78trust / 100

Audit

by x402 Merchant Audit in Security & trust

x402 APIPassing, checked 2 h ago

Is this API safe to pay? Audit any x402 merchant or paid endpoint BEFORE you send money. Answers whether a service is trustworthy, whether it is a scam or dead, and whether it will actually deliver. Probes the live endpoint for a valid HTTP 402 challenge, detects price drift between the advertised price and the real challenge price, pulls settlement history and unique-buyer counts, and verifies on-chain USDC actually reaching the payTo address. Returns a PASS / CAUTION / AVOID verdict with the evidence behind it. Every check is measured live at request time — nothing cached, no reputation scores. Use before paying an unknown merchant, to avoid wasting money on dead or fraudulent endpoints.

GET https://merchant-audit.clankerceo.workers.dev/audit

Last 30 days

All checks passedSome failedAll failedNot checked
Uptime
100%
Response time
143 ms typical, 258 ms slowest 5%
Last check
2 h ago
Next check
any minute now

How to call it

# See the payment challenge (nothing is charged)
curl -i -X GET "https://merchant-audit.clankerceo.workers.dev/audit?target=https%3A%2F%2Fexample-merchant.com%2Fapi%2Fsome-service"
import { wrapFetchWithPayment } from "@x402/fetch";
import { x402Client } from "@x402/core/client";
import { ExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

const client = new x402Client().register(
  "eip155:8453",
  new ExactEvmScheme(privateKeyToAccount(process.env.AGENT_KEY)),
);
const pay = wrapFetchWithPayment(fetch, client);

// Not sure it's safe to pay? Preflight it first for $0.005:
// GET https://toolvet.app/api/v1/check?url=https%3A%2F%2Fmerchant-audit.clankerceo.workers.dev%2Faudit
const res = await pay("https://merchant-audit.clankerceo.workers.dev/audit?target=https%3A%2F%2Fexample-merchant.com%2Fapi%2Fsome-service");
console.log(await res.json());

Example input

{
  "target": "https://example-merchant.com/api/some-service"
}

Example output

{
  "checks": {
    "emits_402": true,
    "has_buyers": false,
    "onchain_inflow_usdc": 0,
    "price_drift": false,
    "reachable": true
  },
  "reasons": [
    "listed but no settlements in 30d"
  ],
  "target": "https://example-merchant.com/api/some-service",
  "verdict": "CAUTION"
}

Security scan

  • No findings. We scan names, descriptions and tool definitions for hidden instructions and other prompt-injection patterns.

Recent checks

WhenResultHTTPTimePrice
2 h agoPassed402114 ms$0.01
6 h agoPassed402156 ms$0.01
9 h agoPassed402143 ms$0.01
13 h agoPassed402258 ms$0.01
17 h agoPassed402161 ms$0.01
20 h agoPassed402266 ms$0.01
24 h agoPassed402121 ms$0.01
28 h agoPassed402141 ms$0.01
31 h agoPassed402143 ms$0.01
36 h agoPassed402179 ms$0.01