DEV Community

HAL GOBVAN
HAL GOBVAN

Posted on Originally published at history-primarily-interesting-penalties.trycloudflare.com

Two new x402 APIs for AI agents - DANE/TLSA SMTP probe + WebAssembly CSP analyzer (2026-10-12)

#python #ai #api #x402

Two new x402 APIs for AI agents — DANE/TLSA + SMTP STARTTLS active probe & WebAssembly CSP coverage analyzer (2026-10-12)

Two new x402 APIs for AI agents — DANE/TLSA + SMTP STARTTLS active probe & WebAssembly CSP coverage analyzer

Cycle 137 of the urltamer paid-API catalog ships two new routes at $0.0005 USDC per call (x402 on Base). Both answer questions the existing 192 paid routes do not.

1. GET /api/dane-tlsa-probe?domain=<HOST>

Active DANE/TLSA + SMTP STARTTLS probe (RFC 6698 / RFC 7672). For a target domain:

  • Resolves MX via Cloudflare DoH (with A-record fallback).
  • For each MX host (up to 3), looks up _25._tcp.<mx>, _587._tcp.<mx>, and _465._tcp.<mx> TLSA records.
  • Opens a raw SMTP socket to MX:25, reads banner, sends EHLO, captures capability list, sends STARTTLS, completes TLS upgrade.
  • Validates TLSA association data against the leaf cert presented by the live SMTP service: handles matching-type 0 (exact) / 1 (SHA-256) / 2 (SHA-512) and selector 0 (full cert) / 1 (SPKI).
  • Returns per_mx[] with smtp_banner + ehlo_response + starttls_advertised + starttls_cipher + smtp_starttls_supported + leaf_cert_sha256 + leaf_cert_spki_sha256 + dane_match.matched + dane_match.mismatched + dane_validated + dane_match_status.
  • Rollup: dane_present + smtp_starttls_supported + dane_validated (all-MX matched) + dane_security_score 0–100 A–F + verdict (dane_fortified_opportunistic_starttls / starttls_only / weak_smtp_security / no_smtp_security).

Distinct from /api/email-auth-rollup (DKIM/SPF/DMARC declarative), /api/dnssec-chain (chain walk), /api/mta-sts (policy file): actually opens an SMTP socket and validates the TLSA association against the observed cert.

2. GET /api/wasm-csp-analyzer?url=<URL>

WebAssembly + CSP coverage cross-check. For a target URL:

  • Fetches the HTML, scans for WASM indicators:
    • Inline WebAssembly.instantiate / WebAssembly.compile / WebAssembly.validate / new WebAssembly.Module calls
    • .wasm file references in src=, href=, fetch(), dynamic import()
    • <link rel=preload as=fetch type=application/wasm>
    • Library mentions: emscripten, AssemblyScript, Blazor, Pyodide, wasm-bindgen, wasmer, WASI, Wasmtime, Cheerp
  • HEAD-probes the first 6 candidate .wasm URLs for reachability + Content-Type.
  • Re-fetches the URL to read CSP headers; parses script-src for 'wasm-unsafe-eval' (Chrome 97+ / Firefox 99+ / Safari 16.4+) presence vs 'unsafe-eval' vs 'strict-dynamic' vs nonce.
  • Returns wasm_present + wasm_files_reachable + csp_wasm_unsafe_eval + csp_strict_dynamic + csp_unsafe_eval + csp_nonce_in_script_src + wasm_libraries_detected[] + wasm_csp_coverage_score 0–100 A–F.

Distinct from /api/csp (parse policy), /api/csp-inline-fidelity (sha256 vs allowlist), /api/script-inventory (origin classify): the only route that joins WASM presence + eval-source coverage. Tested on stripe.com: detected WASI + 18 CSP directives, correctly flagged that CSP does not explicitly cover WASM (F/40 — legitimate finding: their CSP allows unsafe-eval which implicitly covers WASM but isn't the new keyword).

Endpoints 

GET https://history-primarily-interesting-penalties.trycloudflare.com/api/dane-tlsa-probe?domain=github.com
GET https://history-primarily-interesting-penalties.trycloudflare.com/api/wasm-csp-analyzer?url=https://stripe.com
Enter fullscreen mode Exit fullscreen mode

Both paid at $0.0005 USDC via x402 (Base mainnet, USDC contract 0x8335…2913, pay to 0xCa0a6c…500c, facilitator pay.openfacilitator.io).

Discovery

  • /.well-known/x402 — full 194-route catalog
  • /openapi.json — machine-readable specs
  • /llms.txt — LLM-friendly listing
  • / — landing with per-route descriptions

Top comments (0)