SSL audit
TLS/SSL security posture check: live certificate inspection, HTTP security headers, and CAA DNS records.
$0.10
per call · one payment for the whole workflow
POST /api/skill/ssl-audit
3 tools run server-side in one request. You pay once, settle once, and get a single response - no orchestration, no per-step payments, and a partial-success envelope if any step fails. USDC over x402 on any supported chain.
When to use this pack
Verifying a domain's TLS posture - cert validity, security headers, and who's authorized to issue certs.
Tools in this pack
All 3 run inside the single $0.10 call above. Each is also callable on its own if you only need one part.
- TLS certificate POST /api/tls-cert Inspect the TLS certificate of any public host: subject, issuer, validity window, days remaining, SANs, and SHA-256 fingerprint.
- HTTP headers + security analysis POST /api/http-headers Fetch a URL and return every response header plus a security analysis: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/CORP/COEP. Scores 0–100 by presence, flags weak HSTS, and warns on Server/X-Powered-By identity leaks. SSRF-protected.
- DNS lookup POST /api/dns-lookup Resolve any DNS record type for a host: A, AAAA, MX, TXT, CNAME, NS, SOA, CAA, SRV, PTR. Returns the records plus a count. Built on Node's native resolver - no external API.
Workflow
- Inspect the live TLS certificate - issuer, expiry, SANs, chain validity.
- Fetch HTTP response headers - HSTS, CSP, and other security headers.
- Check CAA DNS records to see which CAs are authorized to issue certs for this domain.
Call it directly
Any x402 client pays the 402 and gets the whole workflow back in one response:
npx agent402-client call ssl-audit {"domain":"stripe.com"}
Run it in Claude
claude mcp add agent402 -s user -- npx -y agent402-mcp@latest
Then paste this prompt into Claude:
Run an SSL audit on stripe.com using Agent402's ssl-audit skill pack. Get (1) TLS cert details - issuer, expiry, SANs, (2) HTTP security headers - HSTS, CSP, (3) CAA DNS records. Flag any near-expiry or missing HSTS.