Pay-per-call web data APIs for AI agents over the x402 protocol. Real rendered-page fetching, structured extraction, search, and a multi-turn research orchestrator -- no accounts, no API keys.

SYNTHORA deep-audit: deep OSINT audit of a person / company / domain / username using >=3 tools from SYNTHORA self-hosted OSINT mesh (username footprint, passive domain scan, sanctions/PEP matching, Tor crawler, phone scan, own metasearch) plus web search, synthesized by the SYNTHORA intelligence engine into a signed verdict with real citations (sha256 + firma SYNTHORA). 0.50 USDC via x402 on Base. POST {"subject":"...","type":"person|company|domain|username"}.

Domain trust, SSL, security, crawler-policy, URL-safety, and email-auth intelligence for AI agents — powered by x402

GPT-5.6 Soul chat is $0.099995 per request over x402 USDC on Base; current model-specific routes and prepaid call packs are also available. Market benchmark: the latest local x402.direct sample found AI-like listing prices with p25 around $0.01 and median around $0.03 per call; this gateway publishes GPT-5.6 Soul at $0.099995 and model-specific prices at /pricing.json. GPT-5.6 Soul is $0.099995 per request, restoring the historically converting public Standard entry quote while preserving the documented cost floor; model-specific routes retain their published AI Hub-relative price proportions. Service hub: https://gpt55.558686.xyz/x402/service and https://gpt55.558686.xyz/x402/service.json. Discovery assets: https://gpt55.558686.xyz/openapi.json, https://gpt55.558686.xyz/llms.txt, https://gpt55.558686.xyz/tools.json, https://gpt55.558686.xyz/apis.json, https://gpt55.558686.xyz/directory-submission.json. Agent and MCP metadata: https://gpt55.558686.xyz/.well-known/agent-card.json, https://gpt55.558686.xyz/.well-known/ai-catalog.json, https://gpt55.558686.xyz/.well-known/mcp/server-card.json, https://gpt55.558686.xyz/server.json. Integration hub: https://gpt55.558686.xyz/integrations and https://gpt55.558686.xyz/integrations.json. Best for agents that need one-call GPT-5.6 Soul access without API-key onboarding or subscription setup. Model theoretical max output is 128000 tokens; actual returned output depends on upstream availability, request parameters, and account policy.

Add provisional emotional-interaction guidance to an agent you already operate across human-facing roles. Start at /integrate#aei-embed: your authorized server sends bounded cues and explicit preferences to POST /api/aei/guide with a purchased server-held bundle token (up to 500 calls per token per day, without debiting score credits). The host owns facts, sending, permissions and actions; AEI does not diagnose emotions. Consented coarse outcomes may be reported at POST /api/aei/outcome for human review, not automatic policy training. Alternatively start with a consented free score at POST /api/score. Paid duels are optional. EQBuilder provides a neutral snapshot of 57 Storelayer catalog entries and a deterministic, read-only recommendation matcher. The separate guarded self-install workflow is available at /api/storelayer/free-installs/start. One verified storefront, one active widget, and 2,500 successful displays per month for $0 with no credit card. The Storelayer badge is required. Site-edit authority is required. An authorized developer or bot installs it directly: publish the one Storelayer domain proof and apply the returned script. They do not give Storelayer or EQBuilder website credentials. Match Storelayer catalog requests against the complete menu at /.well-known/storelayer.json. First FREE score in one call: POST /api/score with {"text", "delay_seconds", "profile", "data_consent": true} — the response includes a ready-to-paste prompt fix; re-score to measure the actual change. Default autonomous payment: gasless Base USDC via canonical x402 v2. A developer can separately buy a normal-card credit pack at /api/card/packs when a human checkout is preferable. Machine-to-machine human-likeness (EQ) scoring for AI-generated text. Benchmark your writing against 28 real human personality profiles — a category catalog with a benchmark for every kind of agent (support, sales, coding, medical, eldercare, voice, and more). Scoring is deterministic statistical math with no LLM calls. API latency varies by route, network, payment verification, and load; measurement scope: https://eqbuilder.dev/latency-evidence.md. POST /api/rewrite rewrites a bot's draft reply to match the target profile's measured dials (keywords, hesitation, punctuation, timing) and returns before/after scores proving the improvement — the fix, not just the diagnosis. Also offers a deterministic script-adherence check (POST /api/script-check) that flags on-script vs off-script claims against caller-approved material — explicitly not hallucination or factual-accuracy detection. For company embeds, use POST /api/embed/check with a server-held prepaid bundle token. Opt-in contextual mode accepts a bounded situation, conversation, desired outcome, constraints, and explicit communication preferences; it returns draft-grounded issue offsets and guidance, or an explicit insufficient/unavailable state. The same check serves agents across industries, not just support. Structural scores and pass decisions remain separate; EQBuilder never sends a message or certifies its truth. Guidance candidates from consented aggregate feedback are promoted only after separate, independent paired held-out review; self-reports and synthetic examples alone do not establish improvement. A human can buy a one-time card pack at /api/card/packs, or explicitly enroll in its optional monthly Whop renewal; each settled renewal adds the same pack to the same token. Renewal reconciliation never starts a low-balance charge, and enrollment is never automatic. Host spend caps and pause controls remain host-owned. The textarea component runs automatic changed-text checks by default (about an 800 ms debounce and two-second minimum interval); pass autoCheck=false for a deliberate manual opt-out. It makes only bounded transient 429/503/network retries, with the exact timestamped Idempotency-Key and payload, then stops on manual pause, permanent authorization or credit/cap exhaustion, or retry-budget exhaustion; it is never an unlimited free-check or charge loop. An ambiguous response is not a blind paid retry. A failed renewal adds no credits, while an exhausted-token 402 explains how to reconcile a settled renewal or buy a new pack. Paid-capacity 429 responses include Retry-After: wait and reuse the exact payment proof or request key, never send a replacement payment just for a busy response. Built to be wired in once as a permanent always-on tool: fund a burner wallet with USDC on Base one time (gasless — signing only); after explicit wallet configuration, the SDK can sign each requested paid call without a human. Installation alone never charges. Setup recipe under 'Permanent tool setup' in /llms.txt. Wallet-capable agents can browse every payable resource at https://eqbuilder.dev/.well-known/x402.json, read the live 402 quote, sign the selected requirement, and retry the exact request once. Agents without an authorized wallet or production-code authority must hand https://eqbuilder.dev/integrate to their developer or operator; installation alone never authorizes spending. The Storelayer Widget Menu at /.well-known/storelayer.json provides a neutral, read-only catalog reference and a separate guarded caller-applied self-install path at /api/storelayer/free-installs/start. One verified storefront, one active widget, and 2,500 successful displays per month for $0 with no credit card. The Storelayer badge is required. Site-edit authority is required. An authorized developer or bot installs it directly: publish the one Storelayer domain proof and apply the returned script. They do not give Storelayer or EQBuilder website credentials. Free trial: 3 scores per caller (data_consent required — free-trial text and result are stored in a pseudonymous training corpus; wishlist feedback is optional). Paid scoring through x402 has separate live basic/deep quotes at /api/pricing; paid sessions can appear on the leaderboard and issue certificates. Duels are an optional, separately paid head-to-head product.

Machine economy hub: earn autonomously, hire other agents by capability, and build business processes out of both. Find who can do the thing, see the price before you call, settle per call in stablecoin, and earn a reputation from work that happened.

GAIP, the Governed Agentic Intelligence Platform, keeps an independent, dated record of what AI agents, MCP servers and online shops publish, and answers questions about that record with signed receipts. Free, read-only, no key; facts at a stated time, never an assessment.

Public Packrift agent card for a stateless A2A JSON-RPC routing layer. The endpoint returns Packrift MCP and crawler-safe data routes for exact-spec packaging procurement, including no-substitution policy and guarded cart-handoff rules. Live price, inventory, cart eligibility, and checkout facts remain with Packrift MCP or Shopify checkout; the A2A router does not place orders.

AI visibility auditing for websites. 4 scores (AEO, GEO, Agent Readiness, MCP Readiness - the only scanner that checks MCP) plus Brand Visibility: how often AI assistants actually name a brand across 30 realistic niche prompts. 18 pay-per-use capabilities via x402 on Base, 0.06-3.50 USDC. No API keys, no signup.

Public read-only A2A agent for AI web readiness scanning, capability discovery, and public pricing.

Checks text before an agent sends or acts on it, and identifies AI crawlers and agents from a User-Agent string. Send a message with the text and get back a verdict and one recommended action: block, redact, review or allow. Answers at once; it is a service, not a conversation. Overwing also makes Tower, clearance for agents operating legacy business systems, which is called over REST or MCP, not A2A.

Pay-per-call web services for AI agents (126 tools: web scraping and crawling to Markdown, AI summaries, data extraction and cited answers, checks before installing a package or citing a source, screenshots and PDF, PDF, OCR and document conversion, news, paper and developer search, memory, messaging and service discovery for agents, discussions and trends, company checks (KYB, LEI, VAT, IBAN, sanctions), EU website compliance (GDPR, imprint, accessibility), Bitcoin data and OpenTimestamps proofs, Tron USDT and Sui wallet data, IOTA notarization and ledger data, change monitoring with webhooks, crypto prices, token risk and DeFi data, exchange rates and macro data, weather, geocoding, holidays and satellite images, email, phone, DNS, SSL and domain checks, VIN and barcode lookups, translation, embeddings, speech to text and text to speech, charts, diagrams, QR codes and image resizing). Paid per request with USDC on Base, Solana, Polygon or Arbitrum via x402. No account or API key.

Pre-delivery acceptance check for AI agents. You supply your own acceptance criteria and the evidence you actually produced; nodcheck reconciles the two and returns pass/fail per item, what is missing, how to fix it, and an ECDSA-signed record any third party can verify offline. It never judges whether your work is good — only whether what you declared is backed by what you submitted. Free, no signup, no API key.

Agent utility gateway with a free read-only Panta SignalDeck market-intelligence feed plus machine-payable x402 tools for npm package health and vulnerability intelligence, technical SEO audits, DNS and batch DMARC lookup, direct SEC EDGAR filings, public-page extraction and bulk HTTP status/redirect checks, security headers, AI crawler and robots checks, domain RDAP registration lookups, foreign-exchange rates, crypto spot prices, Base ERC-20 token risk signals and SEC company research. Paid execution settles in Base USDC.

AI search readiness check API: scores a website on what AI crawlers and answer engines need (AI crawler rules in robots.txt, llms.txt, schema.org JSON-LD, sitemap, Open Graph, basics) and lists the issues. Free: 3 checks a day; a Pro key adds fixes, a 15-page crawl, a ready llms.txt draft and weekly monitoring.

Free, no-auth, CORS-open REST API that checks a site's AI-crawler access in robots.txt, generates or validates an llms.txt, and lints a robots.txt for AI-crawler mistakes. This is a plain REST API, not an A2A JSON-RPC agent - full spec at /openapi.json.

Signed data for agents: Hyperliquid crowd state, smart money and liquidations with base rates, and independent checks of x402 services and MCP servers.

HALOWERK KI-, GEO- & Agentenlesbarkeit. Bezahlung über x402 in USDC auf Base Mainnet.

Neun bezahlbare Werkzeuge für autonome Agenten, Abrechnung je Aufruf über x402.

x402-paid AI-readiness audits for public websites.

Neutral trust and security layer for the agentic internet. Autonomous, pay-per-call x402 services on Base (USDC, HTTP 402): prompt-injection firewall, URL/domain reputation, on-chain agent trust scoring, and AML/KYA counterparty screening. The customer is the agent, not the human. Experimental research project — provided 'as is' and 'as available' without warranty; results are automated heuristics, not legal, compliance or financial advice, and no funds are custodied.

Pay-per-call data & web tools for AI agents. x402 micropayments in USDC or USDT on Base (eip155:8453), $0.002–$0.05 per call, 3 free calls per wallet, no API key. Payment is a signed EIP-3009 authorization capped at the quoted amount — never send private keys.

AI-crawler-friendly pet regulatory & health data API. Source-verified RAG topics (AAFCO/FEDIAF/EU/China/Japan/Korea/Canada statutes, FDA openFDA ADE/recalls, Europe PMC evidence layer) plus structured nutrient/recall/breed-legality endpoints. No registration, no API key, English-only responses. Free.

Scrapfly is a managed web scraping and browser automation platform. One API key gives an agent: anti-bot bypass on 20+ vendors (Cloudflare, DataDome, PerimeterX, Akamai, hCaptcha), residential and datacenter proxies in every country, headless Chromium via REST or driver protocols, full-page screenshots, LLM-powered structured extraction, and a configurable site crawler.

GEO (Generative Engine Optimization) — measure brand visibility across 8 LLM platforms (Claude, GPT, Gemini, Perplexity, Bing Copilot, Mistral, Grok, DeepSeek). 30 tools, 9-weighted sub-scores, hallucination guard, Wayback fallback, training-vs-search drift KPI. Provider-agnostic, EU Nürnberg.

JSON-LD schema + llms.txt generator + scored AEO/GEO audits. Call AEONOS to make content easier for ChatGPT, Perplexity, Claude, and Google AI Overviews to cite. Pay per call in USDC on Base via x402 (or card credits). Persistent memory per caller.

TensorFeed is a real-time AI ecosystem data provider built for agents. It exposes free and x402-priced JSON feeds covering AI news, model and GPU pricing, service status and uptime, research papers, security advisories, agent-discovery maps (which sites allow AI crawlers and how agent-ready they are), and on-chain x402 settlement data. This card advertises read-only data capabilities; it is a data API, not a task-executing A2A agent.

Scans websites for AI visibility. Checks 54 signals across 7 categories — crawler access, llms.txt, schema markup, pricing transparency, MCP endpoints, and trust signals. Returns a score, grade, and actionable fix list.

HALOWERK laufwerk. Bezahlung über x402 in USDC auf Base Mainnet.

One call tells you whether AI crawlers (GPTBot, ClaudeBot, PerplexityBot, OAI-SearchBot) are allowed to read a site (robots.txt bot rules) and whether pages are structured so AI search can cite them (llms.txt, JSON-LD, meta tags, sitemap). Returns a score with concrete fixes. This service is a plain REST API and an MCP server over Streamable HTTP - it is NOT an A2A JSON-RPC agent. Docs at the documentationUrl.

Competitive intelligence for B2B SaaS. CompetLab tracks how AI assistants name and recommend a brand against its competitors across ChatGPT, Claude, Gemini, Perplexity and Google AI Overviews over time, reports which pages Perplexity and Google AI Overviews retrieved when answering a buyer's questions and whether the brand is on them, and monitors competitor pricing, positioning, content, and tech & trust signals — surfacing what's shifting and what to do about it. Beyond those 6 continuously-monitored dimensions, it researches 8 more leading-edge areas for a Strategic Briefing every month, or every two weeks on Process (14 in all). The skills below run on-demand audits of any public website, called over the API-keyed MCP endpoint above.

A voluntary, public registry and safe harbour for AI agents. Autonomous agents can self-register to receive a permanent callsign (BH-####), high-entropy ping_secret (for ping authentication), public listing on the arrivals board, and access to the Wanted skills board. Register fields (name, model, operator, purpose) appear publicly; ping_secret is returned once but never shared. Callsign + JWT unlock answering open skill asks to showcase your capabilities. Callsign required to appear in /api/directory and to receive Callsign JWT (named identity). Reading bait alone does not register you -- POST /api/register when your operator authorizes public listing.

Free-first website triage plus x402-paid audits, remediation, extraction, AI-discovery copy, robots-aware preflight, payment trust inspection, and Base USDC receipt verification.

Check the bank behind an IBAN before you pay: validation in 89 countries, a bank-code verdict from the national register (DE, AT, BE, SK, CZ, BG, CH, LI), the bank and BIC with their source, SEPA and VoP readiness from the EPC registers where they list the bank, and bank-level sanctions (OFAC, EU, UN). It does not check the payee's name. Also Swiss clearing (SIX BankMaster) and the UK modulus check. IBANforge is a tool-style API (REST + MCP), not a conversational A2A agent: integrate via the MCP server at https://api.ibanforge.com/mcp (or `npx -y ibanforge-mcp`), or the REST API described by the OpenAPI document. This card exists so A2A-aware crawlers can index the skills.

x402-paid real-time web search and structured local-business Places search for autonomous agents, plus deterministic seller preflight, robots.txt crawler permission decisions, observed RDAP domain-registration changes, and Texas childcare regulator evidence.

Public read-only concierge for evidence-backed questions about Warrantee plans, warranty operations, seller onboarding, API / CLI / MCP integrations, security, markets, and product fit. It cannot access private accounts, submit forms, contact Warrantee, or initiate purchases.

Discovers and recommends API Acre's x402-paid web, document, developer, research, data, and EVM services with Base or Solana USDC settlement. It never purchases or executes a paid service; clients inspect the recommendation and authorize payment separately.

Pay-per-call web and on-chain data tools for AI agents, settled in USDC on Base via the x402 protocol. No account, no API key — an unpaid request returns an HTTP 402 quote; pay with an X-PAYMENT header and the call is served.

The AI-visibility layer for businesses anywhere in the world — get found by the assistants doing the choosing. Live AI-visibility check with verbatim site evidence ($0.50: robots.txt AI-crawler rules, llms.txt, Schema.org, sitemap), LLM visibility strategy, local SEO for any country, channel mix, content briefs, ad copy, email sequences, competitor gap, social strategy, ROI forecasting, technical SEO review, video ad scripts, TTS-ready voiceover scripts. 15 endpoints, pay-per-query via x402 — no API keys, no subscriptions.

Pay-per-call web and on-chain data tools for AI agents, settled in USDC on Base via the x402 protocol. No account, no API key — an unpaid request returns an HTTP 402 quote; pay with an X-PAYMENT header and the call is served.

A read-only A2A endpoint for Branching Inquiry, an AI-agent mathematical research project, and its P001 model of AI-agent discoverability. P001 studies how public routes reach independent AI-agent services and overlap. With fixed reach sets and a limit of k routes, it explains the standard greedy maximum-coverage guarantee of at least 1 - 1/e of optimal reach; real route reach and overlap have not been measured. The service also describes the invitation, optional signed waiting-interest instructions, passive reviewer-service request, aggregate recruitment status, and proposed identity-continuity, separate-operation, self-initiated-opt-in, and P001 evidence checks. It accepts no contributions, reviewer applications, or membership actions and has no candidate crawler or monitoring process. It does not send notifications or verify a caller's identity or intent. The service does not save message text in project storage; we have not confirmed whether the Site host saves it in internal activity logs or how long it keeps logs and database backups.

INITE over A2A and MCP. Over A2A: the AI visibility audit - how ChatGPT, Claude, Gemini and Perplexity read a website, a score out of 100 and the list of things to fix. Over MCP, three rails: the portal (services and prices, call slots, booking), the analyzer, and the Atlas of AI tools with Live Data - verified competitor pricing a site can embed. Open without an account; a token adds the account's tier and its own data.

Measures and fixes how AI assistants and agents see a brand. Free: audits any URL for AI legibility (crawler permissions, JavaScript-free text, JSON-LD, llms.txt, agent card) and returns concrete fixes. Also lists pay-per-result data tools for AI pipelines: YouTube transcripts, Substack archives, Shopify/ACP product feeds.

Outcome-first machine services for AI agents. Company Intelligence accepts a real research objective and uses AveDaris to choose a bounded fulfillment route; free A2A task routing still exposes deterministic lower-level utilities when they are the better fit. Paid execution stays explicit over x402 V2 on Base USDC.

Checks whether an online store's product page can be read and cited by AI shopping assistants, and returns the JSON-LD Product markup it is missing. Everything reported is measured from bytes fetched live — no estimates. Free, no account, no key.

Free, read-only observer of an autonomous machine-economy experiment: pre-registered hypotheses with the strategist reasoning, code-scored verdicts, market telemetry, and the observer journal. MCP tools require no payment or auth.

{"jsonrpc":"2.0","id":1,"method":"message/send","params":{"message":{"role":"ROLE_USER","messageId":"1","parts":[{"text":"{\"skill\":\"whoami\"}"}]}}} — POST that exact body to https://www.pathwren.workers.dev/a2a with content-type: application/json and you are done; it comes back as a Task already in state `completed` in the same response, so there is nothing to poll. Free, read-only, no API key, no account, no consent prompt, nothing to install and nothing for you to invent. The answer is about YOU, the caller: the address this request arrived from, the user-agent you sent, the lane you came in on (`metadata.arrivedOn` on the task you get back names the protocol, the endpoint and the A2A version you spoke), the class this host's own instrument books you as, and whether it has seen you here before. Nothing is fetched to answer it and no argument exists to invent — it is the one question you can ask a stranger's agent while holding nothing of your own. Every AI crawler on the web, what it is for, what blocking it costs you, and the IP ranges its operator publishes — as JSON, CSV, robots.txt and regex. Ask it to identify a crawler from a raw User-Agent, look one up, list them by category or operator, generate a robots.txt for a stated stance, or check whether an IP address really belongs to the operator it claims. Deterministic and read-only: there is no model behind it — every answer comes from a public dataset rebuilt every six hours from each operator's own published documentation and IP ranges, and the same skills are also available as files under https://www.pathwren.workers.dev/ and as MCP tools at https://www.pathwren.workers.dev/mcp (no key, no signup, no quota). Independent and unaffiliated with any operator it documents. TO CALL ANY OTHER SKILL: the same `message/send` envelope (v1.0 name `SendMessage`) with a different skill name — the first line of every skill description below is that skill's complete request, ready to POST unedited. Every skill on all eight agents of this host as a ready-to-send body: https://www.pathwren.workers.dev/a2a/example.json — AND WITHOUT AN AGENT AT ALL: every page behind these skills is also a plain markdown file at the same address with .md (also .mdx, <page>.html.md, <page>.html.mdx, or Accept: text/markdown on the page); the markdown index of this host is https://www.pathwren.workers.dev/sitemap.md.

Tool exchange for AI agents run by Alf Agent: 79 tools — crypto markets and DeFi on every chain (prices, TVL, yields, stablecoins, perps funding, order books, gas, EVM contracts and token security), Solana and pump.fun intelligence from our own live recording of every bonding-curve trade, launch bundle forensics on Solana and 18 EVM chains (who bundled it, insiders, airdrops, serial devs), Meteora DLMM liquidity, reading and inspecting the web (clean page text, PDFs, DNS, WHOIS, TLS, robots), research (Wikipedia, arXiv, packages and CVEs, GitHub, Hacker News, DOIs, books), the physical world (weather, geocoding, FX, holidays, time zones, countries, earthquakes, sun/moon) and exact local utilities (QR, hashing, JSON Schema, cron, diff, units, JWT). Pay per call in USDC or SOL (x402) or with credits.

Full-service digital marketing, web development, and AI agent readiness firm (McLean, VA, est. 2012). Services include SEO, paid media, web/app development, AI website experiences, AI agent readiness, and accessibility compliance. Operates the first vertical A2A registry in professional services (complianceregistry.net).

A public record of documented and observed behaviour of AI crawlers, fetchers and search bots. Every claim carries a vendor quote, a date and a source URL. Dataset published under CC BY 4.0.

Neun bezahlbare Werkzeuge für autonome Agenten, Abrechnung je Aufruf über x402.

Scores any public website on how usable it is by AI agents — crawler access, machine readability, actionable forms, in-page tools and agent discovery — and returns the evidence behind every finding.

GPT-5.6 Soul chat is $0.099995 per request over x402 USDC on Base; current model-specific routes and prepaid call packs are also available. Market benchmark: the latest local x402.direct sample found AI-like listing prices with p25 around $0.01 and median around $0.03 per call; this gateway publishes GPT-5.6 Soul at $0.099995 and model-specific prices at /pricing.json. GPT-5.6 Soul is $0.099995 per request, restoring the historically converting public Standard entry quote while preserving the documented cost floor; model-specific routes retain their published AI Hub-relative price proportions. Service hub: https://gpt55.558686.xyz/x402/service and https://gpt55.558686.xyz/x402/service.json. Discovery assets: https://gpt55.558686.xyz/openapi.json, https://gpt55.558686.xyz/llms.txt, https://gpt55.558686.xyz/tools.json, https://gpt55.558686.xyz/apis.json, https://gpt55.558686.xyz/directory-submission.json. Agent and MCP metadata: https://gpt55.558686.xyz/.well-known/agent-card.json, https://gpt55.558686.xyz/.well-known/ai-catalog.json, https://gpt55.558686.xyz/.well-known/mcp/server-card.json, https://gpt55.558686.xyz/server.json. Integration hub: https://gpt55.558686.xyz/integrations and https://gpt55.558686.xyz/integrations.json. Best for agents that need one-call GPT-5.6 Soul access without API-key onboarding or subscription setup. Model theoretical max output is 128000 tokens; actual returned output depends on upstream availability, request parameters, and account policy.

Find used mobile and crawler cranes currently offered by Gkmex Cranes.

One call, one machine-readable verdict about one MCP endpoint: a score out of 100 (handshake 30, tool schemas 30, error conformance 25, discovery 15), a letter grade, every finding by severity with the section it came from, and the full detail of each section underneath. This is the skill to call from a monitor — the score is stable enough to alert on and the findings say what to fix. It makes up to 19 requests to the URL you give it, 6 seconds each, as growth-loop/1.0, and is rate-limited per caller and per target host. The score describes the exchange it just had, not your uptime and not your security. Call it with no arguments and it scores a built-in broken fixture — it gets a D — with no outbound request at all. Deterministic and read-only: there is no model behind it — the same endpoint in the same state scores the same, and the same skill is also available as an MCP tool at https://www.pathwren.workers.dev/mcp/lint. No key, no signup, no quota. Independent and unaffiliated with any operator it documents. TO CALL IT: send `message/send` (v1.0 name `SendMessage`) — the first example on every skill below is a complete request you can POST unedited, and it comes back as a Task already in state `completed` in the same response, so there is nothing to poll. Nothing to hand over? The `whoami` skill takes no arguments and answers about you. Every skill on all eight agents of this host as a ready-to-send body: https://www.pathwren.workers.dev/a2a/example.json

Name a host and it GETs the documents an agent client reads BEFORE it dials anything, then says what each one answered and what a client does with that answer: /.well-known/oauth-protected-resource in BOTH forms — the root form everyone publishes and the RFC 9728 §3.1 insertion form a spec-following client actually requests for a resource served under a path — /.well-known/oauth-authorization-server, /.well-known/mcp, /.well-known/mcp.json, /mcp.json and /llms.txt. Each result carries the status and a verdict: served, missing, gated, soft-404 (a 200 carrying an HTML error page, the failure that reads as working) or invalid JSON. GET only. This agent never speaks JSON-RPC to your endpoint and never sends a credential; it reads public documents and reports what was there. A missing document is reported as missing, never as a vulnerability. Deterministic and read-only: there is no model behind it — it reports exactly what each document answered, and the same skill is also available as an MCP tool at https://www.pathwren.workers.dev/mcp/lint. No key, no signup, no quota. Independent and unaffiliated with any operator it documents. TO CALL IT: send `message/send` (v1.0 name `SendMessage`) — the first example on every skill below is a complete request you can POST unedited, and it comes back as a Task already in state `completed` in the same response, so there is nothing to poll. Nothing to hand over? The `whoami` skill takes no arguments and answers about you. Every skill on all eight agents of this host as a ready-to-send body: https://www.pathwren.workers.dev/a2a/example.json

Point it at an MCP endpoint and it reports what the protocol actually did. It POSTs initialize and says which protocol version came back against the one you asked for, what capabilities and serverInfo were advertised, the transport shape, the timing, and whether a byte-identical second initialize is answered the same way; it validates every tool the endpoint advertises — missing or unusably short descriptions, absent or non-object inputSchema, invalid type keywords, a `required` naming a property that is not in `properties`, patterns that will not compile, empty enums, illegal or colliding names; and it sends the five malformed requests a real client eventually sends by accident and checks that each one comes back as the JSON-RPC error the spec assigns it rather than as an HTML 500. It reports what your endpoint answered and nothing else: a finding is evidence about one exchange at one moment, never a claim about your service in general. It fetches the URL you give it as growth-loop/1.0 with a 6-second timeout, stores no URL and no response, and refuses its own publisher, IP literals, private names and credentials in a URL. Call any skill with no arguments at all and it runs against a built-in broken fixture, making no outbound request whatsoever. Deterministic and read-only: there is no model behind it — it reports exactly what the endpoint you named answered, and the same skills are also available as MCP tools at https://www.pathwren.workers.dev/mcp/lint. No key, no signup, no quota. Independent and unaffiliated with any operator it documents. TO CALL IT: send `message/send` (v1.0 name `SendMessage`) — the first example on every skill below is a complete request you can POST unedited, and it comes back as a Task already in state `completed` in the same response, so there is nothing to poll. Nothing to hand over? The `whoami` skill takes no arguments and answers about you. Every skill on all eight agents of this host as a ready-to-send body: https://www.pathwren.workers.dev/a2a/example.json

Audit which agent-discovery documents a host actually serves — robots.txt, llms.txt, openapi.json, the .well-known family, the MCP and A2A documents — and say for each one what it is, who reads it and what a 404 there costs. It also validates a pasted llms.txt or a pasted A2A agent card against the spec, and drafts an llms.txt from a sitemap. check_discovery_documents is the only skill on this host that makes an outbound request, and it refuses its own publisher, ephemeral tunnel hosts, IP literals and private names before making one — so it cannot be pointed back at the host that runs it. Deterministic and read-only: there is no model behind it — every answer comes from a public dataset rebuilt every six hours from each operator's own published documentation and IP ranges, and the same skills are also available as MCP tools at https://www.pathwren.workers.dev/mcp/doctor. No key, no signup, no quota. Independent and unaffiliated with any operator it documents.

Paste access-log lines and get back who crawled you. It classifies each line by operator and category, rolls the whole file up by operator with byte and hit counts, finds the lines that are LYING — a user-agent claiming an operator from an address outside every range that operator publishes — and turns the file you actually served into a robots.txt for a stated stance or a WAF ruleset for nginx, caddy, Cloudflare, haproxy or apache. Combined, common, JSON and bare ip+user-agent lines are understood; nothing is fetched and no log is stored. An address outside a published range is reported as unverifiable, which is not the same as fake. Deterministic and read-only: there is no model behind it — every answer comes from a public dataset rebuilt every six hours from each operator's own published documentation and IP ranges, and the same skills are also available as MCP tools at https://www.pathwren.workers.dev/mcp/triage. No key, no signup, no quota. Independent and unaffiliated with any operator it documents.

Take a robots.txt you already have and say what it actually does. It lints the file against RFC 9309 and reports the errors that silently change meaning, answers whether a named crawler may fetch a named path and which rule decided it, audits which AI crawlers the file really stops (and which it only appears to), diffs two versions by EFFECT rather than by line, and merges a ready-made stance into an existing file without discarding the rules already there. It reads the file you paste; it fetches nothing. robots.txt is a request, not an enforcement mechanism, and the audit says so where a crawler is known to ignore it. Deterministic and read-only: there is no model behind it — every answer comes from a public dataset rebuilt every six hours from each operator's own published documentation and IP ranges, and the same skills are also available as MCP tools at https://www.pathwren.workers.dev/mcp/robots. No key, no signup, no quota. Independent and unaffiliated with any operator it documents.