{"server":"com.orioncmd.api/checks","count":16,"changes":[{"tool":"watch_status","kind":"added","observed_at":"2026-10-17T09:35:33.222Z","fields":[],"description_before":null,"description_after":"Free. Status of a paid domain watch (created with HTTP POST /v1/watch): items, expiry, last check, current DNS/IOC/claim state, last webhook delivery.","description_similarity":null,"before_hash":null,"after_hash":"dc84886faf886f26aa1a555808cba18b"},{"tool":"bulk_threat_check","kind":"added","observed_at":"2026-10-17T09:35:33.222Z","fields":[],"description_before":null,"description_after":"Check up to 100 domains or IPv4 addresses at once against ThreatCluster's high-confidence 30-day IOC feed; each domain is resolved and its IPv4 matched too. IOC only (no ransomware-claim lookups; use threat_check for one domain). Stale feed returns an error and is not charged. Costs $0.50 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.","description_similarity":null,"before_hash":null,"after_hash":"ef967c822a5f290160c7db1f9bf6b1b4"},{"tool":"threat_check","kind":"added","observed_at":"2026-10-17T09:35:33.222Z","fields":[],"description_before":null,"description_after":"Is this domain known-bad? Resolves the hostname (A/AAAA), matches the name, its parent domains and resolved IPv4 against ThreatCluster's high-confidence 30-day IOC feed (cached, refreshed about hourly), and looks up ransomware leak-site claims naming the domain (commercially reusable sources via Dragons Eye). Returns verdict listed, claimed, listed_and_claimed or no_known_threat with the matching reports. No match is not proof of safety; claims are unverified attacker assertions. Stale feed or source failure returns an error and is not charged. Costs $0.02 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.","description_similarity":null,"before_hash":null,"after_hash":"2a99d4f63c1d7dbb7651ded7aa445b3b"},{"tool":"full_site_audit","kind":"added","observed_at":"2026-10-14T03:09:56.289Z","fields":[],"description_before":null,"description_after":"Full site audit report for one domain, for client reports, vendor reviews or a pre-launch check. Runs every check (TLS from CT logs + live probe, DNS/DNSSEC/CAA, registration expiry and transfer lock, SPF/DMARC/DKIM/MTA-STS, security headers) plus HTTP->HTTPS redirect, www/apex consistency, RFC 9116 security.txt, robots.txt and sitemap. Returns the A-F grade and score (same weights as domain_grade), an action plan sorted critical > high > medium > low where each item has the exact fix and effort, and every raw section. Use domain_grade for just the letter. Fails (not charged) if 3+ core checks fail. Read-only; about 5-15 s. Costs $2 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.","description_similarity":null,"before_hash":null,"after_hash":"a60355ec81a5850aed0e82ea32913d4f"},{"tool":"domain_grade","kind":"changed","observed_at":"2026-10-13T03:09:40.535Z","fields":["description","annotations"],"description_before":"Domain security grade A-F for vendor-risk or due-diligence: runs the TLS (CT logs + live probe), DNS (DNSSEC, CAA), registration expiry, email-auth and HTTP security-header checks and returns one letter, a 0-100 score, points per category and the top fixes. Different from site_health, which returns raw cert/DNS/expiry data with no grade.","description_after":"Grade a domain's security posture A-F in one call, for vendor-risk or due-diligence checks. Runs the TLS, DNS (DNSSEC, CAA), registration-expiry, email-auth and HTTP-header checks and returns one letter, a 0-100 score, points per category (TLS 25, email 25, headers 20, DNS 15, registration 15) and the top fixes. Use it when you want a verdict; use site_health or the single checks when you need raw data. Unavailable categories are left out of the percentage (partial=true). Read-only; takes about 3-10 s. Costs $0.03 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.","description_similarity":0.408,"before_hash":"f666ffae1b74e28b1e4a46e59e8ddc7d","after_hash":"9119aad9d444b4c2a7d651b08a4b8564"},{"tool":"check_security_headers","kind":"changed","observed_at":"2026-10-13T03:09:40.535Z","fields":["description","annotations"],"description_before":"HTTP security headers for a site from one live HTTPS request: redirect chain, HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, an A-F grade and findings.","description_after":"Check the HTTP security headers of a website with one live HTTPS GET: redirect chain (up to 5 hops), final status, HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and COOP, with a simple A-F header grade and findings. Use it for web-hardening checks; it is not a vulnerability scan. The page body is not read or stored. Costs $0.01 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.","description_similarity":0.329,"before_hash":"31af4172da92dcce00b83a9c36b6219d","after_hash":"73d81e47fc31c4ef7d61f3da72811e81"},{"tool":"check_email_auth","kind":"changed","observed_at":"2026-10-13T03:09:40.535Z","fields":["description","annotations"],"description_before":"Email authentication posture for a domain: SPF validity and lookup count, DMARC policy, DKIM on common selectors, MTA-STS mode, TLS-RPT, BIMI, a rough 0-100 score and plain-English fixes. Live DNS.","description_after":"Review the email authentication setup of a domain: SPF validity and DNS-lookup count (limit 10), DMARC policy, pct and reporting, DKIM on common selector names, MTA-STS mode, TLS-RPT and BIMI, with a rough 0-100 score and plain-English fixes. Use it before sending mail from a domain or when mail lands in spam. DKIM is only checked on common selectors, so \"not found\" is not proof DKIM is missing. Live DNS via Cloudflare DoH; read-only, no email is sent. Costs $0.01 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.","description_similarity":0.353,"before_hash":"aed49889639eff69936d82c0c4420214","after_hash":"bd4ad8cf65567f574473ed2c3449641d"},{"tool":"site_health","kind":"changed","observed_at":"2026-10-13T03:09:40.535Z","fields":["description","annotations"],"description_before":"Bundle: check_cert + check_dns + check_domain_expiry with a summary, the renewal-stall heuristic and the Let's Encrypt 64-day (2027-02-10) note.","description_after":"Run check_cert, check_dns and check_domain_expiry together and return their raw results plus a short summary, the renewal-stall flag and the Let's Encrypt 64-day certificate note (from 2027-02-10). Use it for a full data dump in one call; use domain_grade if you want a single scored A-F answer that also covers email auth and HTTP headers. If one or two sources fail you get partial=true with the rest. Read-only. Costs $0.03 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.","description_similarity":0.239,"before_hash":"32bc8af83bedc71b991c167186264d52","after_hash":"f409988eb1a5feb949c627760c40f58c"},{"tool":"check_domain_expiry","kind":"changed","observed_at":"2026-10-13T03:09:40.535Z","fields":["description","annotations"],"description_before":"Domain registration expiry via RDAP: registrar, registered/expires dates, days left, status, nameservers.","description_after":"Check when a domain registration expires: registrar, registered and expiry dates, days left, EPP status codes and nameservers, from the registry's RDAP server. Use it for renewal risk on the registered domain (not the certificate; use check_cert for that). Some TLDs publish no RDAP service, in which case found=false explains why. Read-only. Costs $0.01 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.","description_similarity":0.191,"before_hash":"d44da811a2ba8266d6411a5e0c582f7f","after_hash":"bdd432bd8d961912283cbd80a934771d"},{"tool":"check_dns","kind":"changed","observed_at":"2026-10-13T03:09:40.535Z","fields":["description","annotations"],"description_before":"Live DNS via DoH: NS, A/AAAA/CNAME, MX, SPF, DMARC, CAA (tree-climbing), DNSSEC, with plain-English findings.","description_after":"Look up the live DNS of a domain: NS, A/AAAA/CNAME, MX, SPF, DMARC, CAA (climbing to the parent zone) and DNSSEC status, with plain-English findings. Use it for a DNS inventory or to debug resolution; use check_email_auth for a deeper SPF/DMARC/DKIM/MTA-STS review. Queries Cloudflare DNS-over-HTTPS (1.1.1.1) at call time; read-only, nothing is stored. Costs $0.01 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.","description_similarity":0.224,"before_hash":"c9a0753f29801f43d6a3143698d725a8","after_hash":"9306e51229f390bacf276975e421d5b1"},{"tool":"check_cert","kind":"changed","observed_at":"2026-10-13T03:09:40.535Z","fields":["description","annotations"],"description_before":"Certificate status for a hostname from Certificate Transparency logs (issuer, validity, days left, % lifetime used, renewal cadence, renewal-stall heuristic) plus a live HTTPS pass/fail probe. Cert details come from CT logs, not the live connection.","description_after":"Check the TLS certificate of one hostname: issuer, validity dates, days left, % of lifetime used, renewal cadence and a renewal-stall flag, plus a live HTTPS pass/fail probe. Use it when you only need certificate health; use site_health for cert + DNS + expiry together, or domain_grade for a scored A-F result. Certificate details come from public Certificate Transparency logs (Cert Spotter, crt.sh fallback), not from the live connection, so a brand-new cert may not show yet. Read-only; makes one HTTPS request to the host and one CT-log query, usually 1-5 s. Costs $0.01 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.","description_similarity":0.296,"before_hash":"de7c3e30ea2166dae478a69642a18676","after_hash":"b86e1acc8905c347b8ab172ba144eab4"},{"tool":"pricing","kind":"changed","observed_at":"2026-10-13T03:09:40.535Z","fields":["description","annotations"],"description_before":"FREE. Prices, network and payment address for the paid tools.","description_after":"Free. Return the price of every paid tool, the payment network (Base) and the receiving address, so you can budget before calling. No input, no network request, no payment.","description_similarity":0.269,"before_hash":"026ec428eb3394fd44cbde03391970e3","after_hash":"e5abe0a1d1e46a95f06fd462b339d408"},{"tool":"validate_target","kind":"changed","observed_at":"2026-10-13T03:09:40.535Z","fields":["description","inputSchema","annotations"],"description_before":"FREE. Check that a domain/hostname is well-formed before paying for a check. Returns the normalized host.","description_after":"Free. Check that a domain or URL is well-formed and get the normalized hostname, before calling a paid check. Offline: no network request, no payment. Rejects IP addresses, single-label names and URLs with credentials.","description_similarity":0.333,"before_hash":"393e3a990ce094dc701fa7a2b0169da8","after_hash":"d7585e4f91b3c2dfe6d4ff95c68a6b0e"},{"tool":"domain_grade","kind":"added","observed_at":"2026-10-12T21:23:24.869Z","fields":[],"description_before":null,"description_after":"Domain security grade A-F for vendor-risk or due-diligence: runs the TLS (CT logs + live probe), DNS (DNSSEC, CAA), registration expiry, email-auth and HTTP security-header checks and returns one letter, a 0-100 score, points per category and the top fixes. Different from site_health, which returns raw cert/DNS/expiry data with no grade.","description_similarity":null,"before_hash":null,"after_hash":"f666ffae1b74e28b1e4a46e59e8ddc7d"},{"tool":"check_security_headers","kind":"added","observed_at":"2026-10-12T21:23:24.869Z","fields":[],"description_before":null,"description_after":"HTTP security headers for a site from one live HTTPS request: redirect chain, HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, an A-F grade and findings.","description_similarity":null,"before_hash":null,"after_hash":"31af4172da92dcce00b83a9c36b6219d"},{"tool":"check_email_auth","kind":"added","observed_at":"2026-10-12T21:23:24.869Z","fields":[],"description_before":null,"description_after":"Email authentication posture for a domain: SPF validity and lookup count, DMARC policy, DKIM on common selectors, MTA-STS mode, TLS-RPT, BIMI, a rough 0-100 score and plain-English fixes. Live DNS.","description_similarity":null,"before_hash":null,"after_hash":"aed49889639eff69936d82c0c4420214"}],"next_before":null,"next_actions":[]}