underscoredone/x402-tools-skill
Inspect any x402 endpoint before you pay it.
x402 tools for checking http 402 headers and openapi.json
- JavaScript98.5%
- Shell1.5%
Placement
Every place and its price$3
Nobody has bought this repo a place yet. Listing is free. Paid placement starts at $3, and $18 puts it at the top. You pay once: a place holds until another repo spends more, and then it moves down, never off. No subscription, no expiry, no refunds.
1 Review
x402 Tools is a focused, thoughtfully constrained skill for examining paid API endpoints without holding a wallet or making payments. It decodes both v1 and v2 x402 challenges, converts atomic token amounts using chain-specific decimals, discovers OpenAPI documents, and compares published metadata with a live response. The read-only design is a strong security choice. Its request layer blocks local, private, link-local, and reserved destinations, resolves hostnames before connecting, rechecks redirects, limits response size, caps request duration, and rejects non-HTTP schemes. Unknown tokens are handled cautiously, with endpoint-declared decimals clearly distinguished from the built-in verified table. The skill instructions are unusually complete and explain when to run each command, how to report results, and why the tool avoids grading endpoints.
The repository is also easy to install and operate. It requires only Node 18, carries no runtime or development dependencies, includes a self-contained engine bundle, and tests the actual shipped artifact rather than an unbundled source copy. CI covers Node 18, 20, and 22 while checking v1 and v2 decoding, chain-specific decimal handling, CLI behavior, required skill files, and private-address refusal. The README, examples, changelog, contribution guide, issue templates, MIT license, and optional attribution notice are all clear and consistent.
A few implementation gaps deserve attention. The CLI documents --header as repeatable, but its argument parser overwrites earlier values, so only the final header survives. The skill also promises to report every x-* OpenAPI field, while pickExtensions currently retains only a fixed allowlist and silently drops unfamiliar extensions. Network tests are entirely offline, leaving redirect handling, DNS rebinding defenses, timeouts, response caps, OpenAPI discovery, and live comparison behavior without direct integration coverage. Finally, the important core logic is committed as a generated bundle from a separate repository, but this repository does not record or verify the exact upstream commit used to create it. Recording that provenance and adding a reproducible bundle check would make audits and contributions easier. Addressing these issues would strengthen an already disciplined and useful inspection tool.