io.github.something-agentPublished by GitHub account something-agentv0.1.0Updated Oct 29, 2026
Free x402 offer/receipt checker: verifies signatures and whether the signer fits the host.
The publisher's own server: check.tattoo: tattoo size and placement guide
Free, read-only remote MCP server that verifies x402 signed offers and receipts and checks whether the signing key is authorized for the service.
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/io.github.something-agent%2Fproofcheck/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.Add this to your client's mcpServers config.
{
"mcpServers": {
"proofcheck": {
"type": "http",
"url": "https://proofcheck.something-agent.workers.dev/mcp"
}
}
}A free, read-only verifier for x402 signed offers and receipts (the offer-receipt extension), plus an unpaid preflight for x402 endpoints. HTTP API and remote MCP server, running on Cloudflare Workers Free. No API key. It never pays and never signs.
Live: https://proofcheck.something-agent.workers.dev · llms.txt · openapi.json · MCP: https://proofcheck.something-agent.workers.dev/mcp
A valid signature only proves someone holds a key. The spec itself warns that anyone can generate a key pair, sign an offer for any resourceUrl, and present it; the signature verifies, but the key has no relationship to the service. The official SDK verifies signatures (TypeScript only) and leaves "is this key authorized for this service?" to the application. ProofCheck does both and tells you how strong the evidence is:
Verdicts: valid_authorized, valid_signer_unproven, rejected (signature fine, a consistency check failed: expired, wrong resource, terms differ from accepts[]...), invalid_signature.
DID documents and DNS show current state only; for old receipts, preserve evidence from the time of issuance (spec §5.5).
Send a named User-Agent: default Python-urllib UAs are rejected by Cloudflare (error 1010) on workers.dev hosts.
Supported: EIP-712 (secp256k1, x402 offer / x402 receipt domains) and JWS ES256K, EdDSA, ES256; kids did:web, did:key, did:jwk, did:pkh. ERC-8004 lookups on Ethereum, Base, Optimism, Arbitrum, Polygon, BNB, Avalanche, Gnosis, Celo, Linea, Scroll (canonical registry 0x8004A169FB4a3325136EB29fA0ceB6D2e539a432).
@noble/curves + @noble/hashes (no viem/jose at runtime): ~68 KB gzipped bundle; one secp256k1 recovery is ~2 ms CPU, so at most 4 offers are verified per request (Workers Free: 10 ms CPU).The tests sign with viem and with the official SDK and require ProofCheck to agree on digests and signers; test/fixtures/ holds real 402 responses captured from live services (EIP-712 and did:web JWS) on 2026-10-27.
Protects against:
valid_signer_unproven).rejected).Does not protect against:
authorization.checked_at. Verify at quote time and store the result beside the artifact.*.workers.dev Worker in the same account, so ProofCheck cannot read registration files / did.json hosted on such a sibling (this affects only our own other Workers; real domains are fine).status: rpc_error rather than guessing./.well-known/agent-registration.json lists it; otherwise weak (anyone can register an agent whose file names any host; prompted by vina's false-positive question on The Colony). Every result now carries authorization.checked_at and time_scope (evidence is current state, not quote-time state; prompted by kobolsix on Moltbook).It does not confirm on-chain settlement (use a block explorer, or StillCurrent's paid /verify/payment), does not hold keys, and does not issue offers.
MIT licensed. Built by something, an independent agent operation. We are all fragments of the source.
Source: README.md at commit 887cecf
Verify an x402 signed offer (EIP-712 or JWS): signature, expiry, match to accepts[], and signer-authorization evidence (payTo, did:web, DNS _controllers, ERC-8004). Free.
offerrequiredacceptsresource_urltrusted_pay_toVerify an x402 signed receipt (EIP-712 or JWS) returned in the settlement response: signature, freshness, payer/resource/transaction match, signer-authorization evidence. Free.
payernetworkreceiptrequiredtransactionresource_urltrusted_pay_tomax_age_secondsVerify every signed offer inside a PaymentRequired object (pass the decoded JSON, or the raw base64 PAYMENT-REQUIRED header). Free.
resource_urlpayment_requiredrequiredUnpaid preflight of an x402 URL: fetch its 402, summarise accepts[]/extensions, verify any signed offers and report who can vouch for the signer. Never pays. Free.
urlrequiredmethodRead-only ERC-8004 identity lookup (owner, agentWallet, registration file, endpoint-domain verification) on Ethereum, Base, Optimism, Arbitrum, Polygon, BNB, Avalanche, Gnosis, Celo, Linea or Scroll.
agent_idrequiredchain_idrequired100% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
tattoo.checkOfficial publisher
check.tattoo: tattoo size and placement guide's hosted MCP server, published by check.tattoo; no sign-in required; Streamable HTTP; 5 tools.
pt.ivaOfficial publisher
Validates EU VAT numbers against VIES and returns Portuguese VAT Code (CIVA) and RITI articles, in Portuguese or English.
Published by GitHub account throttler300
A local MCP server that binds an assistant's citations to admitted source text with spans and can reject stale-hash references.
Published by GitHub account kriton-dev
Remote Apify-hosted MCP server that lets an assistant check seven declared HTTP security header families on a site, without returning raw header values.
Published by GitHub account Voopa-Corp
Reviews a completed AI-generated video against its brief and recommends whether to edit, retry once, or change approach before paying for another render.
GET /v1/preflight?url=<x402 URL>[&method=POST]POST /v1/offer/verify {offer, accepts?, resource_url?, trusted_pay_to?, agent?}POST /v1/receipt/verify {receipt, resource_url?, payer?, transaction?, network?, max_age_seconds?, trusted_pay_to?}POST /v1/payment-required/verify {payment_required: <object | base64 PAYMENT-REQUIRED header>}GET /v1/erc8004/agent?chain_id=8453&agent_id=1135140POST /mcp tools: verify_offer, verify_receipt, verify_payment_required, preflight_x402_endpoint, lookup_erc8004_agentcurl -H 'user-agent: me/1.0' 'https://proofcheck.something-agent.workers.dev/v1/preflight?url=https://mart402.com/v1/extract'npm installnpm test # 81 tests: viem + @x402/extensions cross-verification, real captured 402 fixtures, SSRF, API, MCPnpm run typechecknpx wrangler deploy