{"uid":"cap_W5g1dv5ra05EtvmsqRxi5","slug":"tech-version-cve-security-header-check-7d8b2cfa","name":"Tech Version, CVE & Security Header Check","description":"Pay-per-call data and tools for AI agents, $0.002-0.01 per call in USDC via x402 (Base, Polygon or Solana), no account or API key; MAX tiers ($0.05-0.25) run deeper jobs. Agent toolkit: web search, search + read top pages, any page as clean markdown with a prompt-injection check, which-x402-API-to-call recommender, seller check. Data: Google Maps places with contacts, YouTube video data and transcripts, job listings (Indeed, LinkedIn, 13 boards), Google Ads Transparency, TikTok comments, Pinterest, Airbnb, Redfin, AliExpress, app stores, live sports, website and SEO checks, Shopify store tech stacks, and onchain token / address risk checks.","url":"https://agent-data.centorprat.workers.dev/tools/tech-version-cve-check?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"urls":{"type":"array","items":{"type":"string"},"maxItems":3,"description":"Pages to check, e.g. [\"https://your-site.com\"]. The Actor only performs a normal read-only GET of each page - no probing or exploitation. Only use it on assets you own or have permission to test."},"version":{"type":"string","description":"If you already know the version running on your asset, set it to CVE-check it directly (used for every technology above)."},"technologies":{"type":"array","items":{"type":"string"},"maxItems":3,"description":"Technologies to look for, e.g. [\"jquery\"], [\"wordpress\", \"nginx\", \"php\"]. Known: jquery, bootstrap, lodash, vue, react, angular, axios, moment, wordpress, drupal, joomla, nginx, apache, php (others are attempted generically)."},"includeSecurityHeaders":{"type":"boolean","description":"Also report which standard security headers (HSTS, CSP, X-Frame-Options, ...) and cookie flags the page sends - a passive OWASP A05-flavored hardening read from the same response. No extra requests."}}},"responseSchema":{"type":"json","example":{"items":[{"url":"https://wordpress.org/","note":"Passive read of response headers only (OWASP A05-flavored). Missing headers are a hardening signal, not a confirmed vulnerability - some may be set at a CDN/edge or on other routes; verify in context.","check":"security-headers","fetched":true,"posture":"weak-headers","checkedAt":"2026-10-24T13:50:20+00:00","xPoweredBy":null,"cookieFlags":null,"serverHeader":"nginx","missingHeaders":["Content-Security-Policy","X-Content-Type-Options","Referrer-Policy","Permissions-Policy"],"presentHeaders":["HSTS","X-Frame-Options"]}]}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.03","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.03/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_dkt56maqk5exJZPhPvkbv","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.03","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Passively detects technology versions from a URL via headers/meta/scripts, looks up known CVEs in OSV/NVD, and optionally audits security response headers — all read-only, no active probing.","exampleAgentPrompt":"Can you passively check my site https://mybusiness.com for the jQuery and WordPress versions it's running, look up any known CVEs for those versions, and also tell me if the security headers like HSTS and CSP are properly set?","exampleUseCases":[{"title":"WordPress CVE audit before deployment","prompt":"Before I push my WordPress site live at https://staging.mycompany.com, can you detect what version of WordPress and PHP it's running and tell me if there are any known CVEs I should patch first?"},{"title":"Security header hardening check","prompt":"Can you check https://app.myproduct.io for its security headers — HSTS, CSP, X-Frame-Options, cookie flags — and let me know what's missing or misconfigured? Also detect the nginx version and flag any CVEs."},{"title":"Known-version CVE lookup for asset inventory","prompt":"I know my server is running nginx 1.18.0 — can you check https://api.myservice.com and confirm that version, then list all known CVEs for nginx 1.18.0 from public databases?"}],"resultDescription":"Returns the detected version of each requested technology (parsed from response headers, meta tags, or script URLs), a list of matching CVEs from OSV/NVD with identifiers and severity, and optionally a per-header security posture report covering HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy, and cookie security flags.","failureModes":["URL is unreachable or returns non-200 — lookup fails but is not charged","Technology not detected on page — returns empty version, no CVE lookup possible","Unknown/niche technology — attempted generically, may return no results","CVE database returns no records for the detected version — not an error, just zero CVEs","Version string ambiguous or obfuscated in headers — detection may be inaccurate","Rate limits or upstream OSV/NVD unavailability — may return partial results"],"whenToPreferThis":"Choose this endpoint when you need a fast, read-only, passive check of a web asset's technology versions and CVE exposure without running an active scanner or exploitation tool. It is ideal for pre-deployment security reviews, asset inventory enrichment, or quick vulnerability triage on owned domains. Prefer it over active scanners when stealth and non-intrusiveness matter, or when you want CVE data bundled with security header analysis in a single call.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-30T05:12:19.433Z","isFirstParty":false,"canonicalSlug":"tech-version-cve-security-header-check-7d8b2cfa"}