All tools / x402 Security Check

x402 Security Check

Inspect passive x402 security coverage: advertised resource binding, unpaid cache policy and explicit SDK version claims, with unknown areas disclosed.

Get the free coverage summary

Who it’s for

Sellers maintaining x402 payment endpoints and agents reviewing a saved unpaid snapshot.

Price

Free summary in Lint; 0.10 USDC for a full report with fixes. Weekly passive re-check included in Basic 9 / Pro 19 monitoring.

Paid calls use x402 with USDC on Base. Read the quote before authorizing payment; examples below do not pay automatically.

Know the limits

Passive unpaid observation only. Paid-response caching, replay/idempotency, header parser behavior and settlement-before-delivery stay unknown. No safety verdict or active attack. A complete current free Lint snapshot is required before payment; full reports reuse it without another request.

A 30-second integration

Examples use placeholders. Plain requests to paid tools return a payment challenge, not a paid result. Free Lint can perform an unpaid public probe. Inspect the response status and evidence scope before using any result.

curl

curl -i https://api.spendpreflight.com/v1/security-check \
  -H 'Content-Type: application/json' \
  -d '{"report_id":"00000000-0000-4000-8000-000000000000"}'

MCP

Connect to https://api.spendpreflight.com/mcp. Call the existing tool:

{
  "name": "security_check",
  "arguments": {
    "report_id": "00000000-0000-4000-8000-000000000000"
  }
}

SDK / JavaScript

Use standard fetch alongside the SpendPreflight SDK; the example does not invent a dedicated exported method.

// Node.js SDK integration: use your explicitly budgeted fetch.
// Plain fetch below never signs or pays. There is no dedicated
// spendpreflight SDK helper for this operation.
const response = await fetch('https://api.spendpreflight.com/v1/security-check', {
  method: 'POST', headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({"report_id":"00000000-0000-4000-8000-000000000000"})
});
console.log(response.status, await response.text());

Frequently asked questions

What does the full report add?

Source-linked fixes and controlled verification steps for each check. Coverage and unknowns are disclosed free before purchase. The report is not an audit or proof of exploitability.

Does it replay payments?

No. No payment is signed, forged or replayed. Use an isolated authorized testbed to verify properties that unpaid observations cannot establish.

Where can I use it?

Free coverage appears in Lint HTML/JSON and MCP, the existing GitHub Action finding and linked report, and the Apify Lint + Guard result. Basic and Pro include weekly passive reports at the authenticated seller security endpoint.

Authoritative OpenAPI schemas · What this service stores · Practical guides