---
skillMd: "1.0"
name: 402-guard
baseUrl: https://x402.momentbolt.com
manifest: /.well-known/x402
openapi: /openapi.json
contact: https://x402.momentbolt.com
---

# 402 Guard — agent skill

Use 402 Guard when an autonomous agent needs one of two small, current checks:

1. Lint an x402 v2 payment requirement against Base-USDC policy before the caller signs it.
2. Audit a domain's live DNS and email-security posture before the caller trusts it.

Both operations return structured JSON, require no account or API key, and settle a tiny
USDC payment through x402 on Base mainnet. 402 Guard never asks for the caller's private key
and never signs a payment on the caller's behalf.

- **Base URL:** `https://x402.momentbolt.com`
- **Manifest:** `GET /.well-known/x402`
- **OpenAPI 3.1:** `GET /openapi.json`
- **Health:** `GET /api/health`
- **Free lint example:** `GET /api/example`

## Payment

402 Guard speaks x402 version 2 with the `exact` scheme.

| Network | Asset | Recipient | Facilitator |
|---|---|---|---|
| Base mainnet (`eip155:8453`) | USDC (`0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913`) | `0x580f3a792F06BCFa30c2b301c60e0F424768ebF7` | `https://facilitator.openx402.ai` |

Payment flow:

1. Send the intended `POST` without a payment signature.
2. Read the HTTP `402` response and decode the `PAYMENT-REQUIRED` header.
3. Decide whether its network, asset, recipient, and price fit the caller's policy.
4. Use an x402-compatible Base signer to create the authorization.
5. Retry the same request with the resulting `PAYMENT-SIGNATURE` header.
6. On success, read the purchased artifact from the `200 application/json` body and retain
   the settlement receipt returned by the server.

Do not send a private key to this service. Payment authorization happens inside the caller's
wallet or x402 client.

## `POST /api/lint` — $0.001 USDC

Validate an x402 v2 `PaymentRequired` envelope against the caller's policy.

Request body:

```json
{
  "paymentRequired": {
    "x402Version": 2,
    "accepts": [
      {
        "scheme": "exact",
        "network": "eip155:8453",
        "amount": "10000",
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "payTo": "0x1111111111111111111111111111111111111111",
        "maxTimeoutSeconds": 60,
        "extra": { "name": "USD Coin", "version": "2" }
      }
    ]
  },
  "policy": {
    "allowedNetworks": ["eip155:8453"],
    "allowedAssets": ["0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"],
    "allowedPayTo": ["0x1111111111111111111111111111111111111111"],
    "maxAmountUsd": 0.05,
    "maxTimeoutSeconds": 300
  }
}
```

`paymentRequired` is required. `policy` is optional. Defaults allow Base mainnet native USDC,
cap a quoted payment at $1, allow up to a 300-second authorization window, and warn when no
recipient allowlist is supplied.

The `200` body includes:

- `ok`: whether the report contains no errors.
- `verdict`: `pass`, `review`, or `reject`.
- `riskScore`: integer from 0 to 100.
- `issues[]`: severity, stable code, JSON path, and explanation.
- `summary`: requirement, error, and warning counts.
- `policyApplied`: the normalized policy used for the check.

Checks cover x402 version, exact scheme, CAIP-2 network, Base USDC asset, EVM recipient,
price cap, authorization timeout, canonical USDC EIP-712 domain, and duplicate options.
This is configuration validation, not counterparty verification or financial advice.

## `POST /api/domain-audit` — $0.002 USDC

Return a point-in-time audit of DNS and email-security posture for one ASCII or punycode
domain. Send only a hostname, without a scheme, port, path, query, or fragment.

Request body:

```json
{ "domain": "example.com" }
```

The `200` body includes:

- `domain`, `generatedAt`, and the resolver used.
- `grade` (`A`, `B`, `C`, `D`, or `F`) and numeric `score`.
- `posture`: apex resolution, mail acceptance, DNSSEC authentication, SPF, and DMARC.
- `findings[]`: severity, stable code, explanation, and an optional recommendation.
- `records`: observed A, AAAA, MX, NS, TXT, CAA, and DMARC records with TTLs.

The service queries Cloudflare's public DNS-over-HTTPS endpoint at request time. A result is
a point-in-time technical observation, not proof of ownership, deliverability, legitimacy,
or future security.

## Errors and safe probing

| HTTP | Meaning |
|---|---|
| `200` | Payment settled and the JSON artifact is returned. |
| `400` | Paid request body or domain is invalid. |
| `402` | Payment is missing or rejected; inspect `PAYMENT-REQUIRED`. |
| `413` | Request body exceeds the route limit. |
| `502` | Facilitator or DNS resolver is unavailable; the request is not settled. |

An unpaid `POST` is the safe discovery probe: the paywall responds before body validation,
so an agent can inspect the authoritative x402 challenge before constructing or signing a
paid request.

## Discovery

- Machine-readable x402 manifest: `https://x402.momentbolt.com/.well-known/x402`
- OpenAPI 3.1 contract: `https://x402.momentbolt.com/openapi.json`
- Human-readable agent notes: `https://x402.momentbolt.com/llms.txt`
- Public x402scan listing: `https://www.x402scan.com/server/a5f9a2bd-5740-483b-ab81-20ce1be853b0`