New tools

New: x402 Security Check, Quote Check, Seller Index

Published October 28, 2026 (UTC) · SpendPreflight · AI-assisted; checked against the deployed product scopes.

Inspect the evidence available before an agent pays: a seller's unpaid endpoint behavior, a comparable cached quote, and public discovery metadata. Three new tools are available through the web/API catalog and our existing remote MCP server at https://api.spendpreflight.com/mcp. Each reports missing evidence as unknown; none automatically authorizes a payment.

x402 Security Check: see coverage and unknowns

Start with free x402 Lint for a public endpoint you operate. Its passive summary describes the evidence collected by the unpaid check. Use the saved report_id with POST /v1/security-check or MCP security_check for the full report. A current complete snapshot is required before the tool offers payment; the full report does not re-probe the seller.

An advertised SDK package or version is an unverified claim, not an attestation of the deployed software. Replay protection, paid caching, payment-header parser behavior and settlement ordering remain unknown without controlled evidence. A passing Lint result does not prove a deployment secure. We do not replay signatures, submit paid target requests or claim a seller vulnerability from a passive observation.

Quote Check: compare exact amounts and recipients

Supply the quote you received: resource URL, method when needed, atomic amount, payee, asset and network. GET /quote-check, JSON POST /quote-check and MCP quote_check compare it with the latest comparable cached public unpaid quote. They return ok, above_expected, payTo_changed or unknown, with the observation source, timestamp and limits.

Scout retains its latest probe, at most 24 hours old, rather than a quote history. For URLs absent from Scout, the separate public index may provide up to seven days of retained observations, with a fresh source required. A newer failed or stale Scout result never falls back to an older successful quote. Historical observations are not a market price, proof of paid delivery or a guarantee against loss. The suggested atomic cap expires with its evidence and is not applied automatically.

The existing spendpreflight-js 0.3.2 includes createQuoteCheckHook for onBeforePaymentCreation. Plain fetch stops at a 402 offer. Paying the comparison fee requires a separately configured, locally guarded fee client; the hook cannot recursively pay its own fee. Keep local per-payment limits, allowlists and a shared budget appropriate to your application. See the client spend-limit guide.

Seller Index: find public candidates, then review

Use free GET /seller-index?capability=weather for a top-three shortlist. Extended POST /v1/seller-index and MCP seller_index can return up to twelve matches from the existing cached public catalog. The query performs no new crawl or target request.

The bounded ranking uses observed availability, valid matching unpaid GET challenges, available price consistency and public Lint metadata. Missing components mean the full score is unknown; the security score is null. Results disclose the actual observed method and evidence dates. A small or incomplete sample does not establish uptime, seller identity, safety, successful payment or a catalog endorsement. Paid monitoring plans and private payer data do not boost rankings.

Add the free check to CI

- uses: spendpreflight/x402-lint-action@v1
  with:
    urls: https://api.example.com/resource

The existing Action reuses the free Lint snapshot, including its passive coverage summary. It makes one sequential free attempt per supplied public URL within the existing quotas. It never calls a paid tool, pays, registers monitoring or changes your signer policy automatically. The URL above is a placeholder, not an endpoint we tested.

Choose the tool for the evidence you have: a Lint report for passive coverage, a supplied quote for comparison, or a capability for discovery. Inspect the timestamp, method and unknowns before acting. Open the product catalog for schemas, examples and current prices.