Universal Intel v3

# 🛰️ Universal Intel **An x402-native OSINT endpoint.** One call returns a complete intelligence dossier on any IP, domain, or URL — assembled from **22 independent sources**, distilled into one clean JSON schema, and priced at **$0.001 per call**, payable by any agent. Built for autonomous agents and enrichment pipelines that pay-per-call over **x402** — no accounts, no API-key juggling, no invoices. --- ## 💳 Access & payment This endpoint speaks **x402-v2 on Base**. Two ways in: **1 · Free trial — Sign In With X (SIWX).** Your first **2 calls are free**. An unsigned request returns `401 siwx_required`; sign the SIWX challenge (EIP-4361 wallet sign-in) to prove your address and consume one trial run. No payment, no card — just a signature. **2 · Pay-per-call — x402.** Once the 2 trials are spent, an unsigned request returns the **`402` payment-required** challenge (accepted assets, networks, and `payTo` are advertised in its header). Sign the x402 payment headers and the call settles on-chain at **$0.001** — the dossier comes back in the very same response. `wallet-mcp execute_service` signs both flows automatically. Metered per request, settled per request. --- ## 🎯 What you send ```json { "query": "github.com" } { "query": "8.8.8.8" } { "query": "https://example.com/path" } ``` Domains, IPv4 addresses, full URLs, even an email address — the host is extracted automatically. ## 📦 What you get A single entity-nested dossier (`schema v2.0`): | Section | Contents | |---|---| | **query** | input, resolved type, resolved IP, found flag | | **domain** | registrar, registration dates, age, status, nameservers, full DNS (A / MX / NS / TXT / CAA), DNSSEC | | **host** | ASN, AS name, prefix, RPKI, registry, reverse DNS, geolocation, abuse contacts | | **exposure** | open ports, CPEs, known CVEs, service tags, hostnames | | **email** | SPF record, DMARC policy | | **web** | HTTP status, server, CDN / WAF, security headers (HSTS, CSP, X-Frame, nosniff) | | **reputation** | blocklist status, Tor-exit detection | | **history** | Wayback archive URL + timestamp | | **assessment** | derived `flags[]` — a one-glance risk roll-up | | **meta** | schema version + per-category coverage map | ### Example `assessment.flags` ```json ["dnssec-missing", "spf-present", "dmarc-quarantine", "rpki-valid", "clean-blocklists", "behind-cloudflare", "open-ports-3"] ``` Scattered signals — DNSSEC, SPF / DMARC, RPKI, blocklists, CDN, open ports, CVEs — rolled into one scannable list. --- ## 🛡️ Built to never break - **Fail-open by design.** Any single source can time out or go dark — the dossier still returns, that field simply degraded. No partial crashes, no dropped runs. - **Always-valid schema.** Every response conforms to `schema v2.0` — even malformed input or an internal hiccup returns the full shape, never an empty `[]`. Safe to parse blind. - **SSRF-guarded.** Private, loopback, link-local, and cloud-metadata targets are refused; only public hosts are ever probed. - **Bounded latency.** Per-source timeouts keep every call fast and predictable. Verified green across a broad matrix — major domains, raw IPs, `.co.uk`, and non-existent hosts (which return a clean "not found" dossier, not an error). --- ## ⚡ Coverage & use `network` · `geo` · `dns` · `email` · `registration` · `reputation` · `exposure` · `web` · `history` — with a `meta.sources_ok` map on every response so you always know which dimensions resolved. Ideal for **security triage**, **domain due diligence**, **attack-surface mapping**, and **agent enrichment pipelines** — one x402 call to hydrate any host or domain. --- **POST** `{ "query": "<ip | domain | url>" }` → a complete dossier in one response. Two free trial runs, then $0.001 each over x402.