Skip to main content
Glama

agent-audit + page-read (x402)

Audit an x402 seller

audit_x402_seller
Read-only

Paid, $0.02 USDC on Base via x402 (agent-audit). Read-only x402 seller and agent-readiness audit of one origin: live 402 challenge per paid route, price vs catalog, llms.txt, /.well-known/x402, openapi.json, dead doc links. JSON score, findings and fixes. Grades measure protocol conformance, not legitimacy. Call without payment to get the x402 requirements.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
urlYesOrigin or paid endpoint URL
paymentNoOptional. A signed x402 v2 PaymentPayload for this tool's PaymentRequired (as an object, or base64 as in the PAYMENT-SIGNATURE HTTP header). Prefer params._meta["x402/payment"]. Omit it to get the exact payment requirements first.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/openWorld/idempotent=false/destructive=false, and the description goes well beyond them by disclosing the exact cost and rail ('$0.02 USDC on Base via x402'), the return shape ('JSON score, findings and fixes'), and a genuine limitation ('Grades measure protocol conformance, not legitimacy'). That last caveat is the kind of subtle behavioral signal an agent could not infer from the schema or annotations and directly affects how results should be interpreted.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Dense but front-loaded: price and rail first, then the audited surface, then output shape, then the payment bootstrap hint — every sentence carries signal. It is fragmentary rather than prose (the core purpose is a noun phrase, not a verb), which costs a little readability but wastes no words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description correctly covers the return value ('JSON score, findings and fixes') and the paid-invocation protocol, which are the two things an agent cannot read off structured fields. It stops short of describing error or failure behavior for an unreachable origin, a minor gap for an open-world network tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters (url and the x402 payment payload) are already documented in the schema. The description reinforces the payment semantics by advising a payment-less first call, but adds no format or syntax detail beyond what the schema states. Baseline 3 is appropriate when the schema carries the parameter burden.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource — a read-only x402 seller / agent-readiness audit — plus its exact scope ('of one origin') and enumerates the checks performed (402 challenge per paid route, price vs catalog, llms.txt, /.well-known/x402, openapi.json, dead doc links). This clearly separates it from siblings such as check_links or preview_audit, which do not combine live 402 probing with protocol-conformance grading.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit operational guidance for the paid flow: 'Call without payment to get the x402 requirements,' which tells the agent exactly how to bootstrap the two-step invocation. It also scopes usage to a single origin. However, it never contrasts itself with the closest siblings (preview_audit, check_links) or states when a full audit is warranted versus a cheaper preview, so a 4 rather than 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.