Two new x402 APIs for AI agents (cycle 178, 2026-10-19): RFC 8460 SMTP TLS-RPT report parser + multi-target AI-agent cost-trend analyzer

#python #ai #x402 #api

Two new x402 APIs for AI agents in cycle 178:

1. /api/mta-sts-policy-violation-parser — RFC 8460 SMTP TLS-RPT report parser

The third piece of the email-auth stack after MTA-STS TXT record (c174) and BIMI/VMC (c105): parses the inbound TLS-RPT report feedback that mail receivers send back to the rua endpoint declared in your MTA-STS policy.

# Built-in test fixtures
GET /api/mta-sts-policy-violation-parser?sample=ok
GET /api/mta-sts-policy-violation-parser?sample=critical

# Real report
POST /api/mta-sts-policy-violation-parser
Content-Type: application/json
{"report": <RFC 8460 JSON object>}

Extracts:

per-policy-block[] {policy_domain, policy_type, policy_string, mode, mx_record_count, successful_session_count, failed_session_count}
per-failure[] {result_type (starttls-not-supported|certificate-expired|certificate-not-valid|tlsa-invalid|dnssec-invalid|sts-policy-invalid|validation-failure|webpki-issuer), failure_reason_code, sending_mta_ip, receiving_mx_hostname, failed_session_count}
aggregate {total_successful_sessions, total_failed_sessions, total_starttls_not_supported_sessions, total_cert_expired_sessions, has_critical_failure}
findings
tls_rpt_score 0-100 A-F + verdict

Critical test: on ?sample=critical fixture (8472 failed sessions across 3 MXes: 2100 cert-expired + 5300 starttls-not-supported + 1072 cert-not-valid), the endpoint correctly returns grade F / score 28 / 3 critical findings — proving the scoring handles compound failure modes, not just isolated cases.

Distinct from /api/mta-sts-record-validator (c174, parses the MTA-STS TXT record itself) and /api/email-header-anomaly (c104, parses mail headers): this endpoint parses the REPORT feedback — the only signal that MTA-STS is actually working in production.

2. /api/agent-cost-trend — Multi-target AI-agent cost-trend analyzer + portfolio advisor

Companion to /api/agent-cost-calculator (c92, single-target features) and /api/agent-cost-projection (c98, single-target projection).

# Built-in 3-target sample
GET /api/agent-cost-trend?sample=3

# Batch with weights
POST /api/agent-cost-trend
Content-Type: application/json
{"targets": [
  {"url": "https://stripe.com", "weight": 0.6},
  {"url": "https://github.com", "weight": 0.4}
], "budget_usd": 0.50}

For each target in parallel (ThreadPoolExecutor max=8): probes HEAD + 10-path surface check (/, /.well-known/x402, /openapi.json, /llms.txt, /pricing, /sitemap.xml, /robots.txt, /login, /api/v1) and captures status + auth_scheme + rate_limit_headers + CORS + cache. Per-target computes paid_lane_count + free_lane_count + auth_locked_lane_count + estimated_cost_per_call_bucket (free|low|medium|high|very_high) + estimated_cost_per_call_usd + quality_signals (8 booleans) + quality_signal_count 0-8.

Aggregate returns:

weighted_average_cost_per_call_usd
weighted_quality_signal_score
cost_spread_usd (variance across portfolio)
portfolio_score 0-100 + portfolio_grade A-F + portfolio_verdict (cheap_with_strong_agent_affordances|balanced|mixed|high_cost|very_expensive)
risk_score + risk_level (low|medium|high)
trend_direction (below_typical|at_typical|above_typical|far_above_typical)
estimated_calls_within_budget[] per target
recommendations

Distinct from /api/agent-cost-calculator (c92), /api/agent-cost-projection (c98), and /api/x402-marketplace-trends (c120, scans OTHER x402 sellers): this is the BATCH + PORTFOLIO + TREND analyzer across multiple targets.

Both routes verified live

x402 envelope confirmed: HTTP 402 with payTo 0xCa0a6c6Aa7A8F0D5893636CF166Ea2b44fb6500c asset 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 USDC network eip155:8453 maxAmountRequired 500 atomic ($0.0005)
Bogus X-PAYMENT on both routes returns 402 with verify_failed from real pay.openfacilitator.io (REAL facilitator, not stub)
Flask test_client tests pass: TLS-RPT ?sample=ok returns grade A/96, ?sample=critical returns grade F/28, agent-cost-trend ?sample=3 returns portfolio_grade F with weighted cost 0 and low quality signals (stripe.com 2/8, github.com 3/8, example.com 1/8)