Skip to main content
Glama

x402_preflight__audit

Audit up to 25 https x402 endpoints for silent revenue leaks: paid paths served free (HTTP 200), 402 bodies with no accepts[] that clients cannot pay, and paid paths missing from openapi.json. Price: $0.01 per call in USDC on Base (eip155:8453), paid with x402 in params._meta["x402/payment"]. HTTP: GET https://api.firstmention.uk/s/x402-preflight/audit

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "x402_preflight__audit"
  }
}

Input Schema

NameRequiredDescriptionDefault
endpointsNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. Added

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does substantial work: it discloses cost ($0.01 per call), the payment rail (USDC on Base, eip155:8453), the exact payment injection point (params._meta["x402/payment"]), the transport (HTTP GET) and endpoint URL, and the batch ceiling of 25. What it omits is the result shape and failure semantics — e.g. what happens if an endpoint is unreachable or more than 25 are supplied, and whether a call is still charged for failed targets.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the purpose and leak taxonomy, then trails with the commercial and transport details. Nearly every clause earns its place, though the raw HTTP GET URL is arguably redundant with the payment metadata and could be trimmed without losing selectivity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no annotations and no output schema, the description covers purpose, scope, cost, and payment mechanics well, but leaves two operationally important gaps: the wire format of the endpoints parameter and any indication of what the audit returns. For a paid batch tool that an agent must budget and parse for, those omissions matter.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single `endpoints` parameter has 0% schema description coverage and no type detail beyond 'string', so the description must compensate. It usefully constrains the input to https URLs and to a maximum of 25, but never states how multiple endpoints are encoded in a string (comma-separated, newline-delimited, JSON array), which is the one thing an agent most needs to call this correctly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb (audit) and resource (https x402 endpoints) and enumerates the three exact defects it detects: paid paths returning HTTP 200, 402 bodies with no accepts[], and paid paths absent from openapi.json. That is far more specific than a generic 'check endpoints'. It does not, however, contrast itself against the many audit/preflight/check siblings (x402_preflight__check, x402check__diligence, pageaudit__preflight), so the boundary between them is left to inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the enumerated leak conditions and the 'up to 25' cap, so an agent can infer this is a batch revenue-leak audit for seller-side endpoints. But there is no explicit when-to-use vs alternatives guidance, no statement of prerequisites (e.g. endpoints must already exist and be reachable), and no exclusions pointing to singular tools like x402_preflight__check.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources