Skip to main content
Glama

conform_x402_endpoint

Live adversarial test: fires malformed/garbage/fake payment proofs at a target to see if any trick it into returning 200 without a real payment. Requires payment (0.05 USDC on Base, x402) -- NOT callable for free over MCP. Calling this tool returns the exact HTTP request to make instead; it does not run the check itself. See GET /conform?url=... on this same origin.

Input Schema

NameRequiredDescriptionDefault
urlYesAbsolute http(s) URL of the paid endpoint to check (should return HTTP 402).

Schema Changelog

Changes observed during successful MCP inspections.

  1. Added

TDQS

A4.1/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries the full disclosure burden and meets it: it names the fee and payment rail, states the tool does not run the check itself, and explains that the return value is the exact HTTP request to make. This prevents the most likely agent error, assuming a test result comes back. It also points to the GET /conform?url=... endpoint on the same origin.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose and the adversarial technique are front-loaded in the first clause, and each following sentence adds a distinct operational fact (cost, non-execution, alternative endpoint). It is dense with em-dashes and parentheticals but has no filler. A slightly cleaner separation of the payment terms would read better.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter tool with no output schema and no annotations, everything an agent needs is present: what the test does, its cost and payment rail, the fact that it returns a request rather than a verdict, and where the equivalent GET endpoint lives. Nothing required to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter has 100% schema description coverage, including that it must be an absolute http(s) URL expected to return 402, so the schema already does the work. The prose adds only the example query form GET /conform?url=..., which is marginal. A baseline of 3 is correct when schema coverage is complete.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: it fires malformed/fake payment proofs at a target URL to test whether the endpoint is tricked into returning 200 without payment. That is far more concrete than a name restatement. It does not explicitly name the siblings lint_x402_endpoint or deep_lint_x402_endpoint, though 'live' versus 'lint' implies the distinction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description sets essential expectations for use: the call is paid (0.05 USDC on Base via x402), it is not free over MCP, and invoking the tool returns an HTTP request to execute rather than a check result. That is strong guidance about what calling actually does. It never states when an agent should prefer this live adversarial probe over the lint siblings, leaving the choice to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources