Skip to main content
Glama
TateLyman

x402-triage-mcp

by TateLyman
OverviewSchemaSourceRelated ServersScoreDiscussionsAdmin
TypeScript
Remote

x402-triage-mcp

ci

MCP server for no-payment x402 surface triage, 402 Index health checks, and paid review handoff.

It exposes three MCP tools:

  • triage_x402_surface checks one public x402, MPP, Pay.sh, OpenAPI, manifest, or HTTP 402 endpoint through the Tate Programs public triage API.

  • watch_402_index searches public 402 Index metadata for provider health, payment-validity, and domain-verification signals.

  • x402_paid_paths returns the paid x402 API endpoints, service catalog, AgentCard, and fixed-scope review links.

The tools do not send X-PAYMENT, wallet signatures, API keys, private credentials, or paid calls.

Tool page: https://tateprograms.com/x402-surface-check.html

Paid x402 API catalog: https://tateprograms.com/services.json

AgentCard: https://the402.tateprograms.com/.well-known/agent-card.json

Install

Run directly with npx:

npx --yes x402-triage-mcp

Related MCP server: PreFlight

MCP Config

Add this server to an MCP client that supports stdio servers:

{
  "mcpServers": {
    "x402-triage": {
      "command": "npx",
      "args": ["--yes", "--package", "x402-triage-mcp", "x402-triage-mcp"]
    }
  }
}

STDIO MCP client config launches a local command. Review the command, args, and any env values before running generated configs, and pin versions when repeatability matters.

Tools

triage_x402_surface

{
  "url": "https://api.example.com/.well-known/x402",
  "method": "GET",
  "origin": "https://app.example.com"
}

Returns status, payment headers, parsed challenge summary, attack-class checks, findings, and paid handoff paths.

watch_402_index

{
  "q": "example.com",
  "protocol": "x402",
  "limit": 10
}

Returns matching public 402 Index records, health summary, visible launch blockers, and paid handoff paths.

x402_paid_paths

Returns:

  • https://the402.tateprograms.com/api/x402/triage

  • https://the402.tateprograms.com/api/x402/index-watch

  • https://tateprograms.com/services.json

  • https://tateprograms.com/x402-five-attack-review.html

  • https://tateprograms.com/x402-fix-sprint.html

Payment And Safety Boundary

Use this server only on public launch surfaces that you own or are authorized to inspect. Do not submit private URLs, tokenized URLs, customer data, wallet seed phrases, or production secrets.

This MCP server is read-only. It does not initiate payments, send X-PAYMENT headers, sign wallet messages, call paid endpoints, create invoices, settle balances, or grant purchasing authority. The only paid paths it returns are static Tate Programs handoff URLs for teams that choose to buy a separate review.

For agent-commerce reviews, the server reports whether the target surface exposes the safety controls buyers expect before real spend is enabled:

  • Spend limits: per-call and total budget caps should be explicit before an agent can pay.

  • Approval checkpoints: payment setup and high-risk spend should require a visible user or policy approval step.

  • Recipient validation: paid requests should be constrained to expected domains, merchants, wallet addresses, or signed registry entries.

  • Replay protection: challenges and settlement callbacks should use nonces, expirations, idempotency keys, signed resources, or equivalent controls.

  • Metadata minimization: payment metadata should avoid private user context, secrets, and unnecessary resource detail.

  • Receipts and audit trails: successful payments should produce transaction IDs, recipient, amount, reason, and policy evidence.

Development

npm install
npm run check

Available Tools

3 tools
triage_x402_surfaceTriage x402 payment surfaceA
Read-onlyIdempotent

Run a no-payment external pass against one public x402, MPP, Pay.sh, OpenAPI, manifest, or HTTP 402 endpoint. The tool calls the Tate Programs public triage API and returns status, payment headers, parsed challenge shape, attack-class checks, cache/CORS notes, and paid review handoff. It does not send X-PAYMENT, wallet signatures, API keys, private tokens, or paid calls.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYesPublic HTTPS manifest, OpenAPI file, paid endpoint, or discovery URL to review.
methodNoNo-payment probe method. Use POST only for endpoints that intentionally expose a public paid POST route.GET
originNoOptional browser Origin for CORS/payment-header readability checks.

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, openWorld, and non-destructive. The description adds explicit guarantees that no X-PAYMENT, wallet signatures, API keys, private tokens, or paid calls are sent, plus lists return content. No contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences: first states the core action, second lists outputs and exclusions. No redundant text, well front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the read-only, open-world nature and absence of output schema, the description is complete: it explains what the tool does, what it returns, and what it deliberately avoids sending. No critical gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers 100% of parameters with meaningful descriptions. The description adds no extra parameter-specific guidance beyond what the schema provides, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb phrase ('Run a no-payment external pass') and lists concrete resource types (x402, MPP, Pay.sh, OpenAPI, manifest, HTTP 402 endpoint). It distinguishes itself from siblings by emphasizing 'no-payment' and 'triage' versus watching or paid paths.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear context for use: a single public endpoint, no payment, external triage pass. It does not explicitly name alternative sibling tools or exclude cases, but the scope is well defined.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

watch_402_indexWatch 402 Index listingsA
Read-onlyIdempotent

Look up public 402 Index service records by provider, domain, endpoint URL, or search term. Use this before listing, outreach, launch review, or re-check work to spot down services, invalid payment requirements, and unverified domains. This is public metadata only and does not send payment headers or paid calls.

ParametersJSON Schema
NameRequiredDescriptionDefault
qYes402 Index search term, provider name, domain, service URL, or endpoint URL.
limitNoMaximum records to return.
healthNoOptional health filter.
protocolNoProtocol filter.x402

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint. The description adds value beyond these by explicitly stating "does not send payment headers or paid calls," which clarifies financial side effects not covered by the hints alone. It also describes the kind of insights the lookup provides (spot down services, etc.), but does not elaborate on pagination or response format, keeping it just below a perfect score.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences, each with a distinct purpose: what the tool does, when to use it, and a safety clarification. It is fully front-loaded with the action verb and resource. No redundant or filler words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, but the description explains the practical utility (spot down services, invalid payment requirements, unverified domains). It covers the tool's purpose, use cases, and safety. Missing details like pagination or return counts are not explicitly stated, but the simplicity of the tool and the rich schema/annotations make this adequate with only minor gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description mentions provider, domain, endpoint URL, and search term, but this effectively mirrors the q parameter's schema description ('402 Index search term, provider name, domain, service URL, or endpoint URL'). No additional parameter semantics are added beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: "Look up public 402 Index service records by provider, domain, endpoint URL, or search term." This clearly distinguishes the tool from siblings by explicitly stating it handles public metadata and does not send payment headers or paid calls, contrasting with x402_paid_paths.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit usage context: "Use this before listing, outreach, launch review, or re-check work" and explains what it can reveal (down services, invalid payment requirements, unverified domains). It also includes an exclusion: "This is public metadata only and does not send payment headers or paid calls," guiding when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

x402_paid_pathsReturn x402 paid API pathsA
Read-onlyIdempotent

Return the Tate Programs paid x402 API endpoints, service catalog, AgentCard, and fixed-scope review handoff URLs.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=true and idempotentHint=true, so description only needs to add context. It does so by specifying the content of the return (endpoints, service catalog, AgentCard, handoff URLs), which goes beyond the annotations and helps set expectations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that is directly to the point, listing all the components returned. No filler or redundant information, making it highly concise and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a simple no-parameter read-only tool. The description covers the key return items, which is sufficient given the lack of output schema. It does not explain return format, but the listed items give a clear picture of what to expect.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, and schema coverage is trivially 100%. The baseline for no parameters is 4, and the description does not need to explain parameter behavior.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Return' and identifies the resource as 'Tate Programs paid x402 API endpoints, service catalog, AgentCard, and fixed-scope review handoff URLs.' It is specific about what the tool returns, though it does not explicitly differentiate from siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus the sibling tools 'triage_x402_surface' or 'watch_402_index.' The description simply states what it returns without contextualizing its appropriate usage or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 3 tool updatesv0.1.1
    • First observedtriage_x402_surface
    • First observedwatch_402_index
    • First observedx402_paid_paths
Install Server
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A4/5.0

Scored across 3 tools

Disambiguation5/5

Each tool targets a distinct function: triaging a live endpoint, looking up public index metadata, and retrieving paid service paths. There is no overlap in purpose or output.

Naming Consistency2/5

The naming convention is inconsistent: triage_x402_surface and watch_402_index follow a verb_noun pattern, but x402_paid_paths is a noun phrase. Additionally, the use of 'x402' vs '402' varies across tool names.

Tool Count5/5

Three tools is well-scoped for a specialized triage service, covering the core actions without redundancy. Each tool earns its place in the set.

Completeness4/5

The set covers the main workflows: triage, index lookup, and paid path discovery. Minor gaps exist such as not offering a way to update index records, but these are likely external concerns.

Maintenance

ActivityInactive
ResponsivenessWithin a week

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/TateLyman/x402-triage-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server