Favicons.

GET /icon?url=<url> returns the favicon of any site as an image, served with an open CORS policy so any page — a dashboard, a link list, found.as — can embed it directly. Results are cached, and a missing favicon is an honest 404, never a placeholder.

Use

Embed it as an image. The url value must be URL-encoded.

GET /icon?url=https%3A%2F%2Fexample.com

<img src="https://cc.me/icon?url=https%3A%2F%2Fexample.com"
     width="16" height="16" alt="">

The response is the raw image (image/x-icon, image/png, image/svg+xml, …) with Cache-Control: public, max-age=604800. Handle misses on the client:

<img src="https://cc.me/icon?url=https%3A%2F%2Fexample.com"
     onerror="this.replaceWith(myFallback())">

Behavior

Discovery parses the page for <link rel="icon"> (and apple-touch-icon, shortcut icon) and falls back to /favicon.ico. The first response whose bytes are a real image wins.
The favicon is looked up per origin (scheme + host + port), so https://example.com/a and https://example.com/b share a result.
Results are cached: hits for a week, misses for an hour, so repeated embeds don't re-fetch the target.
Only http and https URLs are accepted, and requests to private, loopback, link-local, or other non-public addresses are refused — including across redirects.
Responses are capped in size and time; oversized or slow targets yield a miss.

Errors

400: Missing or malformed url, a non-http(s) scheme, or a host that is a disallowed literal IP.
404: No favicon could be found for the origin. Substitute your own icon client-side.
502: The cache lookup failed. Safe to retry.