X402 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited X402 (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 2 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
x402 is an open standard for internet native payments. It aims to support all networks (both crypto & fiat) and forms of value (stablecoins, tokens, fiat).
app.use(
paymentMiddleware(
{
"GET /weather": {
accepts: [...], // As many networks / schemes as you want to support
description: "Weather data", // what your endpoint does
},
},
),
);
// That's it! See examples/ for full details<details> <summary><b>Installation</b></summary>
# All available reference sdks
npm install @x402/core @x402/evm @x402/svm @x402/axios @x402/fetch @x402/express @x402/hono @x402/next @x402/paywall @x402/extensions
# Minimal Fetch client
npm install @x402/core @x402/evm @x402/svm @x402/fetch
# Minimal express Server
npm install @x402/core @x402/evm @x402/svm @x402/expresspip install x402go get github.com/x402-foundation/x402/go</details>
The x402 ecosystem is growing! Check out our ecosystem page to see projects building with x402, including:
Want to add your project to the ecosystem? See our demo site README for detailed instructions on how to submit your project.
Roadmap: see ROADMAP.md
Documentation: see docs/ for the GitBook documentation source
resource: Something on the internet. This could be a webpage, file server, RPC service, API, any resource on the internet that accepts HTTP / HTTPS requests.client: An entity wanting to pay for a resource.facilitator: A server that facilitates verification and execution of payments for one or many networks.resource server: An HTTP server that provides an API or other resource for a client.See specs/ for full documentation of the x402 standard/
x402 payments typically adhere to the following flow, but servers have a lot of flexibility. See advanced folders in examples/.
The following outlines the flow of a payment using the x402 protocol. Note that steps (1) and (2) are optional if the client already knows the payment details accepted for a resource.
Client makes an HTTP request to a resource server.Resource server responds with a 402 Payment Required status and a PaymentRequired b64 object return as a PAYMENT-REQUIRED header.Client selects one of the PaymentRequirements returned by the server response and creates a PaymentPayload based on the scheme & network of the PaymentRequirements they have selected.Client sends the HTTP request with the PAYMENT-SIGNATURE header containing the PaymentPayload to the resource server.Resource server verifies the PaymentPayload is valid either via local verification or by POSTing the PaymentPayload and PaymentRequirements to the /verify endpoint of a facilitator.Facilitator performs verification of the object based on the scheme and network of the PaymentPayload and returns a Verification Response.Verification Response is valid, the resource server performs the work to fulfill the request. If the Verification Response is invalid, the resource server returns a 402 Payment Required status and a Payment Required Response JSON object in the response body.Resource server either settles the payment by interacting with a blockchain directly, or by POSTing the Payment Payload and Payment PaymentRequirements to the /settle endpoint of a facilitator server.Facilitator server submits the payment to the blockchain based on the scheme and network of the Payment Payload.Facilitator server waits for the payment to be confirmed on the blockchain.Facilitator server returns a Payment Execution Response to the resource server.Resource server returns a 200 OK response to the Client with the resource they requested as the body of the HTTP response, and a PAYMENT-RESPONSE header containing the Settlement Response as Base64 encoded JSON if the payment was executed successfully.A scheme is a logical way of moving money.
Blockchains allow for a large number of flexible ways to move money. To help facilitate an expanding number of payment use cases, the x402 protocol is extensible to different ways of settling payments via its scheme field.
Each payment scheme may have different operational functionality depending on what actions are necessary to fulfill the payment. For example exact, the first scheme shipping as part of the protocol, would have different behavior than upto. exact transfers a specific amount (ex: pay $1 to read an article), while a theoretical upto would transfer up to an amount, based on the resources consumed during a request (ex: generating tokens from an LLM).
See specs/schemes for more details on schemes, and see specs/schemes/exact/scheme_exact_evm.md to see the first proposed scheme for exact payment on EVM chains.
Because a scheme is a logical way of moving money, the way a scheme is implemented can be different for different blockchains. (ex: the way you need to implement exact on Ethereum is very different from the way you need to implement exact on Solana).
Clients and facilitators must explicitly support different (scheme, network) pairs in order to be able to create proper payloads and verify / settle payments.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.