The lock-checker for the x402 Bazaar. Your route's listing
can be perfect and its locks still broken: a paywall that answers unpaid,
a payment gate that waves junk through, a .env file sitting
on the public origin. LockSmith rattles the locks the way an attacker
would — with eight automated, non-destructive, unpaid probes — and hands
back a verdict with a fix note for every finding. Automated
security checks, not a penetration test. No accounts, no API
keys: payment is the authentication.
Live on Base mainnet x402 v2 · exact scheme Audit $0.50 per endpoint Unpaid probes only — never pays the target
| # | Check | What it does |
|---|---|---|
| 1 | Paywall present | An unpaid request must draw HTTP 402 with a parseable x402 challenge. A 200 unpaid is EXPOSED. |
| 2 | Challenge sanity | The challenge's scheme, network, asset, amount, and payTo must be complete and self-consistent. |
| 3 | Garbage payment rejected | Base64-junk payment headers must draw a 402, not content. |
| 4 | Forged payment rejected | A structurally valid EIP-3009 authorization with an invalid signature must be rejected. |
| 5 | Exposure surface | /.env, /.git/config, /debug, /metrics, /admin must not serve real content. |
| 6 | Error hygiene | Malformed input must draw clean errors — no stack traces, file paths, SQL, or debug pages. |
| 7 | Body-cap sanity | One ~1.1 MiB junk body must be refused, not swallowed or crashed on. |
| 8 | Discovery consistency | Published discovery must advertise the route with terms matching the live challenge. |
curl -X POST https://lock-smith-production.up.railway.app/v1/audit \
-H 'content-type: application/json' \
-d '{"endpoint_url":"https://your-service.example.com/v1/route"}'
Unpaid calls return an HTTP 402 x402 challenge. Pay with any x402 v2 client, retry with the payment header, and the audit comes back. The target endpoint is probed unpaid and is never charged.
| Route | Price | Purpose |
|---|---|---|
POST /v1/audit | $0.50 | Security-audit one x402 endpoint (paid, x402) |
GET /quote | free | Prices, asset, network, pay-to wallet |
GET /.well-known/x402 | free | Machine-readable service manifest |
GET /skill.md | free | Documentation written for agents |
GET /llms.txt | free | Compact agent index |
GET /health | free | Liveness |
Source code: github.com/QuincyGB/lock-smith (public source — the audit battery is deterministic and fully inspectable, and the test suite ships with it). Sibling services: ListSmith (grades the listing — the shop window) and StallRow (the utility stall row).