Skip to main content
Glama

Verify signed x402 receipt (official offer-receipt format)

verify_x402_receipt

Verify a signed receipt in the official x402 offer-receipt extension format (docs.x402.org/extensions/offer-receipt, npm @x402/extensions). Accepts {format:"jws", signature} artifacts (JWS with EdDSA/Ed25519 or ES256/P-256), checks structure, required payload fields (version/network/resourceUrl/payer/issuedAt), cryptographic signature, optional freshness window, and optional expected values. Public key resolves automatically from did:key/did:web/did:jwk kid, or pass public_key_jwk directly. Read-only, no cost.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
expectNoOptional assertions: {resourceUrl?, payer?, network?} — verification fails if the payload contradicts them.
receiptYesSigned receipt artifact, e.g. {"format":"jws","signature":"<JWS compact serialization>"}
public_key_jwkNoOptional JWK to verify with. Omit to resolve from the kid (did:key:z... Ed25519, did:web, did:jwk).
max_age_secondsNoFreshness window for issuedAt (default 3600; pass 0 to skip the freshness gate).

Schema Changelog

Changes observed during successful MCP inspections.

  1. Added

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and discloses that it is read-only and no-cost, checks structure, payload fields, cryptographic signature, freshness, and expected values, and resolves keys from DIDs. It does not describe the exact return shape or error output, which remains a gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but front-loaded with the core purpose and then layers relevant verification details without obvious filler. It could be slightly tightened, but every clause contributes useful information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a nested-input verifier with no annotations and no output schema, the description covers inputs, verification stages, key resolution, freshness, and expected-value assertions thoroughly. The main omission is the success/return format, which is not fully specified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is already 100%, but the description adds supported algorithm details (EdDSA/Ed25519, ES256/P-256) and explains automatic public-key resolution from did:key/did:web/did:jwk when public_key_jwk is omitted. These details go beyond the schema text.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Verify') and resource ('signed receipt') constrained to the official x402 offer-receipt extension format. This scoping distinguishes it from the generic sibling verify_receipt without needing to name it explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly scopes use to the x402 offer-receipt extension format and cites the docs/npm package, giving the agent enough context to choose this over a generic verifier. However, it does not explicitly say when not to use it or name alternative siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.