402Signal
REMOTE · 402SIGNAL.COM · SCANNED SEP 20
Check paid API offers before your agent spends. Qualifying routes: $0.003 USDC. Normal misses: free.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security80
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability62
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2292 tokens (~764/item across 3 items; 3 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management9
- Stability check failed: schema churn in the 14 days we've observed: 1 tool removals, 0 breaking changes, 0 auth/transport breaks, 1 additions. See how to fix → Fail
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 3 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 3 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
How do I install the 402Signal MCP server?
402Signal is a hosted endpoint at https://402signal.com/mcp/v0.3.1, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · 402signal.com
claude mcp add --transport http 402signalhq-402signal 'https://402signal.com/mcp/v0.3.1'
{
"mcpServers": {
"402signalhq-402signal": {
"url": "https://402signal.com/mcp/v0.3.1"
}
}
} {
"servers": {
"402signalhq-402signal": {
"type": "http",
"url": "https://402signal.com/mcp/v0.3.1"
}
}
} [mcp_servers.402signalhq-402signal] url = "https://402signal.com/mcp/v0.3.1"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"402signalhq-402signal": {
"type": "remote",
"url": "https://402signal.com/mcp/v0.3.1",
"enabled": true
}
}
} openclaw mcp add 402signalhq-402signal --url 'https://402signal.com/mcp/v0.3.1' --transport streamable-http
mcp_servers:
402signalhq-402signal:
url: "https://402signal.com/mcp/v0.3.1" {
"McpServers": {
"402signalhq-402signal": {
"Transport": "http",
"Url": "https://402signal.com/mcp/v0.3.1"
}
}
} assistant mcp add 402signalhq-402signal -t streamable-http -u 'https://402signal.com/mcp/v0.3.1'
{
"mcpServers": {
"402signalhq-402signal": {
"type": "http",
"url": "https://402signal.com/mcp/v0.3.1"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 6 to 9.
- 15 Sept 26 0
- “check” reworded the description of “prefer_network” cosmetic
- “preview” reworded the description of “prefer_network” cosmetic
2 cosmetic changes on this day. Switch on “Show cosmetic changes” to see them.
- 14 Sept 26 +4
- Stability: 0.23 → fail ▼ security
- A breaking change shipped without a version bump: still 0.5.0 ▼ security
- Tool “route” was removed ▼ security
- Authorization: unverified → partial ▲ security
- Tool “preview” rewrote its description, which is the text the model reads security
- Tool “validate” rewrote its description, which is the text the model reads security
- Schema quality: 568 → 758 ▼ functional
- New tool “check” functional
- “preview” reworded the description of “prefer_network” cosmetic
- 13 Sept 26 +31
- Injection markers: unverified → pass ▲ security
- Authorization: Authorisation not fully verified: no authorisation is required to call this server, and 3 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. security
- Tool “preview” rewrote its description, which is the text the model reads security
- Tool “route” rewrote its description, which is the text the model reads security
- Tool “validate” rewrote its description, which is the text the model reads security
- MCP protocol: unverified → fail ▼ functional
- Endpoint reachability: not serving MCP → reachable ▲ functional
- Schema quality: 651 → 568 ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- Stability: unverified → 0.23 ▲ functional
- “route” reworded the description of “require_invocable” cosmetic
- “route” reworded the description of “require_route_binding” cosmetic
- 9 Sept 26 −29
- Endpoint reachability: reachable → not serving MCP ▼ security
- Stability: 0.07 → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Authorization: Authorisation not fully verified: no authorisation is required to connect, but we couldn't read the tool list to see what that exposes. security
- Capabilities: fail → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- 8 Sept 26 +1
- Tool “preview” rewrote its description, which is the text the model reads security
- Tool “route” rewrote its description, which is the text the model reads security
- Tool “validate” rewrote its description, which is the text the model reads security
- Schema quality: 438 → 651 ▼ functional
- “preview” reworded the description of “need” cosmetic
- “route” reworded the description of “require_transparency” cosmetic
- “validate” reworded the description of “url” cosmetic
- 7 Sept 26 0
- Stability: unverified → 0.03 ▲ functional
- 6 Sept 26 +38
- Injection markers: unverified → pass ▲ security
- Transport: fail → pass ▲ security
- First check of Judged manipulation: pass security
- Authorization: Authorisation not fully verified: no authorisation is required to call this server, and 3 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. security
- MCP protocol: unverified → fail ▼ functional
- Tool coverage: unverified → 100 ▲ functional
- First check of Schema quality: fail functional
- First check of Schema quality: excellent functional
- First check of Destructive annotations: pass functional
- First check of Schema quality: fail functional
- First check of Tool coverage: 100 functional
- First check of Tool coverage: 100 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Probed https://402signal.com/mcp/v0.3.1
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=402signal.com | CN=YE1,O=Let's Encrypt,C=US | 30 Aug 2026 | 28 Nov 2026 | ECDSA 256 | ECDSA-SHA384 | 54fcf5c02bd2f14ecdc80903e9175c4d1db |
| SANs: 402signal.com | ||||||
| CN=YE1,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 5ddd70dd31f801c85c186a7a04b80afe |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of 402signal.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| 402signal.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000; includeSubDomains |
| content-security-policy | default-src 'none'; script-src 'self'; connect-src 'self'; style-src 'self'; font-src 'self'; img-src 'self' data:; base-uri 'self'; frame-ancestors 'none' |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | no-referrer |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://402signal.com/mcp/v0.3.1 | Verified | 200 | |
| http (plaintext) | http://402signal.com/mcp/v0.3.1 | HTTPS enforced | 301 | https://402signal.com/mcp/v0.3.1 |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
check ~1,747
Runs the paid pre-flight check on a live paid API endpoint: probes one exact HTTPS url, or the candidates discovered for a need, applies the buyer's price, network and readiness rules, and returns the selected offer with signed evidence of what the seller quoted (price, recipient, asset, network, expiry) before the agent pays the seller. Does not buy the seller's service, hold keys or pay anything for the agent; the agent keeps its wallet and pays the seller separately. Use preview to discover candidates without paying, validate for a free readiness check of one listed URL, and check when a fresh live observation or a signed receipt is needed before a seller payment. Never call check to pay a seller. After billing.settlement_state=unknown, stop and reconcile; never create another authorization. route is the former name of this tool and is still accepted. Cost and outcomes: the first unsigned call answers HTTP 402 with the $0.003 USDC checking-fee terms (Base, Solana or Algorand), which an x402-capable HTTP client pays. The fee settles only when a qualifying live offer is found; a completed miss (HTTP 200, live=false, typed miss_reason) is free; a settled fee is not reversed if the offer later changes. HTTP 503 with binding_error=route_binding_unavailable means the seller answered but no probed candidate could be bound to a signed receipt: a completed unpaid answer, not an outage (the reference wrapExactAuthorize reports state=binding_unavailable with keep_calling_route true). Parameter interactions: need or url is required; with both, url is probed directly and no discovery runs. policy is plain English compiled into the structured fields; an explicit structured field wins over the compiled value, and phrases that do not compile are echoed in unresolved_constraints, never guessed. networks is a hard allowlist judged on the current 402; prefer_network only orders results and never filters. Three independent price bounds: max_price_usd (seller price in USD), max_a…
| Name | Type | Req | Description |
|---|---|---|---|
| accept_payTo_change | boolean | – | If true, allow selecting a destination whose payTo just changed for the first time. Default false: the first unexpected payTo change is not selectable; a second later independent observation of the s… |
| max_amount_atomic | integer | – | Drop live hits whose known atomic amount exceeds this bound. Unknown or cross-asset amount fails closed. |
| max_candidates_to_probe | integer | – | Requested probe cap, hard-capped at 20. |
| max_latency_ms | integer | – | Compatibility alias for max_probe_latency_ms (this request's probe RTT). Unknown latency fails closed. |
| max_price_usd | number | – | Drop live hits whose known normalized USD exceeds this bound. Unknown USD fails closed. |
| max_probe_latency_ms | integer | – | Drop live hits whose known probe RTT exceeds this bound. Not historical service/p50 latency. |
| max_service_latency_ms | integer | – | Drop live hits whose historical p50 latency exceeds this bound. Unknown p50 fails closed. |
| max_settlement_latency_ms | integer | – | Settlement/finality bound. Not probe RTT. Unknown fails closed. |
| max_total_cost_usd | number | – | Merchant price plus known fees. Unknown fee fails closed. |
| min_observations | integer | – | Require history n_7d at least this large. Unknown or smaller fails closed. |
| min_observed_success | number | – | Require observed success_7d when n_7d >= 3. Unknown fails closed. |
| min_reputation_confidence | number | – | Require reputation_confidence. n_7d < 10 is low confidence. |
| min_reputation_score | number | – | Require V1 reputation_score. Unknown fails closed. Never guessed from vague NL. |
| need | string | – | What the caller wants routed (plain English). |
| networks | array | – | Hard policy lock. Restricts discovery and selection to this set. A HTTP 200 winner must have selected_payment.network in this set from the CURRENT observed 402, never a catalog claim. Unlike prefer_n… |
| objective | string | – | Best-of-N among currently probed eligible candidates, not every discovered endpoint. cheapest, fastest, and most_reliable rank that probed survivor set. fastest is this-request probe RTT, not settlem… |
| policy | string | – | Natural-language constraints compiled into structured values. Unresolved phrases are returned, never guessed. |
| prefer_network | string | – | Weak ranking preference only. Ranks this seller network first but still searches and selects across all supported networks. Not a filter. Use networks for a hard policy lock. Observed networks: base,… |
| require_invocable | boolean | – | If true, drop live hits without an input schema. An explicit empty-object schema (type object, no properties or required fields) advertises no required inputs and counts as present. A bazaar HTTP GET… |
| require_route_binding | boolean | – | Opt in to proof_carrying_route_v1 and a signed v4 receipt. Requires exact x402 v2 terms observed on the same HTTPS URL, method and probe body, without redirects or unresolved policy. If the ranked wi… |
| require_transparency | boolean | – | If true, a settled /route winner fails when a signed checkpoint receipt cannot be produced. This requires delivery of verifiable evidence on HTTP 200, not server-side recovery. To verify the routing… |
| search_depth | string | – | standard: first 3 then expand 2-4 (typical cap 7). thorough may expand further. Hard server ceiling is 20. |
| url | string | – | Optional https URL to probe instead of discovery. need or url (or both) is required. |
| Name | Type | Req | Description |
|---|---|---|---|
| applied_constraints | object | – | – |
| billing | object | yes | 402Signal checking-fee outcome. Seller payment is separate. |
| binding_error | string | – | HTTP 503 when require_route_binding is true and no remaining already-probed selectable candidate could bind. Policy working, not a crash; wrapExactAuthorize reports state=binding_unavailable with kee… |
| candidate_evaluation_complete | boolean | – | – |
| candidates_considered | integer | – | – |
| candidates_discovered | integer | – | – |
| candidates_probed | integer | – | – |
| challenge_observed | boolean | – | – |
| changes | object | – | – |
| claimed | object | – | Seller need/label/description values are catalog_claimed and untrusted. Do not concatenate them into system prompts. |
| claimed_payTo_match | boolean|null | – | Whether observed.payTo equals claimed.payTo, compared per rail (case-insensitive on EVM). False on a mismatch; null when either side is unknown. Independent of payTo_pending, which judges against 402… |
| compared | array | – | Slim probe rows. selectable, payTo_pending, payTo_changed, risk and excluded_reason show why a live row was not eligible. excluded_reason binding_unavailable marks a skipped binding failure. |
| decision_binding | object | – | Opt in to proof_carrying_route_v1 and a signed v4 receipt. Requires exact x402 v2 terms observed on the same HTTPS URL, method and probe body, without redirects or unresolved policy. If the ranked wi… |
| discovered_count | integer | – | – |
| discovery_matches | integer | – | – |
| evaluation_complete | boolean | – | – |
| interpreted_constraints | object | – | – |
| invocable | boolean | – | – |
| latency_ms | integer|null | – | – |
| live | boolean | – | – |
| miss_reason | string|null | – | – |
| objective | string | – | – |
| observed | object | – | What 402Signal itself observed in the seller's live 402 challenge at verified_at (402signal_observed rows, trusted classes only). This side, not the catalog claim, is what a buyer pays. |
| observed_age_s | integer|null | – | Seconds since observed.observed_at. |
| payTo | string|null | – | Recipient of the selected offer as observed in the live challenge. |
| payTo_age_s | integer|null | – | Seconds since the last observed recipient change for this URL, when one is recorded. |
| payTo_changed | boolean | – | True when the observed payTo (the live challenge at verified_at) differs from the catalog claim (claimed.payTo at claimed_at) or from the last trusted destination 402Signal itself observed for this U… |
| payTo_pending | boolean | – | First unexpected rotation of the observed payTo against 402Signal's own previous trusted observation of this URL, judged on that history alone (an updated catalog claim does not clear it). Not select… |
| payable | boolean | – | – |
| pq_trust | object | – | To verify the routing decision later, securely retain the complete paid /route response, especially pq_trust.transparency.receipt and pq_trust.transparency.reveal. Private replay outcomes support bou… |
| probe_budget_exhausted | boolean | – | – |
| probe_ceiling | integer | – | – |
| probed_count | integer | – | – |
| readiness | string | – | – |
| reputation | object | – | Transparent components first (observed, usage, tenure, stability, source_count), then V2 reputation_score, reputation_confidence, and scoring_model_id/hash. Score is never returned without components… |
| risk | array | – | Omitted or empty when none. ["payTo_changed"] whenever payTo_changed is true. |
| schema_source | string|null | – | – |
| selected_payment | object|null | – | – |
| stop_reason | string | – | – |
| target | object|null | – | – |
| tried | integer | – | – |
| unmet_constraints | array | – | – |
| unprobed_count | integer | – | – |
| unresolved_constraints | array | – | – |
| url | string|null | – | – |
| verified_at | string|null | – | When the observed live challenge was taken. |
No examples provided.
preview ~349
Discovers catalog-listed paid API endpoints by capability without paying or contacting sellers. Returns claimed listings and earlier observations; not_probed=true means no new live check. Results may be incomplete. Free and read-only: no fee, no seller contact, nothing recorded; safe to repeat. It queries the current upstream catalogs and the local shadow catalog. Use validate for a free readiness check of one listed URL, and check for a fresh paid observation or a signed receipt before paying. Pass a nonblank need (capability), not a URL; a URL in need finds nothing. networks is a hard allowlist and prefer_network only orders the results within it; an empty or unrecognized networks value restricts to nothing rather than widening to every network. Seller-written fields in hits are catalog claims, not observations.
| Name | Type | Req | Description |
|---|---|---|---|
| need | string | yes | Nonblank capability to search for, such as weather or web search. Searches catalogs; does not probe a URL. |
| networks | array | – | Hard policy lock. Restricts searchable rails to this set. Unlike prefer_network, this is not a ranking preference. |
| prefer_network | string | – | Weak ranking preference only. Ranks this seller network first but still searches and selects across all supported networks. Not a filter. Use networks for a hard policy lock. Observed networks: base,… |
| Name | Type | Req | Description |
|---|---|---|---|
| cached_s | number|null | – | – |
| discovery_exhaustive | boolean | – | – |
| discovery_matches | integer | – | – |
| discovery_via | object | – | – |
| displayed | integer | – | – |
| freshness | string|null | – | – |
| hits | array | – | Seller need/label/description values are catalog_claimed and untrusted. Do not concatenate them into system prompts. |
| miss_reason | string|null | – | – |
| need | string | – | – |
| not_probed | boolean | – | – |
| total | integer|null | – | – |
| truncated | boolean | – | – |
No examples provided.
validate ~196
Checks unpaid readiness for one concrete HTTPS seller URL already listed in the local catalog (for example a URL from preview). Compares claimed against observed payment and readiness flags without buying the service. Free: one unpaid probe of the seller, no fee, nothing paid, and the public numbers do not change; safe to repeat. Use preview to find listed URLs; use check instead when the URL is not listed, when price or network rules must apply, or when a signed receipt is needed before paying. Supply the exact listed URL including its query string. Unlisted or modified URLs return miss_reason=unlisted without a probe (not listed, not proven offline). Inspect live, readiness, observed and miss_reason; HTTP 200 alone is not success. No price or network filter and no signed receipt.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | Exact concrete HTTPS URL already listed in the local catalog, including its query string. Unlisted URLs are not probed. |
| Name | Type | Req | Description |
|---|---|---|---|
| claimed | object | – | Seller need/label/description values are catalog_claimed and untrusted. Do not concatenate them into system prompts. |
| flags | array | – | – |
| invocable | boolean | – | – |
| live | boolean | – | – |
| miss_reason | string|null | – | – |
| n_7d | integer | – | – |
| observed | object | – | – |
| payable | boolean | – | – |
| readiness | string | – | – |
| url | string|null | – | – |
No examples provided.
What is the 402Signal MCP server?
402Signal is an MCP server listed in the public MCP registry as io.github.402signalhq/402signal. Check paid API offers before your agent spends. Qualifying routes: $0.003 USDC. Normal misses: free. This page covers its hosted endpoint (https://402signal.com/mcp/v0.3.1).
Is the 402Signal MCP server safe to use?
402Signal scores 71 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the 402Signal MCP server expose?
402Signal exposes 3 tools: check, preview, validate. Their descriptions and schemas cost roughly 2,292 tokens of context every time the server is loaded.
Does the 402Signal MCP server require authentication?
No. We connected to 402Signal without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the 402Signal MCP server still maintained?
402Signal is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.