Card snapshot

This is a frozen copy of the agent's agent-card.json as we observed it at the timestamp above. We capture a new snapshot every time the card's content hash changes. Useful for: forensic drift analysis, verifying downstream callers see the right version, reproducing routing decisions made historically.

{
  "name": "x402lint",
  "description": "x402lint scans an x402 seller origin end-to-end: 402 challenge validity, accepts[] schema, price integrity, OpenAPI x402 conventions, agent docs surface, robots policy, favicon, and live standing on x402scan and Bazaar. Returns an A-F grade with per-check evidence and one-line fixes. 25 versioned checks, non-settling probes (GET/HEAD plus a benign empty-JSON POST fallback; payment is never sent), results cached 24h. Cached full reports are free; a paid $0.05 scan forces a fresh run. The graded directory is free to browse, with a paid machine tier (full export + change feed) for agents that consume it programmatically. Built by the Hexanon fleet, which runs seven live x402 products.",
  "url": "https://api.x402lint.dev/a2a",
  "preferredTransport": "JSONRPC",
  "protocolVersion": "0.3.0",
  "provider": {
    "organization": "x402lint",
    "url": "https://api.x402lint.dev"
  },
  "version": "0.3.0",
  "capabilities": {
    "streaming": false,
    "pushNotifications": false,
    "stateTransitionHistory": false,
    "extensions": [
      {
        "uri": "https://github.com/google-a2a/a2a-x402/v0.1",
        "description": "Paid endpoints settle via the x402 protocol (on-chain USDC). On an unpaid paid-route request the server returns HTTP 402 whose accepts[] lists one exact USDC rail per network; sign one rail and retry with PAYMENT-SIGNATURE (x402 V2) or X-PAYMENT (legacy). Free endpoints need no payment.",
        "required": false,
        "params": {
          "x402Version": 2,
          "networks": [
            "eip155:8453"
          ],
          "asset": "USDC",
          "scheme": "exact"
        }
      }
    ]
  },
  "defaultInputModes": [
    "application/json"
  ],
  "defaultOutputModes": [
    "application/json"
  ],
  "endpoints": [
    {
      "method": "GET",
      "path": "/v1/status",
      "params": [
        "url"
      ],
      "priceUsd": 0,
      "description": "Free. Returns whether an origin has been scanned, scan freshness, and the grade summary (grade, score, pass/warn/fail counts) \u2014 no per-check findings. Real data from prior scans; full findings are free at GET /v1/report while a fresh result exists; POST /v1/scan runs a fresh scan."
    },
    {
      "method": "GET",
      "path": "/v1/checks",
      "params": [],
      "priceUsd": 0,
      "description": "Free. The full conformance check catalog: every check's id, title, severity, and category, plus category summaries. Per-origin results (pass/warn/fail, evidence, one-line fixes) are delivered by the paid scan (POST /v1/scan) and cached report (GET /v1/report)."
    },
    {
      "method": "POST",
      "path": "/v1/scan",
      "params": [
        "url"
      ],
      "priceUsd": 0.05,
      "description": "Paid ($0.05). ALWAYS runs a fresh 25-check scan of the origin (non-settling GET/HEAD + benign empty-POST probes), bypassing the 24h cache \u2014 use free GET /v1/report to read the cached result. Concurrent requests for the same origin join the in-flight scan rather than double-scanning. Returns grade, score, per-check status + evidence + fix instructions, and a shareable report URL. Unreachable/broken origins are a valid graded result (F). 504 processing responses and errors are never charged."
    },
    {
      "method": "GET",
      "path": "/v1/report",
      "params": [
        "url"
      ],
      "priceUsd": 0,
      "description": "Free. Returns the full cached scan report (same shape as POST /v1/scan) if a fresh (<24h) result exists; otherwise an uncharged 404 pointing at POST /v1/scan. The zero-cost way to read any origin's latest findings \u2014 scan reports land here for 24h."
    },
    {
      "method": "GET",
      "path": "/v1/directory/export",
      "params": [],
      "priceUsd": 0.1,
      "description": "Paid ($0.10). The entire graded directory in one machine-shaped response: every listed origin with grade, score, grade history, legitimacy signals, branding, verification and featured status \u2014 the same record shape as /v1/directory plus gradeHistory, firstSeenAt, and scanCount. Capped at 10,000 records (truncated:true if hit). Grades measure protocol conformance only and are NOT endorsements."
    },
    {
      "method": "GET",
      "path": "/v1/changes",
      "params": [
        "since",
        "limit"
      ],
      "priceUsd": 0.03,
      "description": "Paid ($0.03). Everything that changed in the graded directory since a timestamp: newly listed origins (changeType \"new\"), grade changes (\"grade_changed\", with previousGrade/previousScore), and plain re-scans (\"rescanned\"). Poll this to keep a local copy of the directory fresh without re-buying the full export. An invalid since/limit is an uncharged 400."
    },
    {
      "method": "GET",
      "path": "/v1/directory",
      "params": [
        "sort",
        "category",
        "verified",
        "q",
        "page",
        "pageSize"
      ],
      "priceUsd": 0,
      "description": "Free. Paginated list of origins x402lint has scanned and graded, with conformance grade, auto-collected UNVERIFIED third-party branding, and ecosystem legitimacy signals. Sort by recency (default) or grade; filter by category, verification, or host substring. A grade measures protocol conformance only and is NOT an endorsement or a safety/legitimacy assessment. hasRecentSettlement is true or null (null = not observed in a bounded most-active-sellers walk, not proof of no settlements)."
    },
    {
      "method": "GET",
      "path": "/v1/featured",
      "params": [],
      "priceUsd": 0,
      "description": "Free. Origins that scored an A on their most recent scan within the last 30 days, recency-ranked. Featured placement is a free consequence of a recent A-grade scan; it expires 30 days after the scan (re-scan to refresh). Conformance only \u2014 NOT an endorsement. hasRecentSettlement is true or null (null = not observed in a bounded most-active-sellers walk, not proof of no settlements)."
    },
    {
      "method": "GET",
      "path": "/v1/project",
      "params": [
        "host"
      ],
      "priceUsd": 0,
      "description": "Free. The public directory record for one origin (grade, branding, legitimacy signals, verification + featured status). 404 uncharged if the origin is unknown or has opted out. hasRecentSettlement is true or null (null = not observed in a bounded most-active-sellers walk, not proof of no settlements)."
    },
    {
      "method": "POST",
      "path": "/v1/verify/start",
      "params": [
        "url"
      ],
      "priceUsd": 0,
      "description": "Free. Begin domain-control verification of an origin you operate. Returns a one-time token to place at /.well-known/x402lint-challenge on that origin, then call POST /v1/verify/confirm."
    },
    {
      "method": "POST",
      "path": "/v1/verify/confirm",
      "params": [
        "url"
      ],
      "priceUsd": 0,
      "description": "Free. x402lint fetches /.well-known/x402lint-challenge over HTTPS and, if it matches the unexpired token from /v1/verify/start, marks the origin owner-verified."
    },
    {
      "method": "POST",
      "path": "/v1/listing",
      "params": [
        "url",
        "listed",
        "suppressEnrichment"
      ],
      "priceUsd": 0,
      "description": "Free. For owner-verified origins only (else 403). Opt the origin out of the public directory (listed=false) and/or suppress auto-collected branding (suppressEnrichment=true)."
    }
  ],
  "x402": {
    "version": 2,
    "networks": [
      "eip155:8453"
    ],
    "assets": [
      "USDC"
    ]
  },
  "skills": [
    {
      "id": "scan",
      "name": "Priority fresh re-scan",
      "description": "Paid ($0.05). ALWAYS runs a fresh 25-check scan of the origin (non-settling GET/HEAD + benign empty-POST probes), bypassing the 24h cache \u2014 use free GET /v1/report to read the cached result. Concurrent requests for the same origin join the in-flight scan rather than double-scanning. Returns grade, score, per-check status + evidence + fix instructions, and a shareable report URL. Unreachable/broken origins are a valid graded result (F). 504 processing responses and errors are never charged.",
      "priceUsd": 0.05,
      "tags": [
        "x402lint",
        "scan"
      ]
    },
    {
      "id": "export",
      "name": "Full directory export (machine tier)",
      "description": "Paid ($0.10). The entire graded directory in one machine-shaped response: every listed origin with grade, score, grade history, legitimacy signals, branding, verification and featured status \u2014 the same record shape as /v1/directory plus gradeHistory, firstSeenAt, and scanCount. Capped at 10,000 records (truncated:true if hit). Grades measure protocol conformance only and are NOT endorsements.",
      "priceUsd": 0.1,
      "tags": [
        "x402lint",
        "export"
      ]
    },
    {
      "id": "changes",
      "name": "Directory change feed",
      "description": "Paid ($0.03). Everything that changed in the graded directory since a timestamp: newly listed origins (changeType \"new\"), grade changes (\"grade_changed\", with previousGrade/previousScore), and plain re-scans (\"rescanned\"). Poll this to keep a local copy of the directory fresh without re-buying the full export. An invalid since/limit is an uncharged 400.",
      "priceUsd": 0.03,
      "tags": [
        "x402lint",
        "changes"
      ]
    }
  ],
  "authentication": {
    "schemes": [
      "none",
      "x402"
    ],
    "description": "Free endpoints need no auth. Paid endpoints use the x402 V2 HTTP-402 flow: on an unpaid request the server returns a 402 whose accepts[] lists an exact USDC rail per network. Sign one rail and retry with the PAYMENT-SIGNATURE header (x402 V2) or legacy X-PAYMENT header. Per-call pricing."
  },
  "documentationUrl": "https://api.x402lint.dev/llms.txt",
  "openApiUrl": "https://api.x402lint.dev/openapi.json",
  "termsOfService": "https://api.x402lint.dev/terms.txt"
}