80trust / 100

Lint

by Tanod utilpeek in Developer tools

x402 APIPassing, checked 13 min ago

utilpeek (Tanod) x402 listing lint: description, resource URL, schema and payment fields checked, with a suggested description. Use when an agent must lint an x402 listing, or check which of a seller's routes the Bazaar lists, before publishing.

POST https://tanod.dev/v1/x402/lint

Last 30 days

All checks passedSome failedAll failedNot checked

Status and outage history · Atom feed

Uptime
100%
Response time
280 ms typical, 1.1 s slowest 5%
Last check
13 min ago
Next check
in 14 min

How to call it

POST https://tanod.dev/v1/x402/lint

Each call costs $0.001 in USDC on Base, paid with the request over x402.

Run a free test callOne unpaid request, the way an agent sends it. You see the payment challenge it gets back. Nothing is charged.

Example request

From the listing.

POST https://tanod.dev/v1/x402/lint
content-type: application/json

{
  "listing": {
    "accepts": [
      {
        "amount": "10000",
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "network": "eip155:8453",
        "payTo": "0x209693Bc6afc0C5328bA36FaF03C514EF312287C",
        "scheme": "exact"
      }
    ],
    "resource": {
      "description": "Weather forecast for a city.",
      "mimeType": "application/json",
      "url": "https://api.example.com/v1/weather"
    },
    "x402Version": 2
  }
}

Parameters

ParameterTypeRequiredDescription
hoststring or nullNoMode coverage: the seller's public host name (such as api.example.com, no scheme or path). Its /openapi.json and /.well-known/x402 are read. Send this or `openapi_url`. Default: null.
listingobject or string or nullNoThe listing to lint, as JSON: an x402 PaymentRequired object (v1 or v2), a bare accepts[] entry or a Bazaar discovery item. The JSON text or the base64 PAYMENT-REQUIRED header value of one is accepted as a string. At most 1 MB. Mode lint: send this or `url`. Default: null.
modestringNo`lint` (default, USD 0.001): lint one listing, send `listing` or `url`. `coverage` (USD 0.01): compare a seller's paid routes with the CDP Bazaar, send `host` or `openapi_url`. One of: lint, coverage. Default: "lint".
openapi_urlstring or nullNoMode coverage: an https URL of the seller's OpenAPI document (JSON, at most 2 MB). The seller host is the URL's host. Send this or `host`. Default: null.
urlstring or nullNoAn https x402 endpoint: it is fetched once (GET, else POST if GET is 405) and its 402 response (PAYMENT-REQUIRED header, else body) is linted. Public https hosts only. Mode lint: send this or `listing`. Default: null.

Example response

The provider's example. We can't check it without paying.

{
  "checked_at": "2026-10-09T08:00:00Z",
  "checks_passed": 9,
  "description_length": 28,
  "errors": 0,
  "note": "Automated checks of the listing rules Tanod knows (Coinbase CDP's 500-character description limit, the Bazaar's https requirement, required fields); the facilitator or catalog may apply others. The suggested description is a draft to review, not a rewrite of your meaning.",
  "problems": [
    {
      "code": "missing_use_when",
      "message": "When-to-use sentence: No \"use when\" sentence found. Fix: Add one, for example: \"Use when an agent needs X before doing Y.\" Curators look for it; 94% of Bazaar listings lack it.",
      "severity": "warning"
    }
  ],
  "score": 95,
  "source": "listing",
  "suggested_description": "Weather forecast for a city. Use when an agent needs weather data from this endpoint.",
  "suggested_length": 85,
  "url": null,
  "warnings": 1
}

Call it from code

The curl command shows the payment challenge. The JavaScript and Python versions pay and call, and never pay more than $0.001.

curl: see the payment challenge
# bash or zsh: see the payment challenge. Nothing is charged.
curl -sS -g -i -X POST 'https://tanod.dev/v1/x402/lint' \
  -H 'content-type: application/json' \
  --data-raw '{"listing":{"accepts":[{"amount":"10000","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","network":"eip155:8453","payTo":"0x209693Bc6afc0C5328bA36FaF03C514EF312287C","scheme":"exact"}],"resource":{"description":"Weather forecast for a city.","mimeType":"application/json","url":"https://api.example.com/v1/weather"},"x402Version":2}}'

# x402 v2 sends the challenge base64-encoded in the PAYMENT-REQUIRED header (v1 sends it in the body).
# To read the header:
curl -sS -g -o /dev/null -D - -X POST 'https://tanod.dev/v1/x402/lint' \
  -H 'content-type: application/json' \
  --data-raw '{"listing":{"accepts":[{"amount":"10000","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","network":"eip155:8453","payTo":"0x209693Bc6afc0C5328bA36FaF03C514EF312287C","scheme":"exact"}],"resource":{"description":"Weather forecast for a city.","mimeType":"application/json","url":"https://api.example.com/v1/weather"},"x402Version":2}}' \
  | grep -i '^payment-required:' | cut -d' ' -f2 | tr -d '\r' | base64 --decode
JavaScript: pay and call
// npm i @x402/fetch @x402/evm viem
import { wrapFetchWithPayment, x402Client } from "@x402/fetch";
import { registerExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

// Pays at most $0.001 per call.
const client = new x402Client().setSpendControls({ maxAmountPerPayment: "$0.001" });
registerExactEvmScheme(client, { signer: privateKeyToAccount(process.env.EVM_PRIVATE_KEY) });
const pay = wrapFetchWithPayment(fetch, client);

// Not sure it's safe to pay? ToolVet checks it first for $0.005. Pay for that from a separate
// client: this one is capped at $0.001 per payment. GET https://toolvet.app/api/v1/check?url=https%3A%2F%2Ftanod.dev%2Fv1%2Fx402%2Flint&method=POST
const res = await pay("https://tanod.dev/v1/x402/lint", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({
    "listing": {
      "accepts": [
        {
          "amount": "10000",
          "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
          "network": "eip155:8453",
          "payTo": "0x209693Bc6afc0C5328bA36FaF03C514EF312287C",
          "scheme": "exact"
        }
      ],
      "resource": {
        "description": "Weather forecast for a city.",
        "mimeType": "application/json",
        "url": "https://api.example.com/v1/weather"
      },
      "x402Version": 2
    }
  }),
});
console.log(res.status, await res.text());
Python: pay and call
# pip install "x402[requests,evm]"
import os
from eth_account import Account
from x402 import x402ClientSync
from x402.http.clients import x402_requests
from x402.mechanisms.evm import EthAccountSigner
from x402.mechanisms.evm.exact.register import register_exact_evm_client

# Pays at most $0.001 per call.
client = x402ClientSync().set_spend_controls({"max_amount_per_payment": "$0.001"})
register_exact_evm_client(client, EthAccountSigner(Account.from_key(os.environ["EVM_PRIVATE_KEY"])))

with x402_requests(client) as session:
    res = session.post(
        "https://tanod.dev/v1/x402/lint",
        json={
            "listing": {
                "accepts": [
                    {
                        "amount": "10000",
                        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
                        "network": "eip155:8453",
                        "payTo": "0x209693Bc6afc0C5328bA36FaF03C514EF312287C",
                        "scheme": "exact",
                    },
                ],
                "resource": {
                    "description": "Weather forecast for a city.",
                    "mimeType": "application/json",
                    "url": "https://api.example.com/v1/weather",
                },
                "x402Version": 2,
            },
        },
    )
    print(res.status_code, res.text)

Security scan

  • No findings. We scan names, descriptions and tool definitions for hidden instructions and other prompt-injection patterns.

Recent checks

WhenResultHTTPTimePrice
13 min agoPassed402276 ms$0.001
4 h agoPassed402268 ms$0.001
8 h agoPassed402272 ms$0.001
12 h agoPassed402272 ms$0.001
16 h agoPassed402280 ms$0.001
20 h agoPassed402255 ms$0.001
24 h agoPassed402431 ms$0.001
27 h agoPassed402830 ms$0.001
31 h agoPassed4021.1 s$0.001
35 h agoPassed4022.8 s$0.001
38 h agoPassed402365 ms$0.001
42 h agoPassed402275 ms$0.001
45 h agoPassed402321 ms$0.001
2 days agoPassed4021.0 s$0.001
2 days agoPassed402268 ms$0.001