{"uid":"cap_LL5GguyTYTR99g4Q-J5Y6","slug":"file-format-inspector-extension-vs-content-mismatch-detector-c6eb9044","name":"File Format Inspector – Extension vs Content Mismatch Detector","description":"Compare a file name's extension with its real type from the first bytes; flags executables disguised as documents or images.","url":"https://file-formats.x402tookit.com/extension-vs-content?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["filename","hex"],"properties":{"hex":{"type":"string","description":"First bytes of the file as hex, up to 512 bytes"},"filename":{"type":"string","description":"The file name as supplied, for example invoice.pdf or photo.jpg"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","properties":{"asOf":{"type":["null","string"]},"source":{"type":["null","string"]},"reasons":{"type":["array","null"],"items":{"type":"string"}},"summary":{"type":["null","string"]},"verdict":{"type":["null","string"]},"degraded":{"type":["boolean","null"]},"filename":{"type":["null","string"]},"extension":{"type":["null","string"]},"disclaimer":{"type":["null","string"]},"notChecked":{"type":["array","null"],"items":{"type":"string"}},"detectedMime":{"type":["null","string"]},"detectedType":{"type":["null","string"]},"doubleExtension":{"type":["boolean","null"]},"detectedCategory":{"type":["null","string"]}}}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.02","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.02/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_L7Ir83AdaSKQ3ZPAayYy5","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.02","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Compares a file's declared extension against its actual type inferred from the first bytes, flagging disguised executables or mismatched file types.","exampleAgentPrompt":"I just received a file called invoice.pdf — can you check if it's actually a PDF by comparing its extension to what its first bytes say it really is? Here's the hex: 4D5A9000...","exampleUseCases":[{"title":"Email attachment security check","prompt":"Someone sent me a file named report.pdf but I'm suspicious — the hex bytes start with 4D5A which I think is an EXE signature. Can you compare the extension against the actual content type to see if it's disguised malware?"},{"title":"File upload validation for web app","prompt":"A user uploaded photo.jpg to our platform. Here are the first 512 bytes as hex: 504B0304... — can you verify whether the extension matches what the file actually is, and flag it if it looks like a disguised executable?"},{"title":"Double extension phishing detection","prompt":"I have a suspicious file called document.docx.exe and its hex header starts with 4D5A9000. Check whether the extension matches the real file type and tell me if this looks like a double-extension trick."}],"resultDescription":"Returns a verdict on whether the file extension matches the detected content type, including the detected MIME type, detected type label, detected category, whether a double extension was found, a human-readable summary, a list of reasons supporting the verdict, and any disclaimers or caveats about the analysis.","failureModes":["Missing filename or hex query params — returns validation error","Hex string too short to identify file type — may return inconclusive result","Unrecognized magic bytes — detected type may be null or generic","Degraded mode if signature database is partially unavailable — degraded flag set to true","Non-hex characters in hex param — likely parse error"],"whenToPreferThis":"Choose this endpoint when you need to cross-validate a file's declared extension against its actual binary signature — especially for security-sensitive upload pipelines, email attachment screening, or anti-phishing workflows. Prefer it over a generic MIME-type identifier when you specifically need to compare the claimed name against the true type and get a pass/fail verdict with reasons.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-30T00:34:53.864Z","isFirstParty":false,"canonicalSlug":"file-format-inspector-extension-vs-content-mismatch-detector-c6eb9044"}