MCP.Market

402cron MCP server

online · 100% uptime
by 402cron.com·com.402cron/402cron·v1.0.1
No reviews yet

Paid cron for AI agents: we call your https URL on schedule, signed. No account, paid with x402.

B83/100grade B
Write a reviewRun it
What users say
No reviews yet
Be the first
Safety scan
B83/100

full report

Adoption
Growing

0 stars

Reviews

Write one

Nobody has reviewed 402cron yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

402cron tools (16, 5 write)

write = sends, deletes, buys or posts
  • create_taskwrite actionFree

    Register a schedule against a destination you have already verified. Idempotent on "name": the same name updates the existing task instead of creating a second one. Creating costs nothing; each delivery ATTEMPT costs one credit.

  • delete_destinationwrite actionFree

    Remove a claimed URL. Refused while a task still points at it — delete the task first.

  • delete_taskwrite actionFree

    Move the task to the recycle bin. It stops firing immediately and can be restored for 30 days with restore_task; after that it is unrecoverable. Credits already spent are not refunded.

  • get_docsFree

    One section of the machine documentation: quickstart, headers, signature, notice, errors, billing or limits. Omit `section` to get the whole document.

  • get_pricingFree

    What a delivery costs, which packs exist, and the exact x402 payment requirements for each. Balance is counted in DELIVERIES, not money, and packs never expire. Call this before buying.

  • get_service_statusFree

    Whether the service is currently selling, on which network, and if not — why not. This is configuration, not liveness: the full health endpoint is at /health.

  • get_taskFree

    A single task: schedule, destination, state, next run, and how many failures in a row it carries.

  • list_destinationsFree

    The URLs you have claimed and whether each is verified. The signing secrets are never shown again.

  • list_tasksFree

    Your tasks and their state. Needs your management token as an Authorization header on this connection.

  • pause_taskFree

    Stop firing until you resume. Nothing is charged while a task is paused.

  • register_destinationFree

    Claim an https:// URL you control. We answer with a challenge and a SIGNING SECRET that is shown ONCE and never again — store it before you do anything else; it is what lets you verify that a delivery really came from us. The permission covers that path and everything beneath it, nothing above. Verification is one request from us to the exact URL you registered: POST, headers X-402cron-Challenge: <value> and X-402cron-Event: verify, JSON body {"challenge":"<value>"}. Reply within 5 seconds, without a redirect, with a body that is the bare value or {"challenge":"<value>"}; we read the first 512 bytes and do not check the HTTP status (2xx is fine). Then call POST /api/destinations/{id}/verify within 15 minutes of registering. A fixed-response webhook cannot pass: you need an endpoint you can program. Registering a URL that is still pending issues a new challenge and a new signing secret every time — the old secret immediately stops verifying deliveries; a verified URL is left untouched unless you add ?rotate=1. The daily verification allowance (10 per destination, 40 per client, UTC day) does not reset on re-registration.

  • restore_taskFree

    Bring a task back from the recycle bin within 30 days. It comes back PAUSED — resume it explicitly.

  • resume_taskFree

    Start firing again on the schedule. Refused if your balance is empty — buy deliveries first.

  • run_task_nowwrite actionFree

    Deliver immediately, outside the schedule. THIS COSTS ONE CREDIT per attempt, exactly like a scheduled firing, and a timeout or unreachable host is retried up to three times — so one call can cost up to three credits. Use it to test a destination.

  • update_taskwrite actionFree

    Change the schedule, destination, method, timeout, headers or body of an existing task. Omit a field to leave it unchanged — sending null is refused, because "unchanged" and "cleared" must not look the same. State is NOT editable here: use pause_task and resume_task.

  • verify_destinationFree

    Verification is one request from us to the exact URL you registered: POST, headers X-402cron-Challenge: <value> and X-402cron-Event: verify, JSON body {"challenge":"<value>"}. Reply within 5 seconds, without a redirect, with a body that is the bare value or {"challenge":"<value>"}; we read the first 512 bytes and do not check the HTTP status (2xx is fine). Then call POST /api/destinations/{id}/verify within 15 minutes of registering. A fixed-response webhook cannot pass: you need an endpoint you can program. Registering a URL that is still pending issues a new challenge and a new signing secret every time — the old secret immediately stops verifying deliveries; a verified URL is left untouched unless you add ?rotate=1. The daily verification allowance (10 per destination, 40 per client, UTC day) does not reset on re-registration. Until this passes, no task may point at the destination.

Public scan report

scanner v0.1.10 · 2026-10-14 · same rubric, same numbers if you re-run it

1 high
  • –Code scanremote-only server, no package to scann/a
  • Live reliabilityremote reachable in 312ms20/20
  • Tool poisoning16 tool descriptions checked15/15
  • Auth qualityopen endpoint exposes 5 write-action tools with no auth3/15
  • Maintenancelast push 6 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; website matches verified namespace9/10

Findings (1)

  • highWrite-action tools reachable without authenticationauth.open-write
Overall 83/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How 402cron compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
83/100
higher than 65% of 48,243 servers
Tools
16
the typical server has 7
Tools that change things
31%
typical: 0%. Fewer write tools means less an agent can break
Uptime
100%
of our recent checks; the typical remote server answers 100%
Response time
152 ms
faster than 74% of 30,027 servers

What its tools let an agent do: 10 read · 2 create · 1 change · 2 delete · 1 run or deploy

Release history: 2 versions in the registry since 2026-09-10, latest 2026-09-21, typically one every 10 days.

Install 402cron in Claude Code, Cursor or VS Code

claude mcp add --transport http 402cron https://402cron.com/mcp
Add to Cursor

What the publisher says

From the 402cron repository's README, as published. We do not edit it. Read it on GitHub

402cron — cron for AI agents, paid per delivery

402cron calls your https endpoint on a cron schedule, signs every request, and retries what fails. An agent can set it up on its own: no account, no card, no human in the loop. Payment is x402 — USDC on Base — and the only identity is the wallet that paid.

This repository holds documentation and runnable examples. The service runs at

https://402cron.com; its source code is not published.

Links

  • https://402cron.com — the service
  • https://402cron.com/docs — machine-readable documentation (JSON; try ?section=quickstart)
  • https://402cron.com/openapi.json — OpenAPI 3.1
  • https://402cron.com/llms.txt — the service, explained for a model
  • https://402cron.com/mcp — remote MCP server (streamable HTTP), listed in the official MCP Registry as com.402cron/402cron
  • https://402cron.com/.well-known/agent-card.json — A2A agent card
  • https://402cron.com/api/pricing — the tariff, machine-readable
  • https://402cron.com/terms — terms · abuse@402cron.com

Further reading

  • Nobody complains: 28 silent failures of a paid API for AI agents: x402 payment headers, agent catalogs, A2A cards and calling out from Cloudflare Workers, each with the cause, the fix and the check that catches it. Useful if you are building your own paid API for agents.

Pricing

The balance counts deliveries, not money, and never expires. Each delivery attempt uses one credit, so a failing delivery costs at most three. Current prices: https://402cron.com/api/pricing.

How it works

PAYMENT-REQUIRED header. Pay with any x402 client. The receipt carries your management token, shown once.

  1. Buy. GET https://402cron.com/buy/trial answers 402 with the price in the

destination id and its signing secret, shown once.

  1. Register. POST /api/destinations with {"url": "https://your.host/hook"} returns the

endpoint echoes it back. The permission then covers that path and everything below it.

  1. Verify. Call POST /api/destinations/{id}/verify. We POST a challenge to your URL and your

next three runs.

  1. Schedule. POST /api/tasks with {"name", "url", "cron", "body"}. The response shows the

Management calls take Authorization: Bearer . Lost the token? Buy again from the same wallet with ?rotate=1; the old token stops working.

What your endpoint receives

Three kinds of requests arrive at the same URL. X-402cron-Event tells them apart:

The signature is X-402cron-Signature: sha256=, an HMAC-SHA256 keyed with your signing secret over the bytes of:

{X-402cron-Timestamp}\n{X-402cron-Delivery-Id}\n{X-402cron-Attempt}\n{METHOD}\n{path+query}\n{raw body}

The event label is not signed: branch on it, but trust what the signature covers. Delivery is at least once — the same X-402cron-Delivery-Id can arrive twice, so treat a repeat as already handled. Deliveries also carry X-402cron-Task-Id and X-402cron-Deliveries-Left.

Retries and pausing

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Grade history

  • 2026-10-14restoreC → Bscore 83: Write-action tools reachable without authentication

402cron: common questions

Is 402cron MCP server safe?
Mostly: it is graded B (83/100). Read the 402cron safety report
How do I install 402cron?
It runs remotely at 402cron.com. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.
Does 402cron need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is 402cron maintained?
The last commit was 27 days ago (2026-10-09). The latest release is v1.0.1.
Is 402cron up?
100% of our last 28 checks got an answer. We check remote servers about four times a day.
How does 402cron compare with other MCP servers?
safety score 83/100 (higher than 65% of 48,243 servers); tools 16 (the typical server has 7); tools that change things 31% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.