X402check

What x402check does

The x402check MCP server provides a pre-payment screening path for agents and wallets working with x402 resources. Its hosted provider evaluates a counterparty, wallet, domain, interaction, payment description, or transaction before the caller authorizes payment or signing.

Checks can include the OFAC SDN list, embedded phishing data, ScamSniffer address and domain data, on-chain account activity, contract verification status, domain impersonation signals, drainer-code fingerprints, and the provider's block-by-block kit watch on Ethereum and Base. The provider also uses Jev typed questions over the context supplied by the caller to look for injected or manipulated instructions.

Results contain a score, tier, categories, evidence, timestamps, and a signed JWS. The ES256 attestation distinguishes evidence the provider checked from fields the caller merely asserted. Caller-supplied screening or authorization claims cannot reduce the score.

How it works

The x402check MCP server sends risk-check requests to the hosted x402check service. Calls are paid: prepaid credits reduce each evaluation to $0.001, while per-call x402 payment costs $0.0035 on Base or $0.005 when transaction simulation is included. An unpaid request returns HTTP 402 with accepted payment options.

A basic evaluation can include a wallet, CAIP-2-style chain identifier, domain, context, interaction details, and payment information. A transaction evaluation adds transaction data for simulation against the latest block. Simulation reports net asset movements, approvals, hidden recipients, payee mismatches, and assets sent to unverified contracts.

The service publishes discovery, DID, and JWKS documents at x402check.xyz. The JWKS endpoint supports verification of the signed attestation returned with a verdict.

Tools and capabilities

The documented capabilities include:

• Evaluate a counterparty before an agent or wallet pays or signs.
• Check sanctioned addresses, known phishing domains, known scam addresses, and community-flagged domains.
• Detect look-alike domains using typosquats, IDN homoglyphs, leetspeak, lure words, and subdomain reuse.
• Inspect whether approvals or permits target plain wallets or unverified contracts.
• Simulate transactions and identify outflows, unexpected recipients, excess payments, and approvals.
• Detect drainer-kit code, address-poisoning executors, compromised wallets, forwarding wallets, and drainer operators covered by the provider's watch.
• Analyze supplied context for injected instructions or manipulated intent.

Limitations and notes

A clean verdict means that none of the implemented checks fired; it does not establish that a counterparty is safe. The service does not detect laundering patterns or other transaction-graph behavior. It may also miss an unknown drainer address that simply receives funds unless the address appears in a watched look-alike or compromised-wallet set.

Evidence changes over time. Feeds have refresh and publication timing, and transaction simulation reflects the latest block available when the evaluation runs. The README states that every evaluation is paid and that there is no free tier. The excerpt identifies an MCP server but does not document a local installation command, transport details, environment variables, or named MCP client compatibility.