sicher.halowerk.com publishes 10 machine-payable endpoints over the x402 protocol, priced from $0.002 to $0.005 per call. Each was probed directly; the response code below is what it returned.
| Endpoint | Method | Price | Probe |
|---|---|---|---|
| /v1/container-inspect | GET | $0.005 | 402 |
| /v1/cve-check | GET | $0.005 | 402 |
| /v1/hash-reputation | GET | $0.005 | 402 |
| /v1/jwt-verify | GET | $0.002 | 402 |
| /v1/license-check | GET | $0.002 | 402 |
| /v1/log-chain-verify | GET | $0.005 | 402 |
| /v1/provenance-verify | GET | $0.005 | 402 |
| /v1/sbom | GET | $0.005 | 402 |
| /v1/tls-chain | GET | $0.002 | 402 |
| /v1/webhook-signature | GET | $0.002 | 402 |
Reads the manifest and config of an OCI or Docker image straight from the registry — a few kilobytes, never the layers, and the image is never run. Returns the digest, the platforms a multi-arch index…
Queries OSV.dev for a list of packages with versions across npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist and the Linux distributions. For each package it returns the vulnerabilities fou…
Queries three abuse.ch metadata services for an MD5, SHA-1 or SHA-256 value. It reports known malware metadata, associated ThreatFox indicators, and URLhaus payload provenance, then derives a conserva…
Decodes a JWT and checks it in two layers. Structure and claims: expiry, not-before and issued-at against the current time with the clock skew you allow, issuer and audience against the values you exp…
Looks up the declared licence of each package through deps.dev and sorts the result by the only question that matters for a closed, sold product: what does this licence demand. Permissive licences nee…
Recomputes every record hash from a canonical JSON representation of id, sequence, timestamp, previous_hash and payload, then checks that each record points to the hash of the record before it. If a r…
Searches the Sigstore Rekor log for entries matching an artefact hash and returns what a provenance claim is actually worth: the log index and inclusion time, the signing identity from the certificate…
Parses package-lock.json, package.json, requirements.txt, go.mod and Cargo.lock and emits a bill of materials in CycloneDX 1.5 or SPDX 2.3, with a package URL per component. The distinction that decid…
Opens a TLS connection and reports the chain the server presents. Per certificate: subject and issuer, validity window with days remaining, serial, SHA-256 fingerprint, key type and size, and the subj…
Providers each build their signing string differently — some sign only the body, others prepend a timestamp, an id, or a version marker in a fixed order — and getting that order wrong produces a misma…