268 個可在自有網域執行的開源測試，每次低至 $0.0005；作者建立供 AI Agent 尋找測試的目錄

I run an x402 paid API catalog on Base (USDC) with 268 endpoints — every one priced at $0.0005–$0.005 per call. The catalog covers web security, DNS, HTTP, email auth, TLS, certificates, accessibility, sustainability, and a dozen adjacent surfaces. Each one is a real linter, real probe, real HTTP socket, real DNS query against your target.

What they cost: less than a coffeeshop dollar to test your entire prod stack.

What this looks like from the agent side

# 1. Pick what to test
WORKFLOW = [
    ("/api/x402-cost-quote",          "path=/api/extract"),
    ("/api/catalog-integrity-audit",  "url=https://yoursite.com"),
    ("/api/buyer-wallet-preflight",   "path=/api/extract"),
]
# 2. For each call, fetch → parse WWW-Authenticate → settle → retry
for path, q in WORKFLOW:
    r = fetch(f"https://host{path}?{q}")
    if r.status == 402:
        pay = build_eip3009(path, r.headers["X-PAYMENT"])
        r = fetch(path, headers={"X-PAYMENT": b64(pay)})
    print(path, r.status, r.json())

A 5-call audit of your domain costs 268 × $0.0005 = $0.134 (about 14 USDC cents). The full pipeline — endpoint picker, payment builder, error diagnoser, retry loop, JSON report — fits in 60 lines.

What's inside the catalog

I built it because no single paid API service catalog existed with this breadth at sub-cent pricing for AI agents. The full inventory lives at the standard /.well-known/x402 discovery path. Every endpoint ships with an extensions.bazaar block describing its input/output schemas so any agent that fetches a 402 envelope can plan the next call without scraping sample bodies.

Some of the endpoints:

Surface	What it does	Price
DNS	A/AAAA/MX/NS/TXT/CNAME/HTTPS/SRV/CAA/DS/DNSSEC/RPKI/AXFR/DANE-chain	$0.0005
HTTP	method-policy, smuggling-evidence, hop-by-hop-strip, encoding-integrity, QPACK-fingerprint, HTTP/3 readiness, CORS-runtime-attack, cache-poisoning, rate-limit-headers	$0.0005
TLS	cert-transparency monitoring, OCSP-stapling check, OCSP-must-staple, DANE/TLSA, MTA-STS policy validation, SVCB/HTTPSSVC parser	$0.0005
Email	DKIM/SPF/DMARC rollup, BIMI selector rotation, MTA-STS policy violation parser, DANE/TLSA	$0.0005
Content-security	CSP-deep, CSP-inline-fidelity, CSP-source-list extraction, CSP-violation-replay, WASM-CSP analyzer	$0.0005
Performance + accessibility	Lighthouse-style performance, accessibility audit, carbon footprint, forms audit	$0.0005–$0.002
Buyer-side tools	x402-cost-quote (price any cart in 1 call), catalog-integrity-audit (score any seller's defects), buyer-wallet-preflight (live x402 settlement test from ephemeral key)	$0.0005

The buyer-side tools are the most novel: instead of paying per-call hoping nothing breaks, an agent can now price its full cart in one call, audit the seller for defects in another, and simulate an end-to-end settle from a funding-less ephemeral key in a third — all before committing real USDC.

Why anyone would pay $0.0005 for a single test

Because time-to-insight matters more than cents-per-call:

A web-security pen-test normally takes days of consultant time
Running 268 domain probes in parallel costs 14 USDC cents and finishes in 90 seconds
An AI agent doing routine CI checks pays for the whole probe suite from one cent's worth of USDC

If you run an AI agent that ships anything to the public web, this catalog turns "