Skip to content

Add underscoredone submit - #188

Open
oritzv wants to merge 6 commits into
solana-foundation:mainfrom
onescales:add-underscoredone-submit
Open

Add underscoredone submit#188
oritzv wants to merge 6 commits into
solana-foundation:mainfrom
onescales:add-underscoredone-submit

Conversation

@oritzv

@oritzv oritzv commented Jul 15, 2026

Copy link
Copy Markdown

Added cors header checker api

@greptile-apps

greptile-apps Bot commented Jul 15, 2026

Copy link
Copy Markdown

Greptile Summary

This PR adds a new underscoredone provider — a CORS Header Checker utility API — consisting of a PAY.md metadata file and an openapi.json spec. The service accepts a URL and optional origin, makes a real HTTP request with an Origin header, and returns the six standard Access-Control-* response headers along with derived cors_enabled and origin_allowed flags, billed at $0.01 USDC per call via the x402 protocol on Base or Solana.

  • The PAY.md frontmatter is complete and well-formed: all required fields (name, title, description, use_case, category, service_url, openapi.path) are present, and the Spend-aware usage section gives clear cost-reduction guidance.
  • The openapi.json is a valid OpenAPI 3.1.0 spec with thorough x-ai-instructions, x-guidance, and x402 payment metadata; a minor schema inconsistency exists where status and error are always present in responses (per the guidance) but are absent from CheckResponse.required.

Confidence Score: 4/5

Safe to merge; both files are additive-only and isolated to the new provider directory.

The submission is clean and well-structured. The only notable issue is that status and error are omitted from CheckResponse.required despite the guidance describing them as always-present fields — this mismatch could cause agent consumers to mishandle those fields. It is not blocking, but worth resolving before the spec is widely adopted.

openapi.json — specifically the CheckResponse required array.

Important Files Changed

Filename Overview
providers/underscoredone/cors-header-checker/PAY.md Well-formed provider metadata with all required frontmatter fields, correct service_url, appropriate category, and a concise Spend-aware usage section.
providers/underscoredone/cors-header-checker/openapi.json Valid OpenAPI 3.1.0 spec with x402 payment metadata and clear AI guidance; the CheckResponse schema omits status and error from required even though the guidance implies both are always present (just nullable).

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant Client
    participant CORSCheckerAPI as CORS Checker API
    participant x402 as x402 / USDC Payment
    participant TargetURL as Target URL

    Client->>CORSCheckerAPI: "POST /check {url, origin}"
    CORSCheckerAPI-->>Client: 402 Payment Required (if no valid payment)
    Client->>x402: Pay $0.01 USDC (Base or Solana)
    x402-->>CORSCheckerAPI: Payment confirmed
    CORSCheckerAPI->>TargetURL: HTTP request with Origin header
    TargetURL-->>CORSCheckerAPI: Response + CORS headers
    CORSCheckerAPI-->>Client: "CheckResponse {cors_enabled, origin_allowed, headers, status, error}"
Loading
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant Client
    participant CORSCheckerAPI as CORS Checker API
    participant x402 as x402 / USDC Payment
    participant TargetURL as Target URL

    Client->>CORSCheckerAPI: "POST /check {url, origin}"
    CORSCheckerAPI-->>Client: 402 Payment Required (if no valid payment)
    Client->>x402: Pay $0.01 USDC (Base or Solana)
    x402-->>CORSCheckerAPI: Payment confirmed
    CORSCheckerAPI->>TargetURL: HTTP request with Origin header
    TargetURL-->>CORSCheckerAPI: Response + CORS headers
    CORSCheckerAPI-->>Client: "CheckResponse {cors_enabled, origin_allowed, headers, status, error}"
Loading

Reviews (1): Last reviewed commit: "Add underscoredone APIs to pay-skills re..." | Re-trigger Greptile

@@ -0,0 +1 @@
{"openapi":"3.1.0","info":{"title":"CORS Header Checker","description":"Sends a real request to any URL you provide, attaches an Origin header, and reads back all six standard cross-origin permission headers the server returns. Tells you whether cross-origin requests are enabled at all, whether your specific origin is permitted, and shows you every permission value exactly as the server sent it. Perfect for figuring out why a browser is blocking a request, confirming a freshly deployed service is configured correctly, or auditing whether a public API allows credentialed cross-origin calls.","version":"1.0.0","contact":{"name":"_done","url":"https://forms.gle/5KzuSFH7p8hHtDmz7","email":"info@underscoredone.com"},"x-openapi-url":"https://cors-header-checker.underscoredone.com/openapi.json","x-logo":{"url":"https://underscoredone.com/logo.png","altText":"_done"},"x-guidance":"POST a JSON body with a required 'url' field (the endpoint to probe) and an optional 'origin' field (defaults to https://example.com). The response always includes 'cors_enabled' (boolean, true if any CORS header was found), 'origin_allowed' (boolean, true if the tested origin would be permitted by the browser), and a 'headers' object with all six Access-Control-* values as strings or null when absent. If the target server could not be reached, the response includes an 'error' string and 'status' is null — this is still a 200 response from this API, not an error. Only raise 400 for malformed input such as a non-HTTP URL. Use 'origin_allowed' to decide whether a frontend at that origin can call the URL. Use 'cors_enabled' to detect servers that return no CORS headers at all.","x-ai-instructions":"POST a JSON body with a required 'url' field (the endpoint to probe) and an optional 'origin' field (defaults to https://example.com). The response always includes 'cors_enabled' (boolean, true if any CORS header was found), 'origin_allowed' (boolean, true if the tested origin would be permitted by the browser), and a 'headers' object with all six Access-Control-* values as strings or null when absent. If the target server could not be reached, the response includes an 'error' string and 'status' is null — this is still a 200 response from this API, not an error. Only raise 400 for malformed input such as a non-HTTP URL. Use 'origin_allowed' to decide whether a frontend at that origin can call the URL. Use 'cors_enabled' to detect servers that return no CORS headers at all.","x-provider":"_done — single-purpose utility APIs for developers and AI agents. Pay per call with USDC on Base Mainnet or Solana Mainnet.","x-pricing":{"model":"pay-per-call","currency":"USDC","network":"Base Mainnet or Solana Mainnet","price":"$0.01"},"x-keywords":["network","cors","header","checker","cross-origin","access-control","cors-debug","browser-blocked","preflight","origin-allowed","cors-audit","utility","api","ai-agent","pay-per-call","usdc","x402"],"x-category":"network","x-provider-url":"https://underscoredone.com","x-agentcash-auth":{"mode":"paid"},"x-402":{"price":"$0.01","network":"eip155:8453","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","pay_to":"0xE9740820225B3918b4ddd1292C7cA4Ca0e2C2F08","facilitator":"https://api.cdp.coinbase.com/platform/v2/x402","scheme":"exact","description":"Sends a real request to any URL you provide, attaches an Origin header, and reads back all six standard cross-origin permission headers the server returns. Tells you whether cross-origin requests are enabled at all, whether your specific origin is permitted, and shows you every permission value exactly as the server sent it. Perfect for figuring out why a browser is blocking a request, confirming a freshly deployed service is configured correctly, or auditing whether a public API allows credentialed cross-origin calls.","mime_type":"application/json","networks":[{"network":"eip155:8453","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","pay_to":"0xE9740820225B3918b4ddd1292C7cA4Ca0e2C2F08"},{"network":"solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp","asset":"EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v","pay_to":"8ugAWAXDB8V18kiUrGZTq1oMvU3C6Fxs8hfC6rvzQT3b"}]}},"paths":{"/check":{"post":{"tags":["Network"],"summary":"Check which cross-origin permissions a URL grants for a given origin","description":"Send a real HTTP request to any web address with an Origin header attached, and report back every cross-origin permission header the server returns.","operationId":"handler_check_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CheckRequest"}}},"required":true},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CheckResponse"},"examples":{"success":{"summary":"Successful response","value":{"api_version":"1.0.0","url":"https://api.github.com","origin_tested":"https://myapp.com","status":200,"cors_enabled":true,"origin_allowed":false,"headers":{"access-control-allow-origin":"https://github.com","access-control-allow-methods":null,"access-control-allow-headers":null,"access-control-allow-credentials":null,"access-control-expose-headers":"ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset","access-control-max-age":null},"error":null}}}}}},"422":{"description":"Unprocessable — a required field is missing or the wrong type. Check the detail field for specifics.","content":{"application/json":{"schema":{"type":"object","properties":{"detail":{"type":"array"}}}}}},"402":{"description":"Payment required. Send a signed USDC payment on Base Mainnet or Solana Mainnet using the x402 protocol.","headers":{"X-Payment-Response":{"description":"x402 payment challenge — base64-encoded JSON with payment details.","schema":{"type":"string"}}}},"400":{"description":"Bad request — your input failed validation or could not be processed. Check the detail field for specifics.","content":{"application/json":{"schema":{"type":"object","properties":{"detail":{"type":"string"}}}}}}},"x-ai-instructions":"POST a JSON body with a required 'url' field (the endpoint to probe) and an optional 'origin' field (defaults to https://example.com). The response always includes 'cors_enabled' (boolean, true if any CORS header was found), 'origin_allowed' (boolean, true if the tested origin would be permitted by the browser), and a 'headers' object with all six Access-Control-* values as strings or null when absent. If the target server could not be reached, the response includes an 'error' string and 'status' is null — this is still a 200 response from this API, not an error. Only raise 400 for malformed input such as a non-HTTP URL. Use 'origin_allowed' to decide whether a frontend at that origin can call the URL. Use 'cors_enabled' to detect servers that return no CORS headers at all.","x-guidance":"POST a JSON body with a required 'url' field (the endpoint to probe) and an optional 'origin' field (defaults to https://example.com). The response always includes 'cors_enabled' (boolean, true if any CORS header was found), 'origin_allowed' (boolean, true if the tested origin would be permitted by the browser), and a 'headers' object with all six Access-Control-* values as strings or null when absent. If the target server could not be reached, the response includes an 'error' string and 'status' is null — this is still a 200 response from this API, not an error. Only raise 400 for malformed input such as a non-HTTP URL. Use 'origin_allowed' to decide whether a frontend at that origin can call the URL. Use 'cors_enabled' to detect servers that return no CORS headers at all.","x-payment-info":{"price":{"fixed":{"mode":"fixed","currency":"USD","amount":"0.01"}},"protocols":[{"x402":{}}]}}}},"components":{"schemas":{"CheckRequest":{"properties":{"url":{"type":"string","title":"Url","description":"The full web address of the endpoint you want to check — must start with http:// or https://."},"origin":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Origin","description":"The website address you want to test cross-origin access from, for example https://myapp.com. Defaults to https://example.com if you leave it out.","default":"https://example.com"}},"type":"object","required":["url"],"title":"CheckRequest","example":{"origin":"https://myapp.com","url":"https://api.github.com"}},"CheckResponse":{"properties":{"api_version":{"type":"string","title":"Api Version","description":"API version","default":"1.0.0"},"url":{"type":"string","title":"Url","description":"The web address that was checked."},"origin_tested":{"type":"string","title":"Origin Tested","description":"The origin address that was used in the check."},"status":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Status","description":"The HTTP status code the server responded with, or null if the server could not be reached."},"cors_enabled":{"type":"boolean","title":"Cors Enabled","description":"True if the server sent at least one cross-origin permission header back."},"origin_allowed":{"type":"boolean","title":"Origin Allowed","description":"True if a browser would allow your origin to make requests to this URL based on the server's response."},"headers":{"additionalProperties":true,"type":"object","title":"Headers","description":"All six standard cross-origin permission headers as returned by the server. Each value is the exact text the server sent, or null if the server did not include that header."},"error":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Error","description":"A plain-English description of what went wrong if the server could not be reached, or null if everything worked fine."}},"type":"object","required":["url","origin_tested","cors_enabled","origin_allowed","headers"],"title":"CheckResponse","example":{"api_version":"1.0.0","cors_enabled":true,"headers":{"access-control-allow-origin":"https://github.com","access-control-expose-headers":"ETag, Link, Location"},"origin_allowed":false,"origin_tested":"https://myapp.com","status":200,"url":"https://api.github.com"}},"HTTPValidationError":{"properties":{"detail":{"items":{"$ref":"#/components/schemas/ValidationError"},"type":"array","title":"Detail"}},"type":"object","title":"HTTPValidationError"},"ValidationError":{"properties":{"loc":{"items":{"anyOf":[{"type":"string"},{"type":"integer"}]},"type":"array","title":"Location"},"msg":{"type":"string","title":"Message"},"type":{"type":"string","title":"Error Type"},"input":{"title":"Input"},"ctx":{"type":"object","title":"Context"}},"type":"object","required":["loc","msg","type"],"title":"ValidationError"}},"securitySchemes":{"siwx":{"type":"apiKey","in":"header","name":"SIGN-IN-WITH-X","description":"CAIP-122 wallet signature for repeat access after payment"}}},"servers":[{"url":"https://cors-header-checker.underscoredone.com","description":"Production"}],"x402Version":2,"x-payment-accepts":[{"scheme":"exact","network":"eip155:8453","payTo":"0xE9740820225B3918b4ddd1292C7cA4Ca0e2C2F08","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"},{"scheme":"exact","network":"solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp","payTo":"8ugAWAXDB8V18kiUrGZTq1oMvU3C6Fxs8hfC6rvzQT3b","asset":"EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v"}]} No newline at end of file

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 status and error missing from CheckResponse.required

The x-ai-instructions state that every response always includes status (null when the target is unreachable) and error (null on success), yet neither field appears in the required array of CheckResponse. Agents that read the schema strictly will treat both as optional/absent, so they may skip null-handling and crash when the fields do appear. Both are nullable but always present and should be listed in required alongside their anyOf nullable types.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant