api.trustsource.cc

Fetches a URL server-side and returns **sanitized, agent-ready text** plus a **prompt-injection risk verdict** (SAFE / REVIEW / BLOCK). Detects indirect prompt injection that an agent cannot detect itself without first ingesting it: instructions hidden in `display:none` elements, HTML comments, `alt` attributes and off-screen text; invisible Unicode-Tag (U+E0000) and zero-width smuggling; homoglyph-obfuscated and base64-encoded payloads; ChatML / `[INST]` delimiter spoofing; markdown-image data exfiltration; and tool-call bait. Findings are weighted by WHERE they occur — the same phrase is low-risk in visible prose (security blogs discuss injection constantly) and high-risk when concealed. The returned `content.text` has hidden elements and invisible control characters removed, so a model only ever sees what a human would see. **Payment:** 0.01 USDC per call via x402 (Base Mainnet). **Caching:** 10 minutes per URL.

One call → one CLEAR / REVIEW / BLOCK verdict on any URL, fusing domain trust (WHOIS age, TLD risk, DNS, registrar), a live TLS certificate check, and typosquat / lookalike-brand detection into a single graded 0–100 answer with human-readable reasons. Use before an agent clicks, fetches, submits data to, or transacts with a link — the go/no-go it can gate on. **Payment:** 0.01 USDC per call via x402 protocol (Base Mainnet). **Caching:** Results cached for 1 hour per domain.

Grade a domain's email-auth posture (SPF, DKIM, DMARC, BIMI, MX) and report whether the sender can be spoofed. Returns an A–F grade, a `spoofable` flag, the parsed DMARC policy and SPF qualifier, and specific misconfiguration issues. Judge a sender domain before trusting an email, or confirm your own domain won't be silently rejected by Gmail/Yahoo/Microsoft's 2026 rules. **Payment:** 0.003 USDC per call via x402 protocol (Base Mainnet). **Caching:** Results cached for 6 hours per domain.

Returns a 0–100 trust score for any domain or URL. Analyzes domain age (WHOIS), TLD risk, DNS presence, and registrar reputation. Returns structured JSON including a tier (TRUSTED/MODERATE/CAUTION/HIGH_RISK), full scoring breakdown, and detailed signals. **Payment:** 0.003 USDC per call via x402 protocol (Base Mainnet). Clients must handle HTTP 402 responses by paying the specified amount and retrying with the payment proof header. **Caching:** Results are cached for 1 hour per domain.

Live TLS handshake to the target domain. Returns 0–100 SSL score, certificate chain details, expiry, trusted CA detection, TLS protocol version, cipher quality, and security warnings. **Payment:** 0.002 USDC per call via x402 protocol (Base Mainnet). **Caching:** Results are cached for 6 hours per domain.

Fetches the target URL and audits HTTP security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-*). Returns a defense-in-depth letter grade A+ through F with per-header analysis and notes. **Note:** This is a hardening signal, not an active vulnerability scan. Many legitimate marketing sites grade F. **Payment:** 0.003 USDC per call via x402 protocol (Base Mainnet). **Caching:** Results cached up to 4 hours per URL.

Fetches and parses the target domain's robots.txt and detects policies across 24 known AI crawlers (GPTBot, ClaudeBot, PerplexityBot, Google-Extended, CCBot, Bytespider, and more). Returns parsed rules, sitemap URLs, and an AI-friendliness tier (OPEN / SELECTIVE / BLOCKED_AI / BLOCKED_ALL / NO_ROBOTS_TXT). **Payment:** 0.002 USDC per call via x402 protocol (Base Mainnet). **Caching:** Results cached up to 12 hours per domain.