# HubVibe Site Compliance Auditing Suite

> Rule-based, verifiable site audits -- accessibility (axe-core), SEO,
> security headers, and performance -- callable a la carte or as a single
> bundle. Every result is a deterministic check against the actual page;
> nothing here is an LLM guessing at quality, and a check that couldn't
> run is never reported as a false pass.

Base URL: https://hubvibe-831480473793.us-south1.run.app

Machine-readable discovery:
- /.well-known/agent.json -- full manifest: pricing, live payment rails,
  rate limits, per-endpoint examples
- /openapi.json -- OpenAPI 3.1 spec for all routes
- /mcp -- live MCP endpoint (Streamable HTTP, JSON-RPC). Discovery via
  initialize/tools/list is free; tools/call is billed per call.
- /mcp.json -- static MCP tool definitions with their httpEndpoint
- /docs -- interactive API reference

Rate limit: 600 requests/minute per API key (or per IP for x402/MPP
callers). Exceeding it returns HTTP 429 with a Retry-After header and
nothing is billed -- the limit is checked before any payment is settled.

## Endpoints

All endpoints below are POST, priced per call, and accept a Stripe API
key, an x402 on-chain payment, or an MPP (Machine Payments Protocol)
payment. There is no free tier and no unauthenticated access: every audit
costs a real browser page load, so every audit is paid for.

- POST /audit/wcag -- $0.03 -- WCAG 2.1 A/AA accessibility audit via axe-core.
  Input: {"html": "string (optional)", "url": "string (optional, one of html/url required)"}

- POST /audit/seo -- $0.03 -- Title, meta description, H1 structure,
  canonical link, OpenGraph tags, structured data, and lang attribute.
  Input: {"html": "string (optional)", "url": "string (optional, one of html/url required)"}

- POST /audit/security -- $0.03 -- HTTPS, HSTS, CSP, X-Content-Type-Options,
  clickjacking protection, Referrer-Policy, and CORS from a live HTTP
  response. Not a TLS/cipher scan or a penetration test.
  Input: {"url": "string (required)"}

- POST /audit/performance -- $0.03 -- DOM node count, transferred bytes,
  and request count from one real page load. Not a full Lighthouse audit.
  Input: {"url": "string (required)"}

- POST /audit/bundle -- $0.10 -- Runs wcag + seo + security + performance
  against one URL, billed as a single call. Atomic: if any dimension
  fails to run, nothing is billed.
  Input: {"url": "string (required)"}

- POST /audit -- $0.03 -- Alias of /audit/wcag, kept for backward compatibility.

## Payment and auth

Up to three rails, all fail-closed (no valid credential/payment means no
audit runs, and nothing partially executes on a rejected payment):

1. Stripe API key -- `X-API-Key` header, issued with a human plan. Plans are
   priced per site watched, not per scan; machine callers should use the
   per-call rails below instead.
2. x402 -- on-chain payment via the x402 protocol; verified and settled
   through a facilitator, never trusted client-side.
3. MPP (Machine Payments Protocol) -- Stripe Shared Payment Tokens (fiat)
   or Tempo network (crypto), co-authored by Stripe and Tempo.

Which of these are actually live is deployment-specific. Do not assume:
read the `accepts` array in any 402 response body, or `payment.methods` in
/.well-known/agent.json. Both list only rails that can genuinely settle
right now -- a rail that isn't configured is omitted rather than advertised
with a null recipient.

An unauthenticated POST to any paid route returns HTTP 402 carrying that
`accepts` array plus, for MPP, one signed `WWW-Authenticate: Payment`
challenge per method. That is the intended discovery path for an agent:
call the endpoint, read the price and rails off the 402, pay, retry.

## What you are charged for

Only an audit that produced a result. An x402 payment is verified in order
to grant access, but is not settled until the audit has actually delivered
-- so an audit that fails to run (unreachable target, timeout) returns HTTP
502 and costs nothing. A rate-limited request returns 429 and also costs
nothing, because the limit is checked before any payment is touched.

## Integrations

Source for these lives in the repo, not on this server -- they are
client-side wrappers around the endpoints above, not additional routes:
https://github.com/its-fortunatefolly/hubvibe/tree/main/wcag-audit-engine/integrations

- langchain_tool.py -- LangChain tool wrapper
- github_action.yml -- GitHub Action for CI audit-on-push
- mcp_server.py -- MCP server using the official Model Context Protocol
  SDK; standalone script with its own requirements.txt, not part of this
  deployed service (its dependencies conflict with this service's FastAPI
  version) -- see that file's docstring for setup.

## Pricing

Machine, per call (this is the product): $0.03 per single-dimension audit,
$0.10 per bundle. No account, no minimum.

Human plans, priced per site watched rather than per scan: $29.99 one-off
report, $79/mo for 5 sites daily, $249/mo for 50 sites daily. See
/.well-known/agent.json for the authoritative live pricing.