- Recipient
- not observed
- Chain
- not observed
- Unit type
- not observed
- Session · authMode
- open
Search engine for agents. 100K+ x402, MCP, and MPP services indexed with real on-chain revenue data. Free discovery layer for the agentic web. Search, discover, and interact with any service — pay via x402 or MPP/Tempo. Powered by Valoria.
- Implementation fingerprint
- unknown no confident attribution
- Fingerprint evidence
- No implementation-specific public signal observed.
- First seen
- Aug 25, 2026, 6:43 PM UTC
- Last seen
- Oct 9, 2026, 12:53 PM UTC
- Origin
- https://valoria.net
- Tags
- None advertised
Payment surface
12 MPP endpoints
This count includes endpoints established by catalog, OpenAPI, or valid runtime 402 evidence. It does not count every URL the harmless scanner attempted.
- Recipient
- not observed
- Chain
- not observed
- Unit type
- not observed
- Session · authMode
- open
- Recipient
- not observed
- Chain
- not observed
- Unit type
- not observed
- Session · authMode
- open
- Recipient
- not observed
- Chain
- not observed
- Unit type
- not observed
- Session · authMode
- open
- Recipient
- not observed
- Chain
- not observed
- Unit type
- not observed
- Session · authMode
- open
- Recipient
- not observed
- Chain
- not observed
- Unit type
- not observed
- Session · authMode
- open
- Recipient
- not observed
- Chain
- not observed
- Unit type
- not observed
- Recipient
- not observed
- Chain
- not observed
- Unit type
- not observed
- Recipient
- not observed
- Chain
- not observed
- Unit type
- not observed
- Recipient
- not observed
- Chain
- not observed
- Unit type
- not observed
- Recipient
- not observed
- Chain
- not observed
- Unit type
- not observed
- Recipient
- not observed
- Chain
- not observed
- Unit type
- not observed
- Session · authMode
- open
Probe coverage
301 harmless observations
These are bounded unauthenticated requests and scanner-policy stops. A response without MPP evidence remains a discovery result, not a security failure.
GET https://valoria.net/.well-known/api-catalog
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/.well-known/api-catalog was recorded but not followed
Oct 9, 2026, 12:53 PM UTCGET https://valoria.net/openapi.json
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/openapi.json was recorded but not followed
Oct 9, 2026, 12:33 PM UTCGET https://valoria.net/.well-known/api-catalog
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/.well-known/api-catalog was recorded but not followed
Oct 9, 2026, 6:48 AM UTCGET https://valoria.net/openapi.json
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/openapi.json was recorded but not followed
Oct 9, 2026, 6:27 AM UTCGET https://valoria.net/.well-known/api-catalog
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/.well-known/api-catalog was recorded but not followed
Oct 9, 2026, 12:57 AM UTCGET https://valoria.net/openapi.json
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/openapi.json was recorded but not followed
Oct 9, 2026, 12:37 AM UTCGET https://valoria.net/.well-known/api-catalog
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/.well-known/api-catalog was recorded but not followed
Oct 8, 2026, 6:56 PM UTCGET https://valoria.net/openapi.json
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/openapi.json was recorded but not followed
Oct 8, 2026, 6:36 PM UTCGET https://valoria.net/.well-known/api-catalog
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/.well-known/api-catalog was recorded but not followed
Oct 8, 2026, 12:53 PM UTCGET https://valoria.net/openapi.json
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/openapi.json was recorded but not followed
Oct 8, 2026, 12:33 PM UTCGET https://valoria.net/.well-known/api-catalog
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/.well-known/api-catalog was recorded but not followed
Oct 8, 2026, 6:52 AM UTCGET https://valoria.net/openapi.json
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/openapi.json was recorded but not followed
Oct 8, 2026, 6:31 AM UTCGET https://valoria.net/.well-known/api-catalog
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/.well-known/api-catalog was recorded but not followed
Oct 8, 2026, 12:53 AM UTCGET https://valoria.net/openapi.json
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/openapi.json was recorded but not followed
Oct 8, 2026, 12:32 AM UTCGET https://valoria.net/.well-known/api-catalog
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/.well-known/api-catalog was recorded but not followed
Oct 7, 2026, 6:52 PM UTCGET https://valoria.net/openapi.json
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/openapi.json was recorded but not followed
Oct 7, 2026, 6:32 PM UTCGET https://valoria.net/.well-known/api-catalog
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/.well-known/api-catalog was recorded but not followed
Oct 7, 2026, 12:52 PM UTCGET https://valoria.net/openapi.json
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/openapi.json was recorded but not followed
Oct 7, 2026, 12:31 PM UTCGET https://valoria.net/.well-known/api-catalog
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/.well-known/api-catalog was recorded but not followed
Oct 7, 2026, 6:57 AM UTCGET https://valoria.net/openapi.json
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/openapi.json was recorded but not followed
Oct 7, 2026, 6:36 AM UTCGET https://valoria.net/.well-known/api-catalog
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/.well-known/api-catalog was recorded but not followed
Oct 7, 2026, 1:01 AM UTCGET https://valoria.net/openapi.json
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/openapi.json was recorded but not followed
Oct 7, 2026, 12:40 AM UTCGET https://valoria.net/.well-known/api-catalog
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/.well-known/api-catalog was recorded but not followed
Oct 6, 2026, 6:57 PM UTCGET https://valoria.net/openapi.json
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/openapi.json was recorded but not followed
Oct 6, 2026, 6:36 PM UTCGET https://valoria.net/.well-known/api-catalog
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/.well-known/api-catalog was recorded but not followed
Oct 6, 2026, 12:57 PM UTCGET https://valoria.net/openapi.json
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/openapi.json was recorded but not followed
Oct 6, 2026, 12:37 PM UTCGET https://valoria.net/.well-known/api-catalog
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/.well-known/api-catalog was recorded but not followed
Oct 6, 2026, 6:46 AM UTCGET https://valoria.net/openapi.json
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/openapi.json was recorded but not followed
Oct 6, 2026, 6:26 AM UTCGET https://valoria.net/.well-known/api-catalog
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/.well-known/api-catalog was recorded but not followed
Oct 6, 2026, 12:52 AM UTCGET https://valoria.net/
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/ was recorded but not followed
Oct 6, 2026, 12:40 AM UTCGET https://valoria.net/openapi.json
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/openapi.json was recorded but not followed
Oct 6, 2026, 12:32 AM UTCGET https://valoria.net/.well-known/api-catalog
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/.well-known/api-catalog was recorded but not followed
Oct 5, 2026, 6:52 PM UTCGET https://valoria.net/
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/ was recorded but not followed
Oct 5, 2026, 6:39 PM UTCGET https://valoria.net/openapi.json
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/openapi.json was recorded but not followed
Oct 5, 2026, 6:32 PM UTCGET https://valoria.net/.well-known/api-catalog
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/.well-known/api-catalog was recorded but not followed
Oct 5, 2026, 12:50 PM UTCGET https://valoria.net/
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/ was recorded but not followed
Oct 5, 2026, 12:38 PM UTCGET https://valoria.net/openapi.json
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/openapi.json was recorded but not followed
Oct 5, 2026, 12:31 PM UTCGET https://valoria.net/.well-known/api-catalog
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/.well-known/api-catalog was recorded but not followed
Oct 5, 2026, 6:50 AM UTCGET https://valoria.net/
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/ was recorded but not followed
Oct 5, 2026, 6:37 AM UTCGET https://valoria.net/openapi.json
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/openapi.json was recorded but not followed
Oct 5, 2026, 6:30 AM UTCGET https://valoria.net/.well-known/api-catalog
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/.well-known/api-catalog was recorded but not followed
Oct 5, 2026, 12:51 AM UTCGET https://valoria.net/
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/ was recorded but not followed
Oct 5, 2026, 12:39 AM UTCGET https://valoria.net/openapi.json
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/openapi.json was recorded but not followed
Oct 5, 2026, 12:31 AM UTCGET https://valoria.net/.well-known/api-catalog
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/.well-known/api-catalog was recorded but not followed
Oct 4, 2026, 6:48 PM UTCGET https://valoria.net/
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/ was recorded but not followed
Oct 4, 2026, 6:35 PM UTCGET https://valoria.net/openapi.json
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/openapi.json was recorded but not followed
Oct 4, 2026, 6:28 PM UTCGET https://valoria.net/.well-known/api-catalog
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/.well-known/api-catalog was recorded but not followed
Oct 4, 2026, 12:53 PM UTCGET https://valoria.net/
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/ was recorded but not followed
Oct 4, 2026, 12:40 PM UTCGET https://valoria.net/openapi.json
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/openapi.json was recorded but not followed
Oct 4, 2026, 12:33 PM UTCGET https://valoria.net/.well-known/api-catalog
scanner stopped: cross-host-redirectCross-host redirect to https://www.valoria.net/.well-known/api-catalog was recorded but not followed
Oct 4, 2026, 6:51 AM UTCEvidence model
Security properties
Every result names its evidence state. Unknown and not tested never mean secure.
probe_safety
Observedcross-host-redirect: Cross-host redirect to https://www.valoria.net/.well-known/api-catalog was recorded but not followed
Basis: scanner policy decision · Oct 9, 2026, 12:53 PM UTCprobe_safety
Observedcross-host-redirect: Cross-host redirect to https://www.valoria.net/api/protocols was recorded but not followed
Basis: scanner policy decision · Sep 16, 2026, 12:24 PM UTCprobe_safety
Observedcross-host-redirect: Cross-host redirect to https://www.valoria.net/search was recorded but not followed
Basis: scanner policy decision · Sep 16, 2026, 6:24 AM UTCprobe_safety
Observedcross-host-redirect: Cross-host redirect to https://www.valoria.net/api/stats was recorded but not followed
Basis: scanner policy decision · Sep 15, 2026, 12:24 PM UTCprobe_safety
Observedcross-host-redirect: Cross-host redirect to https://www.valoria.net/api/leaderboard was recorded but not followed
Basis: scanner policy decision · Sep 15, 2026, 12:21 PM UTCprobe_safety
Observedcross-host-redirect: Cross-host redirect to https://www.valoria.net/api/categories was recorded but not followed
Basis: scanner policy decision · Sep 15, 2026, 12:28 AM UTCprobe_safety
Observedcross-host-redirect: Cross-host redirect to https://www.valoria.net/api/feeds was recorded but not followed
Basis: scanner policy decision · Sep 15, 2026, 12:26 AM UTCauthorization_delivery_settlement
Not testedRequires paid or state-changing behavior outside scanner scope
Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Sep 7, 2026, 12:21 PM UTCbounded_response
Tested — pass1293 bytes within scanner limit
Basis: harmless scanner · Sep 7, 2026, 12:21 PM UTCchallenge_parse
UnknownNo MPP Payment challenge observed
Basis: unauthenticated HTTP response · Sep 7, 2026, 12:21 PM UTCchannel_lifecycle_binding
Not testedChannel and settlement lifecycle require credentials or payments
Basis: public economic-security prior art · Sep 7, 2026, 12:21 PM UTCconcurrency_single_winner
Not testedConcurrency and paid state changes are prohibited
Basis: public economic-security prior art · Sep 7, 2026, 12:21 PM UTCcredential_replay
Not testedScanner never sends credentials or payments
Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Sep 7, 2026, 12:21 PM UTCeconomic_exposure_metadata
UnknownNo current Payment challenge exposes session or authorization inputs
Basis: observable challenge values only · Sep 7, 2026, 12:21 PM UTCfee_payer_cosigner_binding
Not testedSignature and fee-payer relationships are not observable unauthenticated
Basis: public economic-security prior art · Sep 7, 2026, 12:21 PM UTChttps_transport
Tested — passHTTPS fetch completed with platform certificate validation
Basis: platform TLS validation · Sep 7, 2026, 12:21 PM UTCmethod_fallback_policy
Not testedScanner does not select, downgrade, or execute payment methods
Basis: public economic-security prior art · Sep 7, 2026, 12:21 PM UTCprice_debit_consistency
Not testedRequires a completed paid interaction outside scanner scope
Basis: public economic-security prior art · Sep 7, 2026, 12:21 PM UTCredirect_policy
Tested — pass0 redirects; every hop passed URL and DNS validation
Basis: harmless scanner · Sep 7, 2026, 12:21 PM UTCreplay_idempotency_scope
Not testedScanner never replays signed credentials
Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Sep 7, 2026, 12:21 PM UTCssrf_target_validation
Tested — pass1 hop(s) resolved twice to stable public addresses
Basis: scanner URL, DNS and redirect policy · Sep 7, 2026, 12:21 PM UTCauthorization_delivery_settlement
Not testedRequires paid or state-changing behavior outside scanner scope
Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Sep 7, 2026, 6:23 AM UTCbounded_response
Tested — pass6509 bytes within scanner limit
Basis: harmless scanner · Sep 7, 2026, 6:23 AM UTCchallenge_parse
UnknownNo MPP Payment challenge observed
Basis: unauthenticated HTTP response · Sep 7, 2026, 6:23 AM UTCchannel_lifecycle_binding
Not testedChannel and settlement lifecycle require credentials or payments
Basis: public economic-security prior art · Sep 7, 2026, 6:23 AM UTCconcurrency_single_winner
Not testedConcurrency and paid state changes are prohibited
Basis: public economic-security prior art · Sep 7, 2026, 6:23 AM UTCcredential_replay
Not testedScanner never sends credentials or payments
Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Sep 7, 2026, 6:23 AM UTCeconomic_exposure_metadata
UnknownNo current Payment challenge exposes session or authorization inputs
Basis: observable challenge values only · Sep 7, 2026, 6:23 AM UTCfee_payer_cosigner_binding
Not testedSignature and fee-payer relationships are not observable unauthenticated
Basis: public economic-security prior art · Sep 7, 2026, 6:23 AM UTChttps_transport
Tested — passHTTPS fetch completed with platform certificate validation
Basis: platform TLS validation · Sep 7, 2026, 6:23 AM UTCmethod_fallback_policy
Not testedScanner does not select, downgrade, or execute payment methods
Basis: public economic-security prior art · Sep 7, 2026, 6:23 AM UTCprice_debit_consistency
Not testedRequires a completed paid interaction outside scanner scope
Basis: public economic-security prior art · Sep 7, 2026, 6:23 AM UTCredirect_policy
Tested — pass0 redirects; every hop passed URL and DNS validation
Basis: harmless scanner · Sep 7, 2026, 6:23 AM UTCreplay_idempotency_scope
Not testedScanner never replays signed credentials
Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Sep 7, 2026, 6:23 AM UTCssrf_target_validation
Tested — pass1 hop(s) resolved twice to stable public addresses
Basis: scanner URL, DNS and redirect policy · Sep 7, 2026, 6:23 AM UTCauthorization_delivery_settlement
Not testedRequires paid or state-changing behavior outside scanner scope
Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Sep 6, 2026, 12:22 PM UTCbounded_response
Tested — pass138 bytes within scanner limit
Basis: harmless scanner · Sep 6, 2026, 12:22 PM UTCchallenge_parse
UnknownNo MPP Payment challenge observed
Basis: unauthenticated HTTP response · Sep 6, 2026, 12:22 PM UTCchannel_lifecycle_binding
Not testedChannel and settlement lifecycle require credentials or payments
Basis: public economic-security prior art · Sep 6, 2026, 12:22 PM UTCconcurrency_single_winner
Not testedConcurrency and paid state changes are prohibited
Basis: public economic-security prior art · Sep 6, 2026, 12:22 PM UTCcredential_replay
Not testedScanner never sends credentials or payments
Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Sep 6, 2026, 12:22 PM UTCeconomic_exposure_metadata
UnknownNo current Payment challenge exposes session or authorization inputs
Basis: observable challenge values only · Sep 6, 2026, 12:22 PM UTCfee_payer_cosigner_binding
Not testedSignature and fee-payer relationships are not observable unauthenticated
Basis: public economic-security prior art · Sep 6, 2026, 12:22 PM UTChttps_transport
Tested — passHTTPS fetch completed with platform certificate validation
Basis: platform TLS validation · Sep 6, 2026, 12:22 PM UTCmethod_fallback_policy
Not testedScanner does not select, downgrade, or execute payment methods
Basis: public economic-security prior art · Sep 6, 2026, 12:22 PM UTCprice_debit_consistency
Not testedRequires a completed paid interaction outside scanner scope
Basis: public economic-security prior art · Sep 6, 2026, 12:22 PM UTCredirect_policy
Tested — pass0 redirects; every hop passed URL and DNS validation
Basis: harmless scanner · Sep 6, 2026, 12:22 PM UTCreplay_idempotency_scope
Not testedScanner never replays signed credentials
Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Sep 6, 2026, 12:22 PM UTCssrf_target_validation
Tested — pass1 hop(s) resolved twice to stable public addresses
Basis: scanner URL, DNS and redirect policy · Sep 6, 2026, 12:22 PM UTCauthorization_delivery_settlement
Not testedRequires paid or state-changing behavior outside scanner scope
Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Sep 6, 2026, 12:20 PM UTCbounded_response
Tested — pass5612 bytes within scanner limit
Basis: harmless scanner · Sep 6, 2026, 12:20 PM UTCchallenge_parse
UnknownNo MPP Payment challenge observed
Basis: unauthenticated HTTP response · Sep 6, 2026, 12:20 PM UTCchannel_lifecycle_binding
Not testedChannel and settlement lifecycle require credentials or payments
Basis: public economic-security prior art · Sep 6, 2026, 12:20 PM UTCconcurrency_single_winner
Not testedConcurrency and paid state changes are prohibited
Basis: public economic-security prior art · Sep 6, 2026, 12:20 PM UTCcredential_replay
Not testedScanner never sends credentials or payments
Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Sep 6, 2026, 12:20 PM UTCeconomic_exposure_metadata
UnknownNo current Payment challenge exposes session or authorization inputs
Basis: observable challenge values only · Sep 6, 2026, 12:20 PM UTCfee_payer_cosigner_binding
Not testedSignature and fee-payer relationships are not observable unauthenticated
Basis: public economic-security prior art · Sep 6, 2026, 12:20 PM UTChttps_transport
Tested — passHTTPS fetch completed with platform certificate validation
Basis: platform TLS validation · Sep 6, 2026, 12:20 PM UTCmethod_fallback_policy
Not testedScanner does not select, downgrade, or execute payment methods
Basis: public economic-security prior art · Sep 6, 2026, 12:20 PM UTCprice_debit_consistency
Not testedRequires a completed paid interaction outside scanner scope
Basis: public economic-security prior art · Sep 6, 2026, 12:20 PM UTCredirect_policy
Tested — pass0 redirects; every hop passed URL and DNS validation
Basis: harmless scanner · Sep 6, 2026, 12:20 PM UTCreplay_idempotency_scope
Not testedScanner never replays signed credentials
Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Sep 6, 2026, 12:20 PM UTCssrf_target_validation
Tested — pass1 hop(s) resolved twice to stable public addresses
Basis: scanner URL, DNS and redirect policy · Sep 6, 2026, 12:20 PM UTCapi_catalog_parse
ObservedNo RFC 9727 API catalog was available at this URL (HTTP 404); prior advertised links were withdrawn
Basis: RFC 9727 discovery response · Sep 6, 2026, 6:18 AM UTCauthorization_delivery_settlement
Not testedRequires paid or state-changing behavior outside scanner scope
Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Sep 6, 2026, 6:18 AM UTCbounded_response
Tested — pass162 bytes within scanner limit
Basis: harmless scanner · Sep 6, 2026, 6:18 AM UTCchallenge_parse
UnknownNo MPP Payment challenge observed
Basis: unauthenticated HTTP response · Sep 6, 2026, 6:18 AM UTCchannel_lifecycle_binding
Not testedChannel and settlement lifecycle require credentials or payments
Basis: public economic-security prior art · Sep 6, 2026, 6:18 AM UTCconcurrency_single_winner
Not testedConcurrency and paid state changes are prohibited
Basis: public economic-security prior art · Sep 6, 2026, 6:18 AM UTCcredential_replay
Not testedScanner never sends credentials or payments
Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Sep 6, 2026, 6:18 AM UTCeconomic_exposure_metadata
UnknownNo current Payment challenge exposes session or authorization inputs
Basis: observable challenge values only · Sep 6, 2026, 6:18 AM UTCfee_payer_cosigner_binding
Not testedSignature and fee-payer relationships are not observable unauthenticated
Basis: public economic-security prior art · Sep 6, 2026, 6:18 AM UTChttps_transport
Tested — passHTTPS fetch completed with platform certificate validation
Basis: platform TLS validation · Sep 6, 2026, 6:18 AM UTCmethod_fallback_policy
Not testedScanner does not select, downgrade, or execute payment methods
Basis: public economic-security prior art · Sep 6, 2026, 6:18 AM UTCprice_debit_consistency
Not testedRequires a completed paid interaction outside scanner scope
Basis: public economic-security prior art · Sep 6, 2026, 6:18 AM UTCredirect_policy
Tested — pass0 redirects; every hop passed URL and DNS validation
Basis: harmless scanner · Sep 6, 2026, 6:18 AM UTCreplay_idempotency_scope
Not testedScanner never replays signed credentials
Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Sep 6, 2026, 6:18 AM UTCssrf_target_validation
Tested — pass1 hop(s) resolved twice to stable public addresses
Basis: scanner URL, DNS and redirect policy · Sep 6, 2026, 6:18 AM UTCauthorization_delivery_settlement
Not testedRequires paid or state-changing behavior outside scanner scope
Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Sep 6, 2026, 12:25 AM UTCbounded_response
Tested — pass438 bytes within scanner limit
Basis: harmless scanner · Sep 6, 2026, 12:25 AM UTCchallenge_parse
UnknownNo MPP Payment challenge observed
Basis: unauthenticated HTTP response · Sep 6, 2026, 12:25 AM UTCchannel_lifecycle_binding
Not testedChannel and settlement lifecycle require credentials or payments
Basis: public economic-security prior art · Sep 6, 2026, 12:25 AM UTCconcurrency_single_winner
Not testedConcurrency and paid state changes are prohibited
Basis: public economic-security prior art · Sep 6, 2026, 12:25 AM UTCcredential_replay
Not testedScanner never sends credentials or payments
Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Sep 6, 2026, 12:25 AM UTCeconomic_exposure_metadata
UnknownNo current Payment challenge exposes session or authorization inputs
Basis: observable challenge values only · Sep 6, 2026, 12:25 AM UTCfee_payer_cosigner_binding
Not testedSignature and fee-payer relationships are not observable unauthenticated
Basis: public economic-security prior art · Sep 6, 2026, 12:25 AM UTChttps_transport
Tested — passHTTPS fetch completed with platform certificate validation
Basis: platform TLS validation · Sep 6, 2026, 12:25 AM UTCmethod_fallback_policy
Not testedScanner does not select, downgrade, or execute payment methods
Basis: public economic-security prior art · Sep 6, 2026, 12:25 AM UTCprice_debit_consistency
Not testedRequires a completed paid interaction outside scanner scope
Basis: public economic-security prior art · Sep 6, 2026, 12:25 AM UTCredirect_policy
Tested — pass0 redirects; every hop passed URL and DNS validation
Basis: harmless scanner · Sep 6, 2026, 12:25 AM UTCreplay_idempotency_scope
Not testedScanner never replays signed credentials
Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Sep 6, 2026, 12:25 AM UTCssrf_target_validation
Tested — pass1 hop(s) resolved twice to stable public addresses
Basis: scanner URL, DNS and redirect policy · Sep 6, 2026, 12:25 AM UTCauthorization_delivery_settlement
Not testedRequires paid or state-changing behavior outside scanner scope
Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Sep 6, 2026, 12:23 AM UTCbounded_response
Tested — pass8347 bytes within scanner limit
Basis: harmless scanner · Sep 6, 2026, 12:23 AM UTCchallenge_parse
UnknownNo MPP Payment challenge observed
Basis: unauthenticated HTTP response · Sep 6, 2026, 12:23 AM UTCchannel_lifecycle_binding
Not testedChannel and settlement lifecycle require credentials or payments
Basis: public economic-security prior art · Sep 6, 2026, 12:23 AM UTCconcurrency_single_winner
Not testedConcurrency and paid state changes are prohibited
Basis: public economic-security prior art · Sep 6, 2026, 12:23 AM UTCcredential_replay
Not testedScanner never sends credentials or payments
Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Sep 6, 2026, 12:23 AM UTCeconomic_exposure_metadata
UnknownNo current Payment challenge exposes session or authorization inputs
Basis: observable challenge values only · Sep 6, 2026, 12:23 AM UTCfee_payer_cosigner_binding
Not testedSignature and fee-payer relationships are not observable unauthenticated
Basis: public economic-security prior art · Sep 6, 2026, 12:23 AM UTChttps_transport
Tested — passHTTPS fetch completed with platform certificate validation
Basis: platform TLS validation · Sep 6, 2026, 12:23 AM UTCmethod_fallback_policy
Not testedScanner does not select, downgrade, or execute payment methods
Basis: public economic-security prior art · Sep 6, 2026, 12:23 AM UTCprice_debit_consistency
Not testedRequires a completed paid interaction outside scanner scope
Basis: public economic-security prior art · Sep 6, 2026, 12:23 AM UTCredirect_policy
Tested — pass0 redirects; every hop passed URL and DNS validation
Basis: harmless scanner · Sep 6, 2026, 12:23 AM UTCreplay_idempotency_scope
Not testedScanner never replays signed credentials
Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Sep 6, 2026, 12:23 AM UTCssrf_target_validation
Tested — pass1 hop(s) resolved twice to stable public addresses
Basis: scanner URL, DNS and redirect policy · Sep 6, 2026, 12:23 AM UTCopenapi_parse
Tested — pass12 payment offer(s) accepted
Basis: harmless discovery response · Sep 4, 2026, 12:21 PM UTC— security-property-changed
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/openapi.json was re… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/.well-known/api-cat…
Evidence: Repeated harmless observation changed the modeled property
— security-property-changed
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/.well-known/api-cat… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/openapi.json was re…
Evidence: Repeated harmless observation changed the modeled property
— security-property-changed
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/openapi.json was re… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/.well-known/api-cat…
Evidence: Repeated harmless observation changed the modeled property
— security-property-changed
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/.well-known/api-cat… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/openapi.json was re…
Evidence: Repeated harmless observation changed the modeled property
— security-property-changed
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/openapi.json was re… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/.well-known/api-cat…
Evidence: Repeated harmless observation changed the modeled property
— security-property-changed
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/.well-known/api-cat… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/openapi.json was re…
Evidence: Repeated harmless observation changed the modeled property
— security-property-changed
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/openapi.json was re… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/.well-known/api-cat…
Evidence: Repeated harmless observation changed the modeled property
— security-property-changed
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/.well-known/api-cat… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/openapi.json was re…
Evidence: Repeated harmless observation changed the modeled property
— security-property-changed
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/openapi.json was re… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/.well-known/api-cat…
Evidence: Repeated harmless observation changed the modeled property
— security-property-changed
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/.well-known/api-cat… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/openapi.json was re…
Evidence: Repeated harmless observation changed the modeled property
— security-property-changed
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/openapi.json was re… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/.well-known/api-cat…
Evidence: Repeated harmless observation changed the modeled property
— security-property-changed
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/.well-known/api-cat… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/openapi.json was re…
Evidence: Repeated harmless observation changed the modeled property
— security-property-changed
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/openapi.json was re… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/.well-known/api-cat…
Evidence: Repeated harmless observation changed the modeled property
— security-property-changed
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/.well-known/api-cat… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/openapi.json was re…
Evidence: Repeated harmless observation changed the modeled property
— security-property-changed
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/openapi.json was re… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/.well-known/api-cat…
Evidence: Repeated harmless observation changed the modeled property
— security-property-changed
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/.well-known/api-cat… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/openapi.json was re…
Evidence: Repeated harmless observation changed the modeled property
— security-property-changed
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/openapi.json was re… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/.well-known/api-cat…
Evidence: Repeated harmless observation changed the modeled property
— security-property-changed
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/.well-known/api-cat… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/openapi.json was re…
Evidence: Repeated harmless observation changed the modeled property
— security-property-changed
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/openapi.json was re… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/.well-known/api-cat…
Evidence: Repeated harmless observation changed the modeled property
— security-property-changed
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/.well-known/api-cat… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/openapi.json was re…
Evidence: Repeated harmless observation changed the modeled property
— security-property-changed
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/openapi.json was re… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/.well-known/api-cat…
Evidence: Repeated harmless observation changed the modeled property
— security-property-changed
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/.well-known/api-cat… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/openapi.json was re…
Evidence: Repeated harmless observation changed the modeled property
— security-property-changed
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/openapi.json was re… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/.well-known/api-cat…
Evidence: Repeated harmless observation changed the modeled property
— security-property-changed
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/.well-known/api-cat… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/openapi.json was re…
Evidence: Repeated harmless observation changed the modeled property
— security-property-changed
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/openapi.json was re… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://www.valoria.net/.well-known/api-cat…
Evidence: Repeated harmless observation changed the modeled property