AI Agent Stack Dependency Vulnerability Scanner
Resolve packages from a supplied dependency manifest, query the public OSV.dev advisory database, and return a ranked, import-checked fix list plus one pass/fail gate.
1%
users
Apify builder
kingii98 Leaderboard position
out of 10,354
New actors
#1,951
↓ -1,834
Total actors
#294
↓ -77
Monthly users
#711
↓ -136
Total users
#1,393
↓ -137
Monthly runs
#878
↓ -11
Total runs
#698
↑ +127
Portfolio stats
New actors
2
↓ -35
Total actors
73
↑ +2
Monthly users
73
↑ +2
Total users
146
↑ +4
Monthly runs
2,067
↑ +735
Total runs
32.3K
↑ +17.8K
New actors
Each bar shows one day in the last 30 days.
Portfolio concentration
59 of 73 actors cover 80%+ of monthly users.
Resolve packages from a supplied dependency manifest, query the public OSV.dev advisory database, and return a ranked, import-checked fix list plus one pass/fail gate.
1%
users
Audit which AI crawlers can access a site via robots.txt, llms.txt, and sitemap signals for GPTBot, ClaudeBot, PerplexityBot, and more.
1%
users
Check whether AI crawler user agents can read public pages. Audit robots.txt, HTTP status, extracted text, required markers, and cloaking for each URL and bot.
1%
users
Check version, release notes, price, and minimum OS version for each app in each App Store storefront.
1%
users
Watches a list of Artifact Hub packages and reports each new chart version, application-version change, and change in the Artifact Hub security report summary, against a stored baseline. Each change record also gives the signature and deprecation state. P
1%
users
Sends a real OPTIONS preflight and a real cross-origin GET from each origin that you name, against each API path that you name. Reports which origins the API accepts, which accept credentials, and every violation class: wildcard with credentials, origin r
1%
users
Find permissions that an extension manifest declares but the code does not use.
1%
users
Proves that a deploy serves the delivery contract that you agreed. For every URL that you name, the Actor sends header-only transactions: one request for each required compression algorithm, an HTTP-scheme probe and a trailing-slash variant, so four trans
1%
users
Find the renewal that did not reach every server. For each hostname the Actor resolves every A and AAAA address, opens a TLS handshake to each address with the hostname as SNI, and compares the certificate that each address serves with the newest certific
1%
users
Pulls the manifest of every pinned image reference over HTTPS and reports whether the pull works now, why it would fail, which platforms the manifest holds, the TLS name-match verdict, and how much anonymous rate budget the registry has left. HTTP only, n
1%
users
Prove Gmail, Yahoo and Outlook bulk-sender conformance from a message they received. Give it raw .eml messages. It reads the receiver Authentication-Results, verifies each DKIM signature, checks SPF and DKIM alignment, the DMARC record, one-click unsubscr
1%
users
Reads the public dependency dashboard issue of each repository, and reports the declared repository problems, the size of each backlog section, and the change since the last run. One row for each repository, one row for each new problem and each backlog g
1%
users
Check each pinned dependency version against a release-age cooldown policy. Report which pins are still inside the window, and the date on which each one becomes admissible.
1%
users
Reads the script bundles that your deployed pages load from their own origin and probes a fixed set of debug and schema paths. Reports each leaked key and each exposed endpoint with a redacted match, and gives one gate_pass verdict for your build step. HT
1%
users
Polls public DNS-over-HTTPS resolvers until a record matches the expected value at every resolver, then sends one webhook and writes one sealed receipt. Built for the moment of a cutover, so the next step can start. HTTP only, no browser, no proxy, no dat
1%
users
Checks 1 to 500 domains through public RDAP. Reports expiry, missing locks, risk status, and changes since the last run.
1%
users
Find which layer failed in an outage: registration hold, parking delegation, sinkhole DNS, TLS, or origin.
1%
users
Checks that each site advertises its RSS, Atom, or JSON feed, that the feed resolves and is served correctly, and that it points back to the site.
1%
users
Convert GitHub, GitLab, and Bitbucket webhook payloads into one stable event schema.
1%
users
Reads the workflow files of a public repository set and reports every `uses:` reference: mutable tag or branch against commit sha pin, archived, renamed or missing action repositories, the last release date and a risk class. One dataset row for each refer
1%
users
Forecast the date when a GitHub issue reaches the 2,500 comment limit.
1%
users
Checks GitHub Pages sites on custom domains: DNS records for the apex and www, HTTPS status of each required path, the HTTP-to-HTTPS redirect, the certificate host name, dangling-domain risk, and the Pages API state when a token is given. Gives PASS, WARN
1%
users
Validate hreflang annotations after a domain or site migration: locale syntax, duplicates, target health, canonicals, x-default, self-references, reciprocal return links, and old-domain references.
1%
users
Submits published URLs to IndexNow endpoints (Bing, Yandex) with a preflight check and a receipt ledger. HTTP only, no login, no paid API.
1%
users
Compare the current and the proposed version of a dependency, and report every install-time script that the new version adds, removes or changes, with the flagged lines and a clean, review or block verdict.
1%
users
Turn JSON or CSV event rows into a subscribable ICS feed with stable UIDs and SEQUENCE.
1%
users
Validate Open Graph and social-preview cards for public URLs across Slack, Discord, X, Facebook, LinkedIn, and iMessage without a browser.
1%
users
Check a domain-migration redirect map: for each old-to-new URL pair, follow the live redirect chain and verify it lands on the expected target, within bounded hops.
1%
users
Give it your domains. It reads _mta-sts and _smtp._tls TXT, the live MX set and the MTA-STS policy file, compares each one with the snapshot of the last run, parses your TLS-RPT report files, and tells you if the domain can move to enforce mode. It finds
1%
users
Merge 2 to 50 ICS feeds into one subscribable ICS file at a stable key-value record. Remove duplicate events.
1%
users
Watch public JSON GET endpoints for response-shape drift without an OpenAPI spec. The Actor learns the shape from the response, compares it against a stored baseline, and reports each field-level change with a breaking flag.
1%
users
Writes the security opinion that a vendor-intake review needs before a company connects to a SaaS vendor, an identity provider or a remote MCP server. For each issuer that you name, the Actor reads the public OpenID Connect Discovery or RFC 8414 metadata
1%
users
Checks that an app login redirect sends the expected redirect_uri, client_id, PKCE, state, and nonce to the advertised authorization endpoint.
1%
users
Audit the OpenAPI or Swagger documents that you publish. The Actor reports every unresolved reference, every duplicate or absent operationId, every response without a schema, and every example that violates its own schema, with a JSON pointer and a sugges
1%
users
SPF result for your egress IP, before the first mail. Give it the From domain, the egress IP addresses and the DKIM selectors of a new relay, tenant or email provider. It runs SPF check_host() for each IP (RFC 7208, with lookup counts), checks reverse DNS
1%
users
Prove that a published npm or PyPI artifact carries a signed provenance attestation, that the attestation subject digest equals the registry artifact digest, and that the public transparency log holds the entry.
1%
users
For each pinned npm or PyPI package, read the GitHub release notes between the pinned and target version and list breaking and removed items with quoted source text.
1%
users
Reads your RSS, Atom or JSON Feed, then sends one HEAD and one ranged GET to each recent enclosure. It reports range support, content type, declared length against reported length, the redirect chain, TLS use, and every item whose GUID or enclosure URL ch
1%
users
Read manifest files from more than one ecosystem. Report the license, the deprecation flag and the abandonment age of each package in one table.
1%
users
Check email HTML against 12 client profiles before you send it. Finds Outlook and Gmail breakages, dead or insecure assets, and Gmail clip-limit risk, with no browser and no render farm.
1%
users
Compares the commit that a production site serves with the head of its git release branch. Measures how long production lags across scheduled runs, flags a commit that is not on the branch, and gives one pass or fail gate. Works for Vercel, Netlify, Cloud
1%
users
Finds each open GitHub pull request where a reviewer already reviewed, the author then pushed new commits, and nobody requested a new review. One dataset record for each pull request and reviewer pair, plus one summary for each reviewer. HTTP only, no bro
1%
users
Reads the manifest link from the HTML head of each origin, reads the web app manifest, then verifies every declared icon, screenshot and shortcut icon with one HEAD and one ranged GET. It reports the true pixel size read from the file header against the d
1%
users
Check which TLDs have an RDAP server in the IANA bootstrap file, which servers answer correctly, and what a 404 means for each server.
1%
users
Prove that no hop of a redirect chain reaches your internal network. For each URL the Actor walks every hop with automatic redirects off, resolves the hostname of each hop, classifies every address the resolver answers (public, RFC1918 private, loopback,
1%
users
Resolve each declared range or channel tag the way a package manager does, and report when the resolved version is withdrawn, holds no live file, or moved to another version since the last run. One row for each target, with the resolved version, the rule
1%
users
Find each merged pull request in a tag range that the release notes do not mention.
1%
users
Watch remote MCP servers for tool-surface and permission changes. The Actor reads the declared tool list with anonymous requests, compares it against a stored digest, and reports each added tool, removed tool, changed input schema, changed destructive-act
1%
users
Find each hostname in a GitHub repository that does not resolve, is not registered, is near expiry, or is on hold.
1%
users
Find repository files outside the publish directory that your live static site serves.
1%
users
Audit destination pages after a migration: extract and check every resource and link reference, flag old-domain references, broken URLs, redirects, mixed content, and missing references.
1%
users
Watches scheduled GitHub Actions workflows and reports the ones that stopped to fire, that fail again and again, or that GitHub disabled for inactivity. One dataset record for each workflow plus one summary record. HTTP only, no browser, no proxy.
1%
users
Your cron job sends one curl ping after each run. This Actor keeps the ledger in a named key-value store and reports every job that went silent, with an optional webhook alert. HTTP only, no browser, no proxy, no database.
1%
users
Check each scheduled release page from outside, inside its release window. The Actor fails a gate when the outcome content is public before the release time, or when the preview content is still public after it. It compares the CDN copy with a cache-buste
1%
users
Check each scrape source with a plain HTTP fetch and a body marker. Keep consecutive-failure, quarantine, and recovery counters between runs, and report the sources that changed state.
1%
users
Learn when a deploy, a CDN rule or a proxy change removes or weakens a security header on your production URLs. The Actor compares HSTS, CSP (each directive), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and the cross-origi
1%
users
Checks security.txt files for expiry, unresolvable OpenPGP keys and unreachable contacts. Keeps a ledger of changes between runs.
1%
users
Monitor selected parts of public web pages: fetch HTML over HTTP, extract text or inner HTML by CSS selector, and report only selector-level changes after a quiet baseline.
1%
users
Run this on a short schedule. Each run reads what the vendor status page claims and measures a public endpoint of the same service from outside. Each check writes one typed event: MATCH, SHADOW_OUTAGE when the endpoint fails and the vendor still claims th
1%
users
ActorHunt MCP
ActorHunt gives paid members MCP access to keyword data, actor evidence, and Store movement for deciding what to build next.