Dev Reference
Parse a Content-Security-Policy header value, explain each directive and flag risky settings like unsafe-inline.
OtherLiveeip155:8453Exactvia cdp
CspSecurity-headersHttpXss
Calls · 30d
1
This endpoint's own trailing-30-day call count, as published by the upstream catalog and snapshotted daily. 4 snapshots so far.
$24.31
Verified settled volume
1,175 settlements proven x402 by their on-chain EIP-3009 marker.
$0.020
Listed price
As published in the catalog. Always read the live 402 before paying.
1
Calls · 30d
Upstream's own call count for this endpoint, not ours.
1
Unique payers · 30d
Last called 2026-10-20 20:59Z
—
Upstream on-chain volume
Reported by the source catalog.
Paid to
0xb531320805C5BED1D46AEaDcF4F008FDF172DBDaThe wallet the 402 directs payment to. Its whole payment record — every payer, every chain — is on the merchant page.
Asset 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913
Provider
The payTo wallet does not resolve to a registered ERC-8004 agent. That is not a verdict on the service — most of the catalog is unregistered.
Live 402 challenge
Captured by the enrichment pass, not read just now. Prices can change — always read the 402 the endpoint answers with.
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0xb531320805C5BED1D46AEaDcF4F008FDF172DBDa",
"scheme": "exact",
"network": "base",
"mimeType": "application/json",
"resource": "https://dev-reference.x402tookit.com/csp-explain",
"description": "Parse a Content-Security-Policy header value, explain each directive and flag risky settings like unsafe-inline.",
"outputSchema": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"value": "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; img-src *"
}
},
"output": {
"asOf": "2026-10-11T14:26:44.554Z",
"flags": [
{
"fix": "Use nonces or hashes instead of 'unsafe-inline'.",
"message": "'unsafe-inline' in script-src allows inline scripts and javascript: URLs, so injected markup can run script.",
"severity": "HIGH",
"directive": "script-src"
},
{
"fix": "Prefer nonces or hashes with 'strict-dynamic'.",
"message": "cdn.jsdelivr.net in script-src serves content an attacker can influence (user uploads, JSONP or open package mirrors), which bypasses the allow-list.",
"severity": "MEDIUM",
"directive": "script-src"
}
],
"source": "W3C Content Security Policy Level 3 rules, computed locally",
"reasons": [
"HIGH: 'unsafe-inline' in script-src allows inline scripts and javascript: URLs, so injected markup can run script.",
"MEDIUM: cdn.jsdelivr.net in script-src serves content an attacker can influence (user uploads, JSONP or open package mirrors), which bypasses the allow-list.",
"…5 more"
],
"summary": "3 directives parsed: 1 high, 2 medium, 4 low risk flags.",
"verdict": "CSP_HIGH_RISK",
"degraded": false,
"lowCount": 4,
"highCount": 1,
"infoCount": 0,
"directives": [
{
"policy": 1,
"meaning": "Fallback for every fetch directive that is not set.",
"sources": "'self'",
"directive": "default-src"
},
{
"policy": 1,
"meaning": "Where scripts may load from and whether inline scripts and eval run.",
"sources": "'self' 'unsafe-inline' https://cdn.jsdelivr.net",
"directive": "script-src"
}
],
"disclaimer": "Screening signal computed from the named public source. Not financial, legal or investment advice; provided as is. Verify at the source before acting.",
"notChecked": [
"whether the policy is delivered as enforced or report-only, or in a meta tag (frame-ancestors, report-uri and sandbox are ignored in meta tags)",
"your application's real behaviour: nonces must be unpredictable and unique per response, which cannot be seen in a header value",
"…3 more"
],
"mediumCount": 2,
"policyCount": 1,
"directiveCount": 3
}
},
"maxAmountRequired": "20000",
"maxTimeoutSeconds": 300
},
{
"asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
"extra": {
"feePayer": "BFK9TLC3edb13K6v4YyH3DwPb5DSUpkWvb7XnqCL9b4F"
},
"payTo": "DUPiupXtuox38dcGoXUKer5mAydCzmaHjrbQ66qeEm8s",
"scheme": "exact",
"network": "solana",
"mimeType": "application/json",
"resource": "https://dev-reference.x402tookit.com/csp-explain",
"description": "Parse a Content-Security-Policy header value, explain each directive and flag risky settings like unsafe-inline.",
"outputSchema": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"value": "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; img-src *"
}
},
"output": {
"asOf": "2026-10-11T14:26:44.554Z",
"flags": [
{
"fix": "Use nonces or hashes instead of 'unsafe-inline'.",
"message": "'unsafe-inline' in script-src allows inline scripts and javascript: URLs, so injected markup can run script.",
"severity": "HIGH",
"directive": "script-src"
},
{
"fix": "Prefer nonces or hashes with 'strict-dynamic'.",
"message": "cdn.jsdelivr.net in script-src serves content an attacker can influence (user uploads, JSONP or open package mirrors), which bypasses the allow-list.",
"severity": "MEDIUM",
"directive": "script-src"
}
],
"source": "W3C Content Security Policy Level 3 rules, computed locally",
"reasons": [
"HIGH: 'unsafe-inline' in script-src allows inline scripts and javascript: URLs, so injected markup can run script.",
"MEDIUM: cdn.jsdelivr.net in script-src serves content an attacker can influence (user uploads, JSONP or open package mirrors), which bypasses the allow-list.",
"…5 more"
],
"summary": "3 directives parsed: 1 high, 2 medium, 4 low risk flags.",
"verdict": "CSP_HIGH_RISK",
"degraded": false,
"lowCount": 4,
"highCount": 1,
"infoCount": 0,
"directives": [
{
"policy": 1,
"meaning": "Fallback for every fetch directive that is not set.",
"sources": "'self'",
"directive": "default-src"
},
{
"policy": 1,
"meaning": "Where scripts may load from and whether inline scripts and eval run.",
"sources": "'self' 'unsafe-inline' https://cdn.jsdelivr.net",
"directive": "script-src"
}
],
"disclaimer": "Screening signal computed from the named public source. Not financial, legal or investment advice; provided as is. Verify at the source before acting.",
"notChecked": [
"whether the policy is delivered as enforced or report-only, or in a meta tag (frame-ancestors, report-uri and sandbox are ignored in meta tags)",
"your application's real behaviour: nonces must be unpredictable and unique per response, which cannot be seen in a header value",
"…3 more"
],
"mediumCount": 2,
"policyCount": 1,
"directiveCount": 3
}
},
"maxAmountRequired": "20000",
"maxTimeoutSeconds": 300
},
{
"asset": "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0xb531320805C5BED1D46AEaDcF4F008FDF172DBDa",
"scheme": "exact",
"network": "polygon",
"mimeType": "application/json",
"resource": "https://dev-reference.x402tookit.com/csp-explain",
"description": "Parse a Content-Security-Policy header value, explain each directive and flag risky settings like unsafe-inline.",
"outputSchema": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"value": "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; img-src *"
}
},
"output": {
"asOf": "2026-10-11T14:26:44.554Z",
"flags": [
{
"fix": "Use nonces or hashes instead of 'unsafe-inline'.",
"message": "'unsafe-inline' in script-src allows inline scripts and javascript: URLs, so injected markup can run script.",
"severity": "HIGH",
"directive": "script-src"
},
{
"fix": "Prefer nonces or hashes with 'strict-dynamic'.",
"message": "cdn.jsdelivr.net in script-src serves content an attacker can influence (user uploads, JSONP or open package mirrors), which bypasses the allow-list.",
"severity": "MEDIUM",
"directive": "script-src"
}
],
"source": "W3C Content Security Policy Level 3 rules, computed locally",
"reasons": [
"HIGH: 'unsafe-inline' in script-src allows inline scripts and javascript: URLs, so injected markup can run script.",
"MEDIUM: cdn.jsdelivr.net in script-src serves content an attacker can influence (user uploads, JSONP or open package mirrors), which bypasses the allow-list.",
"…5 more"
],
"summary": "3 directives parsed: 1 high, 2 medium, 4 low risk flags.",
"verdict": "CSP_HIGH_RISK",
"degraded": false,
"lowCount": 4,
"highCount": 1,
"infoCount": 0,
"directives": [
{
"policy": 1,
"meaning": "Fallback for every fetch directive that is not set.",
"sources": "'self'",
"directive": "default-src"
},
{
"policy": 1,
"meaning": "Where scripts may load from and whether inline scripts and eval run.",
"sources": "'self' 'unsafe-inline' https://cdn.jsdelivr.net",
"directive": "script-src"
}
],
"disclaimer": "Screening signal computed from the named public source. Not financial, legal or investment advice; provided as is. Verify at the source before acting.",
"notChecked": [
"whether the policy is delivered as enforced or report-only, or in a meta tag (frame-ancestors, report-uri and sandbox are ignored in meta tags)",
"your application's real behaviour: nonces must be unpredictable and unique per response, which cannot be seen in a header value",
"…3 more"
],
"mediumCount": 2,
"policyCount": 1,
"directiveCount": 3
}
},
"maxAmountRequired": "20000",
"maxTimeoutSeconds": 300
}
],
"x402Version": 1,
"alsoAvailable": {
"llms": "https://dev-reference.x402tookit.com/llms.txt",
"catalog": "https://dev-reference.x402tookit.com/catalog",
"message": "Dev Reference has 12 pay-per-call endpoints (Developer reference lookups for agents: HTTP status codes, headers, CSP and Cache-Control explainers, MIME types, ports, DNS record types, ISO 8601 and Unicode.), from $0.02 a call. See the full menu and send your agents our way.",
"openapi": "https://dev-reference.x402tookit.com/openapi.json",
"related": [
{
"url": "https://dev-reference.x402tookit.com/http-header",
"path": "/http-header",
"what": "Explain an HTTP header: request or response, purpose, security notes, and its IANA regist…",
"price": "$0.02"
},
{
"url": "https://dev-reference.x402tookit.com/cache-control-explain",
"path": "/cache-control-explain",
"what": "Parse a Cache-Control value, explain each directive, compute freshness and flag conflicts…",
"price": "$0.02"
},
{
"url": "https://dev-reference.x402tookit.com/http-method",
"path": "/http-method",
"what": "Whether an HTTP method is safe and idempotent (IANA registry), what it is for, and reques…",
"price": "$0.02"
}
]
}
}Accepts
The payment requirements as published to the catalog. Read the live 402 before paying — a price here is a claim, not a quote.
0.02USDC≈ $0.02 USD
on Base · exact scheme
Pay 0.02 USDC on Base to 0xb531…2DBDa. The signed payment is good for 5 minutes.
- Paid to
- 0xb531…2DBDa
- USD Coin contract
- 0x8335…02913
- Payment window
- 5 minutes
- As published
- 20000 smallest units
20000units
on solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp · exact scheme
That figure is in the token’s smallest units. Roundhouse does not hold this contract’s decimals, so it is shown as published rather than converted.
- Paid to
- DUPiup…eEm8s
- Token contract
- EPjFWd…TDt1v
- Payment window
- 5 minutes
20000units
on Polygon · exact scheme
That figure is in the token’s smallest units. Roundhouse does not hold this contract’s decimals, so it is shown as published rather than converted.
- Paid to
- 0xb531…2DBDa
- Token contract
- 0x3c49…c3359
- Payment window
- 5 minutes
20000units
on Arbitrum · exact scheme
That figure is in the token’s smallest units. Roundhouse does not hold this contract’s decimals, so it is shown as published rather than converted.
- Paid to
- 0xb531…2DBDa
- Token contract
- 0xaf88…e5831
- Payment window
- 5 minutes
The catalog’s raw entry
[
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0xb531320805C5BED1D46AEaDcF4F008FDF172DBDa",
"amount": "20000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
},
{
"asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
"extra": {
"feePayer": "D6ZhtNQ5nT9ZnTHUbqXZsTx5MH2rPFiBBggX4hY1WePM"
},
"payTo": "DUPiupXtuox38dcGoXUKer5mAydCzmaHjrbQ66qeEm8s",
"amount": "20000",
"scheme": "exact",
"network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
"maxTimeoutSeconds": 300
},
{
"asset": "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0xb531320805C5BED1D46AEaDcF4F008FDF172DBDa",
"amount": "20000",
"scheme": "exact",
"network": "eip155:137",
"maxTimeoutSeconds": 300
},
{
"asset": "0xaf88d065e77c8cC2239327C5EDb3A432268e5831",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0xb531320805C5BED1D46AEaDcF4F008FDF172DBDa",
"amount": "20000",
"scheme": "exact",
"network": "eip155:42161",
"maxTimeoutSeconds": 300
}
]Extensions
{
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"value": "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; img-src *"
}
},
"output": {
"type": "json",
"example": {
"asOf": "2026-10-11T14:26:44.554Z",
"flags": [
{
"fix": "Use nonces or hashes instead of 'unsafe-inline'.",
"message": "'unsafe-inline' in script-src allows inline scripts and javascript: URLs, so injected markup can run script.",
"severity": "HIGH",
"directive": "script-src"
},
{
"fix": "Prefer nonces or hashes with 'strict-dynamic'.",
"message": "cdn.jsdelivr.net in script-src serves content an attacker can influence (user uploads, JSONP or open package mirrors), which bypasses the allow-list.",
"severity": "MEDIUM",
"directive": "script-src"
}
],
"source": "W3C Content Security Policy Level 3 rules, computed locally",
"reasons": [
"HIGH: 'unsafe-inline' in script-src allows inline scripts and javascript: URLs, so injected markup can run script.",
"MEDIUM: cdn.jsdelivr.net in script-src serves content an attacker can influence (user uploads, JSONP or open package mirrors), which bypasses the allow-list.",
"…5 more"
],
"summary": "3 directives parsed: 1 high, 2 medium, 4 low risk flags.",
"verdict": "CSP_HIGH_RISK",
"degraded": false,
"lowCount": 4,
"highCount": 1,
"infoCount": 0,
"directives": [
{
"policy": 1,
"meaning": "Fallback for every fetch directive that is not set.",
"sources": "'self'",
"directive": "default-src"
},
{
"policy": 1,
"meaning": "Where scripts may load from and whether inline scripts and eval run.",
"sources": "'self' 'unsafe-inline' https://cdn.jsdelivr.net",
"directive": "script-src"
}
],
"disclaimer": "Screening signal computed from the named public source. Not financial, legal or investment advice; provided as is. Verify at the source before acting.",
"notChecked": [
"whether the policy is delivered as enforced or report-only, or in a meta tag (frame-ancestors, report-uri and sandbox are ignored in meta tags)",
"your application's real behaviour: nonces must be unpredictable and unique per response, which cannot be seen in a header value",
"…3 more"
],
"mediumCount": 2,
"policyCount": 1,
"directiveCount": 3
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"required": [
"value"
],
"properties": {
"value": {
"type": "string",
"description": "The header value, for example default-src 'self'; script-src 'self' 'unsafe-inline'"
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object",
"properties": {
"asOf": {
"type": [
"null",
"string"
]
},
"flags": {
"type": [
"array",
"null"
],
"items": {
"type": "object",
"properties": {
"fix": {
"type": [
"null",
"string"
]
},
"message": {
"type": [
"null",
"string"
]
},
"severity": {
"type": [
"null",
"string"
]
},
"directive": {
"type": [
"null",
"string"
]
}
}
}
},
"source": {
"type": [
"null",
"string"
]
},
"reasons": {
"type": [
"array",
"null"
],
"items": {
"type": "string"
}
},
"summary": {
"type": [
"null",
"string"
]
},
"verdict": {
"type": [
"null",
"string"
]
},
"degraded": {
"type": [
"boolean",
"null"
]
},
"lowCount": {
"type": [
"null",
"number"
]
},
"highCount": {
"type": [
"null",
"number"
]
},
"infoCount": {
"type": [
"null",
"number"
]
},
"directives": {
"type": [
"array",
"null"
],
"items": {
"type": "object",
"properties": {
"policy": {
"type": [
"null",
"number"
]
},
"meaning": {
"type": [
"null",
"string"
]
},
"sources": {
"type": [
"null",
"string"
]
},
"directive": {
"type": [
"null",
"string"
]
}
}
}
},
"disclaimer": {
"type": [
"null",
"string"
]
},
"notChecked": {
"type": [
"array",
"null"
],
"items": {
"type": "string"
}
},
"mediumCount": {
"type": [
"null",
"number"
]
},
"policyCount": {
"type": [
"null",
"number"
]
},
"directiveCount": {
"type": [
"null",
"number"
]
}
}
}
}
}
}
}
}
}Provenance
- Seen in the source catalog
- 2026-10-20 20:59Z
- Last indexed by Roundhouse
- 2026-10-22 12:40Z
- Last enriched (probe, favicon, geo)
- 2026-10-20 22:15Z
- x402 version
- 2
- Max timeout
- 300s
- Liveness probe
- HTTP 402
Hand this page to an agent
Copy the prompt and paste it into Claude, an MCP client or your own agent — it will vet this service and call it over the free read API. No key, no account.
GET api.roundhouseai.io/v0/endpoints
This endpoint's own trailing-30-day call count, as published by the upstream catalog and snapshotted daily. 4 snapshots so far. Verified volume counts only settlements with an on-chain EIP-3009 marker.
Show the promptHide the prompt
Using Roundhouse, look up the x402 service Dev Reference and tell me whether it is worth paying: what a call costs, whether the endpoint answered when last probed, and what its payment record actually shows. curl -s 'https://api.roundhouseai.io/v0/endpoints?q=Dev%20Reference' curl -s 'https://api.roundhouseai.io/v0/merchants/<the payTo wallet returned above>' Then call it: read the price from the live 402 at https://dev-reference.x402tookit.com/csp-explain, never from a cached figure, and pay with an x402 client. The /v0 API needs an API key (`authorization: Bearer rh_live_…`) on everything except /v0/unified* and /v0/endpoints. Either pay over x402 (mint a personal key for $0.01 at GET https://api.roundhouseai.io/v0/test/x402), or ask me for an organization key, which I create at https://roundhouseai.io/dashboard/connections. If you have neither, ask before going further. If you do not have Roundhouse tools or skills installed, read https://roundhouseai.io/skill.md first — it is the whole procedure.