# conc-exe.xyz Unified Passive Security Scan

> conc-exe.xyz Unified Passive Security Scan is a paid API for AI agents from conc-exe.xyz, paid per call via x402, $0.1/call, status unknown (last checked 2026-09-13).

Combines passive agent-readiness audit and HTTP security header review into a single unified security breakdown with recommendations for an authorized external website

## Facts

- Endpoint: POST https://conc-exe.xyz/api/concierge-security-scan
- Price: $0.1/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/conc-exe-xyz-unified-passive-security-scan-2b16ef10
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_iEYU9mctvD_uyt9xideAO

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability conc-exe-xyz-unified-passive-security-scan-2b16ef10 -d '<json body>'
```

Example prompt: Can you run a full passive security scan on https://api.mycompany.com — I'm authorized to test it — and give me the combined agent-readiness audit, HTTP header review, and recommendations? Add api.mycompany.com to the allowlist.

## When to prefer this

Choose this endpoint when you need both agent-readiness and HTTP header security analysis in a single call rather than calling the two sibling endpoints separately. Ideal when you want a holistic passive security posture report with recommendations for an external site you own or are authorized to test, without active exploitation.

## Known failure modes

- authorized field is false or missing — request rejected with authorization error
- target URL is a conc-exe.xyz hostname — platform hosts are blocked, returns 403 or validation error
- target URL is HTTP (not HTTPS) — rejected as invalid
- target URL is unreachable or times out — returns connectivity error
- target domain not in allowlist if allowlist is specified — returns scope violation error
- malformed URL format — returns input validation error

## How this service works

Unified passive security breakdown — agent-readiness + HTTP headers + recommendations for an authorized external website (platform hosts blocked)

## Output

A unified passive security breakdown covering: agent-readiness assessment (OpenAPI discovery, AI-agent discoverability signals, security header compatibility for agents), HTTP security header analysis, and prioritized recommendations — all without active exploitation or intrusive probing.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "target": {
   "type": "string",
   "description": "Authorized external https URL. For free platform self-audit only, use https://conc-exe.xyz with selfAudit: true; otherwise never conc-exe.xyz."
  },
  "allowlist": {
   "type": "array",
   "items": {
    "type": "string"
   },
   "description": "Hostname allowlist (*.example.com). Optional for selfAudit of conc-exe.xyz."
  },
  "selfAudit": {
   "type": "boolean",
   "description": "When true with target https://conc-exe.xyz (or www), runs free platform self-audit and skips x402 settlement"
  },
  "authorized": {
   "type": "boolean",
   "description": "Must be true — caller attests permission"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true,
  "kind": "security-scan",
  "target": {
   "origin": "https://api.example.com",
   "hostname": "api.example.com"
  },
  "summary": {
   "headersGrade": "moderate",
   "headersTotal": 6,
   "mcpReachable": false,
   "overallGrade": "B",
   "readinessMax": 3,
   "discoveryFiles": 2,
   "headersPresent": 4,
   "readinessScore": 2.1
  },
  "breakdown": {},
  "disclaimer": "Passive security breakdown only.",
  "recommendations": [
   "Add strict-transport-security — max-age with includeSubDomains on HTTPS"
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/conc-exe-xyz-unified-passive-security-scan-2b16ef10/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from conc-exe.xyz](https://www.zero.xyz/host/conc-exe.xyz/llms.txt)