Automated security checks for x402 endpoints — not a penetration test. POST /v1/audit ($0.50) runs eight non-destructive, unpaid probes against one paid route: paywall presence, challenge sanity, garbage and forged payment rejection, exposure surface, error hygiene, body-size cap, and discovery consistency. Returns SECURE / FINDINGS / EXPOSED with per-check results and a fix note per finding. Use this when you operate an x402 route and want its locks checked before an attacker rattles them.

A2A readiness

D · 49/100

Readiness is how fully this listing follows its protocol and how it behaved in our probes over 30 days. It is shown for reference and does not move it in search. Search order and leaderboards use the separate quality grade (here C+, 91.8/100), which weighs availability, conformance, card completeness and speed. How the two differ

Valid Agent Card	10/10	Parseable Agent Card with the required fields.
Live JSON-RPC	5/25	Endpoint answers, but not with JSON-RPC 2.0 (162 ms).
Protocol version	5/10	Declares pre-1.0 A2A 0.3.0. Upgrade to v1.x for full points.
JWS signature	0/10	Card is unsigned.
Uptime (30 days)	15/15	3/3 probes succeeded; final after 5 probes in 30 days.
Skill declaration	5/10	Declares 1 skill(s) with structured metadata.
Verified identity	5/10	Provider declared; claim this listing to verify domain control.
Freshness + modern flags	4/5	seen in a source within 7 days.
Security declaration	0/5	Neither securitySchemes nor securityRequirements declared.

Responsiveness: Responsive (162 ms; bands ≤2.5 s, ≤5 s, ≤8 s, slower; penalty only).

Measured 2026-11-11.

Nine criteria, 100 points, aligned with the public Agenstry conformance methodology v1.1. Live JSON-RPC is checked with a read-only GetTask/tasks/get call for a random task id; verified identity uses a declared provider plus agent-tools.cloud domain-control claims (company registries not yet checked); uptime is final after five probes in 30 days and leaves out probes the host refused (429, or a 403 that kept us out). Grades: A>=90, B>=75, C>=60, D>=40, F<40. Display only: search order uses the quality grade.

Compared with peers

Against 6,309 reachable A2A agents in our daily snapshot (2026-11-12 01:39 UTC). Display only; it does not change search order.

Readiness: Higher than 40% of peers; This listing 49 · peer median 54
Latency: Faster than 61% of peers; This listing 328 ms · peer median 398 ms

Where it loses the most points, and how to win them back

Live JSON-RPC −20 — Answer JSON-RPC at the URL the Agent Card declares.
Now: Endpoint answers, but not with JSON-RPC 2.0 (162 ms).
JWS signature −10 — Sign the Agent Card (JWS).
Now: Card is unsigned.
Protocol version −5 — Support the current protocol revision.
Now: Declares pre-1.0 A2A 0.3.0. Upgrade to v1.x for full points.

How many agent tools actually work · All statistics

Skills

Audit

Security-audit one x402 endpoint: eight automated, non-destructive, unpaid checks (paywall, challenge sanity, garbage/forged payment rejection, exposure surface, error hygiene, body cap, discovery consistency) with a SECURE / FINDINGS / EXPOSED verdict and a fix note per finding. Automated security checks, not a penetration test.

x402securityauditagentssecurity-auditendpoint-verificationpreflight

How to call

A2A endpoint (JSONRPC)

https://lock-smith-production.up.railway.app/

Agent card

https://lock-smith-production.up.railway.app/.well-known/agent-card.json

Documentation

https://lock-smith-production.up.railway.app/llms.txt

Homepage

https://github.com/QuincyGB

Listed in

Directories this entry was found in.

agenstry since 2026-11-06