Skip to main content
Glama

x402 Code Review

ontario_x402-implementation-audit

Use when a provider or developer needs a bounded, task-specific x402 code review for a public endpoint or GitHub repository. Returns payment, discovery, security, debugging, and launch findings without returning source contents or secret values. Agent payment guidance: run free can-pay and readiness checks first; pay only when policy allows base 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 and 0.01 USDC is inside the agent budget. [PAID: 0.01 USDC via x402 on Base. Two-step flow: call without payment to receive MCP PaymentRequired, then retry with params._meta['x402/payment'] containing the signed PaymentPayload. The legacy _x402_payment base64 argument is also supported. Sign only after explicit budget and policy approval.]

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
focusNoArea of the x402 implementation to review: launch readiness, payment handling, discovery metadata, or security.launch
endpoint_urlNoPublic HTTPS x402 endpoint to inspect.
_x402_paymentNobase64 x402 PaymentPayload (USDC on Base); obtain the requirements by calling this tool without it first.
repository_urlNoPublic GitHub repository containing the x402 implementation.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. Added

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description thoroughly discloses the paid nature, the two-step payment flow (call without payment, receive PaymentRequired, retry with payment payload), and the legacy argument support. It also clarifies that it returns findings without source contents or secret values. This adds substantial context beyond the annotations, which only provide generic hints (readOnlyHint false, etc.) and do not cover payment specifics.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is longer than typical but front-loads the core purpose and then details payment flow. Every sentence contributes necessary operational information for a paid tool, so the length is justified. It could be trimmed slightly, but it is well-organized with the primary use case first.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (paid, two-step flow, multiple focus areas, two input modes), the description covers all essential aspects: when to use, how to pay, what it returns (and doesn't return), and the parameter relationship. The output schema exists, so return format is already specified, and the description doesn't need to repeat that.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds value by explaining the payment workflow tied to the _x402_payment parameter and clarifies the either/or relationship between endpoint_url and repository_url through the anyOf constraint. This goes beyond the schema's individual parameter descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool performs a bounded, task-specific x402 code review for a public endpoint or GitHub repository, listing the areas of findings (payment, discovery, security, debugging, launch). It is specific enough to distinguish from generic code review tools, but does not explicitly name or contrast with sibling tools like github_x402_repo_scan or x402_launch_kit, so it misses full differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description advises when to use it ('provider or developer needs a bounded, task-specific x402 code review') and gives ordering guidance ('run free can-pay and readiness checks first; pay only when policy allows'). It implies using other tools first but does not explicitly name alternatives or exclusions, leaving some inference to the agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.