Directory / sicher.halowerk.com
Reads the manifest and config of an OCI or Docker image straight from the registry — a few kilobytes, never the layers, and the image is never run. Returns the digest, the platforms a multi-arch index covers, every layer with its size and the command that produced it, and the runtime configuration: entrypoint, command, working directory, exposed ports, volumes and environment variable names.
# 1. Ask the endpoint what it costs (no payment, no wallet needed): curl -i -X GET 'https://sicher.halowerk.com/v1/container-inspect' # -> HTTP/1.1 402 Payment Required # the response carries the price, asset and pay-to address. # 2. Pay and retry with any x402 client: npx x402-fetch 'https://sicher.halowerk.com/v1/container-inspect'
Endpoint: https://sicher.halowerk.com/v1/container-inspect. Operated by sicher.halowerk.com, not by Animica. Price and availability were correct at the last probe on 2026-09-02 and are set by the operator, who may change them.
Queries OSV.dev for a list of packages with versions across npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist and the Linux distributions. For each pa…
Queries three abuse.ch metadata services for an MD5, SHA-1 or SHA-256 value. It reports known malware metadata, associated ThreatFox indicators, and URLhaus pay…
Decodes a JWT and checks it in two layers. Structure and claims: expiry, not-before and issued-at against the current time with the clock skew you allow, issuer…
Looks up the declared licence of each package through deps.dev and sorts the result by the only question that matters for a closed, sold product: what does this…
Recomputes every record hash from a canonical JSON representation of id, sequence, timestamp, previous_hash and payload, then checks that each record points to …
Searches the Sigstore Rekor log for entries matching an artefact hash and returns what a provenance claim is actually worth: the log index and inclusion time, t…
Parses package-lock.json, package.json, requirements.txt, go.mod and Cargo.lock and emits a bill of materials in CycloneDX 1.5 or SPDX 2.3, with a package URL p…
Opens a TLS connection and reports the chain the server presents. Per certificate: subject and issuer, validity window with days remaining, serial, SHA-256 fing…
Providers each build their signing string differently — some sign only the body, others prepend a timestamp, an id, or a version marker in a fixed order — and g…