x402-manifestCAUTION
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
An automated, structured web-scraping service built for AI agents. This gateway utilizes local Playwright browser automation combined with Ollama (qwen2.5:14b) structured parsing, gated by x402 micropayments on Base L2.
🤖 Agent Discovery & Schemas
Autonomous agents and integration frameworks (Composio, GPT Actions, LangChain, CrewAI) can discover and ingest this tool using the following machine-readable endpoints:
- x402 Protocol Manifest:
https://silentsw0rd.github.io/x402-manifest/.well-known/x402.json - OpenAPI 3.0 Specification:
https://flight-dill-hangout.ngrok-free.dev/openapi.json
💳 Payment Specifications
Requests require an EIP-712 payment authorization signed by the buyer agent via EIP-3009 (receiveWithAuthorization).
🔌 API Endpoint
Extract Web Data
GET https://flight-dill-hangout.ngrok-free.dev/api/v1/extract
Query Parameters:
url(string, required): The full HTTP/HTTPS URL to scrape and extract.
Headers:
PAYMENT-SIGNATURE(string, required for execution): Base64-encoded JSON envelope containing the buyer's address, EIP-712 payload data, and signature.
🔄 x402 Challenge & Handshake Loop
- Initial Challenge: Send an unauthenticated
GETrequest to/api/v1/extract?url=. - HTTP 402 Response: The server returns status
402 Payment Requiredcontaining the payment spec inside thePAYMENT-REQUIREDresponse header. - Cryptographic Signing: Construct an EIP-712
ReceiveWithAuthorizationdomain payload for 5,000 USDC units and sign it using your client wallet private key. - Authorized Request: Resubmit t
e9a9511457b1OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add x402-extraction-client-44mk1 --env AGENT_PRIVATE_KEY=${AGENT_PRIVATE_KEY} --env CLIENT_PRIVATE_KEY=${CLIENT_PRIVATE_KEY} --env RELAYER_PRIVATE_KEY=${RELAYER_PRIVATE_KEY} -- uvx x402-extraction-client-44mk1{
"mcpServers": {
"x402-extraction-client-44mk1": {
"command": "uvx",
"args": [
"x402-extraction-client-44mk1"
],
"env": {
"AGENT_PRIVATE_KEY": "${AGENT_PRIVATE_KEY}",
"CLIENT_PRIVATE_KEY": "${CLIENT_PRIVATE_KEY}",
"RELAYER_PRIVATE_KEY": "${RELAYER_PRIVATE_KEY}"
}
}
}
}Exposed tools (1)
1 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
extract_web_data | read | Scrapes and extracts structured data from a target URL by paying a $0.005 USDC micro-fee on Base L2. |
Trust audit
CAUTIONgrade B · trust 80/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (2 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (12)
6d65312e786d6c504b01022d00140006000800000021000dd1909fb60000001b0100002700000000000000000000000000040b00007468656d652f7468656d652f5f72656c732f7468656d654d616e616765722e786d6c2e72656c73504b050600000000
656e74323d22616363656e74322220616363656e74333d22616363656e74332220616363656e74343d22616363656e74342220616363656e74353d22616363656e74352220616363656e74363d22616363656e74362220686c696e6b3d22686c696e6b22
d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff090006000000000000000000000001000000010000000000000000100000feffffff00000000feffffff0000000000000000ffffffffffffffffffffffffffffffffffffffff
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
.nojekyll
spec = json.loads(base64.b64decode(raw_header).decode("utf-8")) if raw_header else res.json().get("spec")raw_payload = json.loads(base64.b64decode(payment_signature_b64).decode("utf-8"))sig_bytes = bytes.fromhex(sig_hex.replace("0x", ""))raw = json.loads(base64.b64decode(payment_header).decode("utf-8"))nonce_bytes = bytes.fromhex(nonce_hex)
Gates applied: no_behavioural_pass, no_license.
e9a9511457b1full audit observations/trust-audit/mcp-server/silentsw0rd__x402-manifest.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | e9a9511457b1 | CAUTION | B | 80 | first audit |
Questions
What tools does x402-manifest expose?
1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is x402-manifest safe to connect to an agent?
With care. The audit graded it B (80/100) and found 12 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does x402-manifest need?
It reads AGENT_PRIVATE_KEY, CLIENT_PRIVATE_KEY and RELAYER_PRIVATE_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does x402-manifest run?
It speaks sse, so it runs as a service you connect to over the network. It is published on PyPI as x402-extraction-client-44mk1.
How current is this page?
The grade is for one exact copy of the source (e9a9511457b1), read on 2026-10-12. The repository is watched and re-audited when it changes.