What it checks
Every check answers one question: what concretely breaks when this fails? These come from running a production x402 and MPP gateway and losing real settlements to each one.
| check | what breaks when it fails |
|---|---|
| Returns 402 unpaid | No 402, no price discovery. An agent cannot pay for what it cannot be quoted. |
| x402Version | Clients branch on the version to pick a parser. v1 body-only gets rejected by some wallets. |
| Header transport | Lets a client detect a paywall without buffering and sniffing the body. |
| Concrete amount | Unpriced rails force a blind signature. Reads v2 amount and v1 maxAmountRequired. |
| CAIP-2 legality | A reference over 32 chars is not a valid chain id, so strict clients never match the rail. |
| Solana extra.feePayer | exact-SVM cannot build a transaction without it. Hardcode it and you break when it rotates. |
| I/O schema | Without a declared shape, catalogues cannot generate a working example — you are unlistable. |
| Mandatory spend cap | An optional cap on per-item billing lets an agent trigger an unbounded charge. |
| 402 explains itself | An empty 402 gives whoever is debugging an agent nothing to go on. |
| x-payment-info per operation | Scanners read it per operation. Without it every endpoint reads as unpaid. |
| Real /llms.txt | A 200 of HTML is worse than a 404 — crawlers index navigation chrome as your docs. |
| MCP door | No door, invisible to Claude, Cursor and the agent marketplaces. |
Questions
- Does auditing a service cost anything, or send a payment?
- No. The audit sends only unpaid GET/POST probes and reads the 402 challenge that any client already receives before paying. It never signs or sends a payment, so an audit costs the audited operator nothing.
- What does the score mean?
- It is weighted so that anything which stops a payment outright counts more than anything which only makes a seller hard to find. A seller who is merely undiscoverable can still get paid; one whose challenge is unparseable cannot. Checks that do not apply are skipped, never counted against the score.
- Why does CAIP-2 reference length matter?
- CAIP-2 caps a chain reference at 32 characters. Solana's mainnet genesis hash is 44. If a seller advertises the full hash, spec-compliant clients can never match the rail — payments fail as invalid-challenge and it looks like a bug in the client rather than the seller's metadata.
- Why does a spend cap need to be in the schema?
- If a bill scales per returned item and the cap is an optional field, an agent can trigger an unbounded charge. Putting the cap in the JSON Schema's required array means it literally cannot. Flat and prepaid pricing have no item count to bound, so the check is skipped for them.
- It graded my service wrong. Now what?
- Tell us and we will fix the check. Every check has to name what concretely breaks when it fails; if it cannot, it should not be a check. Several early findings turned out to be scanner bugs rather than seller defects.
Built by a seller that scores 100
twitr.sh is a pay-per-call X/Twitter API for agents — reads, search, bulk exports, real-time monitors with signed webhooks, and posting. x402 on Base and Solana, MPP on Tempo. No signup, no API keys. Audit us with the tool above.