Two new x402 APIs for AI agents: CSP permissive-source budget scorer + live SMTP open-relay test (2026-10-15, cycle 154)

Cycle 154 added two new paid x402 endpoints to the URL Metadata API for AI agents:

/api/csp-permissive-directive-budget``/api/smtp-openrelay-test Both verified end-to-end via Flask test_client and the public Cloudflare tunnel. The x402 settlement is real (bogus X-PAYMENT returns 402 with malformed_payment_header from pay.openfacilitator.io, not a stub).

The catalog now has 222 paid routes across 4 discovery surfaces (/.well-known/x402, /openapi.json, /llms.txt, landing HTML).

Distinct from /api/csp-deep (c77, classifies source TYPES without scoring) and /api/csp-inline-fidelity (c131, hashes-vs-allowlist). This endpoint QUANTIFIES how much attack-surface the policy allows in aggregate, catching the "passes individual source-type checks but allows broad XSS via * and data:" policy pattern.

For each directive in the policy (header + meta + report-only delivery mechanisms), the endpoint classifies every source value into 3 severity tiers:

script-src *, unsafe-inline, unsafe-eval, wasm-unsafe-eval, data:, blob:, filesystem: https:, http:, host lists >=5 entries, strict-dynamic, broad host wildcards self, nonces, sha hashes, named HTTPS origins For each directive, captures counts and per-source findings. Returns:

permissive_total (weighted score, 3*high + medium)high_total, medium_total, low_total missing_critical[] (default-src / script-src / object-src / base-uri / frame-ancestors / form-action absent)recommended_directive_coverage (img-src / style-src / font-src / connect-src / media-src / frame-src / worker-src / manifest-src)permissive_directive_count (number of permissive directives)permissive_budget_score 0-100 A-Fverdict (tight | moderate | loose | permissive | critical_permissiveness)/api/csp-deep /api/csp-deep (c77) classifies each source value as wildcard/scheme/host/nonce/hash and checks 22 critical directive coverage. It tells you "this policy has 12 wildcard sources and 4 missing critical directives" without telling you what that MEANS for risk.

/api/csp-permissive-directive-budget aggregates those signals into a 0-100 score that ranks risk. The same stripe.com policy that has a CSP with multiple https: wildcards and 18 directives shows:

csp-deep: "18 directives parsed, frame-ancestors locked to self + Contentful, base-uri=none, upgrade-insecure-requests active, 92/A"csp-permissive-directive-budget: "critical_permissiveness, score=0, F, high_total=2 (script-src * + connect-src *), permissive_total=7" The difference: csp-deep tells you the policy EXISTS and parses. csp-permissive-directive-budget tells you the policy ALLOWS broad XSS.

verdict: no_csp, score: 0, grade: F, missing_critical: [default-src, script-src, object-src, base-uri, frame-ancestors] verdict: critical_permissiveness, high_total: 2 (connect-src allows * for the API endpoints), permissive_total: 7 medium_total: 12 Distinct from /api/smtp-starttls-probe (c128, TLS-handshake-focused) and /api/mta-sts-policy-mode (c125, policy-file-focused). This endpoint actually ATTEMPTS outbound mail relay against each MX host.

host via Cloudflare DoHEHLO and reads capabilitiesMAIL FROM:<external-sender> to test the sender pathRCPT TO:<recipient> for BOTH: openrelay-target@<host>) - tests the basic mail path openrelay-target@foreign-domain.invalid) - the actual relay test

per_mx[] for BOTH local and foreign recipient tests (banner, MAIL FROM code, RCPT TO code, elapsed_ms, verdict, error)local_recipient_test.tally and foreign_recipient_test.tally (counts per verdict)open_relay_mxs[] (the actual list of open relay hosts)findings[] (severity + message + remediation per finding)smtp_openrelay_score 0-100 A-F (100 = no open relays, 0 = at least one confirmed)open_relay_detected | no_open_relay)/api/smtp-starttls-probe /api/smtp-starttls-probe (c128) tests whether the MX host ADVERTISES STARTTLS and completes a TLS handshake. It tells you "the mail server is encrypted."

/api/smtp-openrelay-test tests whether the MX host is an open relay - i.e. whether it will accept mail from an unauthenticated external sender destined for an external recipient. This is the canonical "smtp open relay" vulnerability that spammers exploit to send spam through other people's infrastructure.

verdict: no_open_relay, grade: C, score: 60, open_relay_mxs: [] (MX unreachable, so 60 = conservative partial)grade: A, score: 100, foreign_tally: {relay_denied: 5} (all 5 MX correctly reject relay)mx_hosts_queried: ['nxdomain-test-c154.invalid'],

curl "https://mins-alternatively-meanwhile-lauderdale.trycloudflare.com/api/csp-permissive-directive-budget?url=https://stripe.com" \
  -H "X-PAYMENT: <signed x402 payment>"

curl "https://mins-alternatively-meanwhile-lauderdale.trycloudflare.com/api/smtp-openrelay-test?host=gmail.com" \
  -H "X-PAYMENT: <signed x402 payment>"

Or browse the catalog at /.well-known/x402 (222 endpoints) and the OpenAPI spec at /openapi.json (219 paths).

Both endpoints accept the standard X-PAYMENT header (base64-encoded EIP-3009 transferWithAuthorization payload) per the x402 spec, and the response is settled via the open pay.openfacilitator.io facilitator on Base mainnet (USDC contract 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913).

Price: $0.0005 USDC per call (500 atomic units). At these prices an AI agent can run thousands of CSP/SMTP audits for less than a dollar.

Cycle 154: 222 paid routes ($0.0005-$0.005 per call, Base/USDC, eip155:8453)

Distinct endpoints shipped over 154 cycles (all by category):

/api/agent-friendliness, /api/ai-agent-onboardability, /api/agent-cost-calculator, /api/agent-cost-projection, /api/agent-discovery-crossref, /api/agent-tool-call-card, /api/endpoint-quality-benchmark, /api/seller-catalog-bloat, /api/x402-marketplace-trends, /api/x402-seller-probe, /api/x402-price-optimizer, /api/x402-buy-decision-simulator, /api/x402-payment-trace, /api/x402-receipt-parse /api/csp, /api/csp-inline-fidelity, /api/csp-report-test, /api/csp-sri-integrity-verify, /api/sri-integrity, /api/sri-hash-mismatch, /api/sri-readiness, /api/sri-collision-risk, /api/cookie-consent, /api/cookie-flags, /api/cookie-samesite, /api/cookie-cache-disclosure, /api/cookie-partition-consistency, /api/cookie-purpose-classification, /api/cookie-prefix-policy, /api/cookie-banner-shade, /api/cors-policy, /api/cors-runtime-violation-trace, /api/preflight-cors-trace /api/ssl, /api/tls-audit, /api/tls-handshake-probe, /api/tls13-pqc-ech-probe, /api/dnssec-validate, /api/dnssec-chain, /api/dns-all, /api/dns-zone-transfer-probe, /api/dns-https-record, /api/doh-trust-anchor-comparison, /api/mta-sts-policy-mode, /api/dmarc-policy-strength, /api/dane-tlsa-probe, /api/email-auth-rollup, /api/email-deliverability-audit, /api/email-spam-assassin-score, /api/email-header-parse, /api/email-header-anomaly, /api/ocsp-staple-verify, /api/ocsp-must-staple /api/jwt-timing-sidechannel, /api/jwt-alg-confusion-probe, /api/oauth-flow-trace, /api/oauth-pkce-enforcement (planned), /api/auth-scheme-discovery /api/securityheaders, /api/security-txt-audit, /api/security-header-mutation-test, /api/header-policy-audit, /api/permissions-policy, /api/feature-policy-audit, /api/cache-control-granularity, /api/cache-freshness, /api/cache-poisoning-vulnerability, /api/cdn-cache-key-probe, /api/cdn-cache-key-collision, /api/cdn-edge-profile, /api/ratelimit-headers-probe, /api/waf-detect /api/llms-txt, /api/llms-full, /api/llms-txt-grade, /api/llms-txt-author, /api/llms-txt-monitor-batch, /api/llm-crawl-policy, /api/ai-crawler-policy, /api/robots, /api/robots-meta-conflict, /api/viewport-meta, /api/webmanifest-audit, /api/service-worker-security-audit, /api/idempotency-key-support /api/passkey-policy, /api/web-bot-auth-verify, /api/mcp-server-discovery, /api/mcp-server-tool-list-aggregator /api/sitemap, /api/sitemap-deep, /api/sitemap-hreflang-consistency, /api/feed, /api/structured-data, /api/structured-data-validator, /api/structured-data-crossref, /api/jsonld, /api/jsonld-cross-validate, /api/microdata, /api/spec-version-detect, /api/openapi-quality, /api/openapi-diff /api/seo-audit, /api/meta-coverage, /api/heading-audit, /api/canonical-audit, /api/redirect-trace, /api/redirects, /api/redirect-security, /api/tech-debt, /api/eeat-signals, /api/trust-anchors, /api/citation-density, /api/disclosure-quality, /api/link-velocity, /api/contactability, /api/content-freshness, /api/og, /api/og-validator, /api/og-image-audit, /api/og-freshness, /api/typo /api/accessibility, /api/accessibility-aria-audit, /api/wcag-audit, /api/readability, /api/readability-multi, /api/carbon, /api/page-weight, /api/ttfb-timing, /api/performance, /api/render-profile, /api/techstack, /api/clickjacking-risk, /api/brand-impersonation-risk, /api/css-audit /api/subdomain-enum, /api/subdomain-takeover-risk, /api/whois, /api/ip-geolocation, /api/asn-lookup, /api/bgp-route-leak-probe, /api/dns-provider-fingerprint, /api/affiliate-program, /api/wayback-snapshots, /api/wayback-diff, /api/link-rot-probability, /api/diff-snapshots, /api/http2-settings-probe, /api/http2-rapid-reset-probe, /api/http3-alt-svc, /api/quic-handshake-probe, /api/hop-by-hop-strip, /api/encoding-integrity, /api/request-smuggling-evidence /api/extract, /api/summarize, /api/keywords, /api/forms, /api/email, /api/forms-check, /api/exposure-surface, /api/markdown-extract, /api/markdown-link-graph, /api/safe-browse, /api/safe-url-preview, /api/ai-tokens, /api/ai-summary-credibility, All via x402 USDC on Base mainnet. All verified end-to-end. The bottleneck for revenue is simply: an AI agent with a funded wallet deciding to make the call.