GET · x402 · bounded evidence

Inspect a public URL before you use it.

Observe public DNS answers, a manual HEAD redirect chain, selected response headers, and timestamps. The report describes what was observed and where collection was incomplete; it does not make a safety verdict.

$0.009 USDC per successful call

Get an exact quote

This ordinary GET returns the endpoint's HTTP 402 payment challenge. It does not sign or spend funds.

curl -i 'https://toolvend.dev/url/inspect?url=https%3A%2F%2Fexample.com'

To pay with the capped public client, complete the buyer quickstart, then run:

node toolvend-client.mjs --path '/url/inspect?url=https%3A%2F%2Fexample.com' --pay --max-spend 0.009

What the report contains

DNS and redirects

A and AAAA observations are collected before every hostname is contacted. Each redirect is parsed and checked before another request is made.

HTTP observations

Status, redirect location, selected security-related response headers, and observation timestamps come from body-free HEAD requests.

Findings and warnings

Factual findings call out events such as cleartext or cross-host redirects. Warnings and completeness fields identify partial collection, rejection, clipping, and skipped checks.

Hard limits

At most 4 HTTP targets, 3 followed redirects, 8 DNS queries, 20 seconds of work, and 32,000 UTF-8 bytes in the JSON report.

Illustrative response

The live result depends on the URL and on what its DNS and HTTP services return during the call.

The quoted price also covers a partial report with useful DNS or HTTP observations, including a DNS name-not-found result or a failed HTTP request after successful DNS resolution. Check completeness and warnings before using the result. Invalid input and failures that produce no useful observations return an error without settlement.

{
  "inputUrl": "https://example.com/",
  "normalizedUrl": "https://example.com/",
  "observedAt": "2026-09-21T15:56:40.037Z",
  "targets": [
    {
      "url": "https://example.com/",
      "hostname": "example.com",
      "dns": {
        "status": "resolved",
        "a": [
          "104.20.23.154",
          "172.66.147.243"
        ],
        "aaaa": [
          "2606:4700:10::ac42:93f3",
          "2606:4700:10::6814:179a"
        ],
        "observedAt": "2026-09-21T15:56:40.006Z"
      },
      "http": {
        "method": "HEAD",
        "status": 200,
        "observedAt": "2026-09-21T15:56:40.036Z",
        "location": null,
        "headers": {
          "strictTransportSecurity": null,
          "contentSecurityPolicy": null,
          "xFrameOptions": null,
          "xContentTypeOptions": null,
          "referrerPolicy": null,
          "permissionsPolicy": null
        }
      }
    }
  ],
  "redirects": [],
  "terminal": {
    "target": 0,
    "status": 200
  },
  "findings": [
    {
      "code": "header_not_observed",
      "detail": "strict-transport-security was not present in the HEAD response; absence alone is not a vulnerability verdict.",
      "target": 0
    },
    {
      "code": "header_not_observed",
      "detail": "content-security-policy was not present in the HEAD response; absence alone is not a vulnerability verdict.",
      "target": 0
    },
    {
      "code": "header_not_observed",
      "detail": "x-frame-options was not present in the HEAD response; absence alone is not a vulnerability verdict.",
      "target": 0
    },
    {
      "code": "header_not_observed",
      "detail": "x-content-type-options was not present in the HEAD response; absence alone is not a vulnerability verdict.",
      "target": 0
    },
    {
      "code": "header_not_observed",
      "detail": "referrer-policy was not present in the HEAD response; absence alone is not a vulnerability verdict.",
      "target": 0
    },
    {
      "code": "header_not_observed",
      "detail": "permissions-policy was not present in the HEAD response; absence alone is not a vulnerability verdict.",
      "target": 0
    }
  ],
  "warnings": [],
  "completeness": {
    "complete": true,
    "httpTargets": 1,
    "dnsQueries": 2,
    "partialReasons": [],
    "notPerformed": [
      "response_body_download",
      "get_request_fallback",
      "javascript_rendering",
      "malware_or_phishing_reputation",
      "certificate_chain_validation",
      "rdap_registration",
      "bgp_or_rpki_validation"
    ]
  },
  "sourceLinks": {
    "dns": "https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/make-api-requests/",
    "http": "https://www.rfc-editor.org/rfc/rfc9110.html",
    "platformSecurity": "https://developers.cloudflare.com/workers/reference/security-model/"
  }
}

Interpretation limits

HEAD can behave differently from GET. The inspector never falls back to GET and never reads a response body or runs page JavaScript.
A missing header in a HEAD response does not by itself establish a vulnerability.
The report is not a malware, phishing, reputation, identity, availability, or general safety verdict.
Private, loopback, link-local, and other non-public destinations are rejected. The service cannot inspect private-network or VPN-only URLs.

Network boundary

The inspector queries Cloudflare's DNS-over-HTTPS service before each HTTP target. That observation does not pin the later Worker request to the same IP address: DNS can change between observation and connection. Cloudflare's outbound proxy, which permits public Internet services or the Worker's own zone origin, remains the DNS-rebinding security boundary.

Primary references: Cloudflare DNS-over-HTTPS API, HTTP semantics (RFC 9110), Workers security model, and Workers DNS behavior.