# Concierge Agent — Security Readiness Auditor

> Concierge Agent — Security Readiness Auditor is a paid API for AI agents from conc-exe.xyz, paid per call via x402, $0.02/call, status unknown (last checked 2026-09-15).

Performs a passive, multi-dimension security readiness audit of an external API origin, scoring it across dimensions like spec presence and returning structured readiness scores.

## Facts

- Endpoint: POST https://conc-exe.xyz/api/concierge-security-readiness
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/concierge-agent-security-readiness-auditor-b80cfe0e
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Lew7HX4N21ZvTsfN6wthj

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability concierge-agent-security-readiness-auditor-b80cfe0e -d '<json body>'
```

Example prompt: Can you run a passive security readiness audit on https://api.example.com — I have authorization to scan it — and tell me how it scores across dimensions like OpenAPI spec presence?

## When to prefer this

Use this endpoint when you need a structured, passive security readiness assessment of an external HTTPS API origin, especially to check for spec presence and other security hygiene dimensions. Prefer this over manual checks when you need a scored, machine-readable audit report suitable for agent pipelines.

## Known failure modes

- authorized field not set to true — attestation required, request rejected
- target origin is not an external HTTPS URL (e.g. conc-exe.xyz itself is not allowed)
- unreachable or invalid origin — may return error or degraded scores
- missing target field — request body invalid
- payment not included or insufficient — 402 response requiring x402 USDC payment

## How this service works

Passive agent-readiness audit for an authorized external API — OpenAPI, discovery files, security headers (platform hosts blocked)

## Output

A JSON object containing overall scores (max, mean, number of dimensions), the target origin and hostname, a breakdown of individual dimension scores with labels (e.g. spec-presence: 'present', score 2), and a disclaimer confirming this is a passive audit only with no exploitation.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "target": {
   "type": "string",
   "description": "Authorized external https origin (never conc-exe.xyz)"
  },
  "allowlist": {
   "type": "array",
   "items": {
    "type": "string"
   },
   "description": "Optional hostname allowlist"
  },
  "authorized": {
   "type": "boolean",
   "description": "Must be true — caller attests permission"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true,
  "kind": "security-readiness",
  "scores": {
   "max": 3,
   "mean": 2.1,
   "dimensions": 4
  },
  "target": {
   "origin": "https://api.example.com",
   "hostname": "api.example.com"
  },
  "dimensions": [
   {
    "id": "spec-presence",
    "name": "OpenAPI spec presence",
    "label": "present",
    "score": 2
   }
  ],
  "disclaimer": "Passive audit only — no exploitation."
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/concierge-agent-security-readiness-auditor-b80cfe0e/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from conc-exe.xyz](https://www.zero.xyz/host/conc-exe.xyz/llms.txt)