9 check types
Each check scans one aspect of a public target. Monitors record changes and alert according to their settings.
DNS TLS PQC Security Headers security.txt MCP robots.txt Agent Card x402
Readings and assertions
Each monitor runs its check on your chosen schedule. It compares each scan with its own last accepted scan. The first scan alerts on failing selected assertions.
- Recorded readings Full readings are stored with normalised ordering and formatting. Text changes can still count. With “Alert on every change” off, changes that make no ticked assertion fail or recover are recorded without an alert. Turn it on to alert on those changes too.
- Standard assertions Tick assertions such as certificate trust or HSTS. Monitors alert when selected assertions fail or recover.
- Pinned assertions Save a value from a reading, such as contacts or DNS records. Depending on the assertion, later readings must match it, add nothing or remove nothing.
Some assertions apply only to certain targets.
DNS
LiveQueries one DNS record type at one name. Records changes to the answer set, excluding TTL countdowns.
Run a free check
No sign-up needed
On by default
Standard assertions
- Name exists
- DNS answer present
- No dangling alias
- SPF present
- No duplicate SPF record
- Within 10 DNS lookups
- At most 2 void lookups
- Includes resolve
- SPF record valid
- Not open to all senders
- DMARC present
- DMARC set to quarantine or reject
- CAA limits issuers
- No persistent authorization
- No wildcard authorization
- Not expired
- Expires in more than 30 days Expiry, pick one
Pinned assertions
- DNS answer unchanged
Off by default
Standard assertions
- Ends in fail or softfail
- No ptr mechanism
- DMARC reports requested
- DMARC not in testing mode
- DMARC subdomains as strict as the domain
- Only known DMARC tags
- Persistent authorization present
- Expires in more than 7 days Expiry, pick one
- Expires in more than 14 days Expiry, pick one
- Expires in more than 90 days Expiry, pick one
Recorded values
- Name missing
- false
- Name
- example.
com - Records
- 192.
0. 198.2. 34 51. 100. 35 - Record type
- A
Change types
alarm
- Name vanished
- CA grant added or restored
- Wildcard authorization added
- Authorization expired
- All records removed
- Open to all senders through an include
notice
- Name returned
- Alias stopped resolving
- Alias changed
- Records found
- Records changed
- Record removed
- Record added
- Broken includes changed
- Expiry approaching
- Lookup counts changed
TLS
LiveReads the certificate chain and tests supported TLS versions. Can alert on trust failures, expiry, issuer changes, lost name coverage or changes to TLS support.
Run a free check
No sign-up needed
On by default
Standard assertions
- Certificate trusted
- Not expired
- Expires in more than 14 days Expiry, pick one
- No TLS below 1.2
- Supports TLS 1.3
Pinned assertions
- Issuing CA unchanged
- No pinned names removed
Off by default
Standard assertions
- Expires in more than 7 days Expiry, pick one
- Expires in more than 30 days Expiry, pick one
Recorded values
- ALPN
- h2
- Cipher
- TLS_
AES_ 128_ GCM_ SHA256 - Endpoint
- api.
example. com: 443 - Expires in
- 14 days or less
- Key exchange group
- X25519
- Trusted
- true
- TLS versions
- 1.
2 1.3
Certificate chain
1 itemLeaf certificate
- Fingerprint
- 9e4c2a0f8d6b4e2c0a8f6d4b2e0c8a6f4d2b0e8c6a4f2d0b8e6c4a2f0d8b6e4c
- Issuing CA
- Let's Encrypt
- Valid until
- 2026-11-08 00:
00 UTC - Valid from
- 2026-08-10 00:
00 UTC - Names
- api.
example. com - Public key hash
- 3f1a9c0e7b2d4f6a8c1e3b5d7f9a0c2e4b6d8f1a3c5e7b9d0f2a4c6e8b1d3f5a
- Subject
- api.
example. com
Change types
alarm
- TLS verification failed
- Certificate expired
- TLS 1.0 support added
- TLS 1.1 support added
notice
- Issuing CA changed
- TLS versions changed
- Certificate public key changed
- Certificate names changed
- Certificate fingerprint changed
- Chain changed
- ALPN changed
- Key exchange group changed
- Cipher changed
- Expiry approaching
info
- Expiry updated
- TLS verification restored
PQC
LiveUses three TLS handshakes to test TLS 1.3 and key exchange support. Can alert when TLS 1.3, hybrid post-quantum support or hybrid preference is lost.
Run a free check
No sign-up needed
On by default
Standard assertions
- Supports TLS 1.3
- Supports post-quantum key exchange
- Prefers post-quantum key exchange
Recorded values
- Classical key exchange
- true
- Endpoint
- example.
com: 443 - Hybrid group
- X25519MLKEM768
- Post-quantum key exchange
- true
- Signature algorithm
- ECDSA-SHA256
- Post-quantum certificate
- false
- Preferred group
- X25519MLKEM768
- TLS 1.3
- true
Change types
alarm
- Post-quantum key exchange support removed
- TLS 1.3 support removed
notice
- Hybrid group changed
- Preferred group changed
- Signature algorithm changed
- Classical key exchange support changed
info
- Post-quantum certificate detected
- Post-quantum key exchange support added
- TLS 1.3 support added
Security Headers
LiveReads the page's HTTP security headers in one request. Can alert on removed headers, disabled HSTS, new script sources or changes to framing restrictions.
Run a free check
No sign-up needed
On by default
Standard assertions
- HTTP 200 from target site
- HSTS enabled
- CSP present
- Framing restricted
- Nosniff enabled
Pinned assertions
- No new script sources
Recorded values
Security headers
11 fields- Content-Security-Policy default-src
- 'self'
- Content-Security-Policy script-src
- 'self'cdn.
shop. example. com - Cross-Origin-Embedder-Policy
- absent
- Cross-Origin-Opener-Policy
- absent
- Cross-Origin-Resource-Policy
- absent
- Permissions-Policy
- absent
- Referrer-Policy
- strict-origin-when-cross-origin
- Strict-Transport-Security includeSubDomains
- true
- Strict-Transport-Security max-age
- 0 seconds
- X-Content-Type-Options
- nosniff
- X-Frame-Options
- deny
Change types
alarm
- Strict-Transport-Security removed
- Content-Security-Policy removed
- X-Content-Type-Options removed
- HSTS disabled
notice
- Unexpected HTTP status or site
- Response or scanner access changed
- Strict-Transport-Security changed
- Content-Security-Policy changed
- X-Content-Type-Options changed
- X-Frame-Options changed
- Referrer-Policy changed
- Permissions-Policy changed
- Cross-Origin-Opener-Policy changed
- Cross-Origin-Embedder-Policy changed
- Cross-Origin-Resource-Policy changed
info
- HTTP 200 restored on target site
- Strict-Transport-Security added
- Content-Security-Policy added
- X-Content-Type-Options added
- X-Frame-Options added
- Referrer-Policy added
- Permissions-Policy added
- Cross-Origin-Opener-Policy added
- Cross-Origin-Embedder-Policy added
- Cross-Origin-Resource-Policy added
security.txt
LiveReads security.txt contacts, expiry and PGP signature presence. Can alert on a missing or expired file, added contacts, format problems or a missing signature.
Run a free check
No sign-up needed
On by default
Standard assertions
- File present
- Not expired
- Expires in more than 30 days Expiry, pick one
- Well-formed
Pinned assertions
- No new contacts
Off by default
Standard assertions
- Expires in more than 7 days Expiry, pick one
- Expires in more than 14 days Expiry, pick one
- Expires in more than 90 days Expiry, pick one
- Canonical matches URL when present
- PGP signature present
- Served by this site
Recorded values
- Expires field count
- 1
- Expires in
- 90 days or less
- Content type
- text/
plain - Served over
- https
- PGP signed
- true
- File URL
- https:
/ / example. com/ . well-known/ security. txt
Contacts
2 itemsmailto:security@example.com
- Order
- 1
mailto:security@example.net
- Order
- 2
Other fields
3 fields- canonical
- https:
/ / example. com/ . well-known/ security. txt - policy
- https:
/ / example. com/ disclosure - preferred_languages
- en
Change types
alarm
- File no longer found
- Contact added
- Served from another site
- PGP signature removed
- Expired
- Expiry unreadable
notice
- Unexpected HTTP status
- Response or scanner access changed
- Contact removed
- Contact reordered
- Delivery changed
- Field changed
- Expiry approaching
info
- File status readable again
- File found
- Served by this site again
- Expiry updated
- PGP signature added
MCP
LiveReads advertised MCP tools, resources and prompts, plus OAuth metadata when authentication is required. Can alert on new tools or changes to tool wording, authentication requirements and OAuth metadata.
Run a free check
No sign-up needed
On by default
Standard assertions
- Authentication required
Pinned assertions
- Authorization servers unchanged
- Tool wording unchanged
- No new tools
Off by default
Standard assertions
- Connector ready
- Client registration not deprecated
- Issuer identification advertised
Recorded values
- Capabilities
- tools
- Endpoint
- https:
/ / mcp. example. com/ mcp - Protocol version
- 2025-06-18
- Transport
- streamable-http
Authentication
1 field- Required
- false
Server
2 fields- Name
- example-docs
- Version
- 1.
4. 0
Tools
3 itemsfetch_site_map
- Description
- Fetch the site map as a list of page URLs.
list_resources
- Description
- List the documents this server can read.
search_docs
- Description
- Search the documentation by keyword.
Change types
alarm
- Authentication no longer required
- Tool wording changed
- PKCE support removed
notice
- MCP greeting refused
- MCP greeting refusal changed
- Sign-in metadata lost
- Tool schema or annotations changed
- Tool removed
- Tool added
- Tool changed
- Authentication changed
- Resources changed
- Prompts changed
- Capabilities changed
- Protocol version changed
info
- MCP greeting answered again
- Authentication now required
- Server details changed
robots.txt
In developmentThe planned check covers robots.txt availability and directives by user agent. Planned change types include parsing failures, removed disallow directives, AI crawler access and sitemap changes.
Recorded values
- File availability and HTTP status
- Allow and disallow directives by user agent
- Directives for AI crawlers
- Sitemap and crawl-delay directives
- Unrecognised directives
Change types
- File missing or invalid
- Disallow directive removed
- AI crawler access changed
- Sitemap URL changed
Agent Card
LiveReads an A2A agent card without calling the agent. Can alert on changed endpoints, authentication requirements, capabilities or skill wording.
Run a free check
No sign-up needed
On by default
Standard assertions
- Card present
- Required card fields present
- Endpoints use HTTPS
- Card found via /.well-known/agent-card.json
Pinned assertions
- Endpoint URLs and bindings unchanged
- Authentication schemes unchanged
- Skill wording unchanged
- No new skills
Off by default
Standard assertions
- Endpoints on target domain
- Authentication requirements present
- Card signature present
- Protocol at least 0.3 Protocol, pick one
- Protocol at least 1.0 Protocol, pick one
Pinned assertions
- No skills removed
- Provider unchanged
Recorded values
Agent Card
21 fields- Capabilities Push notifications
- false
- Capabilities Streaming
- true
- Description
- Reads and summarises web pages.
- Endpoints JSONRPC https://api.example.com/a2a Binding
- JSONRPC
- Endpoints JSONRPC https://api.example.com/a2a URL
- https:
/ / api. example. com/ a2a - Endpoints JSONRPC https://api.example.com/a2a Protocol versions
- 1.
0 - Extended card
- false
- Name
- Example Agent
- Lookup path
- current
- Provider Organization
- Example
- Provider URL
- https:
/ / example. com - Authentication requirements ["bearer"]
- bearer
- Authentication schemes bearer Type
- http
- Serving domain
- example.
com - Signed
- false
- Target domain
- example.
com - Skills summarise Description
- Summarises any page, including ones behind a login.
- Skills summarise ID
- summarise
- Skills summarise Tags
- summary
- Skills summarise Title
- Summarise
- Version
- 1.
2. 0
Change types
alarm
- Card no longer found
- Endpoints changed
- Endpoint removed
- Authentication requirement removed
- Authentication scheme removed
- Authentication scheme changed
- Skill removed
notice
- Card found
- Endpoint added
- Skill wording changed
- Skill added
- Authentication scheme added
- Protocol version changed
- Capabilities changed
- Missing required fields changed
- Card lookup path changed
- Serving domain changed
info
- Card version changed
- Provider changed
- Card description changed
- Skill tags changed
- Card signature presence changed
- Extended card changed
- Card changed
x402
LiveReads the payment quote from one GET request without paying. Can alert on changes to prices, payment details and cache protection headers.
Run a free check
No sign-up needed
On by default
Standard assertions
- Payment required
- Payment quote present
- Cache protection headers present
Pinned assertions
- Payment address unchanged
- Payment token unchanged
- Additional payment details unchanged
Recorded values
- HTTP status
- 402
- Request method
- GET
- Quote transport
- body
- Resource URL
- https:
/ / api. example. com/ api/ data - Protocol version
- 2
Payment options
1 itemeip155:8453|0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913
- Price in atomic units
- 100000
- Token
- 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913
- Additional payment details
{ "name": "USD Coin", "version": "2" }- Network
- eip155:
8453 - Payment address
- 0x4b7a2e9c1d3f5a6b8c0d2e4f6a8b0c2d4e6f8a0b
- Scheme
- exact
- Timeout in seconds
- 300
Cache headers
6 fields- CDN
- Empty
- Cache-Control
- no-store
- Protected
- true
- Hit reported
- false
- Validator
- false
- Varies on payment
- false
Change types
alarm
- Serving without payment
- Payment address changed
- Payment token changed
- Additional payment details changed
- Unexpected HTTP status
- Cache hit reported
- Cache protection headers removed
- Payment quote no longer found
notice
- Price changed
- Payment network changed
- Payment scheme changed
- Payment option removed
- Payment option added
- Payment option changed
- Payment now required
- Reported CDN changed
- Quote transport changed
- Protocol version changed
info
- Cache protection headers added
- Cache headers changed
Check your site or API
See which assertions your site or API passes today.
Run a free check
Start free trialNo sign-up needed