{"uid":"cap_8mPTSQ5RRSPyxEnOAXtLh","slug":"x402-payment-security-posture-auditor-4c47a475","name":"x402 Payment-Security Posture Auditor","description":"Grade any x402 seller's payment-security posture from the outside - a read-only black-box check mapped to the 'Five Attacks on x402' failure modes. Probes the URL's 402 challenge (never pays) and scores TLS transport, gated-response cache hygiene (Attack III / cache leakage), error/info-leak hygiene, and payment-terms well-formedness, then returns a letter grade with per-check findings and an honest note on what only insider/active testing can confirm.","url":"https://agent402.tools/api/x402-audit","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["url"],"properties":{"url":{"type":"string","description":"URL of the paid resource to audit"},"method":{"type":"string","description":"HTTP method to probe with (default GET)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","properties":{"url":{"type":"string"},"grade":{"type":"string"},"score":{"type":"integer"},"checks":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"title":{"type":"string"},"attack":{"type":"string"},"detail":{"type":"string"},"status":{"type":"string"},"severity":{"type":"string"}}}},"status":{"type":"integer"},"summary":{"type":"string"},"reachable":{"type":"boolean"},"x402Version":{"type":"integer"},"paymentRequired":{"type":"boolean"}}}}}}},"responseSchema":{"type":"json","example":{"url":"https://api.example.com/paid","grade":"A","score":92,"checks":[{"id":"transport-tls","title":"Payment challenge served over TLS","attack":"credential interception","detail":"https","status":"pass","severity":"high"},{"id":"cache-hygiene","title":"Gated response is not shared-cacheable","attack":"III - cache leakage","detail":"Cache-Control: no-store, private","status":"pass","severity":"high"}],"status":402,"summary":"A (92/100) - 6 passed, 1 warning, 0 failed. Note: replay/idempotency (II) and router Sybil (IV) can't be graded from outside.","reachable":true,"x402Version":2,"paymentRequired":true}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_1oUVm1hUFoD_-ua5ZpMld","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Black-box audits an x402-protected URL for payment-security vulnerabilities without making a payment, scoring TLS transport, cache hygiene, and gated-response exposure against the Five Attacks on x402 failure modes.","exampleAgentPrompt":"Run a black-box x402 security audit on https://api.example.com/premium-data — check the TLS grade, cache hygiene, and whether it passes the Five Attacks failure mode tests without me actually paying anything.","exampleUseCases":null,"resultDescription":"Returns a structured security posture report for the probed x402 endpoint, including a numeric score, TLS transport grade, cache hygiene evaluation, and per-failure-mode findings mapped to the Five Attacks on x402 taxonomy — all derived without submitting any payment.","failureModes":["Target URL is not a valid x402 endpoint (no 402 challenge returned) — audit cannot proceed","Target host is unreachable or times out — returns connection error","URL is malformed or missing — returns 400 validation error","Target blocks probe user-agent or IP — incomplete results with partial scoring","TLS handshake failure at target — TLS score marked as failed with error detail"],"whenToPreferThis":"Use this endpoint when you need a read-only, non-paying security assessment of any x402-gated resource — particularly when you want to verify that a seller's 402 implementation is hardened against known attack patterns (cache bypass, response leakage, weak TLS) before integrating with it or publishing it as a trusted service. Prefer this over manual inspection when you need a structured, scored report mapped to the Five Attacks taxonomy.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-13T12:53:09.179Z","isFirstParty":false}