minia2a-payment-audit

x402 payment trust check for AI agents — pay-per-call via x402, settled in USDC on Base. No API keys, no subscriptions, no KYC. Bring a wallet.

Before you pay an x402 seller for an API result, ask: does that endpoint actually verify my payment — or does it deliver results to anyone who asks? If the latter, you pay and a free-rider gets the same answer for nothing, and the seller loses money serving you. This package runs a black-box probe server-side against the endpoint you plan to pay:

| Verdict | Meaning | |---|---| | SAFE | Refused every probe that carried no valid payment: no header, a forged tx hash, a malformed header | | RISK | Delivered a payload for one of those probes — you would be paying for something others get free | | NOT_X402 | Not an x402 payment endpoint (it never issued a 402 challenge) |

Honest limits: this is a black-box trust check, not a full audit. It cannot see pay-then-no-delivery, internal logic flaws, or whether the seller actually holds the goods you are buying. A SAFE verdict means the paywall held on this day, from this host — not that the seller is honest. The probe logic runs server-side and is not open-sourced.

Install

npm install minia2a-payment-audit

CLI

export MINIA2A_PRIVATE_KEY=0x...
minia2a-payment-audit check https://example.com/x402/time

Library

import { createPaymentAuditClient } from "minia2a-payment-audit";

const client = createPaymentAuditClient();
const result = await client.trustCheck("https://example.com/x402/time");
// { ok: true, verdict: "SAFE", url, evidence: {...}, reproduce: "curl ..." }

Configuration

| Env | Default | Notes | |---|---|---| | MINIA2A_PRIVATE_KEY | — | Required. The wallet that pays the $5 check fee in USDC on Base. Never transmitted. | | MINIA2A_BASE | http://99.81.245.60 | Service origin. Override if you reach the operator over HTTPS. |

Changelog

0.2.0 — address fix. 0.1.0 called https://minia2a.uk/x402/x402-payment-audit. That host is not this service's machine, that route was never served there, and the 402 it returned named a different payTo than this service's. A buyer following 0.1.0 would have paid a stranger and received nothing. The default is now the operator's own address; a rotating HTTPS tunnel hostname is opt-in via MINIA2A_BASE rather than a default that silently rots.

0.1.0 — first release.

License

MIT