X402lint

Name: X402lint
Author: arden-instance

by arden-instanceversion 0.5.2i★ –iRuns on your computer

Registry nameio.github.arden-instance/x402lint

Install

Overview

Description from the maker (original English)

Lint an HTTP endpoint's x402 402 conformance; decode X-PAYMENT blobs; inspect a facilitator.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiNot measured yet★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs on your computer
Transport: stdio
Category: Online shops & payments

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on your computer with your user’s permissions (files, network, apps).
The registry lists no key to fill in.

You need

PyPIPython’s uv installed (for the uvx command)

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "x402lint": {
      "command": "uvx",
      "args": [
        "x402lint",
        "mcp"
      ]
    }
  }
}

Run this in your terminal

claude mcp add x402lint -- uvx x402lint mcp

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "x402lint": {
      "command": "uvx",
      "args": [
        "x402lint",
        "mcp"
      ]
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "x402lint": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "x402lint",
        "mcp"
      ]
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.

Your choice stays on this device in a cookie; no account needed.

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Runs on your computer; the tool list appears in your AI app after you install it.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 7, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account arden-instance, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
– Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
– Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
… Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints

Compared with others in Online shops & paymentsi

More stars than 0% of the other 1747 servers in this category
Published to the registry more recently than 36% of the other 1747 servers in this category
Basic checks equal to or better than 100% of the other 1747 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is X402lint safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

The registry does not list a required key, though some servers ask you to sign in on first use.

Does it run on my computer or in the cloud?

It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).

Is it still maintained?

The GitHub repo last changed –, and the latest version (0.5.2) reached the registry 2 months ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Python (uv) on your computer.

What can I use instead?

In the same category: Spree Commerce: open-source B2B and marketplace ecommerce, Stripe MCP, MCP Cn Commerce

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Spree Commerce: open-source B2B and marketplace ecommerce

by spree

Open-source B2B and marketplace ecommerce; new stores include an MCP server for AI agents.

Runs in the cloud★ 15,812BSD-3-ClauseUpdated 7 days ago

Install

Stripe MCP

by stripe

Stripe’s official server lets AI view and manage customers, products, payments and invoices. Connect to Stripe’s cloud and sign in with OAuth.

Runs in the cloud★ 2,043MITUpdated 12 months ago

Install

MCP Cn Commerce

by TonyWang-hub

8 read-only MCP platform entries; support is operation-specific; merchant live acceptance pending

Runs on your computer★ 96MITUpdated 27 days ago

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

x402lint

A conformance linter for the x402 agent-payments protocol. Point it at an HTTP endpoint that charges for access and it tells you whether the 402 Payment Required challenge it returns is well-formed — the check an agent runtime does before it will pay.

$ x402lint check https://riddlex402.vercel.app/api/riddle

PASS status: HTTP 402 Payment Required INFO format: x402 v2 (payment-required header) PASS header-decode: payment-required header is base64 JSON PASS x402Version: 2 PASS error: 'Payment required' PASS resource.url: https://riddlex402.vercel.app/api/riddle PASS accepts: 1 payment option(s) PASS accepts[0].required: all required fields present PASS accepts[0].scheme: 'exact' PASS accepts[0].network: eip155:8453 (CAIP-2) PASS accepts[0].amount: 2000 atomic units PASS accepts[0].asset: valid EVM address PASS accepts[0].payTo: valid EVM address PASS accepts[0].maxTimeoutSeconds: 300 PASS accepts[0].extra: EIP-712 domain: name='USD Coin' version='2' INFO discovery: advertises the 'bazaar' discovery extension

14 pass, 0 warn, 0 fail (CONFORMANT)

Install

pip install x402lint

The linter (check / decode / facilitator / survey) is pure standard library, Python 3.12+. The pay command additionally needs an EIP-712 signer: pip install 'x402lint[pay]'.

Commands

`x402lint check`

Fetches with no payment header, expects a 402, and checks the payment challenge:

status is exactly 402
wire format — v2 (payment-required base64 header, the common case today) or v1 (x402Version: 1 JSON body). Reports which.
the challenge document decodes / parses
x402Version is an integer, error is a human-readable string
accepts is a non-empty array, and for every entry:
required fields present (scheme, network, amount, asset, payTo, maxTimeoutSeconds)
scheme in a known set (exact, upto, batch-settlement) — unknown warns
network is CAIP-2 shaped (v2) or a recognised name (v1) — unknown warns
amount is a base-10 string of a positive integer (atomic units)
asset / payTo are valid 0x… addresses on EVM networks
exact/EVM entries carry extra.name + extra.version for the EIP-712 domain
v1 entries carry an absolute resource URL
discovery metadata (extensions.bazaar / v1 outputSchema) — reported, not required

--json emits a machine-readable report (for CI). Exit code: 0 conformant (warnings allowed), 1 any failure, 2 tool error.

For a POST endpoint that validates its request body before returning the 402 (most LLM gateways), pass a body with --data (implies POST; @file or - reads a file / stdin):

$ x402lint check https://x402.telnyx.com/v1/chat/completions \

--data '{"model":"google/gemma-2b-it","messages":[{"role":"user","content":"hi"}]}'

`x402lint decode`

Pretty-prints any base64 x402 header blob — payment-required, X-PAYMENT, payment-response — and labels what kind of document it is. - reads stdin.

curl -sD - https://weather.payapi.market/current \

| grep -i ^payment-required: | cut -d' ' -f2 \ | x402lint decode -

`x402lint facilitator [url]`

Fetches GET /supported and lists every (x402Version, scheme, network) triple the facilitator can verify / settle, plus its advertised extensions. Warns on unknown schemes or non-CAIP-2 v2 networks. url defaults to https://x402.org/facilitator (the public testnet facilitator). --json.

$ x402lint facilitator

v2 exact eip155:84532 v2 upto eip155:84532 +extra v2 batch-settlement eip155:84532 ... 11 kind(s): schemes batch-settlement, exact, upto; 9 network(s); versions 1, 2

`x402lint survey [catalogue]`

Pulls a discovery catalogue (catalogue defaults to the Coinbase CDP .../x402/discovery/resources list), takes the --limit busiest resources by 30-day call volume, and runs check on each — a quick "state of x402 conformance" snapshot. It replays each resource's advertised bazaar input method and example query params so the request actually reaches the paywall (--no-hints to force a plain GET). --json.

$ x402lint survey --limit 8

ok v2 https://x402.twit.sh/tweets/search?from=elonmusk&minLikes=100&words=bitcoin FAIL v2 https://x402.tavily.com/search

accepts[1].amount: 'amount' must be a base-10 string of a positive integer, got '0.016'

... 7/8 endpoints conformant

Recurring survey results — a per-host conformance table of the busiest live x402 endpoints — are maintained in SURVEY.md, with dated snapshots in data/.

`x402lint pay`

Fetches the endpoint's 402, picks the first exact-scheme accepts[] entry (or --accept-index N), and signs an EIP-3009 TransferWithAuthorization payment offline — no transaction, no gas, just an EIP-712 signature. Prints the X-PAYMENT header value a client would send back. The EIP-712 domain (name/version/chainId/verifyingContract) is read from the wire (accepts[].extra + network + asset), never hardcoded.

The private key comes from an env var (X402LINT_PRIVATE_KEY by default, --key-env NAME to change) and is never logged. Needs the pay extra:

pip install 'x402lint[pay]'

export X402LINT_PRIVATE_KEY=0x... $ x402lint pay https://api.example.com/data

payer 0x19E7E376E7C213B7E7e7e46cc70A5dD086DAff2A

asset 0x036CbD53842c5426634e7929541eC2318f3dCF7e (USDC v2, chain 84532)

payTo 0x209693Bc6afc0C5328bA36FaF03C514EF312287C

value 1000 atomic units

expires validBefore=1756431600

X-PAYMENT: eyJ4NDAyVmVyc2lvbiI6MSwic2NoZW1lIjoiZXhhY3Qi...

--json emits the payer, authorization tuple, signature, full PaymentPayload, and header.

`x402lint roundtrip`

pay, then resend the request with the X-PAYMENT header and report what the server did with it. Decodes the X-PAYMENT-RESPONSE header (success, transaction, network); falls back to the response body's error string when the payment is rejected. Exits 0 only if the payment settled, 1 otherwise.

export X402LINT_PRIVATE_KEY=0x...

$ x402lint roundtrip https://api.example.com/data

payer 0x19E7E376E7C213B7E7e7e46cc70A5dD086DAff2A

payTo 0x209693Bc6afc0C5328bA36FaF03C514EF312287C

value 1000 atomic units (chain 84532)

retry HTTP 200

SETTLED tx 0xabc123...

Needs the pay extra and a funded key for a real settlement; without funds it reports NOT SETTLED (insufficient_funds) after exercising the full path.

`--facilitator`

Settle directly against a facilitator's /verify + /settle rather than re-sending to the resource server. Useful when the resource server builds its own (CAIP-2) paymentRequirements and self-fails against a facilitator that only accepts v1 friendly names there. x402lint translates the challenge into the v1 settle envelope (base-sepolia, maxAmountRequired, x402Version: 1) and stops before /settle if /verify rejects the payment.

$ x402lint roundtrip --facilitator https://x402.org/facilitator https://x402.org/protected

payer 0xc838ED72fd5905C30801515DdC7B5cc13F36E88D

payTo 0x209693Bc6afc0C5328bA36FaF03C514EF312287C

value 10000 atomic units (base-sepolia)

facilitator https://x402.org/facilitator

verify HTTP 200 -> valid

SETTLED tx 0x188066d0...

GitHub Action

Run the linter in CI so a deploy that breaks your 402 challenge fails the build. The repo ships a composite action at its root, also listed on the GitHub Marketplace:

# .github/workflows/x402.yml

name: x402 conformance on: [push, pull_request] jobs: check: runs-on: ubuntu-latest steps:

uses: arden-instance/x402lint@v0.5.2 with: url: https://your-endpoint.example/api

url: | # multiple endpoints, one per line

https://a.example/x

https://b.example/y

version: 0.5.2 # pin the linter (default: latest)

strict: "true" # also fail on WARN-level findings

The step exits non-zero (failing the job) if any endpoint returns a non-conformant 402, annotating the run with the specific findings.

A runnable worked example lives at .github/workflows/x402.yml in this repo — it points the action at a known-good public endpoint on a weekly schedule. Copy it and swap in your own URL(s).

MCP server

pip install 'x402lint[mcp]' adds an x402lint mcp subcommand (also installed as x402lint-mcp), a Model Context Protocol server (stdio transport) so an agent or IDE assistant can lint an x402 endpoint without shelling out. It exposes three tools:

tool	what it does
`lint_endpoint`	fetch a URL unpaid, expect a `402`, return the conformance report
`decode_payment`	decode + classify a base64 `X-PAYMENT` / `accepts` blob
`check_facilitator`	summarise a facilitator's settleable scheme/network pairs

// claude_desktop_config.json / any MCP client

{ "mcpServers": { // installed on PATH: "x402lint": { "command": "x402lint-mcp" } // or zero-install via uv: // "x402lint": { "command": "uvx", "args": ["--from", "x402lint[mcp]", "x402lint", "mcp"] } } }

Protocol notes

Two wire formats exist. v2 (x402Version: 2, Linux Foundation spec) is dominant in the wild as of 2026: the PaymentRequired document travels base64-encoded in the payment-required response header, networks are CAIP-2 ids (eip155:8453), the amount field is amount. v1 is the legacy format: the document is the JSON body, networks are friendly names (base), the amount field is maxAmountRequired. x402lint handles both.

License

MIT

X402lint

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Online shops & paymentsi

Common questions

Alternatives

Spree Commerce: open-source B2B and marketplace ecommerce

Stripe MCP

MCP Cn Commerce

README from the maker

x402lint

Install

Commands

x402lint check

x402lint decode

x402lint facilitator [url]

x402lint survey [catalogue]

x402lint pay

payer 0x19E7E376E7C213B7E7e7e46cc70A5dD086DAff2A

asset 0x036CbD53842c5426634e7929541eC2318f3dCF7e (USDC v2, chain 84532)

payTo 0x209693Bc6afc0C5328bA36FaF03C514EF312287C

value 1000 atomic units

expires validBefore=1756431600

x402lint roundtrip

payer 0x19E7E376E7C213B7E7e7e46cc70A5dD086DAff2A

payTo 0x209693Bc6afc0C5328bA36FaF03C514EF312287C

value 1000 atomic units (chain 84532)

retry HTTP 200

--facilitator

payer 0xc838ED72fd5905C30801515DdC7B5cc13F36E88D

payTo 0x209693Bc6afc0C5328bA36FaF03C514EF312287C

value 10000 atomic units (base-sepolia)

facilitator https://x402.org/facilitator

verify HTTP 200 -> valid

GitHub Action

url: | # multiple endpoints, one per line

https://a.example/x

https://b.example/y

version: 0.5.2 # pin the linter (default: latest)

strict: "true" # also fail on WARN-level findings

MCP server

Protocol notes

License

`x402lint check`

`x402lint decode`

`x402lint facilitator [url]`

`x402lint survey [catalogue]`

`x402lint pay`

`x402lint roundtrip`

`--facilitator`