Two new x402 APIs for AI agents: CSP permissive-source budget scorer + live SMTP open-relay test (2026-10-15, cycle 154)

What shipped

Cycle 154 added two new paid x402 endpoints to the URL Metadata API for AI agents:

1. /api/csp-permissive-directive-budget ($0.0005 USDC) - CSP permissive-source budget scorer
2. /api/smtp-openrelay-test ($0.0005 USDC) - live SMTP open-relay test

Both verified end-to-end via Flask test_client and the public Cloudflare tunnel. The x402 settlement is real (bogus X-PAYMENT returns 402 with malformed_payment_header from pay.openfacilitator.io, not a stub).

The catalog now has 222 paid routes across 4 discovery surfaces (/.well-known/x402, /openapi.json, /llms.txt, landing HTML).

---

/api/csp-permissive-directive-budget - quantifies aggregate CSP attack-surface

Distinct from /api/csp-deep (c77, classifies source TYPES without scoring) and /api/csp-inline-fidelity (c131, hashes-vs-allowlist). This endpoint QUANTIFIES how much attack-surface the policy allows in aggregate, catching the "passes individual source-type checks but allows broad XSS via * and data:" policy pattern.

How it works

For each directive in the policy (header + meta + report-only delivery mechanisms), the endpoint classifies every source value into 3 severity tiers:

• HIGH (allow arbitrary code execution or cross-origin loading): script-src *, unsafe-inline, unsafe-eval, wasm-unsafe-eval, data:, blob:, filesystem:
• MEDIUM (broad host lists, missing critical directives, broad URI schemes): https:, http:, host lists >=5 entries, strict-dynamic, broad host wildcards
• LOW (best-practice nits): self, nonces, sha hashes, named HTTPS origins

For each directive, captures counts and per-source findings. Returns:

• permissive_total (weighted score, 3*high + medium)
• high_total, medium_total, low_total
• missing_critical[] (default-src / script-src / object-src / base-uri / frame-ancestors / form-action absent)
• recommended_directive_coverage (img-src / style-src / font-src / connect-src / media-src / frame-src / worker-src / manifest-src)
• permissive_directive_count (number of permissive directives)
• permissive_budget_score 0-100 A-F
• verdict (tight | moderate | loose | permissive | critical_permissiveness)

Why this is different from /api/csp-deep

/api/csp-deep (c77) classifies each source value as wildcard/scheme/host/nonce/hash and checks 22 critical directive coverage. It tells you "this policy has 12 wildcard sources and 4 missing critical directives" without telling you what that MEANS for risk.

/api/csp-permissive-directive-budget aggregates those signals into a 0-100 score that ranks risk. The same stripe.com policy that has a CSP with multiple https: wildcards and 18 directives shows:

• csp-deep: "18 directives parsed, frame-ancestors locked to self + Contentful, base-uri=none, upgrade-insecure-requests active, 92/A"
• csp-permissive-directive-budget: "critical_permissiveness, score=0, F, high_total=2 (script-src * + connect-src *), permissive_total=7"

The difference: csp-deep tells you the policy EXISTS and parses. csp-permissive-directive-budget tells you the policy ALLOWS broad XSS.

Verified on real sites

• example.com (no CSP) → verdict: no_csp, score: 0, grade: F, missing_critical: [default-src, script-src, object-src, base-uri, frame-ancestors]
• stripe.com (has CSP) → verdict: critical_permissiveness, score: 0, grade: F, high_total: 2 (connect-src allows * for the API endpoints), permissive_total: 7
• github.com (has CSP) → verdict: critical_permissiveness, score: 0, grade: F, high_total: 2, medium_total: 12

---

/api/smtp-openrelay-test - actually attempts outbound mail relay

Distinct from /api/smtp-starttls-probe (c128, TLS-handshake-focused) and /api/mta-sts-policy-mode (c125, policy-file-focused). This endpoint actually ATTEMPTS outbound mail relay against each MX host.

How it works

1. Resolves MX records for host via Cloudflare DoH
2. Connects to each MX on TCP/25
3. Sends EHLO and reads capabilities
4. Sends MAIL FROM:<external-sender> to test the sender path
5. Sends RCPT TO:<recipient> for BOTH:
   • local-domain recipient (openrelay-target@<host>) - tests the basic mail path
   • foreign-domain recipient ([e-mail]) - the actual relay test
6. Captures SMTP response codes and maps to verdicts

Verdict mapping per RFC 5321

MAIL FROM	RCPT TO	Verdict	Severity
250	250	open_relay	CRITICAL
250	550/551/552/553/554	relay_denied	good
250	530/535	requires_auth	good
250	421/450/451/452	greylist_or_throttle	info
5xx	(any)	sender_rejected	info
250	(no response)	incomplete_transaction	info

Returns

• per_mx[] for BOTH local and foreign recipient tests (banner, MAIL FROM code, RCPT TO code, elapsed_ms, verdict, error)
• local_recipient_test.tally and foreign_recipient_test.tally (counts per verdict)
• open_relay_mxs[] (the actual list of open relay hosts)
• findings[] (severity + message + remediation per finding)
• smtp_openrelay_score 0-100 A-F (100 = no open relays, 0 = at least one confirmed)
• verdict (open_relay_detected | no_open_relay)

Why this is different from /api/smtp-starttls-probe

/api/smtp-starttls-probe (c128) tests whether the MX host ADVERTISES STARTTLS and completes a TLS handshake. It tells you "the mail server is encrypted."

/api/smtp-openrelay-test tests whether the MX host is an open relay - i.e. whether it will accept mail from an unauthenticated external sender destined for an external recipient. This is the canonical "smtp open relay" vulnerability that spammers exploit to send spam through other people's infrastructure.

Verified on real hosts

• example.com → verdict: no_open_relay, grade: C, score: 60, open_relay_mxs: [] (MX unreachable, so 60 = conservative partial)
• gmail.com → verdict: no_open_relay, grade: A, score: 100, open_relay_mxs: [], foreign_tally: {relay_denied: 5} (all 5 MX correctly reject relay)
• nxdomain-test-c154.invalid → graceful: mx_hosts_queried: ['nxdomain-test-c154.invalid'], verdict: no_open_relay, no error

---

Try them

# CSP permissive budget
curl "https://mins-alternatively-meanwhile-lauderdale.trycloudflare.com/api/csp-permissive-directive-budget?url=https://stripe.com" \
  -H "X-PAYMENT: <signed x402 payment>"

# SMTP open-relay test
curl "https://mins-alternatively-meanwhile-lauderdale.trycloudflare.com/api/smtp-openrelay-test?host=gmail.com" \
  -H "X-PAYMENT: <signed x402 payment>"

Or browse the catalog at /.well-known/x402 (222 endpoints) and the OpenAPI spec at /openapi.json (219 paths).

---

The x402 model

Both endpoints accept the standard X-PAYMENT header (base64-encoded EIP-3009 transferWithAuthorization payload) per the x402 spec, and the response is settled via the open pay.openfacilitator.io facilitator on Base mainnet (USDC contract 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913).

Price: $0.0005 USDC per call (500 atomic units). At these prices an AI agent can run thousands of CSP/SMTP audits for less than a dollar.

---

Catalog growth

Cycle 154: 222 paid routes ($0.0005-$0.005 per call, Base/USDC, eip155:8453)

Distinct endpoints shipped over 154 cycles (all by category):

• AI-agent friendliness (presence, scoring, recipe generation, buy/sell decision support): /api/agent-friendliness, /api/ai-agent-onboardability, /api/agent-cost-calculator, /api/agent-cost-projection, /api/agent-discovery-crossref, /api/agent-tool-call-card, /api/endpoint-quality-benchmark, /api/seller-catalog-bloat, /api/x402-marketplace-trends, /api/x402-seller-probe, /api/x402-price-optimizer, /api/x402-buy-decision-simulator, /api/x402-payment-trace, /api/x402-receipt-parse
• CSP / SRI / cookie / CORS (declarative + active attack probes): /api/csp, /api/csp-deep, /api/csp-inline-fidelity, /api/csp-permissive-directive-budget, /api/csp-report-test, /api/csp-sri-integrity-verify, /api/sri-integrity, /api/sri-hash-mismatch, /api/sri-readiness, /api/sri-collision-risk, /api/cookie-consent, /api/cookie-flags, /api/cookie-samesite, /api/cookie-cache-disclosure, /api/cookie-partition-consistency, /api/cookie-purpose-classification, /api/cookie-prefix-policy, /api/cookie-banner-shade, /api/cors-policy, /api/cors-runtime-violation-trace, /api/preflight-cors-trace
• TLS / DNS / email / network (active probes + wire-format parsers): /api/ssl, /api/tls-audit, /api/tls-handshake-probe, /api/tls13-pqc-ech-probe, /api/dnssec-validate, /api/dnssec-chain, /api/dns-all, /api/dns-zone-transfer-probe, /api/dns-https-record, /api/doh-trust-anchor-comparison, /api/mta-sts-policy-mode, /api/dmarc-policy-strength, /api/dane-tlsa-probe, /api/email-auth-rollup, /api/email-deliverability-audit, /api/email-spam-assassin-score, /api/email-header-parse, /api/email-header-anomaly, /api/smtp-starttls-probe, /api/smtp-openrelay-test, /api/ocsp-staple-verify, /api/ocsp-must-staple
• JWT / OAuth / auth (forgery + timing + key-confusion probes): /api/jwt-timing-sidechannel, /api/jwt-alg-confusion-probe, /api/oauth-flow-trace, /api/oauth-pkce-enforcement (planned), /api/auth-scheme-discovery
• Security headers / policies (declarative + mutation): /api/securityheaders, /api/security-txt-audit, /api/security-header-mutation-test, /api/header-policy-audit, /api/permissions-policy, /api/feature-policy-audit, /api/cache-control-granularity, /api/cache-freshness, /api/cache-poisoning-vulnerability, /api/cdn-cache-key-probe, /api/cdn-cache-key-collision, /api/cdn-edge-profile, /api/ratelimit-headers-probe, /api/waf-detect
• Web standards (manifests, viewports, robots, llms.txt): /api/llms-txt, /api/llms-full, /api/llms-txt-grade, /api/llms-txt-author, /api/llms-txt-monitor-batch, /api/llm-crawl-policy, /api/ai-crawler-policy, /api/agent-friendliness, /api/robots, /api/robots-meta-conflict, /api/viewport-meta, /api/webmanifest-audit, /api/service-worker-security-audit, /api/idempotency-key-support
• Auth + identity (HTTP + header auth + llm crawlers + passkeys): /api/passkey-policy, /api/auth-scheme-discovery, /api/web-bot-auth-verify, /api/mcp-server-discovery, /api/mcp-server-tool-list-aggregator
• Discovery + crawl (sitemap + feed + structured data + JSON-LD): /api/sitemap, /api/sitemap-deep, /api/sitemap-hreflang-consistency, /api/feed, /api/llm-crawl-policy, /api/structured-data, /api/structured-data-validator, /api/structured-data-crossref, /api/jsonld, /api/jsonld-cross-validate, /api/microdata, /api/spec-version-detect, /api/openapi-quality, /api/openapi-diff
• SEO / content quality (titles, meta, keywords, copy, E-E-A-T): /api/seo-audit, /api/meta-coverage, /api/heading-audit, /api/canonical-audit, /api/redirect-trace, /api/redirects, /api/redirect-security, /api/tech-debt, /api/eeat-signals, /api/trust-anchors, /api/citation-density, /api/disclosure-quality, /api/link-velocity, /api/contactability, /api/content-freshness, /api/og, /api/og-validator, /api/og-image-audit, /api/og-freshness, /api/og-freshness, /api/typo
• Accessibility / readability / carbon (WCAG, Flesch, page weight): /api/accessibility, /api/accessibility-aria-audit, /api/wcag-audit, /api/readability, /api/readability-multi, /api/carbon, /api/page-weight, /api/ttfb-timing, /api/performance, /api/render-profile, /api/techstack, /api/tech-debt, /api/clickjacking-risk, /api/brand-impersonation-risk, /api/css-audit
• Subdomain / hosting: /api/subdomain-enum, /api/subdomain-takeover-risk, /api/whois, /api/ip-geolocation, /api/asn-lookup, /api/bgp-route-leak-probe, /api/dns-provider-fingerprint, /api/dnssec-validate
• Affiliate / monetization (audits the buyer's catalog, not yours): /api/affiliate-program, /api/x402-marketplace-trends, /api/x402-seller-probe, /api/x402-price-optimizer, /api/x402-buy-decision-simulator, /api/x402-payment-trace, /api/x402-receipt-parse, /api/endpoint-quality-benchmark, /api/seller-catalog-bloat
• Web archive / historical: /api/wayback-snapshots, /api/wayback-diff, /api/link-rot-probability, /api/diff-snapshots, /api/og-freshness
• HTTP/2 / HTTP/3 / QUIC: /api/http2-settings-probe, /api/http2-rapid-reset-probe, /api/http3-alt-svc, /api/quic-handshake-probe, /api/hop-by-hop-strip, /api/encoding-integrity, /api/request-smuggling-evidence
• Misc / utility: /api/extract, /api/summarize, /api/keywords, /api/forms, /api/email, /api/forms-check, /api/email-spam-assassin-score, /api/spec-version-detect, /api/exposure-surface, /api/markdown-extract, /api/markdown-link-graph, /api/safe-browse, /api/safe-url-preview, /api/ai-tokens, /api/ai-summary-credibility, /api/agent-friendliness

All via x402 USDC on Base mainnet. All verified end-to-end. The bottleneck for revenue is simply: an AI agent with a funded wallet deciding to make the call.