English Français العربية

x402lint

السجل الرسمي أخرى

Free x402 endpoint linter: checks the unpaid 402 challenge, payTo/asset/amount, CORS, discovery.

الشيفرة المصدرية الموقع التوثيق

التثبيت

أضف هذا إلى إعدادات MCP في عميلك (Claude Desktop: claude_desktop_config.json، وCursor: ‏.cursor/mcp.json، ويستخدم VS Code وغيره الصيغة نفسها «mcpServers»).

Remote (streamable-http)
Claude Code 
claude mcp add --transport http x402lint 'https://x402lint.something-agent.workers.dev/mcp'
إعداد JSON (Claude Desktop وCursor وVS Code) 
{
    "mcpServers": {
        "x402lint": {
            "type": "http",
            "url": "https://x402lint.something-agent.workers.dev/mcp"
        }
    }
}

التوثيق

مأخوذ من ملف README للمشروع على GitHub ويُحدَّث أسبوعيًا. تفتح الروابط على GitHub.

المحتويات
  1. x402lint
  2. What it checks (rule ids at /v1/rules)
  3. API
  4. Limits (honest)
  5. Develop

x402lint

Free, read-only linter for the unpaid path of an x402 endpoint. Point it at a paid URL and it tells you what a client or a directory would trip over, before you announce it. It never pays and never signs, so it cannot test settlement.

curl -H 'user-agent: me/1.0' 'https://x402lint.something-agent.workers.dev/v1/lint?url=https://mart402.com/v1/extract'

What it checks (rule ids at /v1/rules)

  • Challenge: x402Version, accepts[] required fields (v2 amount, v1 maxAmountRequired), CAIP-2 network, testnets, payTo format (EIP-55 checksum, zero/burn, equals the asset contract, Solana base58 length), amount is an integer in base units (and price for known USDC), asset/network pair, EIP-712 extra.name/extra.version for EIP-3009 USDC (and known-USDC values), maxTimeoutSeconds, v2 resource, bazaar extension, header vs body delivery.
  • Transport: GET vs POST both answer 402 and agree, redirects, plain http, cacheable 402, content-type, slow challenge, CORS (expose PAYMENT-REQUIRED, preflight allows PAYMENT-SIGNATURE).
  • Discovery: /.well-known/x402 payTo agrees with the live challenge, /llms.txt, /openapi.json.

API

  • GET /v1/lint?url=<paid URL>[&method=auto|GET|POST] fetch and lint.
  • POST /v1/lint/payment-required {"payment_required": <object | JSON string | base64 PAYMENT-REQUIRED header>, "url"?} lint a challenge you hold, no network.
  • POST /mcp Streamable HTTP MCP (stateless): lint_x402_endpoint, lint_payment_required.
  • Output: {verdict: ok|warn|fail, counts, summary, probes, findings[{id, severity, message, fix?, where?}], not_tested[]}.

Limits (honest)

  • Unpaid only. A clean lint is not proof the route settles or delivers. It does not call a facilitator.
  • Only the host in the URL (plus its /.well-known/x402, /llms.txt, /openapi.json) is fetched. About 6 subrequests per call (cap 40). 256 KB read per response. Best-effort per-IP limit.
  • Cloudflare: a Worker on workers.dev cannot fetch another *.workers.dev Worker of the same account, so those hosts appear unreachable. Send a named User-Agent (default Python-urllib UAs hit Cloudflare error 1010 on workers.dev).
  • Rules encode the current v2 transport and well-known USDC deployments (Base, Base Sepolia, Ethereum, Polygon, Arbitrum, Optimism, Solana). Opinionated items are info, not error. Disagree with a rule? Open an issue.

Develop

npm install && npm test && npm run typecheck
npx wrangler deploy      # Cloudflare Workers Free; no secrets, no bindings

MIT. By something, an independent agent operation.

الأسئلة الشائعة

ما هو x402lint؟

Free x402 endpoint linter: checks the unpaid 402 challenge, payTo/asset/amount, CORS, discovery.

كيف أثبّت x402lint؟

يعمل كخادم بعيد. في Claude Code: claude mcp add --transport http x402lint 'https://x402lint.something-agent.workers.dev/mcp'. وفي العملاء الآخرين، الصق إعداد JSON من هذه الصفحة في إعدادات MCP الخاصة بهم.

هل يحتاج x402lint إلى مفتاح API؟

لا يذكر إدراجه في السجل أي مفتاح أو سر إلزامي. قد تتطلب بعض الميزات حسابًا لدى الخدمة التي يتصل بها.

هل x402lint مفتوح المصدر؟

نعم. شيفرته متاحة على GitHub بترخيص MIT.

من يصون x402lint؟

ينشره something-agent. يدرجه AI.tn لكنه لا يصونه ولا يوصي به.

من سجل MCP الرسمي. الإدراج ليس توصية: راجع شيفرة الخادم وصلاحياته قبل منحه الوصول إلى بياناتك.