reference
What is x402lint?
x402lint is a conformance scanner for x402 APIs — the SSL Labs for x402 sellers. It fetches an origin's live surfaces and runs 25read-only checks across three categories — its protocol and payment surface, its agent-facing docs and discovery, and its standing in the x402 ecosystem — then returns a single A–F grade with per-check evidence and a one-line fix for every finding. A fresh scan is paid per call in USDC over x402, with no accounts and no API keys; once an origin has been scanned, looking up its grade and reading the full cached report are free. Every graded origin also gets a public report page and a slot in x402lint's directory, which agents can browse to find working x402 services.
Grades measure x402 protocol conformance only — not legitimacy or safety. A well-built scam can score an A. Always do your own diligence before paying any service.
What a scan checks
Every check is read-only and versioned. x402lint fetches your live surfaces and never sends a real payment — the only payment-ish probe is a literal garbage header, to confirm a bad payment is rejected. The 25 checks fall into 3 families:
Protocol & payment surface
8 checks402 challenge validity, accepts[] schema, price integrity, HEAD-does-not-settle, and payment-header correctness.
Discovery & agent docs
12 checksOpenAPI x402 conventions, security schemes, Bazaar extensions, .well-known surfaces, llms.txt, agent-card, robots, and favicon.
Ecosystem standing
5 checksRegistration/freshness on x402scan, recent on-chain settlement, trust tier, and x402.org presence.
The graded directory
Every origin x402lint scans is listed in a public, graded directory. The machine surface is GET /v1/directory — a free, paginated list of graded origins with their conformance grade and ecosystem signals. The human surface is a per-origin report page at x402lint.dev/o/<host>, which shows the grade, score, and pass/warn/fail counts, plus the exact free curl to read the full cached findings.
An x402lint grade measures x402 protocol conformance only — how well an origin implements the x402 spec and discovery conventions. It is NOT an endorsement and does NOT verify that the operator is legitimate, safe, or that you should send it funds. A well-built fraudulent service can score highly. Always do your own diligence before paying any service.
Listing is a consequence of a scan, not a claim about the operator. If a listed origin is yours and you would rather not appear, you can prove control of the domain and opt out — the same domain-control verification that marks an origin as owner-verified also lets the verified owner remove it from the public directory.
How agents pay
Paid scans use x402: the endpoint answers an unpaid request with an HTTP 402 challenge that states the price and where to pay, the client settles in USDC on Base, and retries the request with a payment header. There are no accounts, no API keys, and no signup — the challenge itself is the entire onboarding. See the pricing section for what each call costs.
FAQ
Is an x402lint grade an endorsement?
No. A grade measures x402 protocol conformance only — how well an origin implements the x402 spec and discovery conventions. It is not an endorsement and does not verify that the operator is legitimate or safe. A well-built fraudulent service can still score an A. Always do your own diligence before paying any service.
How do I remove my listing?
Prove control of the domain and opt out. The directory only lists origins x402lint has scanned; verified owners can remove their origin from the public directory. Verification uses a domain-control check, so only the real operator can opt a host in or out.
How fresh is a cached report?
Cached reports reflect the last scan and are served free. When you need current numbers, force an always-fresh scan, which bypasses the cache and re-runs every check against your live origin.
What does a scan cost?
Cached grades and full reports are free to read. A fresh, cache-bypassing scan is a pay-per-call x402 endpoint priced in USDC on Base. See the pricing section on the homepage for the current amounts.
for agents
Everything is machine-readable and served by the API host. Start at llms.txt.