payql — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited payql (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Get live on-chain data from The Graph's subgraphs (DeFi, DEX pools, NFTs, ENS, tokens, governance — 15,000+ subgraphs across 20+ chains), paying ~$0.01 USDC per query over x402. No API key, no account, no ETH for gas — the payment is the auth, and it's gasless (EIP-3009 transferWithAuthorization on Base).
💸 This spends real USDC. Every paid query is a live on-chain micropayment (~$0.01) from your wallet — it is not a free, read-only API, and the payment is visible on-chain and to the x402 facilitator. Quote the price first (free), and fund a dedicated, low-balance wallet — see Wallet & safety.
402 challenge to read the exact USDC cost before paying (free).402 from your wallet, get the data + a receipt back.Install and wire into your harness (Claude Desktop / Code / Cursor):
{
"mcpServers": {
"payql": {
"command": "npx",
"args": ["-y", "payql"],
"env": { "PAYQL_NETWORK": "base", "PAYQL_PRIVATE_KEY": "0xYOUR_BASE_WALLET_KEY" }
}
}
}⚠️ `PAYQL_PRIVATE_KEY` can spend its wallet's USDC. Use a dedicated, low-balance Base wallet — never a primary, valuable, or reused key. It sits in your harness config (which can be logged, synced, or screenshotted), so treat it like any secret: don't commit it or paste it in shared chats. Don't want a raw key here? Use option B (your harness's own wallet) or an Ampersend-managed wallet with spend caps.
Tools: search_subgraphs, get_payment_info (free price quote), query_subgraph (paid), get_subgraph_schema, wallet_status. Full recipe + example queries in references/gateway.md.
If your harness already has an x402 / pay-for-service capability, hit the gateway directly:
https://gateway.thegraph.com/api/x402/subgraphs/id/<SUBGRAPH_ID>{"query":"..."}. On 402, pay the quoted USDC amount and retry — your x402 client does this automatically.Full no-install recipe (discovery query, pricing, examples) in references/gateway.md.
PAYQL_PRIVATE_KEY can spend that wallet's USDC.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.