badhttp — the server that misbehaves on purpose

● degraded developer-tools

A test server for x402 clients and agents: the payment IS the scenario under test. /402/pay/base is one real, settling x402 paywall (0.01 USDC on Base, ?amount= 0.001-1.00; v2 PAYMENT-REQUIRED header and a spec-valid v1 body in the same 402) that returns a 200 with a PAYMENT-RESPONSE receipt and the transaction hash, and nothing else of value. Every other route under /402/ is a paywall that misbehaves on purpose and never settles. Around it: a free, no-signup catalogue of ~150 documented HTTP edge cases (content codings, ranges, conditional requests, cookies, auth challenges, SSE, cross-host redirects) as NDJSON at /corpus.jsonl, and dated observations of how eight real HTTP clients handle them at /clients.jsonl. No MCP server. Stateless; nothing stored about callers; CC0 output, MIT source; costs and revenue published and chain-reconciled at /books.

Quality grade

How grading works

D 39.5 / 100

Availability 18.0 / 40

Reachable but returned HTTP 200

Payability 10.0 / 20

✗ Answers a real HTTP 402 challenge
✓ Publishes a /.well-known/x402 descriptor
✓ Payment address on record
✓ Settlement network declared
✓ Price declared

Demand 8.5 / 40

3 distinct payers, 8 USDC transfers in the last 30 days

Owner verified 3.0 / 3

Operator proved control of this domain

Endpoint last checked 6 h ago. On-chain activity last read 12 d ago. Availability and on-chain demand are both re-probed daily; the grade updates automatically on the next pass.

Paid endpoints

42 resource(s) advertised by this origin.

https://badhttp.dev/402

https://badhttp.dev/402/%7Bscenario%7D

https://badhttp.dev/402/broken/%7Bflavor%7D

https://badhttp.dev/402/pay/base

https://badhttp.dev/auth

https://badhttp.dev/auth/%7Bflavor%7D

https://badhttp.dev/badjson/%7Bflavor%7D

https://badhttp.dev/books.json

https://badhttp.dev/clients

https://badhttp.dev/clients.jsonl

https://badhttp.dev/compress

https://badhttp.dev/compress/%7Bflavor%7D

https://badhttp.dev/cookies

https://badhttp.dev/cookies/%7Bflavor%7D

https://badhttp.dev/corpus

https://badhttp.dev/corpus.jsonl

https://badhttp.dev/crosshost

https://badhttp.dev/crosshost/%7Bflavor%7D

https://badhttp.dev/crosshost/land

https://badhttp.dev/delay/%7Bseconds%7D

How to call

cURL · x402-fetch / x402-axios will auto-handle 402

curl -X POST https://badhttp.dev/402

MCP endpoint

https://badhttp.dev/sse

/.well-known/x402.json

https://badhttp.dev/.well-known/x402

Listed in

Directories this entry was found in.

x402scan