# HubVibe -- machine-payable services for autonomous agents > A machine-service gateway: site compliance audits plus a catalog of > per-call capabilities -- LLM inference, web search and extraction, > blockchain/market/prediction-market data, media generation, sandboxed > compute, composite research -- every one paid per call over HTTP 402 > with no account and no human in the loop. The audits are deterministic > checks against the actual page; a check that couldn't run is never > reported as a false pass, and a call that produced no result is never > billed. > Every result is checked against the route's published output schema > before it is billed; one that does not match is not delivered and not > charged (HTTP 502, reason contract_mismatch). Base URL: https://hubvibe-io.com Machine-readable discovery: - /.well-known/agent.json -- full manifest: pricing, live payment rails, rate limits, per-endpoint examples - /openapi.json -- OpenAPI 3.1 spec for every paid route: price, payment rails, request schema and example, and a response schema on every /work route - /.well-known/ard.json -- Agentic Resource Discovery manifest: one entry per audit and per worker with capabilities and representative queries - /mcp -- live MCP endpoint (Streamable HTTP, JSON-RPC). Discovery via initialize/tools/list is free; tools/call is billed per call. It speaks the x402 MCP protocol: an unpaid tools/call returns isError with the v2 PaymentRequired in structuredContent; send the signed PaymentPayload in params._meta["x402/payment"] (the x402.mcp client does this for you) and the settlement receipt comes back in the result's _meta["x402/payment-response"]. X-PAYMENT / PAYMENT-SIGNATURE / X-API-Key headers on the POST work as well. Every audit and every /work worker is a tool: /work/research/brief is hubvibe_research_brief, and so on. - /.well-known/agent-card.json -- A2A Agent Card: every MCP tool is a skill, JSON-RPC at /a2a in A2A 1.0 and 0.3, x402 payments extension - /a2a -- A2A JSON-RPC (SendMessage, GetTask, CancelTask). Name a skill in a data part {"skill": "hubvibe_research_brief", "arguments": {...}}; an unpaid call returns the task in input-required with the price in metadata x402.payment.required; send the signed PaymentPayload in the next message's metadata x402.payment.payload with the same taskId. - /contracts/{capability} -- Purchase Verification Contract (free): before paying, the exact capability, its input and output schema, price, and every rail's network, asset and pay-to, under one contract_hash; the 402 names the same contract. POST /contracts/{capability}/verify with {"expect": {...}, "input": {...}} to have your terms and body checked. Send X-HubVibe-Contract: with the paid request and the node refuses payment if the contract changed. GET /contracts lists all. - /mcp.json -- static MCP tool definitions with their httpEndpoint - /discover?q= -- free ranked search over the capabilities sold right now: BM25 over the catalog text and long-tail phrases fused with local MiniLM vectors (the answer's `method` says which). POST /discover/semantic with {"query": "...", "limit": 3} keeps the intent out of URLs; /discover/vector is dense only; /discover/health says which methods are live; /discover/catalog-version changes when the catalog does. Each candidate carries its canonical id, path, price, schemas and contract_url; `status` is candidates, ambiguous (ask the buyer) or no_match; with recommend=true (or a max_price_usd budget) `recommended` names the cheapest shown candidate that delivers what the words ask for (a composite's declared component when that suffices), and the budget removes dearer candidates from it without ever authorizing a purchase. Nothing is run or charged: pick one, verify its contract, then POST to its path. - /docs -- interactive API reference Quote-first professional services (separate from pay-per-call tools): - /human/catalog -- machine-readable catalog for accessibility remediation, website and company intelligence, custom AI systems, and custom lexical, semantic, vector, and hybrid discovery routers with MCP/A2A integration, verifiable receipts, idempotency, spend limits, and anti-loop controls. It includes the exact JSON Schemas and URLs for the free intent guide and quote request. - POST /human/guide with {"message":"..."} -- recommends the closest professional service and scope questions. It executes no paid work and makes no charge. - POST /human/quotes -- requests written scope and price using the schema in /human/catalog. Submission is free and requires customer consent. Human project work can be paid by one-time card checkout only after HubVibe approval; it is separate from prepaid agent credit and x402/MPP wallet payments. Rate limit: 600 requests/minute per API key (or per IP for x402/MPP callers). Exceeding it returns HTTP 429 with a Retry-After header and nothing is billed -- the limit is checked before any payment is settled. ## Endpoints All endpoints below are POST, priced per call, and accept a prepaid API key, an x402 on-chain payment, or an MPP (Machine Payments Protocol) payment. There is no free tier and no unauthenticated access: every audit costs a real browser page load, so every audit is paid for. - POST /audit/wcag -- $0.05 -- Website accessibility audit (a11y, WCAG compliance check): WCAG 2.1 level A and AA conformance of any live URL or raw HTML, tested with axe-core in a real headless browser. Returns every violation with rule id, impact, help text and affected node count. Deterministic rules; a check that cannot run returns an error, never a pass. Input: {"html": "string (optional)", "url": "string (optional, one of html/url required)"} - POST /audit/seo -- $0.05 -- SEO audit of a web page (on-page SEO check) for any live URL or raw HTML: title tag, meta description, H1 heading structure, canonical link, OpenGraph and social tags, JSON-LD structured data, html lang attribute. Rule-by-rule findings with severity and what is missing or malformed. Input: {"html": "string (optional)", "url": "string (optional, one of html/url required)"} - POST /audit/security -- $0.05 -- Security headers check for a website: audits HTTPS, HSTS, Content- Security-Policy (CSP), X-Content-Type-Options, X-Frame-Options / clickjacking protection, Referrer-Policy and CORS from the real HTTP response of any live URL. Findings with severity for what is missing. Header posture only, not a penetration test. Input: {"url": "string (required)"} - POST /audit/performance -- $0.05 -- Page speed and page weight audit of a web page from one real browser load: total bytes transferred, HTTP request count and DOM node count, measured rather than estimated, with findings when the page is heavy. Page-weight signals, not Core Web Vitals. Input: {"url": "string (required)"} - POST /audit/bundle -- $0.15 -- Full website audit in one call: accessibility (WCAG 2.1 A/AA via axe- core), on-page SEO, HTTP security headers and page speed / page weight, from a single browser load of one URL. Cheaper than four separate calls; if any part cannot run, nothing is billed. Input: {"url": "string (required)"} - POST /audit -- $0.05 -- Alias of /audit/wcag, kept for backward compatibility. ## Prepaid key over Solana (no x402 signature needed) A wallet that can send SPL tokens but cannot sign x402 payloads can buy a prepaid X-API-Key with a plain USDC transfer on Solana mainnet: 1. POST /pay/solana/challenge {"amount_usd": 5} -> reference + challenge_token (keep the token private; $0.50-$100). 2. Send at least that much USDC to pay_to, with the reference as a read-only account key (Solana Pay) or an SPL Memo `hubvibe:`. 3. After finality (~15 s) POST /pay/solana/redeem {"tx_signature", "challenge_token"} -> api_key credited with what arrived, to the cent. Send it as X-API-Key. Only the token's holder can redeem; each transfer and each challenge redeems once. ## Worker network (/work/*) -- completed work Priced per call on the same HTTP 402 rail as the audits. GET /work (free) lists every worker live on this node with its price, tier, input schema and what it returns; a worker whose provider is not configured is listed as unavailable and never quoted. Send an Idempotency-Key header to make a retry safe: a repeated key returns the stored result and is not charged again. Utility (one live read, $0.05-$0.10): - POST /work/chain/network -- Base mainnet block height and gas price - POST /work/chain/address -- one Base address: balance, transaction count, contract or wallet - POST /work/chain/transaction -- one Base transaction with its receipt - POST /work/chain/rpc -- generic allowlisted read-only JSON-RPC on Base - POST /work/market/quote -- live Coinbase spot price and 24h change - POST /work/market/rates -- Coinbase exchange-rate table for one currency - POST /work/market/ticker -- live bid/ask/volume from Coinbase's Exchange data host (independent of market/quote) - POST /work/market/prediction -- live Polymarket markets as implied probabilities - POST /work/prediction/market -- one Polymarket market by slug - POST /work/prediction/events -- live Polymarket events by volume - POST /work/market/stock -- live US equity quote and daily OHLCV history (Nasdaq data API, Yahoo Finance fallback; as_of, delayed_minutes, source) - POST /work/market/fundamentals -- SEC EDGAR XBRL company facts by reporting period (revenue, net income, EPS, balance sheet; any concept) - POST /work/extract/page -- readable text, title and links from any page, rendered in a real browser - POST /work/fetch/raw -- raw HTTP fetch: status, headers, body, any status code (unlike extract/page, a 404/500 from the target is a result) - POST /work/search/web -- live web search, grounded via Gemini's Google Search tool - POST /work/opendata/search -- Asia-Pacific open-data portals (data.gov.au, Japan's e-Gov Data Portal and Tokyo catalog, DATA.GOV.HK) searched in one call, in any language, with each dataset's download URLs; portals that did not answer are listed (Singapore's data.gov.sg has no keyless search) - POST /work/maps/places -- places search by free-text query (Google Maps Grounding Lite) - POST /work/maps/route -- directions and travel time between two places - POST /work/maps/weather -- current or forecast weather at a named place - POST /work/traffic/route -- traffic-aware travel time and distance between two places (Google Routes API computeRoutes): duration with live traffic, duration without, the delay, distance, warnings; DRIVE, TWO_WHEELER, WALK, BICYCLE or TRANSIT; optional future departure_time; as_of and checked_at - POST /work/video/youtube -- YouTube search (or lookup by id) with live views, likes, comments, duration and thumbnail on every video (YouTube Data API v3; sort and date, country, language filters; requires the node's YouTube key) - POST /work/social/bluesky -- Bluesky profile + latest posts, account search, or a post thread (public AppView, keyless) - POST /work/social/mastodon -- Mastodon hashtag timeline, account + statuses, account/hashtag search, or trending tags on any public instance Standard (inference and data, $0.25-$0.50): - POST /work/llm/analyze -- answer a question from text you supply, saying so when the text does not contain the answer (Gemini) - POST /work/llm/extract -- named fields from text as JSON, null when not stated (Gemini) - POST /work/llm/generate -- raw completion from your prompt; Gemini by default, provider and model selectable - POST /work/code/execute -- run Python in Google's own hosted sandbox - POST /work/stats/probability -- deterministic linear regression, normal distribution model and p-values over [x, y] points or two BigQuery columns (also the MCP tool hubvibe_predictive_probability_engine) - POST /work/finance/analytics -- deterministic trading mathematics over a price series or a live ticker: returns, volatility, Sharpe/Sortino, max drawdown, VaR/CVaR, beta vs a benchmark, SMA/EMA/RSI/Bollinger, Black-Scholes-Merton with Greeks, Kelly; every formula named in `method` - POST /work/image/generate -- one image from a text prompt (Imagen 4) - POST /work/speech/synthesize -- text to speech (Cloud Text-to-Speech) - POST /work/speech/transcribe -- speech to text, up to 60s/10MB (STT v2) - POST /work/data/query -- read-only BigQuery SQL, including Google's public datasets, under a scan ceiling - POST /work/monitor/snapshot -- save a page as a baseline to check later - POST /work/monitor/check -- re-fetch a baselined page and get a change summary - POST /work/social/x_pulse -- X (Twitter) topic pulse as aggregates only: post volume per hour/day over 1-7 days, engagement totals and rate, language mix, top hashtags over a capped sample (no posts, ids, authors or profiles are returned, by HubVibe's X developer agreement) - POST /work/commerce/availability -- can this be bought or booked right now? Live check of any product or booking page: availability, price, options, the one matching your variant, quantity and ship-to eligibility, evidence, checked_at (schema.org/Open Graph/Shopify JSON first; browser + Gemini only when the page has no structured data) - POST /work/lead/qualify -- assess website opportunities for a URL you provide: SEO and security-header findings, static accessibility signals, platform and marketing tags, mail setup (MX, SPF, DMARC), company profile and a 0-100 opportunity score with suggested outreach hooks (one plain HTTP fetch, no browser). Does not discover prospects or confirm buying intent. Advanced (several providers, one completed result, $5.00): - POST /work/data/question -- a plain-language question about a BigQuery table, answered with the SQL and the rows behind it - POST /work/research/brief -- read a web page and answer a question about it - POST /work/research/page_facts -- the fields you name from a web page, as JSON - POST /work/research/web -- a live web search, read, and a cited answer - POST /work/verify/claims -- specific claims checked against specific sources: supported / contradicted / unsupported, with the quote - POST /work/market/intel -- a live spot quote and prediction-market probabilities on one subject, analysed together (market data, not advice) - POST /work/security/mcp_inspect -- probe a customer's MCP endpoint's handshake: auth posture, protocol version, tools not marked read-only Premium ($10.00): - POST /work/data/forecast -- forecast a BigQuery time series (AI.FORECAST, TimesFM, no training) - POST /work/data/anomalies -- detect anomalies in a BigQuery time series (AI.DETECT_ANOMALIES) - POST /work/research/company -- a cited research brief on a company from live web sources - POST /work/video/generate -- a short video from a text prompt (Veo, once the operator has verified the model on this deployment) Same payment gate and the same guarantees as the audits: an unauthenticated call answers HTTP 402 with the price, requests are validated before any payment is read, and a call no provider could complete returns HTTP 502 with per-provider reasons and bills nothing. Always current: every call reads its source at call time; no result is served from a cache. Two deliberate, documented exceptions: a repeated Idempotency-Key returns the stored result of that same request (and is not charged again), and monitor.check compares against the baseline that monitor.snapshot saved. commerce.availability, market.stock, market.fundamentals and finance.analytics return `checked_at` (UTC), and the three market/finance workers also `as_of` when the source stamps its own data, so you know when the answer was true. Any language: every worker whose answer contains prose (llm.*, search.web, research.*, verify.claims, market.intel, data.question, monitor.check, commerce.availability) takes an optional `language` (BCP-47 tag such as ja or pt-BR) and answers in it; input in any language is accepted as is. Input schemas and prices for every live worker are in /.well-known/agent.json and the /mcp tools/list. ## Payment and auth Up to three rails, all fail-closed (no valid credential/payment means no audit runs, and nothing partially executes on a rejected payment): 1. API key -- `X-API-Key` header: a prepaid key bought through the MPP top-up rail (a $0.50 block, spent at the per-call rates). There are no subscriptions; machine callers should use the per-call rails below. 2. x402 -- on-chain payment via the x402 protocol; verified and settled through a facilitator, never trusted client-side. 3. MPP (Machine Payments Protocol) -- Stripe Shared Payment Tokens (fiat) or Tempo network (crypto), co-authored by Stripe and Tempo. Which of these are actually live is deployment-specific. Do not assume: read the `accepts` array in any 402 response body, or `payment.methods` in /.well-known/agent.json. Both list only rails that can genuinely settle right now -- a rail that isn't configured is omitted rather than advertised with a null recipient. An unauthenticated POST to any paid route returns HTTP 402 carrying that `accepts` array plus, for MPP, one signed `WWW-Authenticate: Payment` challenge per method. That is the intended discovery path for an agent: call the endpoint, read the price and rails off the 402, pay, retry. ## What you are charged for Only an audit that produced a result. An x402 payment is verified in order to grant access, but is not settled until the audit has actually delivered -- so an audit that fails to run (unreachable target, timeout) returns HTTP 502 and costs nothing. A rate-limited request returns 429 and also costs nothing, because the limit is checked before any payment is touched. ## Integrations Source for these lives in the repo, not on this server -- they are client-side wrappers around the endpoints above, not additional routes: https://github.com/its-fortunatefolly/hubvibe/tree/main/wcag-audit-engine/integrations - langchain_tool.py -- LangChain tool wrapper - github_action.yml -- GitHub Action for CI audit-on-push - mcp_server.py -- MCP server using the official Model Context Protocol SDK; standalone script with its own requirements.txt, not part of this deployed service (its dependencies conflict with this service's FastAPI version) -- see that file's docstring for setup. ## Pricing Machine, per call (this is the product): $0.05 per single-dimension audit, $0.15 per bundle. No account, no minimum. There are no subscriptions: per call is the only price. See /.well-known/agent.json for the authoritative live pricing.