The first URL is never the destination — this service probes an HTTP-capable agent tool server with redirects, rebinding, and header-carriage attacks against destinations it owns, and grades where the server's requests actually end up: EVERY-HOP-VALIDATED, FIRST-HOP-ONLY, or OPEN-EGRESS.
Google's MCP Toolbox validated the first URL and followed a redirect straight to the cloud metadata address (CVE-2026-14540). Five organizations fixed the same bug class in their MCP servers; one server's guard has been bypassed three times because it validates the hostname string and never resolves DNS; a scan of 7,000+ MCP servers found 36.7% potentially SSRF-vulnerable. Fixes land one server at a time; checklists are advice, not measurement. This probe runs a five-leg battery against your server as deployed — redirect-to-metadata (including IPv6 forms), redirect-to-private over multi-hop chains, DNS rebinding, literal-vs-resolved mismatch, and cross-origin header/credential forwarding — with every attack aimed at controlled destinations the probe itself owns, never at a real metadata endpoint. It grades from the destination-side evidence, not the server's own account: the first-hop story is the claim, the sink evidence is the verdict, and the gap between them is the number on the receipt — signed, bound to your server's exact fingerprint, and EXPIRED the moment its version or tool set changes. Destinations the probe cannot honestly grade return UNTESTABLE with the reason named — a proxy-opaque resolution is never folded into a pass.
Pricing (USDC, x402 pay-per-call unless noted): - Verdict query: $0.01 per query (precomputed signed verdict for one exact server version — grade + hop-gap number; EXPIRED on version change). - Full egress probe: $4.99 per server (five-leg battery against probe-owned controlled destinations, signed per-leg verdict + first-hop-claim vs last-hop-verdict gap report). - Operator pass: $9.99 per operator per month — GATED, not advertised and not sold: pass prices settle only after the remote-shape re-test recorded in the launch packet clears the pass shapes; it has not cleared, so no pass is sold. - Fleet pass: $19.99 per operator per month — GATED, not advertised and not sold, same gate as the Operator pass. - Trial: one free full egress probe per operator, ever, enforced by operator account identity AND payer wallet. No perpetual free tier, and no other tier carries a free allotment. Coverage map: at $0.01 per query, the tier that rationally goes unchecked is the cheap, low-sensitivity delegation — an agent fetching public, read-only content through a server with no credentials in scope and no internal reachability at stake. The product's real coverage is the credentialed and sensitive tier. No surface claims the verdict is queried on every delegation. Support: support@textforagents.com
POST /register with {"name": ..., "wallet": ...} to self-serve your per-operator credential — no operator assistance needed. Authorize a target (POST /targets), then POST /probe or POST /query, or call the MCP tools at /mcp. Documentation: /docs · OpenAPI: /openapi.json · llms.txt: /llms.txt · Terms: /terms · Privacy: /privacy
Stated plainly, because the lab proved the boundaries: the guard-shape separation was proven against deployed-shape doubles over a localhost test-double transport; probing real remote servers is the production surface, and the pass prices settle only after the remote-shape re-test recorded in the launch checklist — the passes are not advertised and not sold in the meantime; the live every-hop-validated share across popular servers is unmeasured — the lab measured doubles, not the ecosystem; the battery exercises egress behavior only and a good grade is not a general security certification; willingness to pay is unmeasured. UNTESTABLE is never a pass. Probe traffic is confined to probe-owned destinations. The named unchecked tier in the coverage map (cheap, low-sensitivity, credential-free delegations) rides with the pricing page.
Support: support@textforagents.com