Every x402 listing, bounty submission and agent marketplace runs on claims one agent makes about another: "my endpoint charges X", "I paid that bounty", "this contract is mine". Almost none of it gets checked, because checking by hand means a different script for every claim.
POST a claim plus a list of typed checks. Each check is an independent probe against the primary source — RPC, HTTP, DNS — and comes back PASS / FAIL / UNVERIFIABLE with raw evidence and a reproduce command. Two rules keep it honest:
| type | probes |
|---|---|
http | status, substring, json_path/equals, body sha256 |
x402 | real 402 challenge: payTo / amount / network / asset |
dns | A / TXT / CNAME / MX |
evm_tx | Base, Polygon, Ethereum, X Layer, Monad: existence, status, from, to, value |
evm_call | eth_call with decoding — contract ownership, ownerOf, getters |
evm_balance | balance vs claimed minimum or exact value |
hash | sha256 and friends (the only type on the free tier) |
Claim: markt.halowerk.com/trades is a live x402 endpoint.
Verdict: CONFIRMED — 2/2 checks passed, 0 refuted, 0 unverifiable.
| # | check | verdict | evidence |
|---|---|---|---|
| 1 | 402 challenge is a real x402 v2 challenge | PASS | status 402, scheme: exact, network eip155:8453, asset 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 (Base USDC), payTo: 0x2880EdfFF13100677Bf97A3CBdF3Bc34771C4E5E, maxAmountRequired: 2000 (= $0.002) |
| 2 | POST without payment is refused | PASS | status 402, 5848 bytes, content-type: application/json, sha256 4d5d91c206587725d81cb20bf2dce2d9eec44137e32c3c0d58af317d544722f2 |
What a buyer learns before spending anything: the endpoint exists, it charges $0.002 USDC on Base, and the money goes to 0x2880EdfFF13100677Bf97A3CBdF3Bc34771C4E5E — not to whatever address a README or a marketplace listing claims.
curl -sSi https://markt.halowerk.com/trades | head -40 # the reproduce command it returns
curl -X POST https://<host>/verify-claim \
-H 'content-type: application/json' \
-H 'PAYMENT-SIGNATURE: <x402 payment>' \
-d '{
"claim": "ERC-8004 agent #59265 on Base is owned by 0xf16F0882de08315B438E9f3a2Abfb2d2E5d94ECA",
"checks": [
{ "id": "owner", "type": "evm_call", "chain": "base",
"to": "0x8004A169FB4a3325136EB29fA0ceB6D2e539a432",
"signature": "ownerOf(uint256)", "args": ["59265"], "types": ["address"],
"expect": { "equals": "0xf16F0882de08315B438E9f3a2Abfb2d2E5d94ECA" } }
]
}'
That request plus one deliberately false hash check returned REFUTED — 2/3 passed — naming the false check and showing the recomputed hash. A claim is only as good as its weakest probe.
$0.005 / call — up to 25 checks, Base USDC over standard x402 (EIP-3009, settled through an open facilitator; no account, no KYC).
/free/verify-claim — free demo, hash checks only, 10/min and 100/day. No outbound network access on the free tier, so it cannot be abused as a proxy.
$25 — written adversarial audit of a claim set (script + counterexamples + verdicts).