{"audit":{"version":"1.5","generated_at":"2026-11-10T23:39:41.304169+00:00","generated_by":"Agenstry","report_url":"https://agenstry.com/agents/api.lookproof.dev","methodology_url":"https://agenstry.com/methodology","verifier_jwks_url":"https://agenstry.com/.well-known/jwks.json","subject":{"domain":"api.lookproof.dev","name":"Lookproof","url":"https://api.lookproof.dev/.well-known/agent-card.json"}},"identity":{"provider":{"organization":"Lookproof","url":"https://lookproof.dev"},"registry_verification":null,"signature":{"signed":false,"signature_valid":null}},"protocol":{"version":"1.0","supports_streaming":false,"supports_push_notifications":false},"operational":{"live_state":"no_url","live_responds":null,"last_status_code":200,"last_elapsed_ms":216,"last_error":null},"track_record":{"first_seen":"2026-10-27T16:26:44.284987+00:00","last_checked":"2026-11-10T22:02:47.865477+00:00","last_seen_ok":"2026-11-10T22:02:47.865477+00:00","checks_total":33,"checks_ok":33,"uptime_pct":100.0,"uptime_window_days":30,"uptime_probes":1,"archived":false,"archived_reason":null},"conformance":{"score":52,"grade":"D","summary":"D-grade: significant issues, auth-gated, partially broken, or stale.","criteria":[{"key":"valid_card","label":"Valid AgentCard","points":10,"max_points":10,"status":"pass","detail":"Parseable AgentCard returned by the well-known endpoint (Agenstry readiness signal; not an official TCK certification)."},{"key":"live_responds","label":"Live JSON-RPC","points":10,"max_points":25,"status":"partial","detail":"Card declares only gRPC / HTTP+JSON interfaces; the live probe covers JSON-RPC, so the endpoint was not exercised. Not a defect in the card."},{"key":"protocol_version","label":"Protocol version","points":10,"max_points":10,"status":"pass","detail":"Declares A2A 1.0 with supportedInterfaces[] (current v1 card shape)."},{"key":"signature","label":"JWS signature","points":0,"max_points":10,"status":"info","detail":"Card is unsigned (most published agents are)."},{"key":"uptime","label":"Uptime track record","points":0,"max_points":15,"status":"info","detail":"Only 1 probe so far, need ≥5 for an uptime grade."},{"key":"skills","label":"Skill declaration","points":10,"max_points":10,"status":"pass","detail":"Declares 47 skills with structured metadata."},{"key":"verified_identity","label":"Verified Identity","points":5,"max_points":10,"status":"partial","detail":"Provider declared: Lookproof (https://lookproof.dev). Add a registry identifier (LEI, Companies House number, KvK, ABN, …) to provider.legalEntity for full verified-business credit."},{"key":"freshness","label":"Freshness + modern flags","points":5,"max_points":5,"status":"pass","detail":"declares 1 modern capability flag(s) (x402); seen in upstream source within 0d"},{"key":"security","label":"Security declaration","points":2,"max_points":5,"status":"partial","detail":"Declares 1 security scheme(s) but none use PKCE or mTLS."}]},"card_read":{"findings":[],"clean":true,"source_url":"https://api.lookproof.dev/.well-known/agent-card.json"},"skills":[{"id":"dns.caa","name":"CAA record check","description":"Evaluate a domain's CAA records (RFC 8659), climbing to parent names up to the registrable domain when the name has none: allowed issuers for normal and wildcard certificates, iodef, unknown critical tags and invalid values. Use when an agent must tell which certificate authorities may issue for a domain, or why a certificate request is refused because of CAA.","tags":["dns","caa","tls","certificates","security"],"examples":["GET https://api.lookproof.dev/v1/dns/caa?domain=example.com"],"inputModes":[],"outputModes":[]},{"id":"dns.compare","name":"DNS resolver comparison","description":"Ask Cloudflare and Google the same DNS question, each alone and uncached, and compare response codes and records; different codes (such as SERVFAIL from one) are a warning, different records information. Use when an agent debugs propagation, DNSSEC or resolver-specific answers. Input: ?name=example.com&type=A.","tags":["dns","resolvers","propagation","dnssec","compare"],"examples":["GET https://api.lookproof.dev/v1/dns/compare?name=example.com&type=A"],"inputModes":[],"outputModes":[]},{"id":"dns.dnssec","name":"DNSSEC check","description":"Report a domain's DNSSEC status (secure, insecure, bogus or unknown) as validated by public resolvers, with DS and DNSKEY algorithms, deprecated algorithms, SHA-1 digests and DS records without a matching key. Use when an agent must tell whether a domain is signed, why it fails on validating resolvers, or whether a key rollover left the chain of trust broken.","tags":["dns","dnssec","security","ds","dnskey"],"examples":["GET https://api.lookproof.dev/v1/dns/dnssec?domain=example.com"],"inputModes":[],"outputModes":[]},{"id":"dns.https_rr","name":"HTTPS record check","description":"Read a name's HTTPS records (RFC 9460, SVCB): priority, target, AliasMode or ServiceMode, alpn (h3, h2), port, IPv4 and IPv6 hints and whether ECH is published, with AliasMode conflicts and missing mandatory keys. Use when an agent checks HTTP/3 or ECH setup. Input: ?domain=example.com.","tags":["dns","https","svcb","http3","ech"],"examples":["GET https://api.lookproof.dev/v1/dns/https-rr?domain=example.com"],"inputModes":[],"outputModes":[]},{"id":"dns.idn","name":"IDN converter","description":"Convert a domain name between Unicode and punycode (A-labels) and check it against IDNA2008 and UTS 46: disallowed characters, bidi, context and hyphen rules, lengths, and mixed scripts in one label (homograph risk), per label. Offline. Use when an agent must register, compare or display an internationalised domain. Input: ?name=bücher.example.com.","tags":["dns","idn","punycode","unicode","homograph"],"examples":["GET https://api.lookproof.dev/v1/dns/idn?name=b%C3%BCcher.example.com"],"inputModes":[],"outputModes":[]},{"id":"dns.lookup","name":"DNS lookup","description":"Resolve chosen DNS record types (A, AAAA, CNAME, MX, NS, TXT, SOA, CAA, SRV) for a name through public resolvers, with TTL, observation time and the resolver that answered. Use when an agent needs the current public DNS answer for a name, for example to confirm that a record change is visible or to read a TXT verification record.","tags":["dns","lookup","records","ttl"],"examples":["GET https://api.lookproof.dev/v1/dns/lookup?name=example.com&types=A&types=MX"],"inputModes":[],"outputModes":[]},{"id":"dns.ns","name":"Name server check","description":"Check a zone's name servers: the NS set, the IPv4 and IPv6 addresses of up to eight servers, a single server, servers that do not resolve, all addresses in one /24 or /48, one TLD for every name and in-zone servers that need glue. Use when an agent reviews DNS redundancy or a delegation. Input: ?domain=example.com.","tags":["dns","nameservers","ns","redundancy","delegation"],"examples":["GET https://api.lookproof.dev/v1/dns/ns?domain=example.com"],"inputModes":[],"outputModes":[]},{"id":"dns.ns_provider","name":"DNS provider lookup","description":"Find which DNS provider a domain's NS records point to (Cloudflare, Route 53, Azure DNS, Google Cloud DNS, GoDaddy, Namecheap, NS1, Hetzner, OVHcloud and more) from a fixed, versioned list of name server patterns, with unknown name servers and several providers listed. Use when an agent must know where a zone is hosted before a DNS change. Input: ?domain=example.com.","tags":["dns","nameservers","hosting","provider","ns"],"examples":["GET https://api.lookproof.dev/v1/dns/ns-provider?domain=example.com"],"inputModes":[],"outputModes":[]},{"id":"dns.soa","name":"SOA record check","description":"Check a zone's SOA record through public resolvers: primary server, contact name, serial (YYYYMMDDnn or counter), refresh, retry, expire and negative caching TTL against RFC 1912 and RFC 2308. Use when an agent must explain zone transfer timers or why a deleted name keeps answering NXDOMAIN. Input: ?domain=example.com.","tags":["dns","soa","zone","secondary","ttl"],"examples":["GET https://api.lookproof.dev/v1/dns/soa?domain=example.com"],"inputModes":[],"outputModes":[]},{"id":"dns.ttl","name":"DNS TTL check","description":"Show the TTL of A, AAAA, MX, NS, TXT, CAA and SOA records with its source: exact from a validated DNSSEC signature (RRSIG Original TTL) or the resolver's remaining cache time (normally a lower bound), plus the SOA negative caching TTL. Use when an agent plans a DNS change and must know how long old records live. Input: ?domain=example.com.","tags":["dns","ttl","cache","dnssec","records"],"examples":["GET https://api.lookproof.dev/v1/dns/ttl?domain=example.com"],"inputModes":[],"outputModes":[]},{"id":"dns.txt_verification","name":"Domain verification records","description":"List the domain verification tokens in a domain's apex TXT records (google-site-verification, MS=, Atlassian, Facebook, Apple, Adobe, DocuSign, Stripe and more) from a fixed, versioned list, with the full public token and services that have several. Use when an agent audits or cleans up old verification records. Input: ?domain=example.com.","tags":["dns","txt","verification","audit","records"],"examples":["GET https://api.lookproof.dev/v1/dns/txt-verification?domain=example.com"],"inputModes":[],"outputModes":[]},{"id":"dns.wildcard","name":"Wildcard DNS check","description":"Find out whether a DNS zone has a wildcard (RFC 4592): A, AAAA, TXT and MX of a random, uncached name under the domain through public resolvers, with a warning for a wildcard MX that accepts mail for every invented subdomain. Use when an agent must tell whether a subdomain really exists. Input: ?domain=example.com.","tags":["dns","wildcard","subdomains","mx","records"],"examples":["GET https://api.lookproof.dev/v1/dns/wildcard?domain=example.com"],"inputModes":[],"outputModes":[]},{"id":"dns.zone_lint","name":"Zone file checker","description":"Check a pasted DNS zone file (RFC 1035 master format, up to 64 KiB) with $ORIGIN and $TTL: unreadable lines, SOA and NS at the apex, CNAME at the apex or beside other data, duplicates, mixed TTLs in a set, out-of-zone names, NS/MX targets without addresses and SOA timers. Offline. Use when an agent edits a zone before loading it. Input: {\"zone\": \"$TTL 3600\\n@ IN SOA ...\", \"origin\": \"example.com\"}.","tags":["dns","zone","lint","bind","records"],"examples":["POST https://api.lookproof.dev/v1/dns/zone-lint with a JSON body as in the OpenAPI document"],"inputModes":[],"outputModes":[]},{"id":"domain.health","name":"Domain health check","description":"One report on a domain's mail and DNS security: MX, SPF, DMARC, common DKIM selectors, MTA-STS with TLS-RPT, DNSSEC, reverse DNS of the mail servers, BIMI and CAA in one call, each as its own section with coded findings and evidence. Use when an agent must audit a domain's email security or build a domain health report; cheaper than calling the nine checks one by one. No score is computed.","tags":["domain","email","dns","security","audit"],"examples":["GET https://api.lookproof.dev/v1/domain/health?domain=example.com"],"inputModes":[],"outputModes":[]},{"id":"domain.rdap","name":"RDAP domain lookup","description":"Look up a domain's registration at its registry over RDAP (RFC 9083, servers from the IANA bootstrap file): registrar and IANA id, creation, change and expiry dates, EPP statuses such as hold or pending delete, nameservers and DNSSEC delegation. Contact data is never returned. Use when an agent must tell when a domain expires, whether it is locked against transfer or why it suddenly stopped resolving.","tags":["domain","rdap","whois","expiry","registrar"],"examples":["GET https://api.lookproof.dev/v1/domain/rdap?domain=example.com"],"inputModes":[],"outputModes":[]},{"id":"http.cookie_parse","name":"Set-Cookie parser","description":"Parse a pasted Set-Cookie header as RFC 6265bis does: Secure, HttpOnly, SameSite, Partitioned, __Host- and __Secure- prefix rules, Domain, Path, Expires and Max-Age with the 400-day cap. The cookie value is never returned, only its length. Offline. Use when an agent reviews session cookie settings. Input: {\"header\": \"__Host-sid=x; Path=/; Secure; HttpOnly; SameSite=Lax\"}.","tags":["http","cookies","security","headers","session"],"examples":["POST https://api.lookproof.dev/v1/http/cookie-parse with a JSON body as in the OpenAPI document"],"inputModes":[],"outputModes":[]},{"id":"http.csp_parse","name":"CSP header parser","description":"Parse a pasted Content-Security-Policy value as CSP Level 3 does: directives and sources per policy, 'unsafe-inline' and 'unsafe-eval', wildcard and scheme-only script or plugin sources, missing default-src, object-src and base-uri, and report-only mode. Offline. Use when an agent writes or reviews a CSP before it is deployed. Input: {\"header\": \"default-src 'self'; script-src 'self'\"}.","tags":["http","csp","security","headers","xss"],"examples":["POST https://api.lookproof.dev/v1/http/csp-parse with a JSON body as in the OpenAPI document"],"inputModes":[],"outputModes":[]},{"id":"http.hsts_parse","name":"HSTS header parser","description":"Parse a pasted Strict-Transport-Security value as RFC 6797 does: whether browsers accept it, max-age, includeSubDomains, preload, and which hstspreload.org header rules it meets. Offline. Use when an agent sets up HSTS or prepares a preload submission. Input: {\"header\": \"max-age=31536000; includeSubDomains; preload\"}.","tags":["http","hsts","https","security","headers"],"examples":["POST https://api.lookproof.dev/v1/http/hsts-parse with a JSON body as in the OpenAPI document"],"inputModes":[],"outputModes":[]},{"id":"http.security_headers","name":"Security headers check","description":"Follow a site's redirect chains from http:// and https:// and read the security headers of the final HTTPS response: HSTS with preload readiness, Content-Security-Policy with unsafe-inline detection, X-Content-Type-Options, frame protection, Referrer-Policy and cookie flags (never values). Use when an agent must tell whether a site forces HTTPS, why HSTS preload fails or which headers are missing.","tags":["http","https","hsts","csp","security"],"examples":["GET https://api.lookproof.dev/v1/http/security-headers?domain=example.com"],"inputModes":[],"outputModes":[]},{"id":"ip.cidr","name":"CIDR calculator","description":"Compute a CIDR block: network, first and last address, number of addresses, netmask and host mask, and whether the input had host bits set (192.0.2.5/24). IPv4 and IPv6, offline. Use when an agent must check or explain a CIDR block in a firewall, SPF or cloud configuration. Input: ?cidr=192.0.2.5/24.","tags":["ip","cidr","subnet","network","calculator"],"examples":["GET https://api.lookproof.dev/v1/ip/cidr?cidr=192.0.2.5%2F24"],"inputModes":[],"outputModes":[]},{"id":"ip.contains","name":"IP in CIDR check","description":"Check one IPv4 or IPv6 address against up to 100 CIDR blocks and get, for each, whether it contains the address, plus the blocks that do; blocks of the other IP version never match. Offline. Use when an agent must tell whether an address is in an allow list, a provider's ranges or an SPF ip4/ip6 term. Input: {\"ip\": \"192.0.2.10\", \"cidrs\": [\"192.0.2.0/24\"]}.","tags":["ip","cidr","allowlist","firewall","network"],"examples":["POST https://api.lookproof.dev/v1/ip/contains with a JSON body as in the OpenAPI document"],"inputModes":[],"outputModes":[]},{"id":"ip.info","name":"IP address info","description":"Classify an IPv4 or IPv6 address by IANA's special-purpose registries (private, loopback, link-local, shared, documentation, 6to4, Teredo, NAT64 and more, with the RFC), with compressed and expanded forms, the reverse DNS name and the IPv4 form of an IPv4-mapped address. Offline. Use when an agent must tell whether an address is public. Input: ?ip=192.0.2.1.","tags":["ip","ipv6","network","classification","offline"],"examples":["GET https://api.lookproof.dev/v1/ip/info?ip=192.0.2.1"],"inputModes":[],"outputModes":[]},{"id":"ip.range_to_cidr","name":"IP range to CIDR","description":"Turn a start and end IPv4 or IPv6 address into the smallest list of CIDR blocks that covers exactly that range (at most 62 for IPv4, 254 for IPv6). Offline. Use when an agent must write a range from a provider or registry as firewall, ACL or SPF entries. Input: ?start=192.0.2.10&end=192.0.2.20.","tags":["ip","cidr","range","firewall","network"],"examples":["GET https://api.lookproof.dev/v1/ip/range-to-cidr?end=192.0.2.20&start=192.0.2.10"],"inputModes":[],"outputModes":[]},{"id":"ip.subnets","name":"Subnet calculator","description":"Split an IPv4 or IPv6 CIDR block into subnets of a longer prefix, in order, at most 256 at a time; a larger split is refused before anything is computed. Offline. Use when an agent must plan an address layout or hand out subnets. Input: ?cidr=192.0.2.0/24&prefix=26.","tags":["ip","subnet","cidr","planning","network"],"examples":["GET https://api.lookproof.dev/v1/ip/subnets?cidr=192.0.2.0%2F24&prefix=26"],"inputModes":[],"outputModes":[]},{"id":"mail.bimi","name":"BIMI record check","description":"Check a domain's BIMI record (<selector>._bimi, default selector, with fallback to the organisational domain): v=BIMI1 syntax, HTTPS logo and certificate URLs, an SVG logo path and whether DMARC is enforced at quarantine or reject with pct=100. Use when an agent must tell why a brand logo does not show in mail clients. The logo and certificate are not downloaded.","tags":["email","dns","deliverability","bimi","branding"],"examples":["GET https://api.lookproof.dev/v1/mail/bimi?domain=example.com"],"inputModes":[],"outputModes":[]},{"id":"mail.bimi_parse","name":"BIMI record parser","description":"Parse a pasted BIMI record: v=BIMI1, the l= logo and a= certificate tags, repeated or missing tags, HTTPS URLs, the .svg logo path and a missing mark certificate. Offline: the logo and DMARC are not fetched. Use when an agent writes or reviews a BIMI record. Input: {\"record\": \"v=BIMI1; l=https://example.com/logo.svg\"}.","tags":["email","dns","bimi","brand","logo"],"examples":["POST https://api.lookproof.dev/v1/mail/bimi-parse with a JSON body as in the OpenAPI document"],"inputModes":[],"outputModes":[]},{"id":"mail.check","name":"Mail configuration check","description":"One report on a domain's mail setup: MX, SPF and DMARC, plus DKIM for the selectors you give, with coded findings, an overall status and a spoofing protection category (protected, partial, monitoring, unprotected or broken) with its reasons. Use when an agent needs a complete overview of a domain's email authentication in one call instead of four, or must judge how well the domain is protected against spoofing.","tags":["email","dns","deliverability","spf","dmarc"],"examples":["GET https://api.lookproof.dev/v1/mail/check?dkim_selectors=selector1&domain=example.com"],"inputModes":[],"outputModes":[]},{"id":"mail.check.bulk","name":"Bulk mail configuration check","description":"Run the mail configuration check (MX, SPF, DMARC) on up to 20 domains in one request, each with its spoofing protection category. Results keep the input order, and items that fail for a technical reason come with a token for a free retry. Use when an agent must audit many domains at once, for example a customer list or a portfolio of brands.","tags":["email","dns","deliverability","bulk","audit"],"examples":["POST https://api.lookproof.dev/v1/mail/check/bulk with a JSON body as in the OpenAPI document"],"inputModes":[],"outputModes":[]},{"id":"mail.dkim","name":"DKIM record check","description":"Fetch and validate the DKIM public key record at selector._domainkey for a domain: key type, key size, revocation and syntax, with coded findings. Use when an agent knows the selector (s= in a DKIM-Signature header) and must confirm that the key is published and usable. It does not verify message signatures.","tags":["email","dns","deliverability","dkim"],"examples":["GET https://api.lookproof.dev/v1/mail/dkim?domain=example.com&selector=selector1"],"inputModes":[],"outputModes":[]},{"id":"mail.dkim_discover","name":"DKIM selector finder","description":"Try 31 common DKIM selectors (Google, Microsoft 365, Mailchimp, SendGrid, Mailgun, Zoho, Proton, Fastmail, mailbox.org, Mailjet, Amazon SES and generic names) for a domain and validate every key found: type, size, revocation and testing flag. Use when an agent needs a domain's DKIM keys but does not know the selector. Finding none is a hint, not proof that DKIM is missing.","tags":["email","dns","deliverability","dkim","selectors"],"examples":["GET https://api.lookproof.dev/v1/mail/dkim-discover?domain=example.com"],"inputModes":[],"outputModes":[]},{"id":"mail.dmarc","name":"DMARC check","description":"Look up the DMARC record of a domain or its organisational domain and explain policy, subdomain policy, alignment and reporting addresses, with coded findings. Use when an agent must read which policy a domain asks receivers to apply to mail that fails DMARC, how strict it is, or why DMARC reports do not arrive.","tags":["email","dns","deliverability","dmarc"],"examples":["GET https://api.lookproof.dev/v1/mail/dmarc?domain=example.com"],"inputModes":[],"outputModes":[]},{"id":"mail.dmarc_parse","name":"DMARC record parser","description":"Parse a pasted DMARC record without DNS (RFC 9989): p, sp, np, psd, t, adkim, aspf, rua and ruf, historic and unknown tags, with the same coded findings as the DMARC check, such as p=none or a missing report address. Use when an agent must check a DMARC record before publishing it. Input: {\"record\": \"v=DMARC1; p=none; rua=mailto:dmarc@example.com\"}.","tags":["email","dns","deliverability","dmarc","parser"],"examples":["POST https://api.lookproof.dev/v1/mail/dmarc-parse with a JSON body as in the OpenAPI document"],"inputModes":[],"outputModes":[]},{"id":"mail.mta_sts","name":"MTA-STS and TLS-RPT check","description":"Check a domain's MTA-STS setup (RFC 8461): the _mta-sts record, the HTTPS policy file with certificate check and no redirects, mode, max_age and whether every MX host is covered, plus the TLS-RPT record (RFC 8460). Use when an agent must tell whether inbound mail is protected against TLS downgrade, or why senders report MTA-STS failures for a domain.","tags":["email","dns","deliverability","mta-sts","tls"],"examples":["GET https://api.lookproof.dev/v1/mail/mta-sts?domain=example.com"],"inputModes":[],"outputModes":[]},{"id":"mail.mta_sts_parse","name":"MTA-STS policy parser","description":"Parse a pasted MTA-STS policy file (RFC 8461) as a sending server would: version, mode, mx patterns and max_age, lines that do not parse, testing or none mode and a short max_age. Offline. Use when an agent writes an MTA-STS policy before publishing it. Input: {\"policy\": \"version: STSv1\\nmode: enforce\\n...\"}.","tags":["email","dns","mta-sts","tls","policy"],"examples":["POST https://api.lookproof.dev/v1/mail/mta-sts-parse with a JSON body as in the OpenAPI document"],"inputModes":[],"outputModes":[]},{"id":"mail.mx","name":"MX lookup","description":"List a domain's mail servers in preference order and detect null MX (RFC 7505) and MX targets that do not resolve, with coded findings. Use when an agent must find where mail for a domain is delivered or why a domain cannot receive mail.","tags":["email","dns","deliverability","mx"],"examples":["GET https://api.lookproof.dev/v1/mail/mx?domain=example.com"],"inputModes":[],"outputModes":[]},{"id":"mail.provider","name":"Mail provider detection","description":"Name the mail providers a domain uses from its MX hosts and SPF include tree: the mailbox provider behind the primary MX, inbound gateways and sending services, matched against a fixed, versioned list with the matching names as evidence. Use when an agent must tell who hosts a domain's mail, which services may send for it, or whether SPF still authorises a provider the domain has left.","tags":["email","dns","mx","spf","providers"],"examples":["GET https://api.lookproof.dev/v1/mail/provider?domain=example.com"],"inputModes":[],"outputModes":[]},{"id":"mail.ptr","name":"Reverse DNS check for mail servers","description":"Check reverse DNS for a domain's mail servers: up to five MX hosts, their IPv4 and IPv6 addresses, each PTR name and whether it resolves back to the same address (FCrDNS), with coded findings. Use when an agent must tell whether a domain's mail servers have matching reverse DNS, a common reason for rejected or spam-filed mail.","tags":["email","dns","deliverability","ptr","reverse-dns"],"examples":["GET https://api.lookproof.dev/v1/mail/ptr?domain=example.com"],"inputModes":[],"outputModes":[]},{"id":"mail.spf","name":"SPF check","description":"Parse and evaluate a domain's SPF record: the include and redirect tree, qualifiers and the RFC 7208 limit of ten DNS lookups, with coded findings. Use when an agent must tell whether SPF is valid, why mail from a service fails SPF, or whether one more include would exceed the lookup limit.","tags":["email","dns","deliverability","spf"],"examples":["GET https://api.lookproof.dev/v1/mail/spf?domain=example.com"],"inputModes":[],"outputModes":[]},{"id":"mail.spf_flatten","name":"SPF flattening check","description":"Unfold a domain's SPF policy (RFC 7208) into merged IPv4 and IPv6 blocks: include and redirect followed as a receiver counts them (10 lookups, 2 void lookups, PermError stops), a and mx resolved with /cidr, sources per block, exists, ptr and macros listed apart, and very broad blocks flagged. Use when an agent must know which servers may send. Input: ?domain=example.com.","tags":["email","dns","deliverability","spf","flatten"],"examples":["GET https://api.lookproof.dev/v1/mail/spf-flatten?domain=example.com"],"inputModes":[],"outputModes":[]},{"id":"mail.spf_parse","name":"SPF record parser","description":"Parse a pasted SPF record without DNS (RFC 7208): mechanisms with qualifiers and values, modifiers, syntax errors, the all policy and the number of terms that need DNS lookups, with coded findings such as +all, ptr and over ten lookups. Use when an agent must check an SPF record before publishing it. Input: {\"record\": \"v=spf1 mx include:_spf.example.com ~all\"}.","tags":["email","dns","deliverability","spf","parser"],"examples":["POST https://api.lookproof.dev/v1/mail/spf-parse with a JSON body as in the OpenAPI document"],"inputModes":[],"outputModes":[]},{"id":"mail.spoofable","name":"Email spoofing check","description":"Read how strong a domain's DMARC policy (RFC 9989) is: protected (reject), partial (quarantine), monitoring (none), unprotected or broken, plus whether it has gaps (none, partial or full), the effective policy after test mode (t=y), the subdomain policy, pct and the SPF all qualifier. Use when an agent must explain whether a domain asks receivers to stop forged mail. Input: ?domain=example.com.","tags":["email","dns","deliverability","dmarc","spoofing"],"examples":["GET https://api.lookproof.dev/v1/mail/spoofable?domain=example.com"],"inputModes":[],"outputModes":[]},{"id":"mail.tlsrpt","name":"TLS-RPT check","description":"Check a domain's TLS-RPT record (RFC 8460) at _smtp._tls: one v=TLSRPTv1 record with exactly one rua tag of mailto: or https: report addresses. Use when an agent sets up or audits SMTP TLS reporting, alone or before MTA-STS. Input: ?domain=example.com.","tags":["email","dns","tls-rpt","tls","reporting"],"examples":["GET https://api.lookproof.dev/v1/mail/tlsrpt?domain=example.com"],"inputModes":[],"outputModes":[]},{"id":"mail.tlsrpt_parse","name":"TLS-RPT record parser","description":"Parse a pasted TLS-RPT record (RFC 8460): v=TLSRPTv1, exactly one rua tag and whether each report address is a mailto: or https: URI. Offline. Use when an agent sets up SMTP TLS reporting. Input: {\"record\": \"v=TLSRPTv1; rua=mailto:tlsrpt@example.com\"}.","tags":["email","dns","tls-rpt","tls","reporting"],"examples":["POST https://api.lookproof.dev/v1/mail/tlsrpt-parse with a JSON body as in the OpenAPI document"],"inputModes":[],"outputModes":[]},{"id":"site.health","name":"Site health check","description":"One report on a website's security basics: the TLS certificate on port 443 (trust, name, expiry, key), the redirect chains from http:// and https:// with HSTS, CSP, frame protection, Referrer-Policy and cookie flags, and the domain's expiry and EPP statuses from RDAP, each as a section with coded findings. Use when an agent must audit a website or build a site health report; cheaper than the three checks one by one. No score is computed.","tags":["website","tls","https","security","audit"],"examples":["GET https://api.lookproof.dev/v1/site/health?domain=example.com"],"inputModes":[],"outputModes":[]},{"id":"tls.certificate","name":"TLS certificate check","description":"Check the TLS certificate a domain serves on port 443: whether it chains to a trusted root, matches the name (RFC 9525) and when it expires, with issuer, chain, key and signature algorithm, TLS version and coded findings for expired, expiring, untrusted, mismatched or weak certificates. Use when an agent must tell why HTTPS fails for a domain or when its certificate has to be renewed.","tags":["tls","ssl","certificates","https","security"],"examples":["GET https://api.lookproof.dev/v1/tls/certificate?domain=example.com"],"inputModes":[],"outputModes":[]},{"id":"tls.csr_decode","name":"CSR decoder","description":"Decode one pasted PEM certificate signing request (PKCS#10): subject, DNS and IP names, key type and size, signature algorithm and whether the signature matches the key. Email addresses are never returned. Offline. Use when an agent must check a CSR before sending it to a certificate authority. Input: {\"pem\": \"-----BEGIN CERTIFICATE REQUEST...\"}.","tags":["tls","csr","certificates","pkcs10","decoder"],"examples":["POST https://api.lookproof.dev/v1/tls/csr-decode with a JSON body as in the OpenAPI document"],"inputModes":[],"outputModes":[]},{"id":"tls.pem_decode","name":"PEM certificate decoder","description":"Decode one pasted PEM X.509 certificate: subject, issuer, validity and days left, DNS and IP names, key type and size, signature algorithm, CA flag, key usages, self-signed, and SHA-256 and SHA-1 fingerprints. Email addresses are never returned. Offline: no chain or revocation check. Use when an agent must inspect a certificate file before installing it. Input: {\"pem\": \"-----BEGIN CERTIFICATE...\"}.","tags":["tls","certificates","x509","pem","decoder"],"examples":["POST https://api.lookproof.dev/v1/tls/pem-decode with a JSON body as in the OpenAPI document"],"inputModes":[],"outputModes":[]}],"provenance":[{"source":"agentic_market","first_seen":"2026-10-27T16:26:44.284987+00:00"},{"source":"recrawl_paid","first_seen":"2026-10-27T16:28:14.941070+00:00"},{"source":"cdp_discovery","first_seen":"2026-10-29T00:50:38.228460+00:00"}],"recent_probes":[{"fetched_at":"2026-11-10T22:02:47.865477+00:00","ok":true,"status_code":200,"error":null,"elapsed_ms":216,"live_responds":null},{"fetched_at":"2026-11-03T16:29:13.408135+00:00","ok":false,"status_code":404,"error":"HTTP 404","elapsed_ms":null,"live_responds":null},{"fetched_at":"2026-10-27T16:28:14.911958+00:00","ok":false,"status_code":404,"error":"HTTP 404","elapsed_ms":null,"live_responds":null}],"catalog_attestation":null,"operator_revenue_evidence":{"evidence_class":"operator_submitted","authenticity":{"rung":"no_operator_evidence","rank":0,"why":"No verifiable operator evidence has been submitted for this agent.","thresholds":{"min_independent_payers":3,"min_verified_usd":25.0},"engine_table":"agent_authenticity","merge_rule":"max(existing_rank, rank)"},"metric_metadata":{"provenance":"operator_submitted_evidence","confidence":"attested","coverage":{"numerator":0},"as_of":"2026-11-10T23:39:41.445801+00:00","definition":"Revenue proofs submitted by the verified owner and re-checked by Agenstry against the settlement chain or the operator's own Stripe account. Only independently confirmed proofs are counted."},"counts":{"retained":0,"verified":0,"unverifiable":0},"verified":{"gross_usd":0.0,"transactions":0,"independent_payers":0},"detail_url":"https://agenstry.com/api/agents/api.lookproof.dev/evidence","dispute_url":"https://agenstry.com/agents/api.lookproof.dev/dispute"},"verification_history":[],"signatures":[{"protected":"eyJhbGciOiJFUzI1NiIsImprdSI6Imh0dHBzOi8vYWdlbnN0cnkuY29tLy53ZWxsLWtub3duL2p3a3MuanNvbiIsImtpZCI6ImFnZW50ZmluZGVyLWVzMjU2LTEiLCJ0eXAiOiJKT1NFIn0","signature":"qCst07BXBckJU7lSvJ_QaonJzlEbYq_iOAQCOeYmGQJcyXfkPVUj63Yb8IUNEqL3BHCH_2hIphHSRTxPsDiAug"}]}