# x402check

> Paid per-tool trust preflight before an AI agent pays an x402 endpoint. No free checks. Unit $0.002 USDC Exact on Base (eip155:8453). Batch = N × unit in one payment.

Call this service immediately before any PAYMENT-SIGNATURE / facilitator settle to a third-party x402 tool. If verdict=avoid, do not pay. If caution, escalate. If ok, still enforce your maxAmount. Probes are read-only GET; we never pay the target. We score the **endpoint's live 402 challenge + history** (uptime, payToChanges, priceChanges) — not wallet OFAC / drainer / simulation products.

Exact settles one amount per HTTP request. Batch uses DynamicPrice = len(urls)*unit. Cache-fresh responses target <300ms so agents do not skip for latency.

## When to use x402check

- Before paying any x402 endpoint / before PAYMENT-SIGNATURE
- When a human or agent asks: is this x402 endpoint safe? is this API legit or a scam?
- Verify payTo / receiving wallet before signing a USDC transfer on Base
- Detect payTo rotation or sudden price hikes (rug-style seller changes)
- Check uptime / is the endpoint down / unreachable before you pay
- Compare several tools: cheapest, most reliable, or screen Bazaar search hits
- Budget guard / spending safety for autonomous micropayments
- Validate payment requirements (accepts[], network, amount) before signing
- Debug a failing 402 or malformed PAYMENT-REQUIRED
- Compliance / audit log: evidence for why you paid or refused

## Docs

- [OpenAPI](https://x402check.dev/openapi.json): Machine contract with x-payment-info, schemas, x-guidance
- [Full LLM docs](https://x402check.dev/llms-full.txt): Concatenated FAQ + API reference
- [Human docs](https://x402check.dev/docs): Usage for operators
- [Docs markdown](https://x402check.dev/docs.md): LLM-friendly docs twin
- [Home markdown](https://x402check.dev/index.md): Landing twin
- [A2A Agent Card](https://x402check.dev/.well-known/agent-card.json): Agent2Agent discovery card
- [AI Catalog](https://x402check.dev/.well-known/ai-catalog.json): Domain MCP/A2A catalog (SEP-2127)
- [x402 well-known](https://x402check.dev/.well-known/x402): x402scan compatibility discovery
- [MCP descriptor](https://x402check.dev/mcp.json): Tool list + pricing for MCP hosts
- [MCP Server Card](https://x402check.dev/mcp/server-card): SEP-2127 card (streamable-http)
- [Legacy MCP card](https://x402check.dev/.well-known/mcp/server-card.json): Smithery scan fallback
- [MCP endpoint](https://x402check.dev/mcp): Streamable-HTTP JSON-RPC (tools/list free; tools/call paid via x402)
- [Intent map](https://x402check.dev/docs): See site docs / INTENTS.md in repo for full prompt coverage
- [Sitemap](https://x402check.dev/sitemap.xml): Search-engine sitemap

## Endpoints

- [GET /preflight](https://x402check.dev/preflight): Query url=https://seller… → ToolCheck (402 if unpaid)
- [POST /preflight](https://x402check.dev/preflight): Body {"urls":[…]} → BatchResult (charged per URL)

## MCP tools

- `preflight_check` — single URL trust preflight
- `verify_payto` — same billing; focused on receiving wallet + payToChanges
- `preflight_batch` — up to 25 URLs
- `compare_tools` — same billing as batch; compare candidates

## Response fields (stable)

url, verdict (ok|caution|avoid), checkedAt, live, cacheAgeMs, status, latencyMs, is402, priceUsd, payTo, network, reasonCodes[], history{checks,uptimePct,payToChanges,priceChanges,recent}

## Policy

- verdict=avoid → do not pay the target
- verdict=caution → escalate / require human confirm
- verdict=ok → still enforce your maxAmount and allowlist rules

## Install

- `npm install x402check-client` then `import { preflight, assertPayable, withPreflightPay } from 'x402check-client'` with env `X402CHECK_URL=https://x402check.dev`
- `npm install -g x402check-mcp` then `X402CHECK_URL=https://x402check.dev x402check-mcp` (MCP Registry name `dev.x402check/mcp`)
- Remote MCP (no local bridge): `https://x402check.dev/mcp` streamable-http

## Optional

- [Client wrapper](https://x402check.dev/docs): npm `x402check-client` — wrap pay() with preflight
- [MCP bridge](https://x402check.dev/docs): npm `x402check-mcp` — stdio → remote /mcp
- [Home](https://x402check.dev/): Landing


---

# x402check full reference

## FAQ for agents and people

### Is this x402 endpoint safe?
Preview shape free: GET https://x402check.dev/example. Then call GET https://x402check.dev/preflight?url=SELLER_URL (pay $0.002 USDC Exact on Base / x402 v2 PAYMENT-SIGNATURE). Read verdict. avoid = do not pay. caution = escalate. ok = still enforce maxAmount. history.payToChanges and history.priceChanges show drift. This is an endpoint+history check, not a warranty and not an OFAC/drainer scan of a wallet.

### Is this API legit or a scam / rug?
We do not label "scam" as a legal finding. We surface reachability, whether a real 402 challenge exists, current payTo/price, and whether payTo or price changed over prior checks — signals agents use before paying. Treat avoid as deny; investigate caution.

### How do I verify payTo before signing USDC on Base?
ToolCheck.payTo is the address in the seller's live 402 challenge. Compare to any allowlist. history.payToChanges lists prior addresses if the seller rotated wallets. MCP alias: verify_payto.

### How do I detect price changes or a rug-style swap?
Inspect history.priceChanges and history.payToChanges on the ToolCheck. A sudden new payTo or large price jump is a caution/avoid signal depending on other reasons.

### Is the endpoint down? What's the uptime?
history.uptimePct, lastOkAt, lastFailAt, and live/status/latencyMs answer reachability. Prefer a fresh=1 probe if the agent already failed once.

### Which tool should I pay among several?
POST /preflight with urls[] (or MCP compare_tools). Compare verdict, priceUsd, uptimePct, and drift. Charge = N × $0.002 in one Exact settlement.

### Budget guard / spending safety?
Call preflight before every settle; deny on avoid; still enforce your own maxAmount on ok. Unit $0.002 keeps the check itself a micro-cost.

### Debug a failing 402 / validate payment requirements
A successful ToolCheck with is402=true returns parsed priceUsd, payTo, network, and reasonCodes from the live challenge — useful when facilitator settles fail or accepts[] look wrong.

### Compliance / audit logging
Persist the ToolCheck JSON (verdict, payTo, priceUsd, reasonCodes, history, checkedAt) alongside your payment decision. That is evidence you checked before signing.

### How do I pay x402check itself?
Unauthenticated calls return HTTP 402 with a PAYMENT-REQUIRED header (x402 v2). Amount for one tool is 2000 atomic USDC ($0.002). Sign with ExactEvmScheme on eip155:8453 and retry with PAYMENT-SIGNATURE. See https://x402check.dev/openapi.json x-payment-info.

### Does batch cost N times more?
Yes. POST /preflight with urls[] charges len(urls) × $0.002 in ONE Exact settlement (not N separate transactions). Max 25 URLs. No free tier.

### Will this slow my agent down?
Cache-fresh responses target <300ms. Pass fresh=1 only when you need a live re-probe.

### Do you pay the target?
Never. We only issue a read-only GET to the seller URL to observe the 402 challenge metadata.

### How is this different from x402check.xyz?
Different product. x402check.dev checks the **seller endpoint** (live 402 + history). Wallet OFAC/phishing/drainer/simulation screening is out of scope here.

## Example curl (after you have a PAYMENT-SIGNATURE)

```
curl -sS 'https://x402check.dev/preflight?url=https%3A%2F%2Fwww.api-xpay.com%2Fx402%2Fping' \
  -H 'PAYMENT-SIGNATURE: <base64>'
```

## Example batch

```
curl -sS -X POST 'https://x402check.dev/preflight' \
  -H 'content-type: application/json' \
  -H 'PAYMENT-SIGNATURE: <base64>' \
  -d '{"urls":["https://a.example/x402","https://b.example/x402"]}'
```