x402 security audit · X402 Audit

import { wrapFetchWithPayment } from "@x402/fetch";
import { privateKeyToAccount } from "viem/accounts";

const account = privateKeyToAccount(process.env.PRIVATE_KEY);
const fetchWithPay = wrapFetchWithPayment(fetch, account);

const res = await fetchWithPay("https://agent402.tools/api/x402-audit", {
  method: "GET",
});
const data = await res.json();

curl -X GET \
  "https://agent402.tools/api/x402-audit?method=POST&url=https%3A%2F%2Fagent402.tools%2Fapi%2Fhash" \
  -H "X-PAYMENT: <signed x402 payment>"

{
  "checks": [
    {
      "attack": "credential interception",
      "detail": "https",
      "id": "transport-tls",
      "severity": "high",
      "status": "pass",
      "title": "Payment challenge served over TLS"
    },
    {
      "attack": "III - cache leakage",
      "detail": "Cache-Control: no-store, private",
      "id": "cache-hygiene",
      "severity": "high",
      "status": "pass",
      "title": "Gated response is not shared-cacheable"
    }
  ],
  "grade": "A",
  "paymentRequired": true,
  "reachable": true,
  "score": 92,
  "status": 402,
  "summary": "A (92/100) - 6 passed, 1 warning, 0 failed. Note: replay/idempotency (II) and router Sybil (IV) can't be graded from outside.",
  "url": "https://api.example.com/paid",
  "x402Version": 2
}