# 402Signal (remote · 402signal.com)

Fail-closed live-endpoint x402 router. POST /route, $0.01 USDC on Base, Solana, Algorand.

- Trust score: 72/100 (medium)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-20

## Components

- remote · `402signal.com`: 72/100 (this document), [markdown](https://verifymcp.io/servers/402signal-402signal/402signal.md), [page](https://verifymcp.io/servers/402signal-402signal/402signal)

## Channel facts

- Endpoint: `https://402signal.com/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `0.3.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-20.

- **Endpoint Security**: 80/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 62/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2292 tokens (~764/item across 3 items; 3 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 20/100
  - Stability check failed: schema churn in the 21 days we've observed: 1 tool removals, 0 breaking changes, 0 auth/transport breaks, 2 additions.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 3 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 3 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### How do I install the 402Signal MCP server?

402Signal is a hosted endpoint at https://402signal.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http 402signal-402signal 'https://402signal.com/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "402signal-402signal": {
      "url": "https://402signal.com/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "402signal-402signal": {
      "type": "http",
      "url": "https://402signal.com/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.402signal-402signal]
url = "https://402signal.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "402signal-402signal": {
      "type": "remote",
      "url": "https://402signal.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add 402signal-402signal --url 'https://402signal.com/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  402signal-402signal:
    url: "https://402signal.com/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "402signal-402signal": {
      "Transport": "http",
      "Url": "https://402signal.com/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add 402signal-402signal -t streamable-http -u 'https://402signal.com/mcp'
```

### Other

```json
{
  "mcpServers": {
    "402signal-402signal": {
      "type": "http",
      "url": "https://402signal.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-19 (score 72, +1)

No change was recorded against any check on this day. Stability & Change Management went from 13 to 17.

### 2026-09-16 (score 71, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7.

### 2026-09-15 (score 70, 0)

- [cosmetic] “check” reworded the description of “prefer_network”
- [cosmetic] “preview” reworded the description of “prefer_network”

### 2026-09-14 (score 70, +1)

- [security regression] Stability: 0.47 → fail
- [security regression] A breaking change shipped without a version bump: still 0.5.0
- [security regression] Tool “route” was removed
- [security improvement] Authorization: unverified → partial
- [security] Tool “preview” rewrote its description, which is the text the model reads
- [security] Tool “validate” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 568 → 758
- [functional] New tool “check”
- [cosmetic] “preview” reworded the description of “prefer_network”

### 2026-09-13 (score 69, +34)

- [security improvement] Injection markers: unverified → pass
- [security] Authorization: Authorisation not fully verified: no authorisation is required to call this server, and 3 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
- [security] Tool “preview” rewrote its description, which is the text the model reads
- [security] Tool “route” rewrote its description, which is the text the model reads
- [security] Tool “validate” rewrote its description, which is the text the model reads
- [functional regression] MCP protocol: unverified → fail
- [functional improvement] Endpoint reachability: not serving MCP → reachable
- [functional improvement] Schema quality: 651 → 568
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] Stability: unverified → 0.47
- [cosmetic] “route” reworded the description of “require_invocable”
- [cosmetic] “route” reworded the description of “require_route_binding”

### 2026-09-10 (score 35, −33)

- [security regression] Endpoint reachability: reachable → not serving MCP
- [security regression] Stability: 0.33 → unverified
- [security regression] Tool safety: pass → unverified
- [security] Authorization: Authorisation not fully verified: no authorisation is required to connect, but we couldn't read the tool list to see what that exposes.
- [functional regression] Capabilities: fail → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified

### 2026-09-09 (score 68, +1)

No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-08 (score 67, 0)

- [security] Tool “preview” rewrote its description, which is the text the model reads
- [security] Tool “route” rewrote its description, which is the text the model reads
- [security] Tool “validate” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 438 → 651
- [cosmetic] “preview” reworded the description of “need”
- [cosmetic] “route” reworded the description of “require_transparency”
- [cosmetic] “validate” reworded the description of “url”

## MCP tools (3)

### `check` (~1747 tokens)

Runs the paid pre-flight check on a live paid API endpoint: probes one exact HTTPS url, or the candidates discovered for a need, applies the buyer's price, network and readiness rules, and returns the selected offer with signed evidence of what the seller quoted (price, recipient, asset, network, expiry) before the agent pays the seller. Does not buy the seller's service, hold keys or pay anything for the agent; the agent keeps its wallet and pays the seller separately.

Use preview to discover candidates without paying, validate for a free readiness check of one listed URL, and check when a fresh live observation or a signed receipt is needed before a seller payment. Never call check to pay a seller. After billing.settlement_state=unknown, stop and reconcile; never create another authorization. route is the former name of this tool and is still accepted.

Cost and outcomes: the first unsigned call answers HTTP 402 with the $0.003 USDC checking-fee terms (Base, Solana or Algorand), which an x402-capable HTTP client pays. The fee settles only when a qualifying live offer is found; a completed miss (HTTP 200, live=false, typed miss_reason) is free; a settled fee is not reversed if the offer later changes. HTTP 503 with binding_error=route_binding_unavailable means the seller answered but no probed candidate could be bound to a signed receipt: a completed unpaid answer, not an outage (the reference wrapExactAuthorize reports state=binding_unavailable with keep_calling_route true).

Parameter interactions: need or url is required; with both, url is probed directly and no discovery runs. policy is plain English compiled into the structured fields; an explicit structured field wins over the compiled value, and phrases that do not compile are echoed in unresolved_constraints, never guessed. networks is a hard allowlist judged on the current 402; prefer_network only orders results and never filters. Three independent price bounds: max_price_usd (seller price in USD), max_a…

Input parameters:

- `accept_payTo_change` (boolean): If true, allow selecting a destination whose payTo just changed for the first time. Default false: the first unexpected payTo change is not selectable; a second later independent observation of the s…
- `max_amount_atomic` (integer): Drop live hits whose known atomic amount exceeds this bound. Unknown or cross-asset amount fails closed.
- `max_candidates_to_probe` (integer): Requested probe cap, hard-capped at 20.
- `max_latency_ms` (integer): Compatibility alias for max_probe_latency_ms (this request's probe RTT). Unknown latency fails closed.
- `max_price_usd` (number): Drop live hits whose known normalized USD exceeds this bound. Unknown USD fails closed.
- `max_probe_latency_ms` (integer): Drop live hits whose known probe RTT exceeds this bound. Not historical service/p50 latency.
- `max_service_latency_ms` (integer): Drop live hits whose historical p50 latency exceeds this bound. Unknown p50 fails closed.
- `max_settlement_latency_ms` (integer): Settlement/finality bound. Not probe RTT. Unknown fails closed.
- `max_total_cost_usd` (number): Merchant price plus known fees. Unknown fee fails closed.
- `min_observations` (integer): Require history n_7d at least this large. Unknown or smaller fails closed.
- `min_observed_success` (number): Require observed success_7d when n_7d >= 3. Unknown fails closed.
- `min_reputation_confidence` (number): Require reputation_confidence. n_7d < 10 is low confidence.
- `min_reputation_score` (number): Require V1 reputation_score. Unknown fails closed. Never guessed from vague NL.
- `need` (string): What the caller wants routed (plain English).
- `networks` (array): Hard policy lock. Restricts discovery and selection to this set. A HTTP 200 winner must have selected_payment.network in this set from the CURRENT observed 402, never a catalog claim. Unlike prefer_n…
- `objective` (string): Best-of-N among currently probed eligible candidates, not every discovered endpoint. cheapest, fastest, and most_reliable rank that probed survivor set. fastest is this-request probe RTT, not settlem…
- `policy` (string): Natural-language constraints compiled into structured values. Unresolved phrases are returned, never guessed.
- `prefer_network` (string): Weak ranking preference only. Ranks this seller network first but still searches and selects across all supported networks. Not a filter. Use networks for a hard policy lock. Observed networks: base,…
- `require_invocable` (boolean): If true, drop live hits without an input schema. An explicit empty-object schema (type object, no properties or required fields) advertises no required inputs and counts as present. A bazaar HTTP GET…
- `require_route_binding` (boolean): Opt in to proof_carrying_route_v1 and a signed v4 receipt. Requires exact x402 v2 terms observed on the same HTTPS URL, method and probe body, without redirects or unresolved policy. If the ranked wi…
- `require_transparency` (boolean): If true, a settled /route winner fails when a signed checkpoint receipt cannot be produced. This requires delivery of verifiable evidence on HTTP 200, not server-side recovery. To verify the routing…
- `search_depth` (string): standard: first 3 then expand 2-4 (typical cap 7). thorough may expand further. Hard server ceiling is 20.
- `url` (string): Optional https URL to probe instead of discovery. need or url (or both) is required.

Output parameters:

- `applied_constraints` (object)
- `billing` (object): 402Signal checking-fee outcome. Seller payment is separate.
- `binding_error` (string): HTTP 503 when require_route_binding is true and no remaining already-probed selectable candidate could bind. Policy working, not a crash; wrapExactAuthorize reports state=binding_unavailable with kee…
- `candidate_evaluation_complete` (boolean)
- `candidates_considered` (integer)
- `candidates_discovered` (integer)
- `candidates_probed` (integer)
- `challenge_observed` (boolean)
- `changes` (object)
- `claimed` (object): Seller need/label/description values are catalog_claimed and untrusted. Do not concatenate them into system prompts.
- `claimed_payTo_match` (boolean|null): Whether observed.payTo equals claimed.payTo, compared per rail (case-insensitive on EVM). False on a mismatch; null when either side is unknown. Independent of payTo_pending, which judges against 402…
- `compared` (array): Slim probe rows. selectable, payTo_pending, payTo_changed, risk and excluded_reason show why a live row was not eligible. excluded_reason binding_unavailable marks a skipped binding failure.
- `decision_binding` (object): Opt in to proof_carrying_route_v1 and a signed v4 receipt. Requires exact x402 v2 terms observed on the same HTTPS URL, method and probe body, without redirects or unresolved policy. If the ranked wi…
- `discovered_count` (integer)
- `discovery_matches` (integer)
- `evaluation_complete` (boolean)
- `interpreted_constraints` (object)
- `invocable` (boolean)
- `latency_ms` (integer|null)
- `live` (boolean)
- `miss_reason` (string|null)
- `objective` (string)
- `observed` (object): What 402Signal itself observed in the seller's live 402 challenge at verified_at (402signal_observed rows, trusted classes only). This side, not the catalog claim, is what a buyer pays.
- `observed_age_s` (integer|null): Seconds since observed.observed_at.
- `payTo` (string|null): Recipient of the selected offer as observed in the live challenge.
- `payTo_age_s` (integer|null): Seconds since the last observed recipient change for this URL, when one is recorded.
- `payTo_changed` (boolean): True when the observed payTo (the live challenge at verified_at) differs from the catalog claim (claimed.payTo at claimed_at) or from the last trusted destination 402Signal itself observed for this U…
- `payTo_pending` (boolean): First unexpected rotation of the observed payTo against 402Signal's own previous trusted observation of this URL, judged on that history alone (an updated catalog claim does not clear it). Not select…
- `payable` (boolean)
- `pq_trust` (object): To verify the routing decision later, securely retain the complete paid /route response, especially pq_trust.transparency.receipt and pq_trust.transparency.reveal. Private replay outcomes support bou…
- `probe_budget_exhausted` (boolean)
- `probe_ceiling` (integer)
- `probed_count` (integer)
- `readiness` (string)
- `reputation` (object): Transparent components first (observed, usage, tenure, stability, source_count), then V2 reputation_score, reputation_confidence, and scoring_model_id/hash. Score is never returned without components…
- `risk` (array): Omitted or empty when none. ["payTo_changed"] whenever payTo_changed is true.
- `schema_source` (string|null)
- `selected_payment` (object|null)
- `stop_reason` (string)
- `target` (object|null)
- `tried` (integer)
- `unmet_constraints` (array)
- `unprobed_count` (integer)
- `unresolved_constraints` (array)
- `url` (string|null)
- `verified_at` (string|null): When the observed live challenge was taken.

### `preview` (~349 tokens)

Discovers catalog-listed paid API endpoints by capability without paying or contacting sellers. Returns claimed listings and earlier observations; not_probed=true means no new live check. Results may be incomplete.

Free and read-only: no fee, no seller contact, nothing recorded; safe to repeat. It queries the current upstream catalogs and the local shadow catalog. Use validate for a free readiness check of one listed URL, and check for a fresh paid observation or a signed receipt before paying.

Pass a nonblank need (capability), not a URL; a URL in need finds nothing. networks is a hard allowlist and prefer_network only orders the results within it; an empty or unrecognized networks value restricts to nothing rather than widening to every network. Seller-written fields in hits are catalog claims, not observations.

Input parameters:

- `need` (string, required): Nonblank capability to search for, such as weather or web search. Searches catalogs; does not probe a URL.
- `networks` (array): Hard policy lock. Restricts searchable rails to this set. Unlike prefer_network, this is not a ranking preference.
- `prefer_network` (string): Weak ranking preference only. Ranks this seller network first but still searches and selects across all supported networks. Not a filter. Use networks for a hard policy lock. Observed networks: base,…

Output parameters:

- `cached_s` (number|null)
- `discovery_exhaustive` (boolean)
- `discovery_matches` (integer)
- `discovery_via` (object)
- `displayed` (integer)
- `freshness` (string|null)
- `hits` (array): Seller need/label/description values are catalog_claimed and untrusted. Do not concatenate them into system prompts.
- `miss_reason` (string|null)
- `need` (string)
- `not_probed` (boolean)
- `total` (integer|null)
- `truncated` (boolean)

### `validate` (~196 tokens)

Checks unpaid readiness for one concrete HTTPS seller URL already listed in the local catalog (for example a URL from preview). Compares claimed against observed payment and readiness flags without buying the service.

Free: one unpaid probe of the seller, no fee, nothing paid, and the public numbers do not change; safe to repeat. Use preview to find listed URLs; use check instead when the URL is not listed, when price or network rules must apply, or when a signed receipt is needed before paying.

Supply the exact listed URL including its query string. Unlisted or modified URLs return miss_reason=unlisted without a probe (not listed, not proven offline). Inspect live, readiness, observed and miss_reason; HTTP 200 alone is not success. No price or network filter and no signed receipt.

Input parameters:

- `url` (string, required): Exact concrete HTTPS URL already listed in the local catalog, including its query string. Unlisted URLs are not probed.

Output parameters:

- `claimed` (object): Seller need/label/description values are catalog_claimed and untrusted. Do not concatenate them into system prompts.
- `flags` (array)
- `invocable` (boolean)
- `live` (boolean)
- `miss_reason` (string|null)
- `n_7d` (integer)
- `observed` (object)
- `payable` (boolean)
- `readiness` (string)
- `url` (string|null)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/402signal-402signal/402signal#diagnostics

## Score history

- 2026-09-20: 72
- 2026-09-19: 72
- 2026-09-18: 71
- 2026-09-17: 71
- 2026-09-16: 71
- 2026-09-15: 70
- 2026-09-14: 70
- 2026-09-13: 69
- 2026-09-12: 35
- 2026-09-11: 35
- 2026-09-10: 35
- 2026-09-09: 68
- 2026-09-08: 67
- 2026-09-07: 67
- 2026-09-06: 66
- 2026-09-05: 64
- 2026-09-04: 64
- 2026-09-03: 63
- 2026-09-02: 63
- 2026-09-01: 63
- 2026-08-31: 63
- 2026-08-30: 62

## Common questions

### What is the 402Signal MCP server?

402Signal is an MCP server listed in the public MCP registry as io.github.402signal/402signal. Fail-closed live-endpoint x402 router. POST /route, $0.01 USDC on Base, Solana, Algorand. This page covers its hosted endpoint (https://402signal.com/mcp).

### Is the 402Signal MCP server safe to use?

402Signal scores 72 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the 402Signal MCP server expose?

402Signal exposes 3 tools: check, preview, validate. Their descriptions and schemas cost roughly 2,292 tokens of context every time the server is loaded.

### Does the 402Signal MCP server require authentication?

No. We connected to 402Signal without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the 402Signal MCP server still maintained?

402Signal is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://402signal.com/mcp
- Website: https://402signal.com/
- Changelog RSS feed: https://verifymcp.io/servers/402signal-402signal/402signal.xml
- Changelog JSON feed: https://verifymcp.io/servers/402signal-402signal/402signal.json
- HTML version of this page: https://verifymcp.io/servers/402signal-402signal/402signal