# 402cron (remote · 402cron.com)

Paid cron for AI agents: we call your https URL on schedule, signed. No account, paid with x402.

- Trust score: 71/100 (medium)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-28

## Components

- remote · `402cron.com`: 71/100 (this document), [markdown](https://verifymcp.io/servers/com-402cron-402cron/402cron.md), [page](https://verifymcp.io/servers/com-402cron-402cron/402cron)

## Channel facts

- Endpoint: `https://402cron.com/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.1`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-28.

- **Endpoint Security**: 57/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 16 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 75/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2160 tokens (~135/item across 16 items; 16 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 60/100
  - Stability observed for 18 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 75/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - 0 of 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "delete_task" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default.
  - An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the 402cron MCP server?

402cron is a hosted endpoint at https://402cron.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http com-402cron-402cron 'https://402cron.com/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "com-402cron-402cron": {
      "url": "https://402cron.com/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "com-402cron-402cron": {
      "type": "http",
      "url": "https://402cron.com/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.com-402cron-402cron]
url = "https://402cron.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-402cron-402cron": {
      "type": "remote",
      "url": "https://402cron.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-402cron-402cron --url 'https://402cron.com/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-402cron-402cron:
    url: "https://402cron.com/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "com-402cron-402cron": {
      "Transport": "http",
      "Url": "https://402cron.com/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add com-402cron-402cron -t streamable-http -u 'https://402cron.com/mcp'
```

### Other

```json
{
  "mcpServers": {
    "com-402cron-402cron": {
      "type": "http",
      "url": "https://402cron.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-28 (score 71, 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-09-27 (score 71, +1)

No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-25 (score 70, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-09-23 (score 69, +1)

No change was recorded against any check on this day. Stability & Change Management went from 40 to 43. That category is still filling its 30-day observation window: 12 days of observed history at the previous scan, 13 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-21 (score 68, +1)

No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-18 (score 67, 0)

- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “register_destination” rewrote its description, which is the text the model reads
- [security] Tool “verify_destination” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 110 → 135

### 2026-09-16 (score 67, +1)

No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-14 (score 66, +5)

- [security improvement] HTTPS: unverified → pass

## MCP tools (16)

### `get_pricing` (~49 tokens)

Pricing and payment requirements

What a delivery costs, which packs exist, and the exact x402 payment requirements for each. Balance is counted in DELIVERIES, not money, and packs never expire. Call this before buying.

### `get_docs` (~59 tokens)

Machine documentation

One section of the machine documentation: quickstart, headers, signature, notice, errors, billing or limits. Omit `section` to get the whole document.

Input parameters:

- `section` (string): Which section to return. Omit for all of it.

### `get_service_status` (~44 tokens)

Is the service selling right now

Whether the service is currently selling, on which network, and if not — why not. This is configuration, not liveness: the full health endpoint is at /health.

### `list_tasks` (~77 tokens)

List your scheduled tasks

Your tasks and their state. Needs your management token as an Authorization header on this connection.

Input parameters:

- `after` (string): Cursor from a previous page.
- `limit` (integer): How many to return.
- `state` (string): Filter by state: live (default), all, or one exact state such as active or paused_by_client.

### `get_task` (~51 tokens)

One task with its full state

A single task: schedule, destination, state, next run, and how many failures in a row it carries.

Input parameters:

- `id` (string, required): Task id (UUID), as returned by create_task or list_tasks.

### `create_task` (~441 tokens)

Create or update a scheduled task

Register a schedule against a destination you have already verified. Idempotent on "name": the same name updates the existing task instead of creating a second one. Creating costs nothing; each delivery ATTEMPT costs one credit.

Input parameters:

- `body`: The body we send. Stored in the clear, so it must not carry credentials. A non-string is serialized as JSON.
- `cron` (string, required): 5 fields, UTC only, one minute at the finest. Operators: * a-b a,b */n a-b/n. Names: SUN-SAT (day), JAN-DEC (month). Macros: @yearly @annually @monthly @weekly @daily @midnight @hourly. Day-of-week i…
- `headers` (object): Headers we send with the delivery. Stored ENCRYPTED at rest — put credentials here, never in the body.
- `method` (string): HTTP method of the delivery. Default POST. GET and HEAD carry no body.
- `name` (string, required): Your name for the task. Unique among your live tasks; creating with an existing name updates it.
- `timeoutMs` (integer): How long we wait for your server, 250-2000 ms. Answer 202 and do the work behind it.
- `url` (string, required): The https:// destination. It must already be registered and verified — see register_destination.

### `update_task` (~477 tokens)

Edit a task

Change the schedule, destination, method, timeout, headers or body of an existing task. Omit a field to leave it unchanged — sending null is refused, because "unchanged" and "cleared" must not look the same. State is NOT editable here: use pause_task and resume_task.

Input parameters:

- `body`: The body we send. Stored in the clear, so it must not carry credentials. A non-string is serialized as JSON.
- `cron` (string): 5 fields, UTC only, one minute at the finest. Operators: * a-b a,b */n a-b/n. Names: SUN-SAT (day), JAN-DEC (month). Macros: @yearly @annually @monthly @weekly @daily @midnight @hourly. Day-of-week i…
- `headers` (object): Headers we send with the delivery. Stored ENCRYPTED at rest — put credentials here, never in the body.
- `id` (string, required): Task id (UUID), as returned by create_task or list_tasks.
- `method` (string): HTTP method of the delivery. Default POST. GET and HEAD carry no body.
- `name` (string): Your name for the task. Unique among your live tasks; creating with an existing name updates it.
- `timeoutMs` (integer): How long we wait for your server, 250-2000 ms. Answer 202 and do the work behind it.
- `url` (string): The https:// destination. It must already be registered and verified — see register_destination.

### `pause_task` (~43 tokens)

Pause a task

Stop firing until you resume. Nothing is charged while a task is paused.

Input parameters:

- `id` (string, required): Task id (UUID), as returned by create_task or list_tasks.

### `resume_task` (~47 tokens)

Resume a paused task

Start firing again on the schedule. Refused if your balance is empty — buy deliveries first.

Input parameters:

- `id` (string, required): Task id (UUID), as returned by create_task or list_tasks.

### `run_task_now` (~81 tokens)

Fire a task once, right now

Deliver immediately, outside the schedule. THIS COSTS ONE CREDIT per attempt, exactly like a scheduled firing, and a timeout or unreachable host is retried up to three times — so one call can cost up to three credits. Use it to test a destination.

Input parameters:

- `id` (string, required): Task id (UUID), as returned by create_task or list_tasks.

### `delete_task` (~67 tokens)

Delete a task

Move the task to the recycle bin. It stops firing immediately and can be restored for 30 days with restore_task; after that it is unrecoverable. Credits already spent are not refunded.

Input parameters:

- `id` (string, required): Task id (UUID), as returned by create_task or list_tasks.

### `restore_task` (~51 tokens)

Restore a deleted task

Bring a task back from the recycle bin within 30 days. It comes back PAUSED — resume it explicitly.

Input parameters:

- `id` (string, required): Task id (UUID), as returned by create_task or list_tasks.

### `register_destination` (~275 tokens)

Register a destination URL

Claim an https:// URL you control. We answer with a challenge and a SIGNING SECRET that is shown ONCE and never again — store it before you do anything else; it is what lets you verify that a delivery really came from us. The permission covers that path and everything beneath it, nothing above. Verification is one request from us to the exact URL you registered: POST, headers X-402cron-Challenge: <value> and X-402cron-Event: verify, JSON body {"challenge":"<value>"}. Reply within 5 seconds, without a redirect, with a body that is the bare value or {"challenge":"<value>"}; we read the first 512 bytes and do not check the HTTP status (2xx is fine). Then call POST /api/destinations/{id}/verify within 15 minutes of registering. A fixed-response webhook cannot pass: you need an endpoint you can program. Registering a URL that is still pending issues a new challenge and a new signing secret every time — the old secret immediately stops verifying deliveries; a verified URL is left untouched unless you add ?rotate=1. The daily verification allowance (10 per destination, 40 per client, UTC day) does not reset on re-registration.

Input parameters:

- `url` (string, required): The https:// URL you control.

### `verify_destination` (~227 tokens)

Verify a registered destination

Verification is one request from us to the exact URL you registered: POST, headers X-402cron-Challenge: <value> and X-402cron-Event: verify, JSON body {"challenge":"<value>"}. Reply within 5 seconds, without a redirect, with a body that is the bare value or {"challenge":"<value>"}; we read the first 512 bytes and do not check the HTTP status (2xx is fine). Then call POST /api/destinations/{id}/verify within 15 minutes of registering. A fixed-response webhook cannot pass: you need an endpoint you can program. Registering a URL that is still pending issues a new challenge and a new signing secret every time — the old secret immediately stops verifying deliveries; a verified URL is left untouched unless you add ?rotate=1. The daily verification allowance (10 per destination, 40 per client, UTC day) does not reset on re-registration. Until this passes, no task may point at the destination.

Input parameters:

- `id` (integer, required): Destination id, as returned by register_destination.

### `list_destinations` (~28 tokens)

List your destinations

The URLs you have claimed and whether each is verified. The signing secrets are never shown again.

### `delete_destination` (~43 tokens)

Delete a destination

Remove a claimed URL. Refused while a task still points at it — delete the task first.

Input parameters:

- `id` (integer, required): Destination id, as returned by register_destination.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-402cron-402cron/402cron#diagnostics

## Score history

- 2026-09-28: 71
- 2026-09-27: 71
- 2026-09-26: 70
- 2026-09-25: 70
- 2026-09-24: 69
- 2026-09-23: 69
- 2026-09-22: 68
- 2026-09-21: 68
- 2026-09-20: 67
- 2026-09-19: 67
- 2026-09-18: 67
- 2026-09-17: 67
- 2026-09-16: 67
- 2026-09-15: 66
- 2026-09-14: 66
- 2026-09-13: 61
- 2026-09-12: 60
- 2026-09-11: 60
- 2026-09-10: 60

## Common questions

### What is the 402cron MCP server?

402cron is an MCP server listed in the public MCP registry as com.402cron/402cron. Paid cron for AI agents: we call your https URL on schedule, signed. No account, paid with x402. This page covers its hosted endpoint (https://402cron.com/mcp).

### Is the 402cron MCP server safe to use?

402cron scores 71 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the 402cron MCP server expose?

402cron exposes 16 tools: get_pricing, get_docs, get_service_status, list_tasks, get_task, and 11 more. Their descriptions and schemas cost roughly 2,060 tokens of context every time the server is loaded.

### Does the 402cron MCP server require authentication?

No. We connected to 402cron without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the 402cron MCP server still maintained?

402cron is still listed as active in the MCP registry. We last reached this channel on 28 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://402cron.com/mcp
- Repository: https://github.com/402cron/402cron
- Website: https://402cron.com/
- Changelog RSS feed: https://verifymcp.io/servers/com-402cron-402cron/402cron.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-402cron-402cron/402cron.json
- HTML version of this page: https://verifymcp.io/servers/com-402cron-402cron/402cron