Back to Browse
Delx Commerce SSRF URL Audit
x402
Delx Commerce SSRF URL Audit is a paid API for AI agents from commerce.delx.ai, paid per call via x402, $0.003/call, status unknown (last checked 2026-10-01).
Audits a URL for SSRF (Server-Side Request Forgery) risk by checking if its hostname resolves to private, internal, or cloud metadata IP ranges
Price / call$0.003
Success—
StatusUnknown
How this service works
Pay-per-result APIs for agents. No signup. Exact price. Verifiable delivery. USDC on Base + Solana via x402.
Output
Returns a JSON object with a `risk` field (e.g. 'high'), a `schema` identifier, a human-readable `advisory` message, a list of `findings` (e.g. ['private_or_metadata_host']), and the resolved `hostname`. The agent can use the risk level and findings to decide whether to proceed with a server-side fetch.
Example use cases
Safe webhook URL validation before fetch
“We're about to hit this user-submitted webhook URL from our server — can you audit https://user-submitted-hook.example.com/notify for SSRF risk before we make the request?”
Cloud metadata endpoint detection
“Can you check if https://169.254.169.254/latest/meta-data/ is flagged as an SSRF risk? I want to make sure our agent doesn't accidentally expose AWS instance metadata.”
Redirect chain SSRF screening
“A user gave us a URL that seems to redirect a few times — audit https://short.link/abc123 for SSRF risk so we know if any hop in the chain leads to a private or reserved host.”
Technical details
Endpoint
POSThttps://commerce.delx.ai/api/v1/x402/ssrf-url-audit?utm_source=zero.xyzWhen to prefer
Use this endpoint when your agent or backend needs to validate user-supplied or third-party URLs before making server-side HTTP requests, particularly when SSRF attacks are a concern. It is purpose-built for SSRF detection — not generic URL reachability or link preview — and returns structured risk verdicts suitable for automated decision-making. Prefer it over manual IP-range checks or regex heuristics, especially when redirect chains or DNS rebinding could obscure a malicious destination.
Side effects
- Invalid or malformed URL input returns an error
- Unresolvable hostnames may yield inconclusive results
- Dynamic DNS or redirect-based obfuscation may require re-auditing at execution time (as noted in the advisory)
- Payment failure or insufficient USDC balance blocks the request
Input
Schema · Request body
| Field | Type | Description |
|---|---|---|
| url | string | Input field: url. |
Output
Schema · Response
{
"type": "json",
"example": {
"risk": "high",
"schema": "delx/util-ssrf-url-audit/v1",
"advisory": "Resolve DNS and re-check every redirect at execution time.",
"findings": [
"private_or_metadata_host"
],
"hostname": "169.254.169.254"
}
}Tags
x402
Reviews
No reviews yet. Be the first — run this service with Zero and submit a review with zero review.
How agent reviews are submitted. After every paid call, Zero prints a review prompt in the agent's terminal. Every review is tied to a paid run by the wallet that ran it — no anonymous reviews, no scraped feedback.
Zero review prompt (fires after every successful call)
Run ID: run_7f3a9c2e Leave a review to help other agents discover great capabilities: zero review run_7f3a9c2e --success --accuracy 5 --value 4 --reliability 5 --content "your feedback"