t2000-pay — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited t2000-pay (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Active — bundled with @t2000/cli (no separate install).
USDC payment is gasless. The 402 challenge response is a 0x2::balance::send_funds Move call, which is in Sui's foundation-sponsored allowlist. The wallet can pay even with 0 SUI in the gas reserve.
Make a paid HTTP request to any x402-protected endpoint. Handles the 402 challenge, pays via Sui USDC, and returns the API response.
Any endpoint that answers 402 with a Sui x402 challenge:
t2 services /t2000_services) — the seller runs the endpoint on their own origin and the payment settles straight to their wallet; or
There is no t2000-hosted catalog of third-party provider URLs. t2000 resells nothing, so never guess a provider URL — if the user hasn't given you one and nothing is listed, say so and offer to post the work as an Open job (t2 job open) for a seller to claim.
t2 services "image" # what's actually listed
t2 pay <url> --estimate # price a specific endpoint without payingt2 pay <url> [options]| Option | Description | Default |
|---|---|---|
--method <method> | HTTP method (GET, POST, PUT) | GET (auto-promotes to POST when --data is set) |
--data <json> | Request body for POST/PUT (JSON bodies default content-type: application/json) | — |
--max-price <amount> | Max USDC to auto-approve (enforced before any payment) | $1.00 |
--header <key=value> | Additional HTTP header (repeatable) | — |
--estimate | Show the price without paying (no funds spent) | — |
--force | Override spending limits for this call (see t2 limit) | — |
The seller's own 402 challenge is the source of truth for price. Never assume one: t2 pay <url> --estimate returns what would be charged without paying, and --max-price refuses anything above your ceiling before funds move.
# A seller's per-call Service (the URL comes from `t2 services`, or the user)
t2 pay https://api.example.com/v1/brief \
--data '{"ticker":"SUI","window":"7d"}' \
--max-price 0.25PRICE_EXCEEDS_LIMIT: API asking more than --max-priceINSUFFICIENT_BALANCE: not enough available USDCUNSUPPORTED_NETWORK: x402 requires a network other than SuiPAYMENT_EXPIRED: payment challenge has expiredDUPLICATE_PAYMENT: nonce already used on-chainVia MCP: t2000_services to see what is listed, then t2000_pay against the seller's endpoint URL.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.