← x402audit
report for

hirescrape.com

4/20/2026, 10:42:27 PM · 413ms · 39 checks
87
grade B
93
Discovery (draft-payment-discovery-00)
88
Runtime 402 probe
97
HTTP Payment auth + charge intent
100
Per-method charge conformance
100
JSON-RPC / MCP transport
67
Cross-registry visibility

Discovery (draft-payment-discovery-00)

93/100
  • [ok ]
    OpenAPI 3.1 valid
  • [ok ]
    info.x-guidance present
  • [warn]
    x-discovery.ownershipProofs populated
    Empty — register on MPPScan / X402Scan to get a proof string.
    fix · Register on https://mppscan.com and https://www.x402scan.com/resources/register, paste returned proofs into AGENTCASH_OWNERSHIP_PROOFS.
  • [ok ]
    Paid operations detected
    28 operations declare x-payment-info.
  • [ok ]
    Every paid op declares responses.402
    28/28 ops have responses.402
  • [ok ]
    /.well-known/x402 parses
  • [ok ]
    GET /llms.txt

Runtime 402 probe

88/100
  • [ok ]
    Returns 402 without payment
    Got 402
  • [ok ]
    PAYMENT-REQUIRED header emitted (x402 v2)
  • [ok ]
    WWW-Authenticate: Payment (MPP)
    Payment id="CeGPmU6E0zE27v54RNK-vSr-iST_k3LNzwtdTltxgRE", realm="hirescrape.com", method="tempo", intent="charge", request="eyJhbW91bnQiOiI3MDAwMCIsImN1cnJlbmN5IjoiMHgyMGMwMDAwMDAwMDAwMDAwMDAwMDAwMDBiOTUzN2QxMWM2MGU4YjUwIiwibWV0aG9kRGV0YWlscyI6eyJjaGFpbklkIjo0MjE3fSwicmVjaXBpZW50IjoiMHhiNTE5NEE5OERiREJiNzAyOEI1ODVEYjI2Qjk3MmU3RjBGM2Y4MjZBIn0", description="Scrape Reddit posts, comments, AI Answers, subreddits, and search. TLS fingerprinting, no API key.", expires="2026-04-20T22:47:27.325Z"
  • [fail]
    PAYMENT-REQUIRED header under 16KB (Node cap)
    27576 bytes
    fix · Trim input schemas or hoist bazaar.schema to top-level only (strip duplicates from per-accept).
  • [ok ]
    x402Version: 2 on header
  • [ok ]
    extensions.bazaar.schema.properties.input.properties.body
  • [ok ]
    extensions.bazaar.schema.properties.output.properties.example
  • [ok ]
    CAIP-2 network reference
    accepts[0].network = "eip155:8453"

HTTP Payment auth + charge intent

97/100
  • [ok ]
    WWW-Authenticate starts with "Payment" (draft-httpauth-payment-00 §5.1)
    Payment id="CeGPmU6E0zE27v54RNK-vSr-iST_k3LNzwtdTltxgRE", realm="hirescrape.com", method="tempo", intent="charge", request="eyJhbW91bnQiOiI3MDAwMCIsImN1cnJlbmN5IjoiMHgyMGMwMDAwMDAwMDAwMDAwMDAwMDAwMDBiOTUzN2QxMWM2MGU4YjUwIiwibWV0aG9kRGV0YWlscyI6eyJjaGFpbklkIjo0MjE3fSwicmVjaXBpZW50IjoiMHhiNTE5NEE5OERiREJiNzAyOEI1ODVEYjI2Qjk3MmU3RjBGM2Y4MjZBIn0", description="Scrape Reddit posts, comments, AI Answers, subreddits, and search. TLS fingerprinting, no API key.", expires="2026-04-20T22:47:27.325Z"
  • [ok ]
    auth-param "id" present
  • [ok ]
    auth-param "realm" present
  • [ok ]
    auth-param "method" present
  • [ok ]
    auth-param "intent" present
  • [ok ]
    auth-param "request" present
  • [ok ]
    method is lowercase ASCII (§5.1.1 "MUST be a lowercase ASCII string")
    tempo
  • [ok ]
    intent is lowercase ASCII (registered IANA value)
    charge
  • [ok ]
    request has no "=" padding (§5.1.1 "Padding characters MUST NOT be included")
  • [ok ]
    request decodes to a JSON object
  • [warn]
    digest present for request with body (§5.1.2 SHOULD)
    fix · Include a digest auth-param per RFC 9530 when the paid request carries a body. Example: digest="sha-256=:hash:".
  • [ok ]
    expires is RFC3339
    2026-04-20T22:47:27.325Z
  • [ok ]
    charge.amount is a string of digits in minor units (draft-payment-intent-charge-00 §3)
    70000
  • [ok ]
    charge.currency is a valid form (ISO 4217 lowercase or on-chain asset ref)
    0x20c000000000000000000000b9537d11c60e8b50
  • [ok ]
    charge.recipient present
  • [ok ]
    charge.methodDetails is an object

Per-method charge conformance

100/100
  • [ok ]
    Detected method: tempo → draft-tempo-charge-00
  • [ok ]
    methodDetails.chainId present
    4217
  • [ok ]
    charge.currency is a 0x-prefixed TIP-20 address
    0x20c000000000000000000000b9537d11c60e8b50
  • [ok ]
    recipient is a 0x-prefixed address

JSON-RPC / MCP transport

100/100
  • [info]
    JSON-RPC / MCP endpoint present
    No /mcp, /rpc, or /jsonrpc endpoint responding. draft-payment-transport-mcp-00 is optional.
    fix · Serve a JSON-RPC 2.0 endpoint for MCP-compatible buyers. Signal payment via error code -32042.

Cross-registry visibility

67/100
  • [ok ]
    mppscan — indexed
    resources=28, txs=4, vol=$0.085, buyers=1
  • [ok ]
    x402scan — indexed
    origins=2, resources=56
  • [fail]
    Coinbase Bazaar — indexed
    Not in Bazaar.
    fix · Bazaar auto-indexes on first paid x402/Base settle via the CDP facilitator. Self-pay one $0.02 call to bootstrap.
help keep it free
x402audit is free forever. If it saved you an afternoon, buy us a coffee →