OrionCMD Checks

Free. Check that a domain or URL is well-formed and get the normalized hostname, before calling a paid check. Offline: no network request, no payment. Rejects IP addresses, single-label names and URLs with credentials.

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "maxLength": 300,
      "description": "Hostname or URL to normalize, e.g. example.com or https://www.example.com/path"
    }
  },
  "required": [
    "domain"
  ],
  "$schema": "https://json-schema.org/draft/2020-12/schema"
}

Free. Return the price of every paid tool, the payment network (Base) and the receiving address, so you can budget before calling. No input, no network request, no payment.

{
  "type": "object",
  "properties": {},
  "$schema": "https://json-schema.org/draft/2020-12/schema"
}

Check the TLS certificate of one hostname: issuer, validity dates, days left, % of lifetime used, renewal cadence and a renewal-stall flag, plus a live HTTPS pass/fail probe. Use it when you only need certificate health; use site_health for cert + DNS + expiry together, or domain_grade for a scored A-F result. Certificate details come from public Certificate Transparency logs (Cert Spotter, crt.sh fallback), not from the live connection, so a brand-new cert may not show yet. Read-only; makes one HTTPS request to the host and one CT-log query, usually 1-5 s. Costs $0.01 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 300,
      "description": "Hostname or URL, e.g. example.com or https://www.example.com/path"
    }
  },
  "required": [
    "domain"
  ],
  "$schema": "https://json-schema.org/draft/2020-12/schema"
}

Look up the live DNS of a domain: NS, A/AAAA/CNAME, MX, SPF, DMARC, CAA (climbing to the parent zone) and DNSSEC status, with plain-English findings. Use it for a DNS inventory or to debug resolution; use check_email_auth for a deeper SPF/DMARC/DKIM/MTA-STS review. Queries Cloudflare DNS-over-HTTPS (1.1.1.1) at call time; read-only, nothing is stored. Costs $0.01 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 300,
      "description": "Hostname or URL, e.g. example.com or https://www.example.com/path"
    }
  },
  "required": [
    "domain"
  ],
  "$schema": "https://json-schema.org/draft/2020-12/schema"
}

Check when a domain registration expires: registrar, registered and expiry dates, days left, EPP status codes and nameservers, from the registry's RDAP server. Use it for renewal risk on the registered domain (not the certificate; use check_cert for that). Some TLDs publish no RDAP service, in which case found=false explains why. Read-only. Costs $0.01 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 300,
      "description": "Hostname or URL, e.g. example.com or https://www.example.com/path"
    }
  },
  "required": [
    "domain"
  ],
  "$schema": "https://json-schema.org/draft/2020-12/schema"
}

Run check_cert, check_dns and check_domain_expiry together and return their raw results plus a short summary, the renewal-stall flag and the Let's Encrypt 64-day certificate note (from 2027-02-10). Use it for a full data dump in one call; use domain_grade if you want a single scored A-F answer that also covers email auth and HTTP headers. If one or two sources fail you get partial=true with the rest. Read-only. Costs $0.03 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 300,
      "description": "Hostname or URL, e.g. example.com or https://www.example.com/path"
    }
  },
  "required": [
    "domain"
  ],
  "$schema": "https://json-schema.org/draft/2020-12/schema"
}

Review the email authentication setup of a domain: SPF validity and DNS-lookup count (limit 10), DMARC policy, pct and reporting, DKIM on common selector names, MTA-STS mode, TLS-RPT and BIMI, with a rough 0-100 score and plain-English fixes. Use it before sending mail from a domain or when mail lands in spam. DKIM is only checked on common selectors, so "not found" is not proof DKIM is missing. Live DNS via Cloudflare DoH; read-only, no email is sent. Costs $0.01 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 300,
      "description": "Hostname or URL, e.g. example.com or https://www.example.com/path"
    }
  },
  "required": [
    "domain"
  ],
  "$schema": "https://json-schema.org/draft/2020-12/schema"
}

Check the HTTP security headers of a website with one live HTTPS GET: redirect chain (up to 5 hops), final status, HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and COOP, with a simple A-F header grade and findings. Use it for web-hardening checks; it is not a vulnerability scan. The page body is not read or stored. Costs $0.01 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 300,
      "description": "Hostname or URL, e.g. example.com or https://www.example.com/path"
    }
  },
  "required": [
    "domain"
  ],
  "$schema": "https://json-schema.org/draft/2020-12/schema"
}

Grade a domain's security posture A-F in one call, for vendor-risk or due-diligence checks. Runs the TLS, DNS (DNSSEC, CAA), registration-expiry, email-auth and HTTP-header checks and returns one letter, a 0-100 score, points per category (TLS 25, email 25, headers 20, DNS 15, registration 15) and the top fixes. Use it when you want a verdict; use site_health or the single checks when you need raw data. Unavailable categories are left out of the percentage (partial=true). Read-only; takes about 3-10 s. Costs $0.03 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 300,
      "description": "Hostname or URL, e.g. example.com or https://www.example.com/path"
    }
  },
  "required": [
    "domain"
  ],
  "$schema": "https://json-schema.org/draft/2020-12/schema"
}