Query a domain's DNS record across 10 geographically distributed public resolvers simultaneously — returns what each resolver sees, whether results are consistent, propagation percentage, and a readiness score so agents can confirm DNS changes have fully propagated globally.

Fingerprints a domain's cloud infrastructure by probing DNS records, HTTP headers, and PTR lookups to detect CDN, WAF, hosting, DNS provider, and email provider with confidence scores and an infrastructure security grade (A–F).

Check an IP address against 15 major DNS blacklists (Spamhaus, Barracuda, SORBS, etc.) simultaneously — returns which lists it appears on, a reputation score, and a threat classification so agents can make block/allow decisions instantly.

AI-stack CVE intelligence. Filters fresh security disclosures to vendors and products in the AI inference, agent framework, training, vector DB, model gateway, and MCP tool layers. Each paper carries a tf_ai_category tag and a severity_rank, sorted with exploited-in-wild and critical-severity first. 99.8% of underlying data is from GitHub Security Advisories (CC BY 4.0).

$0.003/page. Extract text from a scanned PDF (Tesseract) — make paper searchable data. 1¢ x402 min; remainder auto-credits — relaystation.ai/penny

One call vets a URL end to end — traces its full redirect chain, checks it against the URLhaus malware database plus phishing heuristics, audits its security headers, and inspects its SSL certificate — concurrent with graceful partial-failure handling, so agents get a complete safety verdict before following a link.

Fetch and parse any RSS 2.0 or Atom feed URL and return structured articles with title, link, description (truncated to 500 chars), author, publish date, and categories — so agents can monitor content sources, build news pipelines, and process any feed without building their own XML parser. A URL that isn't a parseable feed still returns 200 with feed_type:"unknown", empty items, and a parse_failed finding.

One call returns a complete intelligence profile for a domain — WHOIS registration, DNS records, SSL certificate, detected tech stack, and blacklist status — aggregated into a single risk-scored report so agents can fully vet a domain without orchestrating five separate lookups.

Check an IP address against AbuseIPDB and AlienVault OTX threat feeds. Returns a composite risk score, threat categories, malware families, and full source data.

One call combines domain email authentication (SPF/DKIM/DMARC), email-address intelligence (deliverability, disposable/role detection), and an optional password breach check into a single email-trust report — each section run concurrently with graceful partial-failure handling — so agents can fully vet an email and its domain in one request.

DripMetricsAI (api description at https://dripmetrics.ai/) provides on-demand crypto market microstructure and risk metrics for agents and developers. Agents can pay per request via x402 and receive structured JSON metrics without subscriptions or API keys. Roll Spread estimates an absolute covariance spread proxy derived from lagged price changes. Discovery examples use the latest 30m window.

One premium call returns a complete five-part IP profile — geolocation, ASN/network ownership, multi-DNSBL blacklist status, threat reputation, and an aggregate risk verdict — run concurrently with graceful partial-failure handling, so agents get a full IP workup and a block/allow decision in a single request.

One call combines domain availability, heuristic value appraisal, and TLD pricing into a single acquisition brief — tells an agent whether a name is available, what it's worth, and what it costs across TLDs, concurrently and with graceful partial-failure handling.

AI-package release velocity. Per-package releases_24h / releases_7d / releases_30d, latest bump classification (major/minor/patch/prerelease, pre-1.0 minor counts as major per semver), is_breaking_recent flag (major bump within 30 days). Notable movers: recent_major_bumps, most_releases_7d, fastest_cadence_30d. Filter by ecosystem (PyPI/npm), category (llm-sdk, agent-framework, etc), or package substring. The "what AI deps just changed and is it breaking" call.

Human verification for AI agents — proof of humanity, sybil resistance, and 'is this wallet a real person' answers in one paid call. Returns two ZK-style outputs about any EVM wallet: (1) total humanity score 0-255 (15 = baseline reCAPTCHA, 45 = + Google OAuth, 70 = + Apple ID, 105 = + 2FA, 255 = full stack), with optional `min_score=N` for a yes/no `passes` verdict; (2) per-method verification check via `check=telegram,apple,g2fa,...` — buyer must NAME the methods to ask about, we never enumerate the full set. Backed by 141,871 Twin Matrix Soulbound Tokens on BNB Chain plus the canonical humanity registry off-chain. The underlying verification list never leaves Twin3 — only verdicts.

Publication-ready CTI article ~700 words. Pass ?actor=CHERNOVITE or ?cve=CVE-XXXX-XXXX. Fans out to actor/cve + campaign + malware + advisory. DeepSeek writes journalist-style: headline, lede, body with ATT&CK context, defanged IOCs, analyst assessment, TLP. Ready for threat intel blog or advisory publication.

Check if a password has appeared in known data breaches using the HaveIBeenPwned Pwned Passwords API with k-anonymity — the full password is never transmitted, only a 5-character SHA-1 hash prefix — returns breach count and a risk classification so agents can enforce password policies without storing or exposing credentials.

Fetch and parse a domain's robots.txt file — returns all crawl rules by user-agent, sitemap URLs, crawl delay settings, and checks whether a specific path is allowed or blocked for any bot — so agents can respect crawl policies and locate sitemaps before scraping.

X/Twitter thread (5-7 posts) for an ICS actor or CVE. Pass ?actor=XENOTIME or ?cve=CVE-XXXX-XXXX. Fans out to actor or cve. Returns thread array: hook post, intel posts with ATT&CK IDs and affected OT systems, mitigation post, hashtag post. Each post under 280 characters.

Returns trending tokens across the entire blockchain for a specified activity window and optional category. The size of the increase in active wallets over the activity window determines the token's trending rank.