com.scriptmasterlabs/x402-pay

Est-ce que com.scriptmasterlabs/x402-pay est sûr ?

Au dernier audit MCP Hub, le serveur MCP « com.scriptmasterlabs/x402-pay » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 5 outils

• check_payment≈ 969 tokens

  Inspect a public HTTPS URL for a fresh x402 v2 HTTP 402 challenge using an unsigned GET with a 10-second network timeout and no redirect following. Returns validated payTo, asset, network, atomic amount, resource and maxTimeoutSeconds; incomplete or non-x402 responses return challenge=null and a reason. Does not sign, settle or verify receipts. Fresh requirements override documented receiver hints; inspect canonical_receiver_match before choosing to pay.

  Paramètres, retour & exemple (1)

  Paramètres

  • url · string · requis
    Full public HTTPS URL to inspect with an unsigned GET. No payment headers; redirects, credentials and private network targets are rejected.

  Exemple d'appel

  {"name": "check_payment", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"reason": "texte", "is_x402": true, "challenge": "texte", "http_status": 1, "raw_headers": {}, "payment_sent": "texte", "missing_fields": [], "canonical_receiver_match": true}}

• check_status≈ 466 tokens

  Read the current SqueezeOS backend status and payment-readiness evidence. Returns both upstream envelopes and autonomous_spend=false. Use to diagnose readiness before purchase; HTTP availability or readiness flags alone do not establish settled or accepted delivery.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "check_status", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"ok": true, "core": {}, "hosting": "texte", "autonomous_spend": "texte", "payment_readiness": {}}}

• list_paid_apis≈ 295 tokens

  List paid API operations declared by the live SqueezeOS OpenAPI document, bounded by limit. Returns method, path, job and advertised price. Use for route selection, then inspect that resource's fresh 402 challenge; listed prices do not authorize payment.

  Paramètres, retour & exemple (1)

  Paramètres

  • limit · integer · optionnel
    Maximum number of declared paid operations to return; not an exhaustive catalog count.

  Exemple d'appel

  {"name": "list_paid_apis", "arguments": {"limit": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"ok": true, "count": 1, "source": "texte", "operations": []}}

• payment_info≈ 236 tokens

  Read the documented SML x402 v2 Base/USDC configuration and receiver before selecting a paid route. Returns configuration and a read-only policy. Fresh resource requirements override these hints; this tool does not sign, spend or prove settlement.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "payment_info", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"asset": "texte", "pay_to": "texte", "policy": {}, "network": "texte", "product": "texte", "protocol": "texte", "asset_contract": "texte"}}

• x402_inspect_challenge≈ 942 tokens

  Inspect a fresh x402 v2 challenge without sending payment. Compatible alias of check_payment with the same schema, 10-second unsigned probe and result. Use before a paid resource call; do not use as a signer, receipt verifier or settlement proof. Non-402 and incomplete challenges remain null rather than receiving invented defaults.

  Paramètres, retour & exemple (1)

  Paramètres

  • url · string · requis
    Full public HTTPS URL to inspect with an unsigned GET. No payment headers; redirects, credentials and private network targets are rejected.

  Exemple d'appel

  {"name": "x402_inspect_challenge", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"reason": "texte", "is_x402": true, "challenge": "texte", "http_status": 1, "raw_headers": {}, "payment_sent": "texte", "missing_fields": [], "canonical_receiver_match": true}}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://squeezeos-api.onrender.com/mcp/x402-pay