x402 Endpoint Scanner
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| scan_endpointA | Free, local, no-payment health probe for one x402 endpoint. GETs the URL (retries once as POST with {} on a 405), then checks: is the response HTTP 402; does it carry a valid PAYMENT-REQUIRED envelope (Base64 JSON with numeric x402Version and a non-empty accepts[] where every entry has scheme/network/asset/payTo/amount), falling back to checking the body for an x402Version field; and does it also advertise MPP dual-stack via WWW-Authenticate: Payment. Grades A (valid envelope + MPP dual-stack), B (valid envelope only), C (402 but the envelope is missing or malformed), or F (not 402, unreachable, or serving paid content for free). Never sends a PAYMENT-SIGNATURE and cannot spend funds — this only inspects the challenge shape. Refuses non-http(s) URLs, localhost/.internal/.local hosts, private/reserved IPs, and ports outside 80/443/8080/8443; never follows redirects; caps the response body at 64KB; makes at most 2 requests. |
| scan_batchA | Runs scan_endpoint sequentially over a list of URLs (max 10) and returns each full result plus a one-line summary, e.g. '7/10 healthy, 2 dead, 1 broken envelope'. One bad URL never aborts the batch — its error is reported per-item instead. Same no-spend, SSRF-guarded probe as scan_endpoint applied to every URL. |
| census_statsA | Fetches the latest ForgeMesh catalog stats (best-effort, 5s timeout, no input required) alongside the static headline numbers from the August 2026 x402 Bazaar health census: 1,225 sellers probed, 74% healthy, 206 dead, 40 serving paid content for free, and 15% MPP dual-stack. Source: https://forgemesh.io/blog/x402-bazaar-health-census-august-2026 |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 3 tools
Each tool occupies a clearly separate slot: one endpoint probe (scan_endpoint), a sequential driver over up to 10 URLs (scan_batch), and a catalog-stats fetcher (census_stats). The overlap between scan_endpoint and scan_batch is explicit and documented, so an agent can pick correctly without guessing. No two tools could plausibly be swapped for the same intent.
All names are snake_case and readable, with scan_endpoint/scan_batch forming a clean verb_noun pair. census_stats breaks the verb-first pattern by being noun-only, a minor but noticeable deviation from an otherwise tight convention.
Three tools is a small but defensible surface for a focused endpoint scanner, and each has a distinct job. census_stats is somewhat tangential (static blog numbers plus a best-effort catalog fetch), which makes the set feel slightly padded at the edges even though nothing is redundant.
The core lifecycle is covered: single probe, batched probe with per-item error isolation, and catalog context, all with a defined A/B/C/F grade and documented safety guards. Gaps are minor — there is no way to inspect or validate a PAYMENT-REQUIRED envelope in isolation, and no persistence/export of prior scan results for the batch case.