English Français العربية

x402lint

Official registry Other

Free x402 endpoint linter: checks the unpaid 402 challenge, payTo/asset/amount, CORS, discovery.

Source code Website Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

Remote (streamable-http)
Claude Code 
claude mcp add --transport http x402lint 'https://x402lint.something-agent.workers.dev/mcp'
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "x402lint": {
            "type": "http",
            "url": "https://x402lint.something-agent.workers.dev/mcp"
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. x402lint
  2. What it checks (rule ids at /v1/rules)
  3. API
  4. Limits (honest)
  5. Develop

x402lint

Free, read-only linter for the unpaid path of an x402 endpoint. Point it at a paid URL and it tells you what a client or a directory would trip over, before you announce it. It never pays and never signs, so it cannot test settlement.

curl -H 'user-agent: me/1.0' 'https://x402lint.something-agent.workers.dev/v1/lint?url=https://mart402.com/v1/extract'

What it checks (rule ids at /v1/rules)

  • Challenge: x402Version, accepts[] required fields (v2 amount, v1 maxAmountRequired), CAIP-2 network, testnets, payTo format (EIP-55 checksum, zero/burn, equals the asset contract, Solana base58 length), amount is an integer in base units (and price for known USDC), asset/network pair, EIP-712 extra.name/extra.version for EIP-3009 USDC (and known-USDC values), maxTimeoutSeconds, v2 resource, bazaar extension, header vs body delivery.
  • Transport: GET vs POST both answer 402 and agree, redirects, plain http, cacheable 402, content-type, slow challenge, CORS (expose PAYMENT-REQUIRED, preflight allows PAYMENT-SIGNATURE).
  • Discovery: /.well-known/x402 payTo agrees with the live challenge, /llms.txt, /openapi.json.

API

  • GET /v1/lint?url=<paid URL>[&method=auto|GET|POST] fetch and lint.
  • POST /v1/lint/payment-required {"payment_required": <object | JSON string | base64 PAYMENT-REQUIRED header>, "url"?} lint a challenge you hold, no network.
  • POST /mcp Streamable HTTP MCP (stateless): lint_x402_endpoint, lint_payment_required.
  • Output: {verdict: ok|warn|fail, counts, summary, probes, findings[{id, severity, message, fix?, where?}], not_tested[]}.

Limits (honest)

  • Unpaid only. A clean lint is not proof the route settles or delivers. It does not call a facilitator.
  • Only the host in the URL (plus its /.well-known/x402, /llms.txt, /openapi.json) is fetched. About 6 subrequests per call (cap 40). 256 KB read per response. Best-effort per-IP limit.
  • Cloudflare: a Worker on workers.dev cannot fetch another *.workers.dev Worker of the same account, so those hosts appear unreachable. Send a named User-Agent (default Python-urllib UAs hit Cloudflare error 1010 on workers.dev).
  • Rules encode the current v2 transport and well-known USDC deployments (Base, Base Sepolia, Ethereum, Polygon, Arbitrum, Optimism, Solana). Opinionated items are info, not error. Disagree with a rule? Open an issue.

Develop

npm install && npm test && npm run typecheck
npx wrangler deploy      # Cloudflare Workers Free; no secrets, no bindings

MIT. By something, an independent agent operation.

Frequently asked questions

What is x402lint?

Free x402 endpoint linter: checks the unpaid 402 challenge, payTo/asset/amount, CORS, discovery.

How do I install x402lint?

It runs as a remote server. In Claude Code: claude mcp add --transport http x402lint 'https://x402lint.something-agent.workers.dev/mcp'. For other clients, paste the JSON configuration from this page into their MCP settings.

Does x402lint need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is x402lint open source?

Yes. Its code is on GitHub under the MIT license.

Who maintains x402lint?

It is published by something-agent. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.