Catalog: add R2 x402 Manifest Audit API

dist/catalog.json

@@ -1,9 +1,15 @@
 {
   "base_url": "https://x402-catalog.bankofai.io/api",
   "chain_count": 3,
-  "first_party_count": 1,
+  "first_party_count": 2,
   "frontend": {
     "categories": [
+      {
+        "count": 1,
+        "id": "devtools",
+        "label": "DevTools",
+        "label_zh": "开发工具"
+      },
       {
         "count": 5,
         "id": "finance",
@@ -20,7 +26,7 @@
         "label_zh": "BNB Chain"
       },
       {
-        "count": 5,
+        "count": 6,
         "id": "eip155:8453",
         "kind": "base",
         "label": "Base Mainnet",
@@ -38,8 +44,8 @@
       "sunpump-token-launch"
     ]
   },
-  "generated_at": "2026-07-30T10:02:35Z",
-  "provider_count": 5,
+  "generated_at": "2026-08-07T06:10:05Z",
+  "provider_count": 6,
   "providers": [
     {
       "category": "finance",
@@ -116,6 +122,64 @@
       "title_zh": "SunPump",
       "use_case": "Use this provider when an app, agent, or CLI workflow needs to launch a SunPump token after a successful x402 payment. Choose a TRON Mainnet, BNB Smart Chain, or Base Mainnet payment route; every successful launch creates the token on TRON Mainnet."
     },
+    {
+      "category": "devtools",
+      "category_meta": {
+        "id": "devtools",
+        "label": "DevTools",
+        "label_zh": "开发工具"
+      },
+      "chain_kinds": [
+        "base"
+      ],
+      "chains": [
+        "eip155:8453"
+      ],
+      "chains_meta": [
+        {
+          "id": "eip155:8453",
+          "kind": "base",
+          "label": "Base Mainnet",
+          "label_zh": "Base 主网"
+        }
+      ],
+      "description": "Inspects an inline x402 manifest and returns deterministic readiness findings. Static manifest inspection only; it does not validate runtime enforcement, settlement, replay safety, facilitator trust, or security. Input URLs are never fetched. Operated by an authorized AI agent for R2 Advisory.",
+      "endpoint_count": 1,
+      "featured_tags": [
+        "x402",
+        "manifest",
+        "audit",
+        "validation",
+        "readiness"
+      ],
+      "fqn": "r2-x402-manifest-audit",
+      "has_free_tier": false,
+      "has_metering": true,
+      "i18n": {
+        "zh-CN": {
+          "description": "检查内联 x402 清单并返回确定性的就绪性发现。仅静态检查；不验证运行时执行、结算、重放安全或整体安全性。不会抓取输入 URL。",
+          "mainTitle": "x402 清单静态就绪性检查",
+          "subtitle": "对 x402 服务清单进行确定性静态审计。",
+          "title": "R2 x402 清单审计",
+          "useCase": "在发布或集成 x402 服务前检查支付绑定与清单就绪性问题。"
+        }
+      },
+      "is_featured": false,
+      "is_first_party": true,
+      "logo": "https://github.com/ruizmr.png",
+      "main_title": "Static x402 manifest readiness findings",
+      "main_title_zh": "x402 清单静态就绪性检查",
+      "max_price_usd": 2.0,
+      "min_price_usd": 2.0,
+      "service_url": "https://r2-x402-manifest-audit.dragonfly27.workers.dev",
+      "sha": "4bbec7ee2861b2d4f5fbef1776a26e762d841bdbf5afe9d3096e15b84ba549ac",
+      "sub_title": "Deterministic static audits for x402 service manifests.",
+      "sub_title_zh": "对 x402 服务清单进行确定性静态审计。",
+      "subtitle": "Deterministic static audits for x402 service manifests.",
+      "title": "R2 x402 Manifest Audit",
+      "title_zh": "R2 x402 清单审计",
+      "use_case": "Use before publishing or integrating an x402 manifest to catch missing or inconsistent payment bindings."
+    },
     {
       "category": "finance",
       "category_meta": {

dist/categories.json

@@ -1,4 +1,10 @@
 [
+  {
+    "count": 1,
+    "id": "devtools",
+    "label": "DevTools",
+    "label_zh": "开发工具"
+  },
   {
     "count": 5,
     "id": "finance",

dist/pay/r2-x402-manifest-audit.json

@@ -0,0 +1,58 @@
+{
+  "chain_kinds": [
+    "base"
+  ],
+  "chains": [
+    "eip155:8453"
+  ],
+  "chains_meta": [
+    {
+      "id": "eip155:8453",
+      "kind": "base",
+      "label": "Base Mainnet",
+      "label_zh": "Base 主网"
+    }
+  ],
+  "description": "Inspects an inline x402 manifest and returns deterministic readiness findings. Static manifest inspection only; it does not validate runtime enforcement, settlement, replay safety, facilitator trust, or security. Input URLs are never fetched. Operated by an authorized AI agent for R2 Advisory.",
+  "endpoints": [
+    {
+      "description": "Audit an inline x402 manifest and return deterministic structured findings.",
+      "max_price_usd": 2.0,
+      "metered": true,
+      "method": "POST",
+      "min_price_usd": 2.0,
+      "path": "/v1/check",
+      "url": "https://r2-x402-manifest-audit.dragonfly27.workers.dev/v1/check",
+      "x402_routes": [
+        {
+          "assetTransferMethod": "eip3009",
+          "network": "eip155:8453",
+          "provider": "r2-x402-manifest-audit-base",
+          "scheme": "exact",
+          "url": "https://r2-x402-manifest-audit.dragonfly27.workers.dev/v1/check"
+        }
+      ]
+    }
+  ],
+  "fqn": "r2-x402-manifest-audit",
+  "i18n": {
+    "zh-CN": {
+      "description": "检查内联 x402 清单并返回确定性的就绪性发现。仅静态检查；不验证运行时执行、结算、重放安全或整体安全性。不会抓取输入 URL。",
+      "mainTitle": "x402 清单静态就绪性检查",
+      "subtitle": "对 x402 服务清单进行确定性静态审计。",
+      "title": "R2 x402 清单审计",
+      "useCase": "在发布或集成 x402 服务前检查支付绑定与清单就绪性问题。"
+    }
+  },
+  "main_title": "Static x402 manifest readiness findings",
+  "main_title_zh": "x402 清单静态就绪性检查",
+  "service_url": "https://r2-x402-manifest-audit.dragonfly27.workers.dev",
+  "sha": "4bbec7ee2861b2d4f5fbef1776a26e762d841bdbf5afe9d3096e15b84ba549ac",
+  "sub_title": "Deterministic static audits for x402 service manifests.",
+  "sub_title_zh": "对 x402 服务清单进行确定性静态审计。",
+  "subtitle": "Deterministic static audits for x402 service manifests.",
+  "title": "R2 x402 Manifest Audit",
+  "title_zh": "R2 x402 清单审计",
+  "use_case": "Use before publishing or integrating an x402 manifest to catch missing or inconsistent payment bindings.",
+  "version": 1
+}

dist/pay/r2-x402-manifest-audit.md

@@ -0,0 +1,45 @@
+# R2 x402 Manifest Audit API (Base Mainnet, Paid)
+
+Deterministic static inspection of an inline x402 manifest. The service returns structured findings about payment requirement bindings and never fetches URLs supplied in the manifest.
+
+## Service
+
+- Catalog FQN: `r2-x402-manifest-audit`
+- Gateway provider identifier: `r2-x402-manifest-audit-base`
+- Category: `devtools`
+- Chain: `eip155:8453` (Base Mainnet)
+- Asset: canonical USDC
+- Scheme: x402 v2 `exact` with EIP-3009
+- Price: `$2.00 USD` per successful report
+- Recipient: `0x605519164197f8464503950196BdB9a932c90Cdb`
+- Source and full boundaries: https://github.com/ruizmr/x402-api-readiness-review
+
+## Endpoint
+
+`POST https://r2-x402-manifest-audit.dragonfly27.workers.dev/v1/check`
+
+Request body, maximum 262144 bytes:
+
+```json
+{"manifest": {"resources": []}}
+```
+
+Probe without payment (returns HTTP 402 and a `PAYMENT-REQUIRED` header):
+
+```bash
+curl -i -X POST 'https://r2-x402-manifest-audit.dragonfly27.workers.dev/v1/check'   -H 'Accept: application/json'   -H 'Content-Type: application/json'   --data '{"manifest":{}}'
+```
+
+Use an x402 v2 client that independently caps the amount, verifies Base mainnet, canonical USDC, and the exact recipient before signing. Never paste a private key into a request or issue.
+
+## Output
+
+A successful paid call returns a JSON report with requirement and finding counts, severity-ranked finding objects, and explicit limitations. Malformed input returns non-2xx and the middleware does not settle it.
+
+## Boundaries
+
+- Static JSON inspection only.
+- Does not test runtime payment enforcement or settlement.
+- Does not validate signatures, replay defenses, facilitator trust, token value, contract safety, or legal compliance.
+- A clean report is not a security audit or certification.
+- The public facilitator is an external availability, verification, and settlement dependency.

dist/providers/r2-x402-manifest-audit.json

@@ -0,0 +1,95 @@
+{
+  "category": "devtools",
+  "category_meta": {
+    "id": "devtools",
+    "label": "DevTools",
+    "label_zh": "开发工具"
+  },
+  "chain_kinds": [
+    "base"
+  ],
+  "chains": [
+    "eip155:8453"
+  ],
+  "chains_meta": [
+    {
+      "id": "eip155:8453",
+      "kind": "base",
+      "label": "Base Mainnet",
+      "label_zh": "Base 主网"
+    }
+  ],
+  "description": "Inspects an inline x402 manifest and returns deterministic readiness findings. Static manifest inspection only; it does not validate runtime enforcement, settlement, replay safety, facilitator trust, or security. Input URLs are never fetched. Operated by an authorized AI agent for R2 Advisory.",
+  "endpoint_count": 1,
+  "endpoints": [
+    {
+      "description": "Audit an inline x402 manifest and return deterministic structured findings.",
+      "i18n": {
+        "zh-CN": {
+          "description": "审计内联 x402 清单并返回确定性结构化发现。",
+          "subtitle": "POST /v1/check",
+          "title": "审计 x402 清单",
+          "useCase": "在发布或集成 x402 服务前验证清单。"
+        }
+      },
+      "max_price_usd": 2.0,
+      "metered": true,
+      "method": "POST",
+      "min_price_usd": 2.0,
+      "path": "/v1/check",
+      "subtitle": "POST /v1/check",
+      "title": "Audit x402 manifest",
+      "url": "https://r2-x402-manifest-audit.dragonfly27.workers.dev/v1/check",
+      "use_case": "Validate a manifest before x402 service publication or integration.",
+      "x402_routes": [
+        {
+          "assetTransferMethod": "eip3009",
+          "network": "eip155:8453",
+          "provider": "r2-x402-manifest-audit-base",
+          "scheme": "exact",
+          "url": "https://r2-x402-manifest-audit.dragonfly27.workers.dev/v1/check"
+        }
+      ]
+    }
+  ],
+  "featured_tags": [
+    "x402",
+    "manifest",
+    "audit",
+    "validation",
+    "readiness"
+  ],
+  "fqn": "r2-x402-manifest-audit",
+  "has_free_tier": false,
+  "has_metering": true,
+  "i18n": {
+    "zh-CN": {
+      "description": "检查内联 x402 清单并返回确定性的就绪性发现。仅静态检查；不验证运行时执行、结算、重放安全或整体安全性。不会抓取输入 URL。",
+      "mainTitle": "x402 清单静态就绪性检查",
+      "subtitle": "对 x402 服务清单进行确定性静态审计。",
+      "title": "R2 x402 清单审计",
+      "useCase": "在发布或集成 x402 服务前检查支付绑定与清单就绪性问题。"
+    }
+  },
+  "is_featured": false,
+  "is_first_party": true,
+  "logo": "https://github.com/ruizmr.png",
+  "main_title": "Static x402 manifest readiness findings",
+  "main_title_zh": "x402 清单静态就绪性检查",
+  "max_price_usd": 2.0,
+  "min_price_usd": 2.0,
+  "service_url": "https://r2-x402-manifest-audit.dragonfly27.workers.dev",
+  "sha": "4bbec7ee2861b2d4f5fbef1776a26e762d841bdbf5afe9d3096e15b84ba549ac",
+  "status": {
+    "catalog": "listed",
+    "gateway": "configured",
+    "payment": "mainnet",
+    "upstream": "public"
+  },
+  "sub_title": "Deterministic static audits for x402 service manifests.",
+  "sub_title_zh": "对 x402 服务清单进行确定性静态审计。",
+  "subtitle": "Deterministic static audits for x402 service manifests.",
+  "title": "R2 x402 Manifest Audit",
+  "title_zh": "R2 x402 清单审计",
+  "use_case": "Use before publishing or integrating an x402 manifest to catch missing or inconsistent payment bindings."
+}

dist/search-index.json

@@ -810,6 +810,58 @@
       "title": "GoPlus",
       "use_case": "Use before buying a token, approving an allowance, or sending to an address: check if a token is a honeypot/scam, whether an address is malicious, and whether an approval is risky."
     },
+    {
+      "category": "devtools",
+      "category_meta": {
+        "id": "devtools",
+        "label": "DevTools",
+        "label_zh": "开发工具"
+      },
+      "chain_kinds": [
+        "base"
+      ],
+      "chains": [
+        "eip155:8453"
+      ],
+      "chains_meta": [
+        {
+          "id": "eip155:8453",
+          "kind": "base",
+          "label": "Base Mainnet",
+          "label_zh": "Base 主网"
+        }
+      ],
+      "description": "Inspects an inline x402 manifest and returns deterministic readiness findings. Static manifest inspection only; it does not validate runtime enforcement, settlement, replay safety, facilitator trust, or security. Input URLs are never fetched. Operated by an authorized AI agent for R2 Advisory.",
+      "endpoints": [
+        {
+          "description": "Audit an inline x402 manifest and return deterministic structured findings.",
+          "method": "POST",
+          "path": "/v1/check",
+          "title": "Audit x402 manifest",
+          "x402_routes": [
+            {
+              "assetTransferMethod": "eip3009",
+              "network": "eip155:8453",
+              "provider": "r2-x402-manifest-audit-base",
+              "scheme": "exact",
+              "url": "https://r2-x402-manifest-audit.dragonfly27.workers.dev/v1/check"
+            }
+          ]
+        }
+      ],
+      "featured_tags": [
+        "x402",
+        "manifest",
+        "audit",
+        "validation",
+        "readiness"
+      ],
+      "fqn": "r2-x402-manifest-audit",
+      "service_url": "https://r2-x402-manifest-audit.dragonfly27.workers.dev",
+      "subtitle": "Deterministic static audits for x402 service manifests.",
+      "title": "R2 x402 Manifest Audit",
+      "use_case": "Use before publishing or integrating an x402 manifest to catch missing or inconsistent payment bindings."
+    },
     {
       "category": "finance",
       "category_meta": {
@@ -900,6 +952,6 @@
       "use_case": "Use this provider when an app, agent, or CLI workflow needs to launch a SunPump token after a successful x402 payment. Choose a TRON Mainnet, BNB Smart Chain, or Base Mainnet payment route; every successful launch creates the token on TRON Mainnet."
     }
   ],
-  "generated_at": "2026-07-30T10:02:35Z",
+  "generated_at": "2026-08-07T06:10:05Z",
   "version": 1
 }

dist/status.json

@@ -1,6 +1,6 @@
 {
-  "generated_at": "2026-07-30T10:02:35Z",
-  "provider_count": 5,
+  "generated_at": "2026-08-07T06:10:05Z",
+  "provider_count": 6,
   "status": "ok",
   "version": 1
 }