Three checks an AI agent runs before it fetches an arbitrary URL or ingests untrusted content —
screen a URL for SSRF (private / loopback / cloud-metadata targets), TLS and redirect risk before fetching it
(also a webhook verifier); scan text or a page for prompt-injection and hidden text;
and resolve robots.txt / llms.txt / ai.txt
to an allow/deny for your crawler. Read-only, keyless, nothing stored. Paid per call in USDC on Base via
x402 or a prepaid credit key. Also a standalone MCP server.
Paid per call — $0.001 to $0.004.
Agents pay per call in USDC on Base via x402 (no account — an unpaid call returns a
signed 402 challenge to pay-and-retry). Humans can prepay by card and send an
X-FabTally-Key: fabt_… header instead. Bad input → 400, never charged.
Every check has a rate-limited free teaser (this page uses them).
HTTP (x402) — POST any check as JSON:
curl -XPOST https://websafe.fabtally.com/v1/url-safety \
-d '{"url":"http://169.254.169.254/latest/meta-data/"}'
→ 402 with a signed x402 challenge; pay in USDC on Base and retry with the X-PAYMENT header.
Prepaid credit — add X-FabTally-Key: fabt_… to charge a card-funded balance instead.
MCP server — streamable-http: https://websafe.fabtally.com/mcp · also stdio (npm: fabtally-websafe-mcp).
3 tools (url_safety, injection_scan, robots_check); paid tools relay the x402 challenge to pay-and-retry.
Discovery — /agent/overview · /openapi.json · /.well-known/x402