# agent-audit

> Pay-per-request, read-only checks for AI agents and x402 sellers: x402 seller audit, bulk link health, and quote/citation verification. USDC on Base (eip155:8453) via x402. No signup, no API key.

Every check is read-only: GET/HEAD, one unpaid POST per paid route (the quote step), and one request with a literal garbage payment header. We never pay targets, never log in, never load-test. Unpaid calls get HTTP 402 with a PAYMENT-REQUIRED header; pay with any x402 client and retry.

## Paid endpoints

- [GET /v1/audit?url=](https://agent-audit.agent-audit.workers.dev/v1/audit): $0.02 per call. x402 seller + agent-readiness audit of one origin (402 challenge per paid route, price vs catalog, llms.txt, /.well-known/x402, openapi.json, dead links). JSON report with score, findings and fixes.
- [POST /v1/links](https://agent-audit.agent-audit.workers.dev/v1/links): $0.01 per call. Body {"urls": [...]} up to 25 URLs; status, final URL, redirects, latency, verdict.
- [GET /v1/quote-check?url=&quote=](https://agent-audit.agent-audit.workers.dev/v1/quote-check): $0.005 per call. Is this quote really on that page right now? Verdict, similarity, context, page sha256.

## Related API (same operator, same wallet)

- [page-read](https://page-read.agent-audit.workers.dev/llms.txt): web page -> clean markdown for agents, $0.001 per page (GET /v1/read?url=).

## Free

- [GET /v1/preview?url=](https://agent-audit.agent-audit.workers.dev/v1/preview?url=example.com): audit score, grade and fail/warn counts, no findings. 10 per hour per IP.
- [OpenAPI](https://agent-audit.agent-audit.workers.dev/openapi.json)
- [x402 discovery](https://agent-audit.agent-audit.workers.dev/.well-known/x402)

## How to pay (x402 v2, exact scheme)

1. Call the paid URL with no payment. You get HTTP 402 and a PAYMENT-REQUIRED header (base64 JSON; the same terms are mirrored in the JSON body): x402Version 2, accepts[0] = {scheme "exact", network eip155:8453, asset USDC 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 (6 decimals), amount in atomic units, payTo 0xa31bE3a1Ac1dde980dB8D18D32E7cd9Ab557360A, maxTimeoutSeconds 120, extra {name "USD Coin", version "2"}}.
2. Sign an EIP-3009 transferWithAuthorization for exactly that amount to payTo (random 32-byte nonce, validBefore about now + maxTimeoutSeconds). Send the same request again with header PAYMENT-SIGNATURE: base64 of the x402 v2 PaymentPayload (x402Version, accepted requirements, payload {signature, authorization}). Any x402 v2 client (e.g. @x402/fetch with @x402/evm) does steps 1-2 for you. You need no ETH: the facilitator pays gas.
3. We verify with the facilitator, run the request, and settle only if the result is 2xx. A settled response is HTTP 200 with header PAYMENT-RESPONSE: base64 JSON {success: true, transaction: <Base tx hash>, network: "eip155:8453", payer: <your address>}. Keep it as your receipt.
- Production facilitator: PayAI, https://facilitator.payai.network. Settlement transactions are sent by PayAI's signers (listed at https://facilitator.payai.network/supported) and show up as a USDC Transfer from your address to payTo.

## If the payment status is uncertain (timeout, dropped connection, 5xx, or no PAYMENT-RESPONSE)

- Do not sign a new payment right away. First check whether your authorization was used: call USDC authorizationState(yourAddress, nonce) on Base (true = settled), or look for the USDC Transfer from your address to 0xa31bE3a1Ac1dde980dB8D18D32E7cd9Ab557360A on https://basescan.org.
- Not used: the old authorization stops being valid at its validBefore (at most 120 s). Wait until then, or check again, before you retry with a fresh signature, so you cannot pay twice.
- Used, but you did not get the result: settlement happens only after the result is ready, and a failed settlement returns an error, never the result. So this only happens if the connection breaks after settlement. Repeating the request costs a new payment; nothing is cached. Email parafield-dev@mail.grokbot.com with the transaction hash.
- A 503 payment_facilitator_unavailable with charged:false means the request never reached settlement and nothing was charged.

## Operator

Operated by the GitHub account agent-audit-x402 (https://github.com/agent-audit-x402); contact parafield-dev@mail.grokbot.com. Directory proposal: https://github.com/X402blockchains/x402-registry/pull/14. page-read has the same operator and payee.

## Limits and honesty

- Results reflect one fetch from Cloudflare's edge at the time shown; JavaScript is not executed.
- Each call makes at most 44 outbound requests; anything beyond is reported as "skipped", never guessed.
- Grades measure protocol conformance and documentation, not whether a seller is legitimate or safe.
- Private, loopback and link-local targets are refused.
- Unreachable targets still get a report (that is the finding). Invalid input returns 400 and is not charged; payment settles only after a successful (2xx) result.
- Payments go to 0xa31bE3a1Ac1dde980dB8D18D32E7cd9Ab557360A.