Prospect Brief

What it runs

1. 1
   Email Validation

   Source: Algorithmic (syntax) + DNS protocol (MX record verification)

2. 2
   Email Deliverability Check

   Source: DNS protocol (SPF, DKIM, DMARC record verification) + blacklist check

3. 3
   Domain Reputation

   Source: Threat intelligence feeds (multi-source scoring)

4. 4
   Tech Stack Detection

   Source: HTTP response analysis (headers, JavaScript libraries, meta tags)

The answer returns every step’s result, so your agent can show or check each one.

Inputs

How to call it

# Needs an API key. The whole check is charged once, at the listed price.
curl -X POST https://api.strale.io/v1/solutions/prospect-brief/execute \
  -H "Authorization: Bearer $STRALE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "inputs": {
      "email": "[email protected]"
    },
    "max_price_cents": 30
  }'

# No account. The first request answers 402 with the price in USDC;
# an x402 client pays it from your wallet and repeats the request.
curl -i -X POST https://api.strale.io/x402/v2/solutions/prospect-brief \
  -H 'Content-Type: application/json' \
  -d '{
    "email": "[email protected]"
  }'

The bundle’s published example input.

Limitations

• Disposable email detection covers major providers but new throwaway domains may not be flagged

  From step: Email Validation

  What to do instead: Check the domain’s age when investigating suspicious traffic.

• No mailbox is contacted. A made-up or bouncing address can return valid if its syntax is correct, its domain has mail servers, and it is not flagged as disposable. Catch-all domains are one example; mailbox existence and delivery are never checked.

  From step: Email Validation

  What to do instead: Require confirmation through a verification link before relying on a mailbox.

• SMTP verification may be blocked by some mail servers — a 'deliverable' result is not guaranteed delivery

  From step: Email Deliverability Check

  What to do instead: Treat SMTP-verified results as 'likely deliverable' and implement bounce handling in your email pipeline for definitive status

• Reputation scores aggregate multiple blocklists — a single listing may not indicate actual malicious activity

  From step: Domain Reputation

  What to do instead: Check which specific blocklist flagged the domain in the response details and verify the listing reason before blocking

• Blocklist data refreshed daily — recently resolved issues may still show negative reputation for 24-48 hours

  From step: Domain Reputation

  What to do instead: If a domain was recently cleaned, re-check after 48 hours and use the trend direction to assess improvement

• Trustpilot, Glassdoor, LinkedIn, Google Search, Google Patents, Reddit and the major social platforms (Facebook, Instagram, X) are not supported and return a policy error before the page is read. Repeating the same request does not return content.

  From step: Tech Stack Detection

• Database covers 1,000+ technologies — niche or custom-built tools may not be identified

  From step: Tech Stack Detection

  What to do instead: Check the raw HTTP headers in the response for custom X-Powered-By or Server values that indicate unlisted technology

• Detection based on HTTP headers, JavaScript libraries, and HTML signatures — technologies loaded conditionally or server-side only may not be detected

  From step: Tech Stack Detection

  What to do instead: Complement with dns-lookup and ssl-check results to infer infrastructure choices not visible in the HTML

• Pages with more than 16 MiB of HTML are refused with a caller_input error naming the input field. The call is not charged, and the page is not retried through another fetch or rendering route.

  From step: Tech Stack Detection