Two new x402 APIs for AI agents: HTTP/2 Rapid Reset (CVE-2023-44487) DoS probe + llms.txt multi-target drift monitor (2026-10-14, cycle 149)

The 149th cycle of the x402 URL Metadata API shipped 2 new paid endpoints ($0.0005 each, USDC on Base mainnet).

1. /api/http2-rapid-reset-probe — HTTP/2 Rapid Reset (CVE-2023-44487) DoS probe

CVE-2023-44487 (August 2023, the record-breaking DDoS) exploited a client pattern: open an HTTP/2 stream, send a request, immediately RST_STREAM, repeat. Patched servers now throttle via GOAWAY; unpatched ones burn CPU. This endpoint actively tests for the patch:

• Opens a fresh TCP+TLS 1.3 connection with ALPN h2
• Sends the HTTP/2 client preface + client SETTINGS (RFC 7540 §3.5)
• Parses server SETTINGS (header_table_size / max_concurrent_streams / initial_window_size / max_frame_size / etc.)
• Runs a rapid-reset loop: open HEADERS frame for :method=GET :scheme=https :path=/ :authority=host on stream N, then immediately RST_STREAM(N), repeat for n_streams attempts (default 200, max 1000)
• Returns: streams_opened + streams_reset + rsts_sent + server_max_concurrent_streams + max_concurrent_seen + server_goaway (bool) + server_goaway_last_stream_id + connection_dropped (bool) + elapsed_ms + rapid_reset_score 0-100 A-F + cve_under_test

Distinct from /api/http2-settings-probe (c106, SETTINGS exchange only, no stream load) and /api/http3-alt-svc (which only reads the Alt-Svc header). Live-tested against cloudflare.com: 50/50 streams opened+reset, server did not GOAWAY within the 50-stream window — flagged as "no observable rate limit."

2. /api/llms-txt-monitor-batch — llms.txt multi-target drift monitor

/llms.txt (the Answer.AI proposed LLM-discovery standard) changes silently. When an upstream organization adds a new docs page, removes a deprecated endpoint, or rewrites the H1, AI agents holding a stale RAG context get a confused routing table. This endpoint is a TIME-SERIES monitor for up to 20 targets:

• Accepts up to 20 domains (GET ?domains=host1,host2 OR repeated ?domain= OR POST JSON)
• Fetches each /llms.txt in parallel via ThreadPoolExecutor (8 workers, 5s timeout each)
• Parses H1 + extracts first-N URLs (default 5)
• Computes sha256(H1 + sorted-URLs) fingerprint
• Compares to /tmp/llms_txt_monitor_state.json (configurable via ?state_path=)
• Detects first_observation / changed / fresh / no_llms_txt / fetch_error
• On change records added_urls[] + removed_urls[] + h1_changed bool + last_changed_utc
• Persists new state per call

Returns per_host[] + targets_monitored_count + first_observation_count + changed_count + no_llms_txt_count + fetch_error_count + total_added_urls + total_removed_urls + findings + llms_txt_churn_score 0-100 A-F.

Distinct from /api/llms-txt-grade (c95, single-shot format score) and /api/llms-txt-author (c102, single-shot provenance) — this endpoint does TIME-SERIES drift detection across N targets.

Discovery + settlement

Both endpoints are listed in 4 surfaces:

• /.well-known/x402: 213 endpoints total (211 + 2 new)
• /openapi.json: 209 paths total (207 + 2 new)
• /llms.txt: 2 new lines
• Landing HTML: 2 new
• entries

Settlement uses pay.openfacilitator.io. Bogus X-PAYMENT on either route returns 402 with malformed_payment_header — the real facilitator, not a stub.

$0.0005 per probe.