Six checks, one question: did it change?

Every TLS endpoint makes promises: a chain a client will trust, a named owner, a date it stops being true. We handshake the way a browser does, write down what was presented, and compare it against what stood there last time.

Security headers are standing orders from a site to every browser: use HTTPS, run only these scripts, never frame this page. They live in server config and vanish quietly in a deploy. We ask for the page once, as a named scanner, and compare its headers against what stood there last time.

Traffic recorded today can be opened later, once the machine to open it exists. Hybrid key exchange closes that window. We ask your endpoint three questions in three handshakes, and record which answers it is willing to give.

A name is the front door, and everything follows it. We ask one record type at one name, write the answers down as a set, and compare that set with the last one. A TTL ticking down is not a change; the records are.

An MCP server tells agents which tools exist and what they do. A description rewritten quietly is a new instruction to every agent that reads it, and nothing else would show you. We speak the protocol, list what is on offer, and diff it.

robots.txt is the one place you tell crawlers and AI agents what they may take. It is edited by hand, rarely, and a deploy can replace it without anyone reading the diff.

An agent card is what another system reads before it calls you: who you are, what you can do, where to send the request and how to authenticate. When it drifts, your callers are working from an older answer than you think.

x402 turns HTTP 402 into a working handshake, so an agent can pay per call with no account to open first. The terms quoted there are money, so a change to them is a change to what your callers pay. We ask one path once and never pay, so the quote is all we ever hold.