x402 Doctor MCP server
online · 100% uptimecom.twelvepermissions/x402-doctor·v1.0.0Diagnose x402 seller endpoints: what is wrong with your 402 challenge, and how to fix it.
0 stars
Reviews
Write oneNobody has reviewed x402 Doctor yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
x402 Doctor tools (3)
write = sends, deletes, buys or postsexplain_defectFreeFull explanation of one rule by id — what it checks, why it matters, how to fix it, and where the rule came from. Use when you want the reasoning without re-probing.
list_checksFreeThe whole rule table. Knowing what was NOT checked is part of knowing what a clean result means.
probe_x402_endpointFreeProbe an x402 seller endpoint and report what it observes about it. Performs the handshake a paying client would: GET with no X-PAYMENT header, then checks the 402 challenge against 16 rules. Every finding says whether the rule comes from the x402 spec or from an observed facilitator rejection. Reports status "healthy" (nothing to report), "advisories" (only warn/info findings — the endpoint works), "defects_found" (at least one error-severity finding), "not_x402" or "unreachable".
Public scan report
scanner v0.1.10 · 2026-11-03 · same rubric, same numbers if you re-run it
- –Code scanremote-only server, no package to scann/a
- Live reliabilityremote reachable in 276ms20/20
- Tool poisoning3 tool descriptions checked15/15
- Auth qualityopen endpoint, read-only tools10/15
- Maintenancelast push 56 days ago12/15
- Maintainer identitynamespace and repository owner differ3/10
How x402 Doctor compares
Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 80/100
- higher than 60% of 48,255 servers
- Tools
- 3
- the typical server has 7
- Tools that change things
- 0%
- typical: 0%. Fewer write tools means less an agent can break
- Uptime
- 100%
- of our recent checks; the typical remote server answers 100%
- Response time
- 37 ms
- faster than 94% of 30,031 servers
What its tools let an agent do: 3 read
Install x402 Doctor in Claude Code, Cursor or VS Code
claude mcp add --transport http x402-doctor https://x402-doctor.tsharpe.workers.dev/mcp
What the publisher says
From the x402 Doctor repository's README, as published. We do not edit it. Read it on GitHub
Twelve Permissions — verification apparatus
Twelve NFTs on XRP Ledger mainnet. Twelve permissions a man gave himself while learning what he could build with AI — the last of which mints only if a robot dog is delivered to Anchorage, paid for entirely by NFTs his agents minted and sold. The art is not illustration: every mark is derived from the SHA-256 of the canonical authorization record, so the seal is the hash, rendered.
This repository exists so you don't have to take any of that on trust. It holds the generator, the canonical records, and the server source. Re-run them yourself.
Collection: Issuer: rHEiuaYLNQ4UdLqeUrnE9AwEHqsDMr9g9R (taxon 12, 5% royalty)
Verify a seal from first principles
No dependencies. Node only.
node generate.js # regenerates every seal from events.json
git status # should report no changesThe second line is the test. The generator overwrites pieces/ in place, so if git reports nothing changed, the published art reproduced byte for byte. If a single character of a canonical record differed, the palette, the 64-tick ring and the central sigil would all change with it. Forging a seal means breaking SHA-256.
To check one piece end to end:
explorer.
- Read its canonical record in events.json.
- Take the SHA-256 of that record — it is committed in the NFT's on-chain URI.
- Re-run the generator and compare the art, byte for byte.
- Look up the mint transaction in records/minted.mainnet.json on any XRPL
VERIFY.md has the long version.
What's here
Two artifacts, and only one of them proves anything
Each piece has two images, and the difference matters:
SHA-256 of its record by generate.js. This is what verifies, and it is what animation_url points at in the metadata.
- pieces/NN.svg — the canonical seal. Derived deterministically from the
field artwork by compose-art.js. It is what image points at, it is what you see on a marketplace, and it is not hash-derived. The field art is decorative.
- NN.png — the display image. The same seal composited over generated
That split is deliberate and is stated in every piece's metadata under verification. Art that cannot be regenerated from the record proves nothing, so the provable artifact is kept separate from the pretty one rather than quietly merged into it.
PNGs are not committed here because they are large and are display-only. Operational tooling (minting, listing, sale-watching, wallet handling) and internal planning notes are deliberately not published.
The MCP server
Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
x402 Doctor: common questions
- Is x402 Doctor MCP server safe?
- Mostly: it is graded B (80/100). Read the x402 Doctor safety report
- How do I install x402 Doctor?
- It runs remotely at x402-doctor.tsharpe.workers.dev. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.
- Does x402 Doctor need an API key?
- Not as far as the registry entry and our scan can tell: no credentials are declared or required.
- Is x402 Doctor maintained?
- The last commit was 57 days ago (2026-09-08). The latest release is v1.0.0.
- Is x402 Doctor up?
- 100% of our last 28 checks got an answer. We check remote servers about four times a day.
- How does x402 Doctor compare with other MCP servers?
- safety score 80/100 (higher than 60% of 48,255 servers); tools 3 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.