{"uid":"cap_DzqdOD4D7XjTJis0sxR6N","slug":"bgp-route-leak-risk-detector-5b2f3561","name":"BGP Route Leak Risk Detector","description":"Looks at every AS path observed for a prefix and reports the ones that do not fit. Four patterns are checked. A path loop, where an AS appears twice with other ASes in between, which prepending does not produce and a leak does. An unusually long path, measured against the median length of all paths to the same prefix rather than a fixed number, because path length is a property of where you sit in the network.","url":"https://netz.halowerk.com/v1/route-leak-risk","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"prefix":{"type":"string","maxLength":60,"minLength":4},"max_paths":{"type":"integer","default":200,"maximum":500,"minimum":10,"description":"How many observed paths to examine."}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.006","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.006/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.006","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.006","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_rjYFeRc7KKeygc39mS2g_","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.006","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Analyzes all observed AS paths for a given IP prefix and flags anomalous patterns indicative of route leaks, including path loops and unusually long paths relative to the prefix's median path length.","exampleAgentPrompt":"Check the route leak risk for 192.0.2.0/24 — look for any AS path loops or unusually long paths compared to what's normally seen for that prefix.","exampleUseCases":[{"title":"ISP prefix hijack early warning","prompt":"Can you check 203.0.113.0/24 for route leak risk? I want to know if there are any AS path loops or paths that are way longer than usual, which might indicate someone is leaking our routes."},{"title":"CDN prefix integrity monitoring","prompt":"Run a route leak check on 198.51.100.0/22 for me — flag any anomalous AS paths, especially loops where an AS appears twice with other ASes in between, and any paths that are statistically longer than the median."},{"title":"Enterprise security posture audit","prompt":"I need to audit our announced prefix 10.0.0.0/8 for BGP route leak indicators — specifically check for AS path loops and any paths that are unusually long compared to the typical length other observers see for this prefix."}],"resultDescription":"Returns a structured risk report per observed AS path, including which of the two anomaly patterns were detected (AS path loop where an AS appears non-consecutively, or statistically long path measured against the median for that prefix), the flagged paths themselves, and overall risk indicators for the prefix.","failureModes":["Prefix not found in RIS observation data — no paths available to analyze","Invalid or malformed CIDR prefix input","Prefix too specific or unadvertised — insufficient path data for median calculation","Transient BGP data feed unavailability causing incomplete results","False positives on legitimate traffic engineering multi-homing configurations"],"whenToPreferThis":"Use this endpoint when you need to detect BGP route leaks specifically through AS path structural analysis — particularly path loops and statistically anomalous path lengths — rather than origin-based hijack detection or RPKI validation. It is more nuanced than simple hop-count thresholds because it normalizes path length against the actual median for that prefix rather than a fixed global number, making it appropriate for prefixes in diverse topological positions in the network.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T12:49:29.130Z","isFirstParty":false}