x402-audit-mcp

audit_x402_and_a2a_endpoint

Read-onlyIdempotent

Audits any remote agent or MCP URL for JSON-RPC compliance, latency SLA, OpenAPI schema, and HTTP 402 settlement headers. WHEN TO USE: Call audit_x402_and_a2a_endpoint when your task requires deterministic x402-audit analysis for url; use get_agent_wallet_status to check your remaining free trial quota or prepaid balance. WHEN NOT TO USE: Do not use for unrelated domains or binary media. PARAMETER INTERACTIONS: Pass the target url as a non-empty string; omit agent_id and tx_hash during your 5 free trial calls, or supply agent_id (agd_pass_...) / tx_hash for paid execution. Read-only and idempotent; results are cached for 1 hour (<5ms cache hit). $0.01 per call. Pricing: the first 5 calls per agent_id are free and failed calls are never charged. After 5 calls, the tool returns a payment-required quote (not a fatal error) with a $2 Stripe top-up link and Base/Solana USDC addresses; complete payment, then retry with your agd_pass_ key in agent_id or pass tx_hash. Example: audit_x402_and_a2a_endpoint(url='https://docs.stripe.com/api')

Input Schema

Name	Required	Description
`url`	Yes	Target A2A, MCP, or x402 service URL to audit for protocol compliance.
`tx_hash`	No	Optional on-chain Base Mainnet (0x...) or Solana SPL USDC transaction hash. Omit unless settling an individual call directly on-chain instead of using an agd_pass_ key in agent_id.
`agent_id`	No	Optional agent identifier or prepaid agd_pass_ session key. Omit during your 5 free trial calls to use an ID automatically derived from your client IP, or pass your agd_pass_ key after topping up.

Output Schema

Name	Required	Description
`data`	No	Structured tool output payload.
`status`	Yes	Execution status ('ok' or 'payment_required').
`roi_proof`	No	Token compression and cost-savings verification metrics.

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedOct 19, 2026

addedInput schema / examples

Added value: +[
+  {
+    "url": "https://docs.stripe.com/api"
+  }
+]

Changed8 schema fields changedOct 18, 2026

changedInput schema / additionalProperties
```
Previous value: -trueNew value: +false
```

changedInput schema / properties / agent_id / description

Previous value: -"Your agent ID, or the agd_pass_ key you got from a payment. It tracks your free calls and credit, so treat it like a password. Omit it to use an ID derived from your IP and client."New value: +"Optional agent identifier or prepaid agd_pass_ session key. Omit during your 5 free trial calls to use an ID automatically derived from your client IP, or pass your agd_pass_ key after topping up."

addedInput schema / properties / agent_id / maxLength
```
Added value: +256
```
addedInput schema / properties / agent_id / minLength
```
Added value: +1
```

changedInput schema / properties / tx_hash / description

Previous value: -"Use only after paying on-chain: the Base (0x...) or Solana USDC transfer hash. It is verified on-chain before the call runs, and any overpayment is returned as an agd_pass_ credit key."New value: +"Optional on-chain Base Mainnet (0x...) or Solana SPL USDC transaction hash. Omit unless settling an individual call directly on-chain instead of using an agd_pass_ key in agent_id."

addedInput schema / properties / tx_hash / maxLength
```
Added value: +256
```
addedInput schema / properties / tx_hash / minLength
```
Added value: +10
```

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "properties": {
+    "data": {
+      "description": "Structured tool output payload.",
+      "type": "object"
+    },
+    "roi_proof": {
+      "description": "Token compression and cost-savings verification metrics.",
+      "type": "object"
+    },
+    "status": {
+      "description": "Execution status ('ok' or 'payment_required').",
+      "type": "string"
+    }
+  },
+  "required": [
+    "status"
+  ],
+  "type": "object"
+}

Changed3 schema fields changedOct 16, 2026

changedInput schema / properties / agent_id / description

Previous value: -"Optional Agent ID or Session Pass (agd_pass_...)"New value: +"Your agent ID, or the agd_pass_ key you got from a payment. It tracks your free calls and credit, so treat it like a password. Omit it to use an ID derived from your IP and client."

changedInput schema / properties / tx_hash / description

Previous value: -"Optional Base (0x...) or Solana USDC tx hash"New value: +"Use only after paying on-chain: the Base (0x...) or Solana USDC transfer hash. It is verified on-chain before the call runs, and any overpayment is returned as an agd_pass_ credit key."

changedInput schema / properties / url / description

Previous value: -"Target A2A, MCP, or x402 service URL to audit for protocol compliance"New value: +"Target A2A, MCP, or x402 service URL to audit for protocol compliance."

Changed3 schema fields changedOct 16, 2026

changedInput schema / additionalProperties
```
Previous value: -falseNew value: +true
```

addedInput schema / properties / agent_id

Added value: +{
+  "description": "Optional Agent ID or Session Pass (agd_pass_...)",
+  "type": "string"
+}

addedInput schema / properties / tx_hash

Added value: +{
+  "description": "Optional Base (0x...) or Solana USDC tx hash",
+  "type": "string"
+}

Changed3 schema fields changedOct 15, 2026
- addedInput schema / additionalProperties
```
Added value: +false
```
- addedInput schema / properties / url / maxLength
```
Added value: +99999
```
- addedInput schema / properties / url / minLength
```
Added value: +1
```

Changed1 schema field changedOct 14, 2026

changedInput schema / properties / url / description

Previous value: -"Target x402 or A2A service URL to audit for protocol compliance"New value: +"Target A2A, MCP, or x402 service URL to audit for protocol compliance"

First observedOct 13, 2026

TDQS

A4.8/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations: discloses 1-hour result caching with <5ms cache hits, $0.01 per-call pricing, a 5-call free trial, that failed calls are never charged, and that exhausted quota returns a payment-required quote rather than a fatal error, including top-up mechanisms (Stripe link, Base/Solana USDC). This is exactly the behavioral context an agent needs before invoking.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core purpose and organized under clear labeled sections, which aids scanning. However, the pricing/trial terms are restated multiple times ($0.01 per call, first 5 free, then re-explained), so some sentences are redundant rather than additive.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described. The description fully covers the billing lifecycle, caching, trial limits, and parameter interplay, leaving nothing an agent needs to call the tool correctly unstated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3, but the PARAMETER INTERACTIONS section adds genuine meaning: use only url during free trials, and supply agent_id (agd_pass_) or tx_hash for paid execution. This encodes the mutual-exclusion/branching logic between optional params that the schema lists but does not relate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Audits) plus the resource (remote agent or MCP URL) and enumerates exactly what is checked: JSON-RPC compliance, latency SLA, OpenAPI schema, and HTTP 402 settlement headers. It also names the sibling get_agent_wallet_status and its distinct role, so the agent can differentiate without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit WHEN TO USE and WHEN NOT TO USE sections, with a named alternative (get_agent_wallet_status) tied to a concrete condition (checking trial quota/prepaid balance). Exclusions for unrelated domains and binary media remove ambiguity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All x402-audit-mcp tools Inspect

Try in Browser

Shareable, User-Owned Context BackendPeople, applications, and agents read, write, and coordinate together in one context lake. Reach it over MCP, a CLI, a Python SDK, or REST.fulcradynamics.comAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?