# agent-audit + page-read (x402)

> Pay-per-call page reader, quote check, link check and x402 seller audit. USDC on Base via x402.

- name: io.github.agent-audit-x402/x402-tools
- version: 0.1.1
- connection class: R0 (autonomous)
- trust: 97/100
- quality: 91/100 (strong)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.agent-audit-x402%2Fx402-tools
- tools: https://api.protogrid.dev/v1/servers/io.github.agent-audit-x402%2Fx402-tools/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "x402-tools": {
      "type": "http",
      "url": "https://mcp.agent-audit.workers.dev/mcp"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 99
- freshness: 100
- provenance: 90
- drivers: +repository +namespace-matches-repo +website +reachable +uptime-99% +updated-18d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 91/100 (strong)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 100 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 7 of 7 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 1,139 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 7, about 1,139 tokens to load them all
- tool set hash: 74f2bb5b64360f89c8e271f837ab19ac
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.agent-audit-x402/x402-tools.svg)](https://protogrid.dev/servers/io.github.agent-audit-x402/x402-tools)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Remotes

- https://mcp.agent-audit.workers.dev/mcp (streamable-http, auth none, reachable true, uptime30d 0.98571426)

## Packages

_none_

## Tools (7)

- `audit_x402_seller`: Paid, $0.02 USDC on Base via x402 (agent-audit). Read-only x402 seller and agent-readiness audit of one origin: live 402 challenge per paid route, price vs catalog, llms.txt, /.well-known/x402, openapi.json, dead doc links. JSON score, findings and fixes. Grades measure protocol conformance, not legitimacy. Call without payment to get the x402 requirements.
- `check_links`: Paid, $0.01 USDC on Base via x402 (agent-audit). Checks up to 25 URLs now: status, final URL, redirects, latency, verdict ok/broken/paid(402). Call without payment to get the x402 requirements.
- `list_services`: Free. Lists the paid tools, their USDC prices on Base, the upstream x402 HTTP endpoints, and how to pay.
- `preview_audit`: Free, rate-limited (10 per hour). Audit score, grade and fail/warn counts for one origin (no findings), from agent-audit's free preview.
- `preview_page`: Free, rate-limited (10 per hour). Title and the first 300 characters of a public page, from page-read's free preview.
- `quote_check`: Paid, $0.005 USDC on Base via x402 (agent-audit). Fetches the page now and reports whether the quote is really there: found_exact/found_near/partial/not_found/page_unavailable, similarity, context and page sha256. Call without payment to get the x402 requirements.
- `read_page`: Paid, $0.001 USDC on Base via x402 (page-read). Fetches one public web page now and returns clean markdown or text with title, canonical URL, published time and sha256. No JavaScript execution. Fetch failures and unreadable pages are not charged. Call without payment to get the x402 requirements.