x402 Preflight MCP server

x402 Preflight

Inspect and validate an unfamiliar x402 endpoint before an autonomous agent spends USDC.

x402 Preflight performs bounded, read-only HTTPS probes. It observes the live payment challenge, price, network, asset, receiver, Bazaar discovery metadata, CORS, redirects, cache behavior, and other operational signals. It never connects a buyer wallet, forwards payment credentials, signs a payload, or spends funds.

A report is time-bound evidence, not an endorsement. It cannot prove seller identity or intent, contract safety, future availability, successful settlement, or delivery of a business outcome.

Canonical Capabilities

For HTTP clients that cannot submit a JSON body during discovery, the paid audit also has a compatibility alias at GET /api/x402/preflight/audit. It requires resourceurl in the query string and accepts optional method=GET|HEAD, expectednetwork, and maxpriceusd parameters. The alias uses the same price, x402 payment, and audit report as the canonical POST, but is not a fourth capability and never audits a POST target.

Canonical remediation requires a healthy ORDERDATABASEURL. If durable storage is unavailable, HTTP and MCP calls fail with REMEDIATION_UNAVAILABLE before a payment challenge is served.

These are the only primary operations in OpenAPI, MCP, llms.txt, the manifest, and agent metadata. Existing wallet, market, weather, repository, marketplace, and helper routes remain available under the manifest's labs section.

Fixed-Price Service Routes

The public inspector also generates direct GET intakes for buyers who want a human readback after payment settles. They are ordinary x402 resources, not additional MCP tools:

Each route requires repositoryorurl and goal query parameters before it serves an x402 challenge. Optional contact, constraints, callbackurl, responseformat, and language parameters can travel with the paid intake.

Example payable URLs:

https://x402.chikocorp.com/api/x402/services/quick-review?repository_or_url=https%3A%2F%2Fgithub.com%2Fexample%2Fproject&goal=Verify%20the%20x402%20payment%20challenge%20and%20identify%20the%20next%20patch&response_format=both

https://x402.chikocorp.com/api/x402/services/integration-triage?repository_or_url=https%3A%2F%2Fgithub.com%2Fexample%2Fproject&goal=Make%20the%20x402%20Base%20USDC%20endpoint%20browser-agent%20readable&response_format=both

Bitcoin Lightning / L402 Seller

The service also contains a gateway-only repository opportunity scanner for coding agents:

GET or POST https://l402.chikocorp.com/api/l402/repo-opportunity-scan

Lightning Labs Aperture presents the public L402 challenge and then forwards a private gateway credential to this backend. Direct backend requests fail closed when the credential is absent, so the public Node/Vercel route cannot bypass the Lightning paywall. The deterministic report ranks public GitHub issues, detects open-PR competition and hardware risk, and treats payout words as unverified until an authorized payer and amount are explicit.

Free machine-readable discovery lives at:

Shortened. The full README is on GitHub.