Ha Tang docs and API for agents: email, VietQR payments, e-invoices, support inbox (Vietnam).
Nothing to run from here
Lordevo Shop (x402 website checks) is installed from its publisher's own source and answers where it runs, so this marketplace is not in the path of a single call. There is no address here to send one to, and a panel that pretended otherwise would be showing you an answer we made up. Install it and call it from your own client — the Installation tab has the entry for each one.
93/100
tool-list score
35
tools declared
remote
at its publisher
—
calls last 7d
What it does
33 paid x402 web/DNS/email/SSL checks for agents from $0.01 per call, plus 2 free tools.
Quickstart
# 1 — add it to Claude Code
claude mcp add --scope user --transport http lordevo-shop-x402-website-checks-mcp https://shop.lordevo.com/mcp
# 2 — ask your agent for something these tools do
# site_check, list_services, get_sample_output and 32 more
Lordevo Shop (x402 website checks) costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.
Publishernot claimed
LOAll 2 servers
lordevo2 servers
2 categories
Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.
Installation
Where are you running it?
Every route below installs the same thing and ends at the same approval screen. Nothing here runs on your machine and nothing runs on ours: this server answers at its publisher’s own address, and what you install is the connection straight to it.
Claude Codedeclared by this listing
This is a public server: it answers at its publisher’s own address and this marketplace is not in the path. Claude Code registers it in one command; --scope user makes it available in every project. The transport below is http, as the publisher's own manifest declares it.
claude mcp add --scope user --transport http lordevo-shop-x402-website-checks-mcp https://shop.lordevo.com/mcpReconnect, or start a new session, and the tools appear in the model’s tool list.
Free on mcprush, and it answers at its publisher’s own address: this marketplace is not in the path, so there is no key of ours to hold and no card to add.
What it writes
One config entry pointing straight at the publisher’s own address — this marketplace is not in the path, and nothing from this listing executes on your machine.
What you approve
35 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.
Tool surface
What the model actually sees. Descriptions are diffed on every release — see version history.
$0.03 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). One call answers both questions agents ask about a website: can I trust or pay it (url-trust: TLS, redirects, domain age via RDAP, lookalike/punycode, scam/parked signals, x402 challenge validity) and is it ready for AI agents and search (agent-readiness score 0-100), plus a sec
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | Public http(s) URL or bare domain, e.g. https://example.com |
Free. Lists every Lordevo pay-per-call service (quick checks and AI verdicts from $0.01, LITE tiers and full SEO/security/content services), with price, endpoint and input.
No parameter schema on file.
Free. Returns an example of what a paid tool returns, so you can decide before paying.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| tool | string | yes | — |
$0.03 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). Scores how visible and usable a site is for AI assistants and agents (0-100, grade A-F): robots.txt rules for AI search and training crawlers (GPTBot, OAI-SearchBot, ClaudeBot, PerplexityBot, Google-Extended...), noindex/noai, /llms.txt quality, schema.org JSON-LD, sitemap, titl
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | Public http(s) URL or bare domain, e.g. https://example.com |
$0.01 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). Pre-click / pre-pay check of one URL: TLS validity and expiry, redirect chain (HTTPS downgrades, cross-domain hops), domain age via RDAP, brand lookalike and punycode/mixed-script signals, parked or scam-pattern content, seed-phrase or lookalike login forms, security-header grad
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | Public http(s) URL or bare domain, e.g. https://example.com |
$0.01 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). Pre-fetch gate for agents and scrapers: is this exact URL allowed by robots.txt (RFC 9309: missing = allow, 5xx/unreachable = disallow) for generic agents and 16 named AI agents/crawlers (ChatGPT-User, Claude-User, PerplexityBot, GPTBot, ClaudeBot, Google-Extended, CCBot...), pl
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | Public http(s) URL or bare domain, e.g. https://example.com |
$0.01 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). Resolve one link the way a browser would: follows up to 10 redirects (HEAD first, GET fallback), returns alive true/false with a reason (http_404, dns_not_found, timeout...), the final URL and domain, every hop with its status, cross-domain and HTTPS-downgrade flags, URL-shorten
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | Public http(s) URL or bare domain, e.g. https://example.com |
$0.01 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). Live DNS lookup for any public host name: one record type or ALL (A, AAAA, CNAME, MX, TXT, NS, SOA, CAA) in one call, with NXDOMAIN detection and a flag for private addresses. Cached 2 min. ~0.1-1 s.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Public host name, e.g. example.com or www.example.com (a URL also works) |
| type | string | no | Record type (default ALL = A, AAAA, CNAME, MX, TXT, NS, SOA, CAA) |
$0.01 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). Validates one email address without contacting the mailbox: RFC 5321 syntax, domain exists, MX / null-MX / implicit-MX, MX hosts resolve, mail provider, disposable-domain flag (CC0 list), role account (info@, support@), free provider, typo suggestion (gmial.com -> gmail.com). Ve
| Parameter | Type | Required | Notes |
|---|---|---|---|
| string | yes | Email address, e.g. jane@example.com |
$0.01 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). Connects to host:443 and reports the certificate: trusted or not (and why), hostname match, issuer, valid from/to, days left, expired / expiring within 21 days, SAN list, wildcard, key type and size, serial, SHA-256 fingerprint, OCSP/CA URLs, chain, TLS version, cipher and ALPN.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Public host name, e.g. example.com or www.example.com (a URL also works) |
$0.01 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). Registration facts for a domain from the official registry RDAP service (successor to WHOIS): registered or not, registrar and IANA id, created / updated / expiry dates, age in days, days to expiry, EPP status codes, nameservers and DNSSEC. Personal contact data is never returne
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | Domain name, e.g. example.com (a URL or email address also works) |
$0.01 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). Who holds a public IPv4/IPv6 address, from the Regional Internet Registry RDAP record: network name, handle, CIDR, address range, country, holding organisation, abuse mailbox, RIR (ARIN/RIPE/APNIC/LACNIC/AFRINIC) and reverse DNS (PTR). No geolocation database and no ASN. Cached
| Parameter | Type | Required | Notes |
|---|---|---|---|
| ip | string | yes | Public IPv4 or IPv6 address, e.g. 8.8.8.8 |
$0.02 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). The link-check for up to 10 URLs in one paid call (comma-separated): for each, alive or dead with the reason, final URL after redirects, redirect chain, cross-domain / HTTPS-downgrade flags, content type and TLS. ~1-6 s.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| urls | string | yes | 1-10 public http(s) URLs, comma-separated |
$0.02 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). Reads one page (robots.txt obeyed) and checks up to 40 of its unique links (internal first) with HEAD then GET: broken links with status or error, restricted (401/403/429/999), timeouts and counts. ~2-8 s.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | Public http(s) URL or bare domain, e.g. https://example.com |
$0.01 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). Finds a site's sitemaps (robots.txt Sitemap lines, /sitemap.xml, /sitemap_index.xml, or a sitemap URL you give), follows sitemap indexes (up to 6 files) and returns up to 1000 page URLs with lastmod, plus per-sitemap status. Cached 1 h. ~0.5-4 s.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | Public http(s) URL or bare domain, e.g. https://example.com |
$0.01 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). Everything needed to render a link card from one public page: title, description, site name, Open Graph image (size, alt), canonical URL, best favicon plus all icons, logo (JSON-LD Organization), web manifest, theme colour, Twitter card fields, author and dates. Cached 1 h. ~0.3
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | Public http(s) URL or bare domain, e.g. https://example.com |
$0.01 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). Text statistics for the main content of one page: word, sentence and character counts, Flesch reading ease and Flesch-Kincaid grade (English), level, long-sentence ratio, reading and speaking time, and top terms. Computed by formula, no AI. Cached 1 h. ~0.3-2 s.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | Public http(s) URL or bare domain, e.g. https://example.com |
$0.01 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). Extracts schema.org data from one page: every JSON-LD item (Product, Article, Organization, FAQPage, Event, Recipe and others) as parsed JSON with missing required / recommended properties, invalid JSON-LD blocks, microdata itemtypes and RDFa types. Cached 1 h. ~0.3-2 s.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | Public http(s) URL or bare domain, e.g. https://example.com |
$0.01 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). Is this URL indexable and which URL is canonical: canonical tag or HTTP Link header, self-referencing or pointing elsewhere, multiple/relative/cross-domain canonicals, og:url mismatch, meta robots and X-Robots-Tag (noindex/nofollow), hreflang list with code validation, x-default
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | Public http(s) URL or bare domain, e.g. https://example.com |
$0.01 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). Will a browser on a given origin be allowed to call this URL: sends a CORS preflight (OPTIONS) and a GET with Origin, reports Access-Control-Allow-Origin / Credentials / Methods / Headers / Max-Age, Vary: Origin, and flags arbitrary-origin reflection, wildcard with credentials a
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | Public http(s) URL or bare domain, e.g. https://example.com |
| origin | string | no | Origin to test, e.g. https://app.example.com |
| method | string | no | Method for the preflight |
$0.01 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). One live request to a URL with no redirect following: up or down (and why: DNS, timeout, refused, TLS), status, Location, timings in ms for DNS, TCP connect, TLS handshake, time to first byte and total, IP, HTTP version, server header. Measured from Malaysia. Never cached. ~0.1-
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | Public http(s) URL or bare domain, e.g. https://example.com |
$0.01 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). Instant offline check of a host name for phishing patterns: Unicode / punycode form, scripts per label and mixed-alphabet homographs, typo or confusable lookalikes of commonly phished brands, brand outside its official domain, risky TLD, login/wallet words, hyphens, subdomain de
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Public host name, e.g. example.com or www.example.com (a URL also works) |
$0.01 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). Bank Negara Malaysia exchange rates against the ringgit (buying, selling, middle; MYR per unit) for one currency or ALL, plus the current Overnight Policy Rate. Source: Bank Negara Malaysia; data subject to the Terms of Use for BNM Datasets; not endorsed by BNM. Cached 15 min. ~
| Parameter | Type | Required | Notes |
|---|---|---|---|
| currency | string | yes | 3-letter currency code (e.g. USD, SGD, EUR) or ALL |
$0.02 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). The site-verdict trust check rendered as a branded 1200x630 SVG card: grade A-F, trust score, verdict, a one-line plain verdict and top reasons, with a permanent public URL (card_url) to share or embed, plus the inline SVG and the full reasons. Verdict text comes from Lordevo's
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | Public http(s) URL or bare domain, e.g. https://example.com |
$0.01 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). Fetch one public web page and return its main content as clean Markdown (headings, lists, links, images with alt) plus title, description, lang, canonical and word count. Up to 60,000 characters. Obeys robots.txt. ~1-3 s.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | Public http(s) URL or bare domain, e.g. https://example.com |
$0.01 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). Read one public web page and return clean Markdown of the main content plus metadata: title, meta description, canonical, robots, lang, Open Graph/Twitter tags, headings outline, JSON-LD types, internal/external links, images missing alt, word count. Obeys robots.txt. ~1-3 s.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | Public http(s) URL or bare domain, e.g. https://example.com |
$0.01 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). Check a domain's email authentication and spoofing risk from public DNS: MX and mail provider, SPF (record, all-qualifier, DNS lookup count vs the 10 limit), DMARC policy/pct/rua, DKIM at 30 common selectors, MTA-STS, TLS-RPT, BIMI. Returns grade, spoofable flag and fixes. ~1-3
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | Domain name, e.g. example.com (a URL or email address also works) |
$0.01 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). Passive check of a public website's HTTPS setup: TLS version and certificate expiry, HTTP->HTTPS redirect, HSTS, CSP, X-Frame-Options/frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cookie flags, version disclosure. Returns grade A+..F and fixes. ~1
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | Public http(s) URL or bare domain, e.g. https://example.com |
$0.02 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). Detect what a website is built with from its homepage HTML and headers: CMS/site builder, ecommerce platform, JS framework, analytics and ad pixels, tag manager, chat/support widgets, payments, consent, CDN, hosting, web server, language. ~90 signatures with evidence-based detec
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | Public http(s) URL or bare domain, e.g. https://example.com |
$0.02 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). On-page SEO check of one URL: title/meta lengths, H1, canonical, noindex, viewport, lang, Open Graph, JSON-LD, images alt, thin content, compression, response time, plus robots.txt, XML sitemap, llms.txt and which AI crawlers (GPTBot, ClaudeBot, PerplexityBot...) are allowed. Sc
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | Public http(s) URL or bare domain, e.g. https://example.com |
$0.03 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). All four quick checks in one call for a website: on-page SEO score and issues, security headers/TLS grade, tech stack, and the domain's SPF/DKIM/DMARC email authentication. Good for lead qualification, vendor due diligence or a first look before a full audit. ~3-8 s.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | Public http(s) URL or bare domain, e.g. https://example.com |
$0.01 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). AI verdict on one page's content quality: high/medium/low with a 0-100 score, topic, strengths, problems and one-line summary, blended with measured metrics (word count, Flesch readability, headings, duplicate sentences, link ratio, author/date). Runs on Lordevo's own local mode
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | Public http(s) URL or bare domain, e.g. https://example.com |
$0.02 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). AI trust verdict for a website: likely_legit / caution / suspicious with a 0-100 trust score and short reasons, from public signals: HTTPS, domain age (RDAP), MX/SPF/DMARC, contact details, address, company registration, policies, social links, parked/for-sale and scam-phrase de
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | Public http(s) URL or bare domain, e.g. https://example.com |
$0.03 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). LITE version of the $2 SEO Audit: one page, the top 10 issues ranked by severity and effort with why/fix, plus up to 12 internal links checked for 404s, mixed content, headings, structured data, Open Graph, robots.txt/sitemap/llms.txt. ~5-15 s. Upgrade: full 10-page SEO Audit ($
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | Public http(s) URL or bare domain, e.g. https://example.com |
$0.03 per call (x402, USDC on Base; the first call returns the payment terms, pay and retry with _meta["x402/payment"]). LITE version of the Website Security Check: passive summary only (headers, TLS/certificate, HTTP->HTTPS, cookies, SPF/DKIM/DMARC, CAA, IPv6, security.txt) with grade A-F and top 10 findings. Nothing intrusive. ~3-10 s. Upgrade: Safe check ($1) or Deep active scan ($5, ownership
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | Public http(s) URL or bare domain, e.g. https://example.com |
Free
$0 forever
- Every tool — any call limit is its publisher’s, not ours
- No card, and mcprush charges nothing for it
- Runs at its publisher’s own address — this marketplace is not in the path
- Nothing to cap, because mcprush bills nothing
What counts against your monthly calls
| Tool | Unit | Calls used | Out of the allowance |
|---|
Nothing here is billable: mcprush charges nothing to install Lordevo Shop (x402 website checks) or to call it, at any volume.
Call allowance · this installenforced at the gateway
Monthly allowance, in calls
—
—
Alert at 80% · then the tool returns a normal MCP error
Used this month: —
ATool-list grade · score 93 / 100
Release 1.1.1 · scanned 28 Oct 2026
Graded from the tools this server lists, not from its source code.
Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.
Threat score100
Client score93
Findings0 threat · 27 capability
Capabilitymoderate
Coveragemanifest
Verificationnot in this report
Surface digest26ce8070d4549b3ba0d44cdae6577358c85e94a32255bd59e8e52d0398a3f926
Score vectorthreat 100 → client 93
| Term | Level | What it prices | Points |
|---|---|---|---|
| capability-exposure | moderate | capability blast radius (moderate) — client exposure if the model is manipulated | −3 |
| coverage-honesty | manifest | inspection depth (manifest) — how much of the target the scan could see | −4 |
score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.
What the scan could actually read
A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.
The scan read each tool’s name, description, input schema and annotations exactly as the server listed them the last time it answered us; no code was reviewed. We ask the server again about once a month, and a list that changed is graded again.
Tool surfaceread
Implementation sourcenot available
Package metadatanot available
Live transportnot available
The implementation source was not read — this reflects the declared tool metadata only.
Capability — what it could do if the model were manipulated
Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. moderate is the level these add up to.
| Tool | Capability tags | Why the tag was assigned |
|---|---|---|
| site_check | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| list_services | no tags | |
| get_sample_output | no tags | |
| agent_readiness | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| url_trust | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| can_fetch | untrusted-input | untrusted-input: keyword "fetch", declares openWorldHint: true (interacts with entities outside the server) |
| link_check | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| dns_lookup | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| email_validate | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| ssl_cert | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| domain_rdap | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| ip_info | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| links_batch | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| broken_links | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| sitemap_urls | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| link_preview | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| readability | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| structured_data | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| canonical_check | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| cors_check | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| http_ping | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| domain_lookalike | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| myr_rates | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| verdict_card | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| page_markdown | untrusted-input | untrusted-input: keyword "fetch", declares openWorldHint: true (interacts with entities outside the server) |
| page_meta | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| email_auth | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| security_headers | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| tech_stack | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| seo_page | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| site_snapshot | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| page_quality | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| site_verdict | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| seo_audit_lite | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| security_scan_lite | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
Toxic-flow graph
The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.
The public result for this release does not print the flow graph, so there is nothing to show here. That is not the same as "no paths were found": what the scan did read is above, under coverage.
Supply chain and provenance
Integrityfirst-seen
Surface digest26ce8070d4549b3b
Scanned2026-10-28
This is the first scan of this surface here, so there is nothing yet to compare it against.
Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.
Release history
This is an address its publisher runs: which release it serves is theirs to choose, so there is nothing here to pin. The history below is for reading; the current release on file is 1.1.1.
1.1.1
undated
latestNo release note was published with this version.
—
no reviews yet
Who can review
One review per account, from a signed-in account that does not publish this listing. Nothing else is asked — you can say what you think before you install it. Publishers can reply once per review, and a review can be edited or deleted by whoever wrote it.
Sign in to write one
Any signed-in account that does not publish Lordevo Shop (x402 website checks) can review it, once — before installing it or after. A review from an account that has installed it is marked as one.
No reviews yet
Nobody has reviewed this listing. The rating on the card is the mean of the reviews written here and nothing else, so there is no rating until somebody writes the first — which takes a signed-in account that does not publish it, and nothing else.