Which x402-conformance?
This page refers to atsp-protocol/x402-conformance, not other packages with similar names. Its Apache-2.0 repository documents facilitator and resource-server checks, a CLI and a GitHub Action.
Its published CLI description documents an unpaid resource mode that checks a public 402 response; its live mode checks facilitator /supported responses. Separate fault-injection probes use a controlled facilitator double to test a server’s behavior when settlement is delayed, broken or duplicated. Reports include JSON, SARIF and JUnit. The project labels itself experimental: passing a property is not a conformance certification.
We reviewed the README at commit 18defdf. Repository documentation spans several releases and explicitly separates some code-only or unreleased checks. Select a release and read its coverage before assuming a particular check is included; this page does not claim every documented check runs in one Action invocation.
Where SpendPreflight fits
SpendPreflight Lint and its Action inspect an unpaid public challenge, listing metadata and passive Security Check coverage, with dated reports and fixes. They do not inject settlement failures, authorize target payments or prove paid response delivery. The full Security Check reuses a complete, current saved Lint snapshot rather than probing the target again.
| Question | SpendPreflight | x402-conformance |
|---|---|---|
| Is the public challenge inspectable? | Free Lint, share report and CI Action; heuristic listing and passive coverage. | Documented unpaid resource-response checks. |
| What happens when settlement fails? | Replay, settlement order, paid caching and parser behavior remain unknown from passive evidence. | Controlled fault-injection checks for the properties supported by your selected version and setup. |
| What is the output? | Dated observations, coverage/unknowns, findings and fixes; paid tools have separate prices. | Per-check evidence and CI report formats. |
| Where does it run? | Hosted free checks, MCP/HTTP products and a GitHub Action. | Your CLI, CI or documented MCP setup; consult the selected version’s coverage. |
A useful combined workflow
Before deploying, test a server you control with the conformance project’s documented controlled setup. After deploying, use our unpaid Lint and Action for observable challenge and metadata checks, and use the CDP validator for CDP discovery diagnostics. A later passive observation cannot replace the controlled payment-behavior test.
Keep the scope of each result attached to it. A passing test of one configuration, a well-formed 402 and a low listing-risk score answer different questions. None establishes that every deployment is secure or that a future paid request will deliver. Our passive reports do not attest to an SDK version deployed by a seller.
Read the project’s setup and coverage → · Read our Lint scope →