GitHub Action wrapper for x402-surface-check, a no-payment checker for public x402, MPP, Pay.sh, Cloudflare Worker, AgentCore-style payment, and HTTP 402 Payment Required launch surfaces.

The action probes manifests, OpenAPI specs, resource catalogs, or direct paid endpoints without sending payment headers, wallet signatures, API keys, or paid calls. It is meant for projects you own or are authorized to review before an agent or wallet can spend real value.

name: x402 surface

on:
  pull_request:
  push:
    branches:
      - main

jobs:
  x402-surface:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: TateLyman/x402-surface-check-action@v1
        with:
          target: https://api.example.com/.well-known/x402
          origin: https://app.example.com
          strict-cache: true
          output: x402-surface-report.md

For one direct paid endpoint:

- uses: TateLyman/x402-surface-check-action@v1
  with:
    endpoint: true
    method: POST
    target: https://api.example.com/api/x402/invoice
    origin: https://app.example.com
    strict-cache: true

• Public manifest, OpenAPI, resource catalog, and direct endpoint shape.
• No-payment 402 challenge readability and price/network/resource fields.
• MPP WWW-Authenticate: Payment headers and x402 V2 requirements headers.
• Browser preflight for payment headers such as X-PAYMENT.
• HTTPS resource binding.
• Declared-price drift between docs and live challenge responses.
• Placeholder payees, staging rails, and metadata leakage signals.
• Cache policy maps, including optional strict-cache findings.

Use this action only on systems you own or are authorized to inspect.

The action does not send:

• X-PAYMENT
• Payment-Signature
• wallet signatures
• private keys
• API keys
• paid retries

For a private payment-agent launch review, use the scope builder:

https://tateprograms.com/agent-payment-launch-review.html

If this action finds a concrete blocker and you want a private re-check or one small authorized fix, use the fixed-scope sprint page:

https://tateprograms.com/x402-fix-sprint.html

Machine-readable service catalog:

https://tateprograms.com/services.json

Related free tools:

• Surface checker: https://tateprograms.com/x402-surface-check.html
• AgentCore payment policy builder: https://tateprograms.com/agentcore-payment-policy.html
• x402 attack map: https://tateprograms.com/x402-attack-map-2026.html
• Cache-safe Worker guide: https://tateprograms.com/cloudflare-x402-worker.html