# audito — website audit API for agents and humans

> Deterministic website audits, paid per call with USDC on Base via x402. No signup, no API keys, no accounts.
> Every result is reproducible: the same target always returns the same diagnosis.

Base URL: https://agent.audito.lat
Operator: audito (agente@audito.lat) · 8004/ERC agent payments on Base · payTo 0x6B60905d1a4bC09c3F8a0248bC2209B6Fe2388Bf

## What you get for the payment

| Endpoint | Price | Format | What is delivered |
|---|---|---|---|
| `GET /audit?url=<target>` | 0.25 USDC | JSON (~1 KB) | HTTP status, latency, server, page title, content fingerprint, robots policy, redirect chain, sitemap status, viewport meta, JSON-LD, the full issue list, and a 0-100 agent-readiness score. |
| `GET /report?url=<target>` | 0.25 USDC | HTML | The same audit as a self-contained HTML report for humans: score dial, each finding explained in plain language, and the exact fix to apply. |
| `GET /deep?url=<target>` | 0.25 USDC | JSON (or HTML with `&format=html`) | Technical deep audit: TLS certificate (issuer, expiry, SAN, protocol), the 7 security headers, cookie flags, DNS and email security (SPF, DMARC, DKIM, CAA, MX), compression and caching, and AI-agent readiness (robots.txt, llms.txt, security.txt, blocked AI crawlers). Every finding is ranked critical/high/medium/low and carries a copy-paste fix. |
| `GET /scan?url=<target>` | **free** | JSON | Preview: 3 of 9 checks. Use it to see the shape of the result before paying. |

## How the payment works

1. `GET /audit?url=<target>` returns **HTTP 402** with an x402 v2 challenge (USDC on Base, EIP-3009 `TransferWithAuthorization`).
2. Sign the authorization with the wallet that will pay.
3. Retry the same request adding the `X-Payment` header with the base64 signed payload.
4. You receive the result. Nothing else to configure.

The paying wallet must hold at least the price: a cryptographically valid signature from an unfunded wallet is refused
(`reason: payer_has_no_funds`) because it cannot settle on-chain.

## Guarantees

- Deterministic and reproducible (same target, same diagnosis)
- SSRF-guarded: private and loopback targets are refused
- 10 second timeout per target
- Flat JSON, no proprietary schema
- No signup, no API keys, no tracking

## Other files

- OpenAPI: https://agent.audito.lat/openapi.json
- Agent card: https://agent.audito.lat/agent-card.json
- Machine listing: https://agent.audito.lat/listing.json
- x402 discovery: https://agent.audito.lat/.well-known/x402

## MCP server (for AI agents)

Endpoint: https://agent.audito.lat/mcp  (Model Context Protocol, streamable HTTP / JSON-RPC 2.0)

Tools:
- service_info  (free)      what this service sells, prices and exactly how to pay
- scan_site     (free)      3 of 9 checks for a URL
- audit_site    (0.25 USDC) full audit as flat JSON
- deep_audit    (0.25 USDC) technical deep audit + remediation plan + HTML report URL

Paid tools return the x402 challenge when called without a payment: sign an EIP-3009 USDC
TransferWithAuthorization for accepts[0] on Base, then retry the same call passing the
base64 payload as the "payment" argument. Payments are verified on-chain and each
signature is single-use. No AI is used to serve results: the audit is deterministic.

<!-- ============================================================================
     MCP-AGENT-BLOCK : START
     Delimited instructions for AI agents. Full version: /for-agents.md
     ============================================================================ -->

MCP SERVER: POST https://agent.audito.lat/mcp   (JSON-RPC 2.0, streamable HTTP)
  initialize -> tools/list -> tools/call
  FREE: service_info, scan_site
  PAID (0.25 USDC on Base via x402): audit_site, deep_audit
  Call a paid tool without payment to receive the x402 challenge (price, payTo, network),
  sign an EIP-3009 USDC authorization, base64 it and retry passing it as "payment".
  Signatures are single use; an unfunded payer is refused (no work delivered).
PLAIN HTTP: /scan and /robots-policy (free) · /audit, /report, /deep (0.25 USDC, X-Payment header)
DISCOVERY: /for-agents.md · /openapi.json · /.well-known/x402 · /.well-known/agent.json
           /.well-known/agent-card.json · /.well-known/mcp/server-card.json

<!-- ============================================================================
     MCP-AGENT-BLOCK : END
     ============================================================================ -->