{"schema_version":"0.1","name":"anb-data-consultancy","display_name":"ANB Data Consultancy Preflight","description":"Checklist preflight APIs from ANB Data Consultancy for AI-built apps (secrets, authz, webhooks, OpenAPI lint, deps, supply-chain). Not a penetration test. Year-1: free, experimental, no SLA.","homepage":"/","human_landing":"/","terms":"/terms","privacy":"/privacy","agent_card":"/.well-known/agent.json","openapi":"/openapi.json","llms_txt":"/llms.txt","health":"/health","robots":"/robots.txt","sitemap":"/sitemap.xml","pricing":{"current":"free","notes":"Base service: free, no API key, no SLA. Machine payments may follow for higher tiers if demand is proven.","planned":{"model":"stripe_machine_payments","unit_hint_usd":0.05,"protocols":["MPP","x402"]}},"claim_boundary":"Checklist heuristics and guidance only — not a penetration test or certification.","disputes":{"proof":"payment_ref + payer-only receipt_id + hashes + rules_pin (paid tier); raw Stripe payment_id stays server-side","receipts":"Issued and retrievable only for payers; free tier gets request_id only; payment_ref is opaque","owner_action":"Human owners contact support with payment_ref and receipt_id or request_id"},"tools":[{"id":"preflight_secrets","name":"Secrets & Config Exposure Preflight","status":"ga","path":"/v1/preflight/secrets","method":"POST","operation_id":"preflightSecrets","when_to_use":["Agent created or edited .env / CI YAML / config with possible secrets","Before PR or deploy of AI-generated app config"],"input_summary":"JSON blobs of text (max 64KB total)","output_summary":"risk_band, flags with remediation hints, summary_for_agent"},{"id":"preflight_authz","name":"Route Authz Preflight","status":"ga","path":"/v1/preflight/authz","method":"POST","operation_id":"preflightAuthz","when_to_use":["Review API routes for IDOR / missing auth / body-supplied identity"],"input_summary":"routes[] + optional ownership_model (max 25 routes, 64KB)","output_summary":"risk_band, checklist flags, summary_for_agent"},{"id":"preflight_webhooks","name":"Webhook & Callback Trust Preflight","status":"ga","path":"/v1/preflight/webhooks","method":"POST","operation_id":"preflightWebhooks","when_to_use":["Verify webhook signature / callback trust setup"],"input_summary":"callbacks[] with verification enum (64KB)","output_summary":"risk_band, flags, summary_for_agent"},{"id":"preflight_openapi","name":"OpenAPI Security Lint Preflight","status":"ga","path":"/v1/preflight/openapi","method":"POST","operation_id":"preflightOpenapi","when_to_use":["Lint OpenAPI excerpt for OWASP-aligned security gaps"],"input_summary":"OpenAPI document JSON/YAML string or object (64KB)","output_summary":"risk_band, lint flags, summary_for_agent"},{"id":"preflight_deps","name":"Dependency Preflight","status":"ga","path":"/v1/preflight/deps","method":"POST","operation_id":"preflightDeps","when_to_use":["Scan lockfile excerpt / package list via OSV for known vulns"],"input_summary":"lockfile_excerpt or packages[] (max 40 pkgs, 64KB)","output_summary":"risk_band, CVE-oriented flags, upgrade hints"},{"id":"preflight_supplychain","name":"Supply-chain Smell Preflight","status":"ga","path":"/v1/preflight/supplychain","method":"POST","operation_id":"preflightSupplychain","when_to_use":["Heuristic npm package trust signals (age, repo, name smell)"],"input_summary":"packages[] names (max 40, 64KB)","output_summary":"risk_band, smell flags, summary_for_agent"}]}