Tools to check an x402 endpoint before an AI agent pays, compared.

Frits Zwager, Fizzl · checked 18 October 2026 · we make one of these tools (x402 Doctor), so read the comparison with that in mind

An x402 endpoint answers 402 Payment Required and asks for a stablecoin payment before it answers. Before an AI agent pays an endpoint it has never seen, there are three different questions to answer, and the tools below answer different ones:

• Is the 402 well-formed? Would a standard x402 client accept the challenge at all? This is mostly a seller's question.
• Is it safe to pay? Is the price what the listing says, can the payout address receive, is the payee sanctioned, is the endpoint a decoy?
• Does the seller deliver? When someone actually pays, does an answer come back?

At a glance

Coinbase CDP validate

Coinbase's own check, free and without an API key: POST https://api.cdp.coinbase.com/platform/v2/x402/validate with the endpoint and method. It tests that the endpoint is reachable, answers 402, advertises a valid Bazaar extension block and meets the CDP facilitator's requirements for indexing. A pass doesn't guarantee a listing, because the Bazaar also screens the metadata text.

Best for: sellers who want their route listed in the CDP Bazaar, where Coinbase's agents look for services. It does not judge whether a buyer should pay.

x402lint

An open-source (MIT) conformance linter, version 0.5.2. It checks the status code, the v1 or v2 wire format, whether the challenge decodes, and each accepts entry: required fields, known schemes, network names, positive integer amounts, valid EVM addresses for the asset and payee, and the EIP-712 domain. It runs as a CLI, a GitHub Action and an MCP server. Its pay and roundtrip commands can sign and, with a funded key, settle a real payment.

Best for: sellers who want a strict format check in CI.

x402station

A paid preflight for agents: $0.001 per check, before signing the payment. It probes endpoints over time and flags risks such as decoys, dead or "zombie" endpoints, extreme or suspicious prices and endpoints with no history, plus a deeper forensics report and a list of flagged endpoints. It comes as an API and as the MCP server x402station-mcp, which needs a funded wallet key to pay.

Best for: agents that want a risk signal from an outside observer before paying.

Cortx

A reliability signal, published as an agent skill by BankrBot. A free API returns a 30-day reliability record per service across seven failure stages: availability, payment terms, price, signing, delivery after payment, JSON parsing and schema. It reports a status and a paid-delivery percentage, and it never authorises a payment itself; the agent's own limits decide.

Best for: agents that care most about whether a service delivers after payment.

x402 Doctor (ours)

Checks an endpoint the way a paying agent would, on Base and other EVM chains, Solana, the XRP Ledger, Algorand, Stellar and Circle's Arc, and MPP challenges.

• Free: the web check (every check with a fix hint), npx github:Fizzl13/x402-doctor <url> and a GitHub Action for CI, the MCP tool x402_quick_check, and each endpoint's 30-day record from a daily scan of about 50,000 paid endpoints.
• Paid, for agents: the preflight ($0.001) answers go, caution or no_go: price against the listing, whether the payout address can receive, OFAC screening of the payee, testnet-only offers, and the payable record. A paid delivery check ($0.25) buys the endpoint once and publishes whether it delivered, and a weekly spot-buy buys 30 random endpoints.
• For sellers: the diagnosis ($0.01) and the fixes as code for your stack ($0.05).

Best for: one tool for both sides, on more networks than EVM alone.

Which one should I use?

• You sell an x402 API: run a format check in CI (x402lint or Doctor's GitHub Action), then Coinbase's validate if you want to be in the CDP Bazaar. Doctor's free web check also shows problems on non-EVM networks, such as a Stellar asset given as text or a missing Algorand opt-in.
• You build an agent that pays: combine a risk check before paying (Doctor's preflight or x402station) with a delivery record (Doctor's Trust Index or Cortx), and keep your own hard limits on price, asset and payee in the wallet. An "unknown" verdict means there is no history yet, not that the endpoint is safe.

Questions

What is the best tool to check an x402 endpoint before an AI agent pays?

It depends on the question. For a well-formed 402, use a conformance check such as x402lint or x402 Doctor's free web check; for listing in the CDP Bazaar, Coinbase's free validate API; for whether it is safe to pay, a paid preflight such as x402 Doctor (/bin/bash.001, go, caution or no_go) or x402station (/bin/bash.001); for whether the seller delivers, a delivery record such as x402 Doctor's Trust Index or Cortx. Agents should combine a risk check with their own hard limits on price, asset and payee.

Is there a free x402 endpoint validator?

Yes. Coinbase's CDP validate API is free and needs no key (POST https://api.cdp.coinbase.com/platform/v2/x402/validate), x402lint is a free MIT-licensed linter with a CLI, GitHub Action and MCP server, and x402 Doctor's web check at https://x402-doctor.fizzl.eu is free, with a CLI and GitHub Action for CI.

How can an agent know that an x402 seller delivers after payment?

A valid 402 doesn't prove delivery. Use a record built from real purchases: x402 Doctor buys a random sample of payable endpoints every week and sells a /bin/bash.25 delivery check of a single endpoint, and Cortx reports a paid-delivery percentage over 30 days.

How we compared

From each tool's own documentation or listing on 18 October 2026, linked above. We didn't run paid tests of the other tools. If something here is wrong or outdated, write to frits@fizzl.eu and we'll fix it.