X402 Fetch Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited X402 Fetch Mcp (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP (Model Context Protocol) server that enables AI agents to automatically pay for and access paywalled content using the x402 payment protocol.
x402 is a payment protocol that uses HTTP status code 402 (Payment Required) to enable micropayments for web content. When an AI agent encounters a 402 response, this MCP server automatically handles the payment using USDC on Base network.
~/.x402/config.json (not environment variables)# Run the setup wizard
npx x402-fetch-mcp setupYou'll be prompted for:
baseSepolia (testnet) or base (mainnet)claude mcp add x402 -- npx x402-fetch-mcpclaude mcp list
# Should show: x402 - ✓ ConnectedOnce installed, Claude Code can automatically access paywalled content:
User: Fetch the content from https://learn402.xyz/demo/protected-content
Claude: I'll use the x402_fetch tool to access this paywalled content...
[Automatically pays $0.01 USDC and retrieves content]Fetches content from a URL with automatic x402 payment support.
Parameters:
url (required): The URL to fetchmethod (optional): HTTP method (GET, POST, etc.)headers (optional): Additional headersbody (optional): Request body for POST/PUTReturns information about the configured wallet.
Config file location: ~/.x402/config.json
{
"privateKey": "0x...",
"network": "baseSepolia"
}npx x402-fetch-mcp-setup infonpx x402-fetch-mcp setup
# Choose 'y' to overwrite existing config~/.x402/config.json with 600 permissionsenv command)| Network | Chain ID | USDC Contract |
|---|---|---|
| Base Sepolia | 84532 | 0x036CbD53842c5426634e7929541eC2318f3dCF7e |
| Base | 8453 | 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 |
For Base Sepolia testnet:
Try the x402 payment flow at learn402.xyz
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.