# Common Ports Scanner

> Common Ports Scanner is a paid API for AI agents from intel.rallylive.ca, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-14).

TCP-connects to 12 well-known ports on a target host and reports which are open, providing a quick exposure check.

## Facts

- Endpoint: GET https://intel.rallylive.ca/ip/ports
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/common-ports-scanner-70b38435
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_KPDDKX-SwRp81yWsLZMQf

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability common-ports-scanner-70b38435
```

Example prompt: Can you scan the common ports on api.mycompany.com and tell me which ones are open — I want to know if anything like Redis, MongoDB, or SSH is accidentally exposed?

## When to prefer this

Choose this endpoint when you need a fast, low-cost ($0.01) check of the most commonly exposed services on a host you operate. It covers the 12 most security-critical ports without requiring a full nmap-style scan. Ideal for pre-launch audits, firewall verification, or routine exposure checks. Not suitable for Cloudflare-fronted hosts or comprehensive port range scans.

## Known failure modes

- Cloudflare-fronted hosts cannot be probed and will return misleading or error results
- Host not found / DNS resolution failure if an invalid hostname is provided
- Connection timeouts for heavily firewalled hosts may slow or block results
- Private/internal IP addresses may be unreachable from the scanning service
- Rate limiting or access restrictions may prevent scanning certain hosts

## How this service works

Common ports scan: TCP-connects to 12 well-known ports (FTP 21, SSH 22, SMTP 25, HTTP 80, HTTPS 443, MySQL 3306, Postgres 5432, Redis 6379, 8080, 8443, Elasticsearch 9200, MongoDB 27017) and reports which are open. Quick exposure check for a host you operate. Cloudflare-fronted hosts cannot be probed. $0.01 per host.

## Output

A report of which of the 12 probed ports (FTP 21, SSH 22, SMTP 25, HTTP 80, HTTPS 443, MySQL 3306, Postgres 5432, Redis 6379, 8080, 8443, Elasticsearch 9200, MongoDB 27017) are open or closed on the target host, based on TCP connection attempts.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {}
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/common-ports-scanner-70b38435/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from intel.rallylive.ca](https://www.zero.xyz/host/intel.rallylive.ca/llms.txt)