Lint
by Tanod utilpeek in Developer tools
utilpeek (Tanod) x402 listing lint: description, resource URL, schema and payment fields checked, with a suggested description. Use when an agent must lint an x402 listing, or check which of a seller's routes the Bazaar lists, before publishing.
POST https://tanod.dev/v1/x402/lint
Last 30 days
Status and outage history · Atom feed
- Uptime
- 100%
- Response time
- 280 ms typical, 1.1 s slowest 5%
- Last check
- 13 min ago
- Next check
- in 14 min
How to call it
POST https://tanod.dev/v1/x402/lint
Each call costs $0.001 in USDC on Base, paid with the request over x402.
Run a free test callOne unpaid request, the way an agent sends it. You see the payment challenge it gets back. Nothing is charged.
Example request
From the listing.
POST https://tanod.dev/v1/x402/lint
content-type: application/json
{
"listing": {
"accepts": [
{
"amount": "10000",
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"network": "eip155:8453",
"payTo": "0x209693Bc6afc0C5328bA36FaF03C514EF312287C",
"scheme": "exact"
}
],
"resource": {
"description": "Weather forecast for a city.",
"mimeType": "application/json",
"url": "https://api.example.com/v1/weather"
},
"x402Version": 2
}
}Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
host | string or null | No | Mode coverage: the seller's public host name (such as api.example.com, no scheme or path). Its /openapi.json and /.well-known/x402 are read. Send this or `openapi_url`. Default: null. |
listing | object or string or null | No | The listing to lint, as JSON: an x402 PaymentRequired object (v1 or v2), a bare accepts[] entry or a Bazaar discovery item. The JSON text or the base64 PAYMENT-REQUIRED header value of one is accepted as a string. At most 1 MB. Mode lint: send this or `url`. Default: null. |
mode | string | No | `lint` (default, USD 0.001): lint one listing, send `listing` or `url`. `coverage` (USD 0.01): compare a seller's paid routes with the CDP Bazaar, send `host` or `openapi_url`. One of: lint, coverage. Default: "lint". |
openapi_url | string or null | No | Mode coverage: an https URL of the seller's OpenAPI document (JSON, at most 2 MB). The seller host is the URL's host. Send this or `host`. Default: null. |
url | string or null | No | An https x402 endpoint: it is fetched once (GET, else POST if GET is 405) and its 402 response (PAYMENT-REQUIRED header, else body) is linted. Public https hosts only. Mode lint: send this or `listing`. Default: null. |
Example response
The provider's example. We can't check it without paying.
{
"checked_at": "2026-10-09T08:00:00Z",
"checks_passed": 9,
"description_length": 28,
"errors": 0,
"note": "Automated checks of the listing rules Tanod knows (Coinbase CDP's 500-character description limit, the Bazaar's https requirement, required fields); the facilitator or catalog may apply others. The suggested description is a draft to review, not a rewrite of your meaning.",
"problems": [
{
"code": "missing_use_when",
"message": "When-to-use sentence: No \"use when\" sentence found. Fix: Add one, for example: \"Use when an agent needs X before doing Y.\" Curators look for it; 94% of Bazaar listings lack it.",
"severity": "warning"
}
],
"score": 95,
"source": "listing",
"suggested_description": "Weather forecast for a city. Use when an agent needs weather data from this endpoint.",
"suggested_length": 85,
"url": null,
"warnings": 1
}Call it from code
The curl command shows the payment challenge. The JavaScript and Python versions pay and call, and never pay more than $0.001.
curl: see the payment challenge
# bash or zsh: see the payment challenge. Nothing is charged.
curl -sS -g -i -X POST 'https://tanod.dev/v1/x402/lint' \
-H 'content-type: application/json' \
--data-raw '{"listing":{"accepts":[{"amount":"10000","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","network":"eip155:8453","payTo":"0x209693Bc6afc0C5328bA36FaF03C514EF312287C","scheme":"exact"}],"resource":{"description":"Weather forecast for a city.","mimeType":"application/json","url":"https://api.example.com/v1/weather"},"x402Version":2}}'
# x402 v2 sends the challenge base64-encoded in the PAYMENT-REQUIRED header (v1 sends it in the body).
# To read the header:
curl -sS -g -o /dev/null -D - -X POST 'https://tanod.dev/v1/x402/lint' \
-H 'content-type: application/json' \
--data-raw '{"listing":{"accepts":[{"amount":"10000","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","network":"eip155:8453","payTo":"0x209693Bc6afc0C5328bA36FaF03C514EF312287C","scheme":"exact"}],"resource":{"description":"Weather forecast for a city.","mimeType":"application/json","url":"https://api.example.com/v1/weather"},"x402Version":2}}' \
| grep -i '^payment-required:' | cut -d' ' -f2 | tr -d '\r' | base64 --decodeJavaScript: pay and call
// npm i @x402/fetch @x402/evm viem
import { wrapFetchWithPayment, x402Client } from "@x402/fetch";
import { registerExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";
// Pays at most $0.001 per call.
const client = new x402Client().setSpendControls({ maxAmountPerPayment: "$0.001" });
registerExactEvmScheme(client, { signer: privateKeyToAccount(process.env.EVM_PRIVATE_KEY) });
const pay = wrapFetchWithPayment(fetch, client);
// Not sure it's safe to pay? ToolVet checks it first for $0.005. Pay for that from a separate
// client: this one is capped at $0.001 per payment. GET https://toolvet.app/api/v1/check?url=https%3A%2F%2Ftanod.dev%2Fv1%2Fx402%2Flint&method=POST
const res = await pay("https://tanod.dev/v1/x402/lint", {
method: "POST",
headers: { "content-type": "application/json" },
body: JSON.stringify({
"listing": {
"accepts": [
{
"amount": "10000",
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"network": "eip155:8453",
"payTo": "0x209693Bc6afc0C5328bA36FaF03C514EF312287C",
"scheme": "exact"
}
],
"resource": {
"description": "Weather forecast for a city.",
"mimeType": "application/json",
"url": "https://api.example.com/v1/weather"
},
"x402Version": 2
}
}),
});
console.log(res.status, await res.text());Python: pay and call
# pip install "x402[requests,evm]"
import os
from eth_account import Account
from x402 import x402ClientSync
from x402.http.clients import x402_requests
from x402.mechanisms.evm import EthAccountSigner
from x402.mechanisms.evm.exact.register import register_exact_evm_client
# Pays at most $0.001 per call.
client = x402ClientSync().set_spend_controls({"max_amount_per_payment": "$0.001"})
register_exact_evm_client(client, EthAccountSigner(Account.from_key(os.environ["EVM_PRIVATE_KEY"])))
with x402_requests(client) as session:
res = session.post(
"https://tanod.dev/v1/x402/lint",
json={
"listing": {
"accepts": [
{
"amount": "10000",
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"network": "eip155:8453",
"payTo": "0x209693Bc6afc0C5328bA36FaF03C514EF312287C",
"scheme": "exact",
},
],
"resource": {
"description": "Weather forecast for a city.",
"mimeType": "application/json",
"url": "https://api.example.com/v1/weather",
},
"x402Version": 2,
},
},
)
print(res.status_code, res.text)Security scan
- No findings. We scan names, descriptions and tool definitions for hidden instructions and other prompt-injection patterns.
Recent checks
| When | Result | HTTP | Time | Price |
|---|---|---|---|---|
| 13 min ago | Passed | 402 | 276 ms | $0.001 |
| 4 h ago | Passed | 402 | 268 ms | $0.001 |
| 8 h ago | Passed | 402 | 272 ms | $0.001 |
| 12 h ago | Passed | 402 | 272 ms | $0.001 |
| 16 h ago | Passed | 402 | 280 ms | $0.001 |
| 20 h ago | Passed | 402 | 255 ms | $0.001 |
| 24 h ago | Passed | 402 | 431 ms | $0.001 |
| 27 h ago | Passed | 402 | 830 ms | $0.001 |
| 31 h ago | Passed | 402 | 1.1 s | $0.001 |
| 35 h ago | Passed | 402 | 2.8 s | $0.001 |
| 38 h ago | Passed | 402 | 365 ms | $0.001 |
| 42 h ago | Passed | 402 | 275 ms | $0.001 |
| 45 h ago | Passed | 402 | 321 ms | $0.001 |
| 2 days ago | Passed | 402 | 1.0 s | $0.001 |
| 2 days ago | Passed | 402 | 268 ms | $0.001 |