# Highland Intel API

> 70 pay-per-call tools for AI agents: DNS, mail auth, TLS and header audits, web search and scraping, text AI, dev utilities and business maths. REST or MCP. Prepaid credits (1 credit = 1 CAD cent) or x402 USDC on Base per call, no account needed.

## Start
- [Buy credits / API key](https://api.highlnd-intel.group/buy)
- [Catalog JSON](https://api.highlnd-intel.group/v1/catalog)
- [OpenAPI](https://api.highlnd-intel.group/openapi.json)
- [x402 discovery](https://api.highlnd-intel.group/.well-known/x402)
- MCP (streamable HTTP): https://api.highlnd-intel.group/mcp with Authorization: Bearer <key>

## Tools
- dns-lookup (2¢ CAD): DNS records. A, AAAA, MX, NS and TXT records for a domain over DNS-over-HTTPS.
- mail-auth (3¢ CAD): Email authentication check. SPF and DMARC presence and policy strength for a domain.
- header-audit (3¢ CAD): HTTP security header audit. Which security headers a site's HTTPS front page sends, with a simple grade.
- https-redirect (2¢ CAD): HTTPS redirect check. Whether plain HTTP redirects to HTTPS, and whether HSTS is set.
- security-txt (2¢ CAD): security.txt check. Fetches /.well-known/security.txt and reports Contact and Expires (RFC 9116).
- summarize (4¢ CAD): Summarize. Three-bullet summary of up to 8,000 characters. Input is PII-redacted first.
- classify (3¢ CAD): Classify. Picks one label from your list (2 to 20 labels) for a piece of text.
- translate (4¢ CAD): Translate (EN/FR and more). Translates text between languages; defaults to English to French for NS/NB customers.
- pii-redact (1¢ CAD): PII redaction. Strips emails, phone numbers, card numbers, SINs and IPv4s. Runs locally, no model.
- text-stats (1¢ CAD): Text statistics. Word, sentence and character counts, reading time and a Flesch reading-ease score.
- json-validate (1¢ CAD): JSON Schema validate. Validates a JSON value against a JSON-Schema subset and lists every error path.
- regex-test (1¢ CAD): Regex tester. Runs a JavaScript regex over sample text and returns matches and groups (capped sizes).
- cron-explain (1¢ CAD): Cron explainer. Explains a 5-field cron expression in plain English (UTC, as Cloudflare runs it).
- text-diff (2¢ CAD): Text diff. Line-by-line diff of two texts (up to 500 lines each).
- hash (1¢ CAD): Hash. SHA-1/256/384/512 hex digest of UTF-8 text.
- hst-calc (1¢ CAD): Nova Scotia HST calculator. Adds 14% NS HST to a subtotal, or splits a tax-included total. Confirm the rate with CRA.
- quote-build (5¢ CAD): Quote builder. Totals line items, applies a discount and HST, and computes a deposit. No customer details taken.
- invoice-number (1¢ CAD): Invoice number. Formats PREFIX-YYYYMM-NNNNN-C with a Luhn check digit, or validates one.
- uptime-check (2¢ CAD): Uptime check. One HTTPS probe of a public domain: status, latency and whether it looks up.
- web-search (8¢ CAD): Web search. Neural or keyword web search with highlights, for agents. Up to 10 results, public URLs only.
- web-contents (6¢ CAD): Web page contents. Clean text of up to 5 public pages, capped per page, for agents to read.
- find-similar (8¢ CAD): Find similar pages. Pages similar in meaning to a given public URL, with highlights. Up to 10 results.
- web-scrape (7¢ CAD): Web scrape to Markdown. Main content of one public page as Markdown (up to 50,000 characters), with title and status.
- web-map (6¢ CAD): Site map. Discovers the URLs of a public site (up to 200), optionally ranked by a search term.
- web-extract (10¢ CAD): Structured web extract. Scrapes a public page and fills your flat schema (up to 20 typed fields) from it. Values are type-checked.
- enrich-url (12¢ CAD): Enrich URL. Profiles one public page: title, summary, organisations and other entities, topics, sentiment and public contact points.
- enrich-company (14¢ CAD): Enrich company. Company profile from public web sources: name, description, industry, recent signals and the sources used.
- entity-extract (10¢ CAD): Entity extraction. Named entities of fixed types (person, organization, location, product, event, date, money, law, technology), each found verbatim in your text.
- keywords (10¢ CAD): Keywords. Key phrases of your text, each found verbatim in it; falls back to a frequency ranking if the model answer is unusable.
- sentiment (10¢ CAD): Sentiment. Positive, negative or neutral, with a score from -1 to 1, from a sentiment classifier over up to 8,000 characters.
- cf-ip-check (1¢ CAD): Cloudflare IP check. Says whether an IPv4 or IPv6 address is in Cloudflare's published edge ranges, and which range.
- wrangler-lint (2¢ CAD): Wrangler config lint. Lints a wrangler.jsonc or wrangler.toml: name, entry point, compatibility date, secrets left in vars, routes.
- cron-to-cf (1¢ CAD): Cron to Cloudflare trigger. Checks a cron expression against Cloudflare Cron Trigger syntax, explains it, lists the next runs and gives the wrangler snippet.
- mcp-config-validate (2¢ CAD): MCP config validator. Validates a Claude Code .mcp.json: transports, commands, URLs, headers and env, and flags literal secrets by path.
- claude-md-lint (2¢ CAD): CLAUDE.md lint. Lints a CLAUDE.md: size, structure, @imports, and secrets, passwords or email addresses that should not be there.
- hooks-validate (2¢ CAD): Claude Code hooks validator. Validates a Claude Code hooks block (or a whole settings.json): events, matchers, hook types, timeouts and risky commands.
- slash-command-scaffold (1¢ CAD): Slash command scaffold. Writes a ready-to-save Claude Code slash command file with frontmatter, $ARGUMENTS and a step outline.
- token-count (1¢ CAD): Token count estimate. Estimated token counts for cl100k-like, o200k-like, Claude-like and Llama-like tokenizers plus a char/4 baseline. Deterministic estimates, not exact counts.
- chunk-text (2¢ CAD): RAG text chunker. Splits text for retrieval by estimated tokens, sentences or markdown headings, with token overlap and stable SHA-256 chunk ids.
- dataset-validate (2¢ CAD): Fine-tune dataset validator. Checks chat (OpenAI-style), messages (Anthropic-style) or Alpaca JSONL: per-line errors, role order, empty turns, duplicates, token estimates and a training-cost estimate from your price.
- dataset-convert (2¢ CAD): Fine-tune dataset converter. Converts JSONL between OpenAI-style chat, Anthropic-style messages and Alpaca rows. System prompts move between the system message and the top-level field; rows that cannot convert are listed.
- dataset-split (1¢ CAD): Seeded dataset split. Deterministic seeded shuffle and train/val/test split of JSONL rows. The same seed and input always give the same split.
- embed (3¢ CAD): Text embeddings. Embeds 1 to 16 short texts with the fixed Workers AI model @cf/baai/bge-base-en-v1.5 (768 dimensions) for search and clustering.
- similarity (3¢ CAD): Semantic similarity ranking. Ranks up to 15 candidate texts by cosine similarity to a query, using @cf/baai/bge-base-en-v1.5 embeddings.
- prompt-lint (1¢ CAD): Prompt safety lint. Flags prompt-injection phrasing, chat-template tokens, hidden characters, PII and secrets per line, and lists {{variables}}. Rule-based, no model call; flagged text is never echoed.
- jwt-decode (1¢ CAD): JWT decoder. Decodes a JWT header and payload without verifying it, with warnings for alg none, missing or past exp, future nbf/iat and risky header fields.
- url-parse (1¢ CAD): URL parser. Splits a URL into scheme, host, port, path segments, query (repeated keys as arrays) and fragment, with warnings for credentials, plain http and punycode. Passwords are never echoed.
- base64 (1¢ CAD): Base64 encode and decode. Encodes UTF-8 text to standard or url-safe base64, or decodes either form; binary results that are not valid UTF-8 come back as hex.
- uuid (1¢ CAD): UUID generator. Generates 1 to 100 random v4 or time-ordered v7 UUIDs (RFC 9562) from Web Crypto.
- user-agent-parse (1¢ CAD): User-agent parser. Identifies browser, engine, OS, device class and known crawlers, AI bots and HTTP clients from a User-Agent string. Rule-based; user agents can be spoofed.
- cors-check (2¢ CAD): CORS check. Sends a GET with an Origin header (and an OPTIONS preflight for non-simple methods, custom headers or credentials) to a public URL and reports the Access-Control-* headers with an allowed/blocked verdict.
- openapi-lint (2¢ CAD): OpenAPI lint. Checks an OpenAPI 3.0/3.1 document (as JSON): version, info, paths, responses, unique operationIds, declared path parameters and unresolved local $refs.
- http-status (1¢ CAD): HTTP status lookup. Name, meaning, class, retryability and default cacheability of an HTTP status code, including Cloudflare's 52x codes.
- og-preview (3¢ CAD): Link preview (Open Graph). Fetches a public page (first 512 KB) and returns its link-preview metadata: title, description, image, Open Graph and Twitter tags, canonical URL, icons and missing tags.
- code-review (4¢ CAD): AI code review. Reviews a code snippet and returns concrete issues (bugs, security, performance, style) with severity and a fix for each.
- commit-message (2¢ CAD): Commit message writer. Turns a unified diff into a Conventional Commits message: type, scope, subject and body.
- regex-from-english (3¢ CAD): Regex from English. Writes a JavaScript regex from a plain-English description, compiles it, and tests it against your sample strings.
- sql-explain (2¢ CAD): SQL explainer. Explains a SQL query step by step and flags performance and safety risks, with index suggestions.
- semver (1¢ CAD): Semver resolver. Sorts versions by SemVer 2.0 precedence, returns the latest stable and pre-release, and the next major, minor and patch.
- page-markdown (3¢ CAD): Web page to Markdown. Fetches a public page and returns clean, LLM-ready Markdown of the main content, with title, word and link counts. No third-party scraper.
- json-extract (3¢ CAD): Structured extraction. Pulls the fields you name out of free text (emails, invoices, tickets) and returns strict JSON, null when a field is absent.
- tool-schema (1¢ CAD): Tool schema generator. Builds ready-to-paste tool definitions for Anthropic, OpenAI and MCP from a compact parameter spec.
- prompt-inject-scan (1¢ CAD): Prompt-injection scanner. Scans untrusted text (web pages, emails, tool output) for prompt-injection patterns before it reaches your agent; returns a risk score and the hits.
- seo-audit (3¢ CAD): On-page SEO audit. Audits a live page: title and description length, H1s, canonical, robots, lang, viewport, image alts, structured data and links, scored 0-100.
- contrast-check (1¢ CAD): WCAG contrast checker. Computes the WCAG 2.2 contrast ratio of two colours, pass/fail for AA and AAA, and the nearest passing foreground when it fails.
- robots-check (1¢ CAD): robots.txt checker. Reads a site's robots.txt and says whether a crawler may fetch a path, with the matching rule, the major AI crawlers' access and the sitemaps.
- webhook-verify (1¢ CAD): Webhook signature verifier. Verifies Stripe, GitHub, Slack, Shopify or generic HMAC-SHA256 webhook signatures exactly as the provider computes them, with timestamp tolerance.
- curl-to-code (2¢ CAD): curl to code. Converts a curl command into JavaScript fetch, Python requests, Go net/http or PHP code.
- mock-response (1¢ CAD): Mock API response. Generates realistic sample JSON from a JSON Schema or OpenAPI schema object, with field-aware values (emails, UUIDs, dates, URLs).
- rdap-lookup (2¢ CAD): Domain RDAP lookup. Modern WHOIS over RDAP: registrar, creation and expiry dates, days to expiry, status codes, nameservers and DNSSEC.