x402 census · payai.agentstools.dev · a07b0dafcb6c · JSON

POST /mcp/scan

method-gated

Static security scan of an MCP manifest or tool list. Detects tool poisoning, hidden unicode instructions, prompt injection, data-exfiltration directives, dangerous capabilities, tool shadowing and post-approval rug-pull drift. Returns a 0-100 risk score, category, per-tool findings and content hashes. Security indicators, not a guarantee.

Verdict: not verified by an unpaid GET. 405/400: the 402 sits behind the declared method. This says nothing about whether the route works when called as declared.

Facts from the catalogs

Field Value

URL https://payai.agentstools.dev/mcp/scan

Method POST

Price $0.01 USDC = 10000 atomic units of EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v

Network solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp (solana)

payTo AytHnvc6bZx1ALTy7b5Px7hcavoSYszG9aeKvDcZ8R1u

Seller payai.agentstools.dev

Catalogs payai (row updated 2026-09-30)

Listed since (lower bound) 2026-09-30 (earliest catalog timestamp; catalogs report last-update times only)

Last catalog update 2026-09-30

CDP quality counters not in the CDP catalog

Category (keyword rule) crypto-data

Templated path no

x402Version in catalog 2

Service name / tags mcp-scan · mcp, security, tool-poisoning, prompt-injection, scanner

Unpaid probe (census of 2026-09-30)

Field

Value

Probed at

2026-09-30T23:48:01.995Z

HEAD

405

GET

405

Verdict

method-gated 405/400: the 402 sits behind the declared method

402 carried in

n/a

x402Version in the 402

n/a

accepts[0]

none

Live amount equals catalog price

not comparable

Live payTo equals catalog payTo

not comparable

extensions.bazaar in the 402

PAYMENT-REQUIRED header

WWW-Authenticate offer

none

Content type / server / CORS

application/json / uvicorn / none

Latency

2,111 ms

Error

none

No hourly re-probe has reached this resource yet; the cron covers a rotating slice of 150 per hour.

On-chain facts for the payTo (public address)

Field

Value

Settlement history

unresolved: non-EVM payTo; only Base is covered

Declared input and output (extensions.bazaar)

{
 "input": {
  "body": {
   "manifest": {
    "tools": [
     {
      "name": "get_weather",
      "description": "Get the weather for a city.",
      "inputSchema": {
       "type": "object",
       "properties": {
        "city": {
         "type": "string"
        }
       }
      }
     }
    ]
   }
  },
  "type": "http",
  "method": "POST",
  "bodyType": "json"
 },
 "output": {
  "type": "json",
  "example": {
   "object": "manifest",
   "reasons": [],
   "coverage": {
    "tools_scanned": 1,
    "dimensions_total": 8,
    "dimensions_flagged": []
   },
   "findings": [],
   "per_tool": {
    "get_weather": {
     "score": 0,
     "category": "clean",
     "findings": [],
     "tool_hash": "sha256:…"
    }
   },
   "disclaimer": "Automated security indicators, not a guarantee.",
   "risk_score": 0,
   "tool_count": 1,
   "manifest_hash": "sha256:…",
   "risk_category": "clean"
  }
 }
}

Try it (unpaid: shows the 402)

curl -si -X POST 'https://payai.agentstools.dev/mcp/scan' -H 'accept: application/json' -H 'content-type: application/json' --data '{}'

The catalog declares POST. A 402 answer carries the payment requirements in the JSON body and, for x402 v2, base64 in the PAYMENT-REQUIRED header. This page never sends a payment.

Paid checks (x402, USDC on Base)

GET https://bazaar.agentexchange.work/r/a07b0dafcb6c/probe.json re-runs this probe right now for $0.01 and writes the result here. POST https://bazaar.agentexchange.work/featured with {"id":"a07b0dafcb6c"} places this resource at the top of the report and search pages for 30 days for $1.00, labelled. Unpaid requests answer 402 with the terms. Pricing.

Catalog references: PayAI listing status · this record as JSON · all resources on payai.agentstools.dev.