{
  "markdown": "# x402-triage-mcp\n\n[![ci](https://github.com/TateLyman/x402-triage-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/TateLyman/x402-triage-mcp/actions/workflows/ci.yml)\n\nMCP server for no-payment x402 surface triage, 402 Index health checks, and paid review handoff.\n\nIt exposes three MCP tools:\n\n- `triage_x402_surface` checks one public x402, MPP, Pay.sh, OpenAPI, manifest, or HTTP 402 endpoint through the Tate Programs public triage API.\n- `watch_402_index` searches public 402 Index metadata for provider health, payment-validity, and domain-verification signals.\n- `x402_paid_paths` returns the paid x402 API endpoints, service catalog, AgentCard, and fixed-scope review links.\n\nThe tools do not send `X-PAYMENT`, wallet signatures, API keys, private credentials, or paid calls.\n\nTool page: https://tateprograms.com/x402-surface-check.html\n\nPaid x402 API catalog: https://tateprograms.com/services.json\n\nAgentCard: https://the402.tateprograms.com/.well-known/agent-card.json\n\n## Install\n\nRun directly with `npx`:\n\n```bash\nnpx --yes x402-triage-mcp\n```\n\n## MCP Config\n\nAdd this server to an MCP client that supports stdio servers:\n\n```json\n{\n  \"mcpServers\": {\n    \"x402-triage\": {\n      \"command\": \"npx\",\n      \"args\": [\"--yes\", \"--package\", \"x402-triage-mcp\", \"x402-triage-mcp\"]\n    }\n  }\n}\n```\n\nSTDIO MCP client config launches a local command. Review the `command`, `args`, and any `env` values before running generated configs, and pin versions when repeatability matters.\n\n## Tools\n\n### `triage_x402_surface`\n\n```json\n{\n  \"url\": \"https://api.example.com/.well-known/x402\",\n  \"method\": \"GET\",\n  \"origin\": \"https://app.example.com\"\n}\n```\n\nReturns status, payment headers, parsed challenge summary, attack-class checks, findings, and paid handoff paths.\n\n### `watch_402_index`\n\n```json\n{\n  \"q\": \"example.com\",\n  \"protocol\": \"x402\",\n  \"limit\": 10\n}\n```\n\nReturns matching public 402 Index records, health summary, visible launch blockers, and paid handoff paths.\n\n### `x402_paid_paths`\n\nReturns:\n\n- `https://the402.tateprograms.com/api/x402/triage`\n- `https://the402.tateprograms.com/api/x402/index-watch`\n- `https://tateprograms.com/services.json`\n- `https://tateprograms.com/x402-five-attack-review.html`\n- `https://tateprograms.com/x402-fix-sprint.html`\n\n## Payment And Safety Boundary\n\nUse this server only on public launch surfaces that you own or are authorized to inspect. Do not submit private URLs, tokenized URLs, customer data, wallet seed phrases, or production secrets.\n\nThis MCP server is read-only. It does not initiate payments, send `X-PAYMENT` headers, sign wallet messages, call paid endpoints, create invoices, settle balances, or grant purchasing authority. The only paid paths it returns are static Tate Programs handoff URLs for teams that choose to buy a separate review.\n\nFor agent-commerce reviews, the server reports whether the target surface exposes the safety controls buyers expect before real spend is enabled:\n\n- Spend limits: per-call and total budget caps should be explicit before an agent can pay.\n- Approval checkpoints: payment setup and high-risk spend should require a visible user or policy approval step.\n- Recipient validation: paid requests should be constrained to expected domains, merchants, wallet addresses, or signed registry entries.\n- Replay protection: challenges and settlement callbacks should use nonces, expirations, idempotency keys, signed resources, or equivalent controls.\n- Metadata minimization: payment metadata should avoid private user context, secrets, and unnecessary resource detail.\n- Receipts and audit trails: successful payments should produce transaction IDs, recipient, amount, reason, and policy evidence.\n\n## Development\n\n```bash\nnpm install\nnpm run check\n```\n",
  "bytes": 3754,
  "sha": "1de0bd7b0a66ab4dbfc5338f084f381680cfb3546548f73c7c6780f953495373",
  "repo_slug": "tatelyman/x402-triage-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_tatelyman_x402_triage_mcp_ddb67974/readme"
}