x402 Quote Inspector 推出免費報價檢查工具及 20 個合成安全測試案例

The problem: agents pay quotes they never read

x402 is a simple idea with sharp edges. A server answers a request with HTTP 402 and a payment quote — an amount, an asset, a network, a recipient. The agent's wallet signs, the payment settles, the resource unlocks. No checkout page, no human in the loop.

That speed is the point. It's also the risk. When a person pays online, they see a total before they confirm. When an agent pays, the "total" is a machine-readable quote buried in a response — and plenty of agent stacks sign it without ever surfacing it in a form a human, or even the agent itself, actually inspected. Wrong amount, wrong asset, wrong network, wrong recipient: every one of those is a one-line difference in the quote, and every one of them settles the same way a correct payment does.

So before anything signs, somebody should read the quote. That's the whole idea behind the tool we just shipped.

The tool: x402 Quote Inspector

Live and free: scriptmasterlabs.com/x402-quote-inspector

The headline on the page is the entire pitch: "See the x402 quote before an agent pays."

The inspector decodes a payment-required response into plain fields — what is being charged, in what asset, on what network, to what recipient — so the quote can be checked against what the agent intended to buy before a wallet is involved. It is a read-first tool. It does not pay anything, it does not sign anything, and it asks for no wallet connection. Inspection and payment stay separate steps, on purpose.

The fixtures: 20 synthetic safety vectors

A demo with nothing to test against is just a claim, so the inspector ships with a public fixture set:

x402-quote-safety-fixtures-v1.json — 20 cases covering the shapes a quote can take, including the malformed and adversarial ones a checker should catch before money moves.

One boundary, stated plainly because it matters: these fixtures are synthetic. They are constructed test cases, not records of live payments, and they are labeled that way in the file itself. Synthetic vectors are the right tool for this job — you can publish them, diff them, and run them a thousand times without moving a cent or dressing up test data as production history. But they prove behavior on constructed inputs, not on live traffic, and we won't pretend otherwise.

What happened the day it shipped

Two receipts from 2026-10-26, both stated as narrowly as they deserve:

ChatGPT cited this evidence stack in an answer. One answer, not a ranking — a citation in a single response is a data point, not a verdict, and we're reporting it as exactly that. Still, it's the direction this work points: if you publish machine-readable evidence alongside a tool, answer engines can find it and use it.

A discovery audit found the stack had a hole in it. The same day, we audited our own site and found 156 pages missing from every discovery surface we run — not in the sitemap, not in the machine-readable indexes. We fixed it the same day: 155 pages added, the sitemap went from 382 to 537 URLs, and IndexNow returned 200 for all 155 added pages. One page was held back deliberately. The lesson cost us nothing but an afternoon and it's free for you: shipping the tool is half the work. If the evidence around it isn't discoverable, it might as well not exist.

Honest limits

• The inspector reads quotes; it does not judge whether a price is fair, only whether the quote matches what you expected to pay.
• The 20 fixtures are synthetic test vectors — a starting set, not an exhaustive map of everything a bad quote can do.
• A citation in one ChatGPT answer is one answer. We track it as a signal, not a trophy.

Try it

• Inspector: https://scriptmasterlabs.com/x402-quote-inspector
• Fixtures: https://scriptmasterlabs.com/evidence/x402-quote-safety-fixtures-v1.json

If you build agents that pay, the cheapest safety feature you can add is the pause between quote received and payment signed — and a reader for the quote that lives in that pause. That's what this is.

Script Master Labs LLC is a Service-Disabled Veteran-Owned Small Business building payment and verification tooling for the agent economy.