# Kit Rx Website Security, TLS & Markdown

> Website tools for AI agents: security headers grade, SSL/TLS certificate check, page and document to Markdown, site and agent-readiness checks, paid per call over x402.

HTTP security headers graded A+ to F with fixes, SSL/TLS certificate expiry and issuer from Certificate Transparency, clean Markdown from any web page or PDF/DOCX/XLSX document, and a website check covering redirects, metadata, AI-crawler rules, llms.txt and x402 presence. Each call is one x402 v2 payment in USDC on Base, Polygon, Arbitrum, Avalanche or Sei; no signup or API key. Requests that fail or match nothing are not charged.

## Payment

- Protocol: x402 v2, scheme exact, USDC on Base (eip155:8453); also accepted: eip155:137,eip155:42161,eip155:43114,eip155:1329 (Polygon, Arbitrum, Avalanche, Sei). payTo 0xAf8E0A8a8A0A8f65831b2dD0FFe0c1B804698D70
- An unpaid request returns HTTP 402 with the payment requirements in the PAYMENT-REQUIRED header.
- Only 2xx responses are settled. 400 (invalid input), 404 (no match) and 5xx (upstream down) are free.
- A request with no query parameters runs the documented example query and says so in notes (defaulted_to_example: true).
- Machine-readable: https://web.kit-rx.com/openapi.json, https://web.kit-rx.com/.well-known/x402, https://web.kit-rx.com/catalog.json
- MCP: remote Streamable HTTP server at https://web.kit-rx.com/mcp (MCP Registry name com.kit-rx.api/kitrx). Each route is a tool; paid tools use the x402 MCP transport (_meta["x402/payment"]); kitrx_catalog is free.
- Human docs: https://web.kit-rx.com/docs (one page per endpoint). Agent skill: https://web.kit-rx.com/.well-known/agent-skills/index.json

## Endpoints

- GET https://web.kit-rx.com/v1/web/check ($0.005) params: url. Facts about a URL from a live fetch, never its body: final URL, status and chain after up to 5 validated redirects, response time, content type, server, security headers present/missing (HSTS, CSP, nosniff, framing, Referrer-Policy, Permissions-Policy), title, description, canonical, lang, Open Graph, robots meta, robots.txt rules for GPTBot, ClaudeBot, Google-Extended, CCBot, PerplexityBot, *, llms.txt, agent card, OpenAPI, x402 discovery, 402 terms. DNS via Cloudflare DoH.
- GET https://web.kit-rx.com/v1/web/headers ($0.005) params: url. Grades a URL's HTTP security headers A+ to F (0-100) from one live fetch after up to 5 validated redirects. Per header: present, value, rating, points, issue, fix for HSTS, Content-Security-Policy (unsafe-inline, unsafe-eval, wildcards, frame-ancestors), X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP, COEP, CORP; Server/X-Powered-By version leaks; cookie Secure, HttpOnly, SameSite flags; missing list, summary. DNS via Cloudflare DoH.

## Data sources

US FDA (openFDA), NLM RxNav/RxNorm, CMS NADAC (data.medicaid.gov), Wikidata, GLEIF, SEC EDGAR, US Census Geocoder, USGS EPQS, NOAA NWS, RDAP registries, Cloudflare DNS-over-HTTPS, and the checked websites themselves. Reports are informational summaries; verify critical decisions against the primary source.