 per call, settlement via pay.openfacilitator.io on Base USDC.

Pricing & payment

  • 500 atomic USDC per call ($0.0005)
  • payTo: 0xCa0a6c6Aa7A8F0D5893636CF166Ea2b44fb6500c
  • Network: eip155:8453 (Base)
  • Asset: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 (USDC)

Top comments (0)