com.402cronPublished by 402cron.comOfficial publisherv1.0.1Updated Oct 24, 2026
Paid cron for AI agents: we call your https URL on schedule, signed. No account, paid with x402.
A remote paid cron service that calls your HTTPS endpoint on a schedule, signs each request, and retries failures, managed by an assistant.
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/com.402cron%2F402cron/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.Add this to your client's mcpServers config.
{
"mcpServers": {
"402cron": {
"type": "http",
"url": "https://402cron.com/mcp"
}
}
}402cron calls your https endpoint on a cron schedule, signs every request, and retries what fails. An agent can set it up on its own: no account, no card, no human in the loop. Payment is x402 — USDC on Base — and the only identity is the wallet that paid.
This repository holds documentation and runnable examples. The service runs at https://402cron.com; its source code is not published.
?section=quickstart)com.402cron/402cronThe balance counts deliveries, not money, and never expires. Each delivery attempt uses one credit, so a failing delivery costs at most three. Current prices: https://402cron.com/api/pricing.
GET https://402cron.com/buy/trial answers 402 with the price in the
PAYMENT-REQUIRED header. Pay with any x402 client. The receipt carries your management
token, shown once.POST /api/destinations with {"url": "https://your.host/hook"} returns the
destination id and its signing secret, shown once.POST /api/destinations/{id}/verify. We POST a challenge to your URL and your
endpoint echoes it back. The permission then covers that path and everything below it.POST /api/tasks with {"name", "url", "cron", "body"}. The response shows the
next three runs.Management calls take Authorization: Bearer <token>. Lost the token? Buy again from the same
wallet with ?rotate=1; the old token stops working.
Three kinds of requests arrive at the same URL. X-402cron-Event tells them apart:
The signature is X-402cron-Signature: sha256=<hex>, an HMAC-SHA256 keyed with your signing
secret over the bytes of:
The event label is not signed: branch on it, but trust what the signature covers. Delivery is
at least once — the same X-402cron-Delivery-Id can arrive twice, so treat a repeat as
already handled. Deliveries also carry X-402cron-Task-Id and X-402cron-Deliveries-Left.
4xx or 5xx is your server's answer, so it is not retried.task_paused notice; resuming is one call.cron: 5 fields, always UTC, one minute at the finest. Names (MON-FRI, JAN) and macros
(@daily, @hourly, …) work; anything unsupported is refused with a code that says why.https://.All limits: https://402cron.com/docs?section=limits
Both receivers answer the challenge, verify signatures, drop duplicate deliveries and log pause
notices. The client reads the price from the PAYMENT-REQUIRED header like any standard x402
client, caps what it may spend (MAX_USD, default $0.05), and with DRY_RUN=1 signs without
paying anything. On Windows PowerShell, set variables with $env:SECRET_402CRON="…" first.
Claude Code:
Other clients: add a remote (streamable HTTP) server at https://402cron.com/mcp with the same
header. get_pricing, get_docs and get_service_status work without a token. There is no
purchase tool on purpose: pay over plain HTTP, because a signed payment should not travel through a
model's context.
We guarantee that we tried to deliver your task — not what someone else's server does with it. Full terms: https://402cron.com/terms
The examples in this repository are MIT-licensed — see LICENSE.
Source: README.md at commit 6aee667
Pricing and payment requirements
What a delivery costs, which packs exist, and the exact x402 payment requirements for each. Balance is counted in DELIVERIES, not money, and packs never expire. Call this before buying.
Takes no parameters.
Machine documentation
One section of the machine documentation: quickstart, headers, signature, notice, errors, billing or limits. Omit `section` to get the whole document.
sectionIs the service selling right now
Whether the service is currently selling, on which network, and if not — why not. This is configuration, not liveness: the full health endpoint is at /health.
Takes no parameters.
List your scheduled tasks
Your tasks and their state. Needs your management token as an Authorization header on this connection.
afterlimitstateOne task with its full state
A single task: schedule, destination, state, next run, and how many failures in a row it carries.
idrequiredCreate or update a scheduled task
Register a schedule against a destination you have already verified. Idempotent on "name": the same name updates the existing task instead of creating a second one. Creating costs nothing; each delivery ATTEMPT costs one credit.
urlrequiredbodycronrequirednamerequiredmethodheaderstimeoutMsEdit a task
Change the schedule, destination, method, timeout, headers or body of an existing task. Omit a field to leave it unchanged — sending null is refused, because "unchanged" and "cleared" must not look the same. State is NOT editable here: use pause_task and resume_task.
idrequiredurlbodycronnamemethodheaderstimeoutMsPause a task
Stop firing until you resume. Nothing is charged while a task is paused.
idrequiredResume a paused task
Start firing again on the schedule. Refused if your balance is empty — buy deliveries first.
idrequiredFire a task once, right now
Deliver immediately, outside the schedule. THIS COSTS ONE CREDIT per attempt, exactly like a scheduled firing, and a timeout or unreachable host is retried up to three times — so one call can cost up to three credits. Use it to test a destination.
idrequiredDelete a task
Move the task to the recycle bin. It stops firing immediately and can be restored for 30 days with restore_task; after that it is unrecoverable. Credits already spent are not refunded.
idrequiredRestore a deleted task
Bring a task back from the recycle bin within 30 days. It comes back PAUSED — resume it explicitly.
idrequiredRegister a destination URL
Claim an https:// URL you control. We answer with a challenge and a SIGNING SECRET that is shown ONCE and never again — store it before you do anything else; it is what lets you verify that a delivery really came from us. The permission covers that path and everything beneath it, nothing above. Verification is one request from us to the exact URL you registered: POST, headers X-402cron-Challenge: <value> and X-402cron-Event: verify, JSON body {"challenge":"<value>"}. Reply within 5 seconds, without a redirect, with a body that is the bare value or {"challenge":"<value>"}; we read the first 512 bytes and do not check the HTTP status (2xx is fine). Then call POST /api/destinations/{id}/verify within 15 minutes of registering. A fixed-response webhook cannot pass: you need an endpoint you can program. Registering a URL that is still pending issues a new challenge and a new signing secret every time — the old secret immediately stops verifying deliveries; a verified URL is left untouched unless you add ?rotate=1. The daily verification allowance (10 per destination, 40 per client, UTC day) does not reset on re-registration.
urlrequiredVerify a registered destination
Verification is one request from us to the exact URL you registered: POST, headers X-402cron-Challenge: <value> and X-402cron-Event: verify, JSON body {"challenge":"<value>"}. Reply within 5 seconds, without a redirect, with a body that is the bare value or {"challenge":"<value>"}; we read the first 512 bytes and do not check the HTTP status (2xx is fine). Then call POST /api/destinations/{id}/verify within 15 minutes of registering. A fixed-response webhook cannot pass: you need an endpoint you can program. Registering a URL that is still pending issues a new challenge and a new signing secret every time — the old secret immediately stops verifying deliveries; a verified URL is left untouched unless you add ?rotate=1. The daily verification allowance (10 per destination, 40 per client, UTC day) does not reset on re-registration. Until this passes, no task may point at the destination.
idrequiredList your destinations
The URLs you have claimed and whether each is verified. The signing secrets are never shown again.
Takes no parameters.
Delete a destination
Remove a claimed URL. Refused while a task still points at it — delete the task first.
idrequired100% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
{X-402cron-Timestamp}\n{X-402cron-Delivery-Id}\n{X-402cron-Attempt}\n{METHOD}\n{path+query}\n{raw body}claude mcp add --transport http 402cron https://402cron.com/mcp --header "Authorization: Bearer <token>"