Security & trust

Website security posture report with an A-F grade: HTTPS and redirect to HTTPS, HSTS, security headers (CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy), cookie flags, DNS hygiene (SPF, DMARC, DNSSEC, CAA), server header exposure and TLS certificate validity. Vendor vetting in one call. $0.01 per domain.

Mixed content check: finds http:// scripts, stylesheets, images, iframes, media and form actions on an HTTPS page (active vs passive), which browsers block or flag. Fix warnings before they cost you conversions. $0.01 per page.

Redirect audit for a domain: how http://, https://, www and apex variants each resolve, where they end, hop counts and status codes, and whether all four converge on a single canonical HTTPS URL. Catch split traffic and SEO dilution. $0.01 per domain.

Maintenance-risk hints for an npm package: is the latest version deprecated (with the message), days since the last publish, whether any direct dependency's latest is deprecated, single-maintainer flag, and a simple risk label (healthy / stale / deprecated). Not a CVE scanner; a fast triage before install. $0.01 per package.

Security grade A-F for a website in one number: HTTPS upgrade, HSTS, CSP, frame/content-type/referrer/permissions headers, cookie flags, server-version exposure, TLS certificate validity and days left, and DNS hygiene (SPF, DMARC, DNSSEC, CAA). Returns the grade, score, and a ranked list of reasons to fix. Track it on a schedule to catch regressions. $0.01 per domain.

GraphQL endpoint check: sends a minimal introspection query and reports whether the URL is a GraphQL endpoint, whether introspection is enabled (a security signal), the query/mutation/subscription root type names, number of types, the first 40 query fields, and whether GET requests are accepted. $0.01 per endpoint.

Bulk domain expiry for up to 20 domains in one call: expiry date, days left, registrar and at-risk status per domain, sorted soonest-first, with a count of domains expiring within 30 and 90 days. Portfolio renewal sweeps for agents managing many domains. $0.01 per batch.

Bulk security-header grade for up to 10 URLs in one call: each URL gets an A-F grade from HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and server-version exposure, with the specific missing headers, sorted worst-first. Vendor sweeps and portfolio audits. $0.01 per batch.

Explains HTTP headers: for each header name you give (comma-separated), what it does, typical values and an example, plus whether it is a request, response or both, and a security relevance flag. Covers 60+ common headers including security, caching, CORS, cookies and x402 payment headers. $0.01 per lookup.

OpenAPI/Swagger spec summary from a URL: title, version, OpenAPI version, servers, path and operation counts, operations by method, tags with counts, security schemes, whether every operation has an operationId and description, schema count, and the first 60 operations (method, path, summary). Instant API comprehension for integration agents. $0.01 per spec.

Web application firewall detection: signs of Cloudflare WAF, AWS WAF, Akamai Kona, Imperva, Sucuri, F5 BIG-IP, Barracuda, Fortinet, ModSecurity and others from response headers, cookies and block-page behaviour on a probe request. Know what stands in front of an app. $0.01 per site.

Cookie audit from the Set-Cookie headers of a page load: each cookie's name, Secure, HttpOnly and SameSite flags, expiry/max-age, domain and path, with counts of cookies missing Secure or SameSite. Privacy and security hygiene without a browser. $0.01 per page.

IP reputation check: is this IP address on spam or abuse blocklists (DNSBL lookups across major lists), is it a Tor exit node, and does it belong to a cloud or hosting provider (datacenter IP) rather than a residential network. Returns a risk label (clean / suspicious / bad) with the reasons. Fraud screening, signup risk and firewall decisions. $0.01 per IP.

SEO audit of a web page with a 0-100 score and a ranked issues list: title and meta description length, H1 and heading structure, canonical tag, noindex, Open Graph and Twitter cards, image alt text, internal and external links, word count, language, viewport and structured data. On-page SEO check for any URL in one call. $0.01 per page.

QSIG geopolitical risk score (0-100) with 24h change, percentile rank vs 30-day and 90-day history, regime label, and relevance-classified event headlines. Use when reasoning about event risk or macro regime. Computed observation, not a forecast. Updated every ~15 minutes.

Verify a business is real and get a legitimacy verdict plus a 0-100 risk score. Give one of name, lei, cik, ticker, isin or qid and get a verdict (real, likely_real, inactive, dissolved or not_found), a risk category, per-dimension flags, reasons, the official registry and which registries corroborated. Deterministic scoring, no LLM. Legitimacy indicators, not legal or credit advice.

Redirect tier (deterministic, no LLM): verifies where a public URL actually leads: final URL (byte-exact), first response status, and hop count of the HTTP chain, walked twice with per-hop SSRF checks. Use it to confirm a link or a moved page points where it claims. Loops and unstable chains return unverifiable, never a guess. First 100 checks per client are free: resend with header X-Use-Free-Allowance: yes and no payment to use them.

Checksum tier (deterministic, no LLM): verifies the exact bytes served at a public URL hash to a claimed sha256, by independent double re-fetch. Use it to confirm a download or artifact matches its published checksum. Bodies up to 3 MB; dynamic pages return unverifiable, never a guess. sha256 only. First 100 checks per client are free: resend with header X-Use-Free-Allowance: yes and no payment to use them.

OpenAI vs Anthropic side by side as JSON: full-year revenue, latest revenue run-rate, last private round and post-money valuation, IPO status and valuation target, compute obligations, cash, and valuation-to-run-rate multiples. Every value keeps its source URL, verification grade and value type; gaps are listed.

Batch France company verification (KYB): up to 50 SIREN per call, same output as /v1/verify for each (status, insolvency proceedings from BODACC, explained verdict, signal codes). Usage-based: you authorize up to $0.008 x n and pay only for successful verifications. Supplier and vendor list screening for AI agents.

Douketis 2022 ACCP elective perioperative DOAC interruption (PAUSE-style, recommendations 22-25). Returns hold_days_before and resume_days_after from INN (apixaban, rivaroxaban, edoxaban, dabigatran) and bleed_risk. dabigatran also needs caller-assigned CrCl. heparin_bridge is always false (recommendation 26). Not warfarin, not urgent surgery, not a prescription. magent does not assay CrCl.

Palumbo 2015 R-ISS for multiple myeloma. ISS from beta-2 microglobulin and albumin (Greipp 2005). R-ISS I: ISS I, standard-risk iFISH CA, and normal LDH. R-ISS III: ISS III plus high-risk CA (del(17p) and/or t(4;14) and/or t(14;16)) or LDH > ULN. R-ISS II: all other combinations. Not a myeloma diagnosis or treatment choice; not R2-ISS; not Durie-Salmon. magent does not assay beta-2 microglobulin, albumin, LDH, or cytogenetics.

Jawhar 2019 mutation-adjusted risk score (MARS) for advanced systemic mastocytosis: age >60 (1), hemoglobin <10 g/dL (1), platelets <100×10^9/L (1), exactly one S/A/R mutation among SRSF2, ASXL1, RUNX1 (1) or two or more (2, not both). Max 5. Low 0–1 (training-set median OS not reached), intermediate 2 (3.9 y), high 3–5 (1.9 y). Not WHO SM criteria. magent does not sequence or assay labs.

Bello-Chavolla 2018 METS-IR: ln(2×glucose_mg_dl + triglycerides_mg_dl)×BMI / ln(HDL_mg_dl), natural log, two decimals. Supply glucose, triglycerides, and HDL each as exactly one of mg/dL or mmol/L (glucose ×18, TG ×88.57, HDL ×38.67). BMI is caller-supplied (10–80). highest_quartile_t2d is true only when METS-IR > 50.39 (derivation highest T2D-risk quartile). Not a diabetes diagnosis, not HOMA-IR/HOMA2, and not a treatment threshold.

Oakland 2017 risk score for safe discharge after acute lower gastrointestinal bleeding. Points from age (0-2), sex (male 1), previous LGIB admission (1), caller-assigned blood on digital rectal examination (1), heart rate (0-3), systolic BP (0-5), and hemoglobin g/dL (0-22); max 35. safe_discharge when score ≤8 (derivation cutoff, not a later US validation). Not a discharge order or LGIB diagnosis. magent does not examine the rectum or assay hemoglobin. Hemoglobin g/dL or g/L.

Dakik 2019 AUB-HAS2 for 30-day death/MI/stroke after noncardiac surgery: six 1-point elements (history of heart disease, angina or dyspnea, age ≥75, hemoglobin <12 g/dL, vascular surgery, emergency surgery). Low 0-1, intermediate 2-3, high >3 (max 6). Derivation rates 0%, 0.5%, 2.0%, 5.6%, 15.7% by score 0/1/2/3/>3. Not a medical device, not RCRI, not ACS treatment, and not operative clearance.

Does the domain carry a box domain-verification TXT record? Reads the apex TXT records (Cloudflare DoH) and reports whether the box ownership token is present and the token value (truncated). A present token usually means the company uses box's product; absence means not verified there. $0.01 per lookup.

Does the domain carry a asana domain-verification TXT record? Reads the apex TXT records (Cloudflare DoH) and reports whether the asana ownership token is present and the token value (truncated). A present token usually means the company uses asana's product; absence means not verified there. $0.01 per lookup.

Does the domain carry a krisp domain-verification TXT record? Reads the apex TXT records (Cloudflare DoH) and reports whether the krisp ownership token is present and the token value (truncated). A present token usually means the company uses krisp's product; absence means not verified there. $0.01 per lookup.

Does the domain carry a cisco domain-verification TXT record? Reads the apex TXT records (Cloudflare DoH) and reports whether the cisco ownership token is present and the token value (truncated). A present token usually means the company uses cisco's product; absence means not verified there. $0.01 per lookup.