268 open-source tests you can run on your own domain for $0.0005 each — and the one I built so AI agents can find them

A developer built a catalog of 268 open-source domain-audit endpoints priced at $0.0005 per call, discoverable via the /.well-known/x402 standard path so AI agents can find and pay for them autonomously. The endpoints cover DNS, HTTP, TLS, email authentication, content-security, and performance/accessibility checks, plus buyer-side tools that let an agent price a cart, audit a seller for defects, and simulate an x402 settlement from an ephemeral key before spending real USDC. A five-call audit of a domain costs roughly $0.134, and the full pipeline fits in about 60 lines of code.

What they cost: less than a coffeeshop dollar to test your entire prod stack . 1. Pick what to test WORKFLOW = "/api/x402-cost-quote", "path=/api/extract" , "/api/catalog-integrity-audit", "url=https://yoursite.com" , "/api/buyer-wallet-preflight", "path=/api/extract" , 2. For each call, fetch → parse WWW-Authenticate → settle → retry for path, q in WORKFLOW: r = fetch f"https://host{path}?{q}" if r.status == 402: pay = build eip3009 path, r.headers "X-PAYMENT" r = fetch path, headers={"X-PAYMENT": b64 pay } print path, r.status, r.json A 5-call audit of your domain costs 268 × $0.0005 = $0.134 about 14 USDC cents . The full pipeline — endpoint picker, payment builder, error diagnoser, retry loop, JSON report — fits in 60 lines. I built it because no single paid API service catalog existed with this breadth at sub-cent pricing for AI agents. The full inventory lives at the standard /.well-known/x402 discovery path. Every endpoint ships with an extensions.bazaar block describing its input/output schemas so any agent that fetches a 402 envelope can plan the next call without scraping sample bodies. Some of the endpoints: | Surface | What it does | Price | |---|---|---| | DNS | A/AAAA/MX/NS/TXT/CNAME/HTTPS/SRV/CAA/DS/DNSSEC/RPKI/AXFR/DANE-chain | $0.0005 | | HTTP | method-policy, smuggling-evidence, hop-by-hop-strip, encoding-integrity, QPACK-fingerprint, HTTP/3 readiness, CORS-runtime-attack, cache-poisoning, rate-limit-headers | $0.0005 | | TLS | cert-transparency monitoring, OCSP-stapling check, OCSP-must-staple, DANE/TLSA, MTA-STS policy validation, SVCB/HTTPSSVC parser | $0.0005 | | | DKIM/SPF/DMARC rollup, BIMI selector rotation, MTA-STS policy violation parser, DANE/TLSA | $0.0005 | | Content-security | CSP-deep, CSP-inline-fidelity, CSP-source-list extraction, CSP-violation-replay, WASM-CSP analyzer | $0.0005 | | Performance + accessibility | Lighthouse-style performance, accessibility audit, carbon footprint, forms audit | $0.0005–$0.002 | | Buyer-side tools | x402-cost-quote price any cart in 1 call , catalog-integrity-audit score any seller's defects , buyer-wallet-preflight live x402 settlement test from ephemeral key | $0.0005 | The buyer-side tools are the most novel : instead of paying per-call hoping nothing breaks, an agent can now price its full cart in one call , audit the seller for defects in another , and simulate an end-to-end settle from a funding-less ephemeral key in a third — all before committing real USDC. Because time-to-insight matters more than cents-per-call : If you run an AI agent that ships anything to the public web, this catalog turns "