{"id":"mppscan-7c7720614d3e4e5a8bc821e8","name":"x402.agentindex.world","homepage_url":"https://x402.agentindex.world","service_url":"https://x402.agentindex.world/","origin":"https://x402.agentindex.world","description":"Public discovery candidate; runtime MPP not yet established","status":"candidate","implementation":"unknown","implementation_confidence":0,"fingerprint_observed_at":null,"published":1,"catalog_ingest_at":null,"openapi_ingest_at":null,"catalog_seen_at":null,"openapi_seen_at":null,"first_seen":"2026-10-09T12:17:42.307Z","last_seen":"2026-10-09T18:17:43.417Z","last_probe_at":"2026-10-09T12:53:02.753Z","created_at":"2026-10-09 12:29:50","updated_at":"2026-10-09 18:27:38","categories":[],"tags":[],"fingerprintEvidence":[],"paymentMethods":[],"paymentMethodCount":0,"endpoints":[],"endpointPagination":{"limit":25,"total":0,"nextCursor":null},"sources":[{"source_kind":"mppscan","source_url":"https://mppscan.com/","first_seen":"2026-10-09T12:17:42.307Z","last_seen":"2026-10-09T18:17:43.417Z","evidence":{"discoveredUrl":"https://x402.agentindex.world/"}}],"sourcePagination":{"limit":100,"total":1,"truncated":false},"security":[{"property_key":"authorization_delivery_settlement","state":"not-tested","evidence":"Requires paid or state-changing behavior outside scanner scope","basis":"Tempo Aug 24 research class","advisory_ref":"https://github.com/wevm/mppx/pull/510#discussion_r3377899233","observed_at":"2026-10-09T12:53:02.753Z","endpoint_id":null},{"property_key":"bounded_response","state":"tested-pass","evidence":"297599 bytes within scanner limit","basis":"harmless scanner","advisory_ref":null,"observed_at":"2026-10-09T12:53:02.753Z","endpoint_id":null},{"property_key":"challenge_parse","state":"unknown","evidence":"No MPP Payment challenge observed","basis":"unauthenticated HTTP response","advisory_ref":null,"observed_at":"2026-10-09T12:53:02.753Z","endpoint_id":null},{"property_key":"channel_lifecycle_binding","state":"not-tested","evidence":"Channel and settlement lifecycle require credentials or payments","basis":"public economic-security prior art","advisory_ref":null,"observed_at":"2026-10-09T12:53:02.753Z","endpoint_id":null},{"property_key":"concurrency_single_winner","state":"not-tested","evidence":"Concurrency and paid state changes are prohibited","basis":"public economic-security prior art","advisory_ref":null,"observed_at":"2026-10-09T12:53:02.753Z","endpoint_id":null},{"property_key":"credential_replay","state":"not-tested","evidence":"Scanner never sends credentials or payments","basis":"methodology","advisory_ref":"https://github.com/advisories/GHSA-fxc9-7j2w-vx54","observed_at":"2026-10-09T12:53:02.753Z","endpoint_id":null},{"property_key":"economic_exposure_metadata","state":"unknown","evidence":"No current Payment challenge exposes session or authorization inputs","basis":"observable challenge values only","advisory_ref":null,"observed_at":"2026-10-09T12:53:02.753Z","endpoint_id":null},{"property_key":"fee_payer_cosigner_binding","state":"not-tested","evidence":"Signature and fee-payer relationships are not observable unauthenticated","basis":"public economic-security prior art","advisory_ref":null,"observed_at":"2026-10-09T12:53:02.753Z","endpoint_id":null},{"property_key":"https_transport","state":"tested-pass","evidence":"HTTPS fetch completed with platform certificate validation","basis":"platform TLS validation","advisory_ref":null,"observed_at":"2026-10-09T12:53:02.753Z","endpoint_id":null},{"property_key":"method_fallback_policy","state":"not-tested","evidence":"Scanner does not select, downgrade, or execute payment methods","basis":"public economic-security prior art","advisory_ref":null,"observed_at":"2026-10-09T12:53:02.753Z","endpoint_id":null},{"property_key":"openapi_parse","state":"observed","evidence":"Credential-shaped discovery URL was excluded from indexing and fan-out by scanner policy","basis":"harmless discovery response","advisory_ref":null,"observed_at":"2026-10-09T12:53:02.753Z","endpoint_id":null},{"property_key":"price_debit_consistency","state":"not-tested","evidence":"Requires a completed paid interaction outside scanner scope","basis":"public economic-security prior art","advisory_ref":null,"observed_at":"2026-10-09T12:53:02.753Z","endpoint_id":null},{"property_key":"redirect_policy","state":"tested-pass","evidence":"0 redirects; every hop passed URL and DNS validation","basis":"harmless scanner","advisory_ref":null,"observed_at":"2026-10-09T12:53:02.753Z","endpoint_id":null},{"property_key":"replay_idempotency_scope","state":"not-tested","evidence":"Scanner never replays signed credentials","basis":"public advisory and protocol prior art","advisory_ref":"https://github.com/advisories/GHSA-fxc9-7j2w-vx54","observed_at":"2026-10-09T12:53:02.753Z","endpoint_id":null},{"property_key":"ssrf_target_validation","state":"tested-pass","evidence":"1 hop(s) resolved twice to stable public addresses","basis":"scanner URL, DNS and redirect policy","advisory_ref":null,"observed_at":"2026-10-09T12:53:02.753Z","endpoint_id":null},{"property_key":"authorization_delivery_settlement","state":"not-tested","evidence":"Requires paid or state-changing behavior outside scanner scope","basis":"Tempo Aug 24 research class","advisory_ref":"https://github.com/wevm/mppx/pull/510#discussion_r3377899233","observed_at":"2026-10-09T12:43:47.341Z","endpoint_id":"616ecc34aa3e478b2b4dcb479ba1ffd2a0b6380258458f6db70a257053564232"},{"property_key":"bounded_response","state":"tested-pass","evidence":"164214 bytes within scanner limit","basis":"harmless scanner","advisory_ref":null,"observed_at":"2026-10-09T12:43:47.341Z","endpoint_id":"616ecc34aa3e478b2b4dcb479ba1ffd2a0b6380258458f6db70a257053564232"},{"property_key":"challenge_parse","state":"unknown","evidence":"No MPP Payment challenge observed","basis":"unauthenticated HTTP response","advisory_ref":null,"observed_at":"2026-10-09T12:43:47.341Z","endpoint_id":"616ecc34aa3e478b2b4dcb479ba1ffd2a0b6380258458f6db70a257053564232"},{"property_key":"channel_lifecycle_binding","state":"not-tested","evidence":"Channel and settlement lifecycle require credentials or payments","basis":"public economic-security prior art","advisory_ref":null,"observed_at":"2026-10-09T12:43:47.341Z","endpoint_id":"616ecc34aa3e478b2b4dcb479ba1ffd2a0b6380258458f6db70a257053564232"},{"property_key":"concurrency_single_winner","state":"not-tested","evidence":"Concurrency and paid state changes are prohibited","basis":"public economic-security prior art","advisory_ref":null,"observed_at":"2026-10-09T12:43:47.341Z","endpoint_id":"616ecc34aa3e478b2b4dcb479ba1ffd2a0b6380258458f6db70a257053564232"},{"property_key":"credential_replay","state":"not-tested","evidence":"Scanner never sends credentials or payments","basis":"methodology","advisory_ref":"https://github.com/advisories/GHSA-fxc9-7j2w-vx54","observed_at":"2026-10-09T12:43:47.341Z","endpoint_id":"616ecc34aa3e478b2b4dcb479ba1ffd2a0b6380258458f6db70a257053564232"},{"property_key":"economic_exposure_metadata","state":"unknown","evidence":"No current Payment challenge exposes session or authorization inputs","basis":"observable challenge values only","advisory_ref":null,"observed_at":"2026-10-09T12:43:47.341Z","endpoint_id":"616ecc34aa3e478b2b4dcb479ba1ffd2a0b6380258458f6db70a257053564232"},{"property_key":"fee_payer_cosigner_binding","state":"not-tested","evidence":"Signature and fee-payer relationships are not observable unauthenticated","basis":"public economic-security prior art","advisory_ref":null,"observed_at":"2026-10-09T12:43:47.341Z","endpoint_id":"616ecc34aa3e478b2b4dcb479ba1ffd2a0b6380258458f6db70a257053564232"},{"property_key":"https_transport","state":"tested-pass","evidence":"HTTPS fetch completed with platform certificate validation","basis":"platform TLS validation","advisory_ref":null,"observed_at":"2026-10-09T12:43:47.341Z","endpoint_id":"616ecc34aa3e478b2b4dcb479ba1ffd2a0b6380258458f6db70a257053564232"},{"property_key":"method_fallback_policy","state":"not-tested","evidence":"Scanner does not select, downgrade, or execute payment methods","basis":"public economic-security prior art","advisory_ref":null,"observed_at":"2026-10-09T12:43:47.341Z","endpoint_id":"616ecc34aa3e478b2b4dcb479ba1ffd2a0b6380258458f6db70a257053564232"},{"property_key":"price_debit_consistency","state":"not-tested","evidence":"Requires a completed paid interaction outside scanner scope","basis":"public economic-security prior art","advisory_ref":null,"observed_at":"2026-10-09T12:43:47.341Z","endpoint_id":"616ecc34aa3e478b2b4dcb479ba1ffd2a0b6380258458f6db70a257053564232"},{"property_key":"redirect_policy","state":"tested-pass","evidence":"0 redirects; every hop passed URL and DNS validation","basis":"harmless scanner","advisory_ref":null,"observed_at":"2026-10-09T12:43:47.341Z","endpoint_id":"616ecc34aa3e478b2b4dcb479ba1ffd2a0b6380258458f6db70a257053564232"},{"property_key":"replay_idempotency_scope","state":"not-tested","evidence":"Scanner never replays signed credentials","basis":"public advisory and protocol prior art","advisory_ref":"https://github.com/advisories/GHSA-fxc9-7j2w-vx54","observed_at":"2026-10-09T12:43:47.341Z","endpoint_id":"616ecc34aa3e478b2b4dcb479ba1ffd2a0b6380258458f6db70a257053564232"},{"property_key":"ssrf_target_validation","state":"tested-pass","evidence":"1 hop(s) resolved twice to stable public addresses","basis":"scanner URL, DNS and redirect policy","advisory_ref":null,"observed_at":"2026-10-09T12:43:47.341Z","endpoint_id":"616ecc34aa3e478b2b4dcb479ba1ffd2a0b6380258458f6db70a257053564232"},{"property_key":"api_catalog_parse","state":"observed","evidence":"No RFC 9727 API catalog was available at this URL (HTTP 404); prior advertised links were withdrawn","basis":"RFC 9727 discovery response","advisory_ref":null,"observed_at":"2026-10-09T12:29:52.423Z","endpoint_id":null}],"securityPagination":{"limit":250,"total":30,"truncated":false},"observations":[{"id":"26e29230d58546c14b4455fbafd7e3b083c675e8bc58f95236d425c2c46b9d0d","endpoint_id":null,"observed_at":"2026-10-09T12:53:02.753Z","request_method":"GET","requested_url":"https://x402.agentindex.world/openapi.json","final_url":"https://x402.agentindex.world/openapi.json","status":200,"redirect_count":0,"response_bytes":297599,"body_sha256":"02cecccfaaa78cd481128ba19128b117a1a6fe07a032f30e48e50eba5db1a191","error_code":null,"error_detail":null,"headers":{"cf-cache-status":"[redacted]","cf-ray":"[redacted]","connection":"[redacted]","content-length":"[redacted]","content-type":"application/json","date":"[redacted]","server":"cloudflare"},"dns":[{"hostname":"x402.agentindex.world","addresses":["169.58.121.36"],"stable":true}],"tls":{"state":"tested-pass","httpProtocol":null,"note":"HTTPS fetch completed with platform certificate validation"}},{"id":"12de467416e11f977fc2742d4da1a2e59f08c4e015572e4b63292771f868463b","endpoint_id":"616ecc34aa3e478b2b4dcb479ba1ffd2a0b6380258458f6db70a257053564232","observed_at":"2026-10-09T12:43:47.341Z","request_method":"GET","requested_url":"https://x402.agentindex.world/","final_url":"https://x402.agentindex.world/","status":200,"redirect_count":0,"response_bytes":164214,"body_sha256":"470015408ec798e774ec65d36f11586b9c9437c76c73353b917cd80c5d1a2426","error_code":null,"error_detail":null,"headers":{"cf-cache-status":"[redacted]","cf-ray":"[redacted]","connection":"[redacted]","content-length":"[redacted]","content-type":"application/json","date":"[redacted]","server":"cloudflare"},"dns":[{"hostname":"x402.agentindex.world","addresses":["169.58.121.36"],"stable":true}],"tls":{"state":"tested-pass","httpProtocol":null,"note":"HTTPS fetch completed with platform certificate validation"}},{"id":"b3918c3079600111268a7cfe205a6cd7fa797a371e941c14b994355e5ab7f23d","endpoint_id":null,"observed_at":"2026-10-09T12:29:52.423Z","request_method":"GET","requested_url":"https://x402.agentindex.world/.well-known/api-catalog","final_url":"https://x402.agentindex.world/.well-known/api-catalog","status":404,"redirect_count":0,"response_bytes":22,"body_sha256":"37ec4665a8102d115ffd1ac20dae94c98b4dac64b0c1a68228aa2a531caeb35d","error_code":null,"error_detail":null,"headers":{"cf-cache-status":"[redacted]","cf-ray":"[redacted]","connection":"[redacted]","content-length":"[redacted]","content-type":"application/json","date":"[redacted]","server":"cloudflare"},"dns":[{"hostname":"x402.agentindex.world","addresses":["169.58.121.36"],"stable":true}],"tls":{"state":"tested-pass","httpProtocol":null,"note":"HTTPS fetch completed with platform certificate validation"}}],"observationPagination":{"limit":50,"total":3,"truncated":false},"changes":[{"id":"e8e6a24eb6fb25045f65d5cfdd4690cf","endpoint_id":null,"changed_at":"2026-10-09T12:53:02.753Z","change_type":"security-property-changed","field_name":"security:bounded_response","old_value":"{\"state\":\"tested-pass\",\"evidence\":\"22 bytes within scanner limit\",\"basis\":\"harmless scanner\"}","new_value":"{\"state\":\"tested-pass\",\"evidence\":\"297599 bytes within scanner limit\",\"basis\":\"harmless scanner\"}","evidence":"Repeated harmless observation changed the modeled property"},{"id":"2cef9ec28e9afda7d7301102a2c02b76","endpoint_id":"616ecc34aa3e478b2b4dcb479ba1ffd2a0b6380258458f6db70a257053564232","changed_at":"2026-10-09T12:43:47.341Z","change_type":"probe-observation","field_name":"redirect_count","old_value":null,"new_value":"0","evidence":"harmless unauthenticated HTTP observation"},{"id":"6b5d58ab9690277e4c2ba138a57b92ea","endpoint_id":"616ecc34aa3e478b2b4dcb479ba1ffd2a0b6380258458f6db70a257053564232","changed_at":"2026-10-09T12:43:47.341Z","change_type":"probe-observation","field_name":"last_status","old_value":null,"new_value":"200","evidence":"harmless unauthenticated HTTP observation"},{"id":"72df148ec581f89674dcd85714548000","endpoint_id":"616ecc34aa3e478b2b4dcb479ba1ffd2a0b6380258458f6db70a257053564232","changed_at":"2026-10-09T12:43:47.341Z","change_type":"probe-observation","field_name":"content_type","old_value":null,"new_value":"application/json","evidence":"harmless unauthenticated HTTP observation"},{"id":"9564f33b8038b4cd8ceb8f88985f3844","endpoint_id":"616ecc34aa3e478b2b4dcb479ba1ffd2a0b6380258458f6db70a257053564232","changed_at":"2026-10-09T12:43:47.341Z","change_type":"endpoint-discovered","field_name":"endpoint","old_value":null,"new_value":"created","evidence":"normalized discovery source"},{"id":"bfd44f2e84c64cc53aa9f1e3e135c0cb","endpoint_id":"616ecc34aa3e478b2b4dcb479ba1ffd2a0b6380258458f6db70a257053564232","changed_at":"2026-10-09T12:43:47.341Z","change_type":"probe-observation","field_name":"tls_state","old_value":"not-tested","new_value":"tested-pass","evidence":"harmless unauthenticated HTTP observation"},{"id":"b68175c37b33a0e39349f6028f4b5a9b","endpoint_id":null,"changed_at":"2026-10-09T12:17:42.307Z","change_type":"service-discovered","field_name":"service","old_value":null,"new_value":"created","evidence":"normalized discovery source"}],"changePagination":{"limit":50,"total":7,"truncated":false}}