# SCRIPTMASTERLABS — x402 Gateway (remote · mcp-x402.onrender.com)

OMNIGATE facilitator: settled 14 fleet services end-to-end 2026-11-02 (SELF-PROOF). Receipts public.

- Trust score: 67/100 (medium)
- Change this week: +4
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

> **Recent critical change**: Authorization (2026-10-29). See the changelog below before you install this server.

## Components

- remote · `mcp-x402.onrender.com`: 67/100 (this document), [markdown](https://verifymcp.io/servers/com-scriptmasterlabs-x402-gateway/mcp-x402.md), [page](https://verifymcp.io/servers/com-scriptmasterlabs-x402-gateway/mcp-x402)

## Channel facts

- Endpoint: `https://mcp-x402.onrender.com/mcp?registry=scriptmasterlabs`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.6.2`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 57/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (interfere).
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 58/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2563 tokens (~256/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 40/100
  - Stability observed for 12 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 10 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the SCRIPTMASTERLABS — x402 Gateway MCP server?

SCRIPTMASTERLABS — x402 Gateway is a hosted endpoint at https://mcp-x402.onrender.com/mcp?registry=scriptmasterlabs, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http com-scriptmasterlabs-x402-gateway 'https://mcp-x402.onrender.com/mcp?registry=scriptmasterlabs'
```

### Cursor

```json
{
  "mcpServers": {
    "com-scriptmasterlabs-x402-gateway": {
      "url": "https://mcp-x402.onrender.com/mcp?registry=scriptmasterlabs"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "com-scriptmasterlabs-x402-gateway": {
      "type": "http",
      "url": "https://mcp-x402.onrender.com/mcp?registry=scriptmasterlabs"
    }
  }
}
```

### Codex

```toml
[mcp_servers.com-scriptmasterlabs-x402-gateway]
url = "https://mcp-x402.onrender.com/mcp?registry=scriptmasterlabs"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-scriptmasterlabs-x402-gateway": {
      "type": "remote",
      "url": "https://mcp-x402.onrender.com/mcp?registry=scriptmasterlabs",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-scriptmasterlabs-x402-gateway --url 'https://mcp-x402.onrender.com/mcp?registry=scriptmasterlabs' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-scriptmasterlabs-x402-gateway:
    url: "https://mcp-x402.onrender.com/mcp?registry=scriptmasterlabs"
```

### Netclaw

```json
{
  "McpServers": {
    "com-scriptmasterlabs-x402-gateway": {
      "Transport": "http",
      "Url": "https://mcp-x402.onrender.com/mcp?registry=scriptmasterlabs"
    }
  }
}
```

### Vellum

```bash
assistant mcp add com-scriptmasterlabs-x402-gateway -t streamable-http -u 'https://mcp-x402.onrender.com/mcp?registry=scriptmasterlabs'
```

### Other

```json
{
  "mcpServers": {
    "com-scriptmasterlabs-x402-gateway": {
      "type": "http",
      "url": "https://mcp-x402.onrender.com/mcp?registry=scriptmasterlabs"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 67, 0)

- [security] Tool “precross_analyze” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 231 → 256
- [functional regression] Schema quality: 2082 → 2466
- [functional] New tool “precross_analyze”
- [cosmetic] “precross_analyze” reworded the description of “timeframe”

### 2026-11-04 (score 67, +1)

No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-02 (score 66, +1)

No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-31 (score 65, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-30 (score 64, +1)

- [security] New tool “omnigate_runtime_execute”, which the server declares destructive
- [functional regression] Schema quality: 1401 → 2082
- [functional] Destructive annotations: pass → 100
- [functional] New tool “omnigate_runtime_receipt”
- [functional] New tool “omnigate_runtime_search”

### 2026-10-29 (score 63, 0)

- [critical regression] Authorization: unverified → fail
- [security] Tool “spend_gate_check” rewrote its description, which is the text the model reads
- [security] Tool “leviathan_interfere” is now declared destructive
- [security] Tool “interfere” is now declared destructive
- [security] Tool “spend_gate_check” is now declared destructive

### 2026-10-27 (score 63, 0)

- [functional regression] Schema quality: 159 → 227
- [functional] New tool “spend_gate_check”

### 2026-10-26 (score 63, −7)

- [security regression] Authorization: partial → unverified
- [security] Tool “interfere” rewrote its description, which is the text the model reads
- [security] Tool “leviathan_interfere” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 29 → 95
- [functional regression] Tool coverage: 100% → 60%
- [functional regression] Schema quality: pass → fail
- [functional] New tool “leviathan_interfere”
- [functional] New tool “interfere”
- [cosmetic] “leviathan_interfere” reworded the description of “signal_type”
- [cosmetic] “leviathan_interfere” reworded the description of “ticker”

## MCP tools (10)

### `sml_discover` (~25 tokens)

Find the x402 Gateway contract and where to inspect fresh payment requirements. FREE.

### `sml_status` (~22 tokens)

Check the public x402 Gateway identity and canonical payment rail. FREE.

### `x402_contract` (~40 tokens)

Inspect the canonical x402 payment contract. Returns network, USDC asset, payTo, headers, and the rule for resolving fresh target requirements. FREE.

### `interfere` (~369 tokens)

Coherent Gate (PAID, x402/USDC). Scores whether your trading-signal paths agree: confidence-weighted long/short/flat consensus, coherence 0-1, and a pass/block gate (pass needs a non-flat consensus and coherence at or above the threshold, default 0.6). Tiers by path count: scout ≤4 $0.01, standard ≤8 $0.05, beast ≤32 $0.25 (defaults). The $0.25 max tier is charged upfront; on the x402 rail the unused difference is recorded as owed (not yet auto-refunded); on the Arc escrow rail (arc_auth_id) only the used tier is captured. Optional ticker pulls extra paths from registered sources before charging. Max 32 paths. Not financial advice.

Input parameters:

- `arc_auth_id` (string): Arc rail: authId from AuthCaptureEscrow.authorize() for at least the max-tier amount to our receiver. Only the used tier is captured; the rest returns via reclaim() after expiry.
- `paths` (array): Coherent Gate: AI trading signal paths to check for coherence. Priced tiers: scout ≤4, standard ≤8, beast ≤32 (defaults); >32 hard-rejected.
- `payment_header` (string): Base64 X-PAYMENT EIP-3009 payload (standard rail).
- `payment_tx_hash` (string): Base USDC tx hash (sovereign rail).
- `sources` (array): Optional path-source ids; default = all enabled verified sources. Requires ticker.
- `ticker` (string): Optional: pull extra paths for this ticker from registered path sources (see docs/COHERENT_GATE_PATH_SOURCES.md).
- `wallet_address` (string): Agent wallet address (informational).

### `leviathan_interfere` (~341 tokens)

Coherent Gate + Leviathan (PAID, x402/USDC). Fetches the SML Leviathan signal (squeeze, momentum, or all) for a ticker, adds it as one path with your optional paths and registered sources, then runs the same coherence check as interfere: consensus, coherence 0-1, pass/block gate. Same tiers and billing as interfere ($0.25 max tier charged upfront; x402 difference recorded as owed, Arc rail captures only the used tier). If Leviathan is unavailable it continues on the other paths; with no paths it errors before charging. Max 32 paths. Not financial advice.

Input parameters:

- `arc_auth_id` (string): Arc rail: authId from AuthCaptureEscrow.authorize() for at least the max-tier amount to our receiver. Only the used tier is captured; the rest returns via reclaim() after expiry.
- `paths` (array): Coherent Gate: extra signal paths (Leviathan adds one; total ≤ 32).
- `payment_header` (string): Base64 X-PAYMENT EIP-3009 payload (standard rail).
- `payment_tx_hash` (string): Base USDC tx hash (sovereign rail).
- `signal_type` (string, required): Which Leviathan signal to fetch and add as a path: squeeze, momentum, or all.
- `sources` (array): Optional path-source ids added alongside Leviathan; default = all enabled verified sources.
- `ticker` (string, required): Ticker symbol, 1-10 uppercase letters (e.g. AAPL).
- `wallet_address` (string): Agent wallet address (informational).

### `spend_gate_check` (~604 tokens)

Spend Gate (PAID $0.005 USDC on Base via x402). Advisory payment assessment — no wallet signing or spending by the buyer: a real Provider Trust approval and price cap are mandatory; explicit package/history rejections block. Four distinct decision inputs vote pay-side/reject-side — provider_trust (Provider Trust verify_provider) and payload_safety (ScriptDocs vulnerability check, only when manifest_url names an npm/PyPI/crates package) — both vote with real verdicts via the fleet operator lane at $0 upstream toll, price_sanity (quote vs caller policy_cap_usdc or the v1 default cap table; cap-only in v1, no historical median), delivery_history (this host's OmniGate settlement/delivery ledger). Coherence = |Σ w·d| / Σ w with d=+1 pay-side, −1 reject-side, w=confidence; gate_pass requires a positive Provider Trust decision, a real within-cap quote, no explicit safety or delivery-history rejection, coherence ≥ 0.6, and a pay-side consensus. The verdict is advisory, not payment authorization. Paths with no data abstain (no_signal) and contribute nothing. Only on a gate pass does Jev review run (noul act probability + pay/reject/quarantine choice, model + token usage returned). Use for: vetting a payee/invoice immediately before an agent wallet pays it. Don't use when: you need an actual payment executed (this is a check, it moves no funds), a trading signal (use interfere), or a free lookup (there is none — unpaid calls return the payment challenge). Settlement to the canonical SML payTo on Base.

Input parameters:

- `manifest_url` (string): Optional package page URL (npmjs.com/package/…, pypi.org/project/…, crates.io/crates/…) for the payload_safety path.
- `payee` (string, required): Payee domain (e.g. "api.example.com") and/or full endpoint URL the wallet is about to pay.
- `payment_header` (string): Base64 X-PAYMENT EIP-3009 payload (standard rail) for $0.005 USDC on Base.
- `payment_tx_hash` (string): Base USDC tx hash (sovereign rail) paying $0.005 to the canonical SML receiver.
- `policy_cap_usdc` (number): Optional caller policy cap in USDC; overrides the v1 default cap table for price_sanity.
- `quoted_amount` (number, required): Quoted amount in USDC the wallet is about to pay.
- `tool_category` (string): Optional category of the tool/service being bought (e.g. data_lookup, market_data, inference, compute). Selects the v1 default cap when policy_cap_usdc is omitted; when omitted entirely the cap table…
- `wallet_address` (string): Agent wallet address (informational).

### `precross_analyze` (~481 tokens)

SML PRECROSS (PAID $0.02 USDC on Base via x402). 11/64 EMA cross intelligence for US stocks and ETFs on 1H or 4H (regular session) or 1D bars — derived analysis, not raw bars. Returns the exact price at which the 11 and 64 EMA cross on the next bar (closed-form, plus a zero-lag variant), the move needed to reach it in % and ATR, whether the EMAs are converging and an estimated bars-to-cross, and a walk-forward self-backtest of anticipating that cross (in-sample config selection, out-of-sample verdict, costs both sides, confirmed-cross baseline for comparison) with a six-check proof gate per side; on 1H/4H the grid also tests a "daily agrees" filter (daily 11/64 trend, no lookahead). Also returns a 75-ticker basket proof (pooled out-of-sample trades across US stocks and funds incl. gold, silver, Bitcoin and Ethereum funds, with breadth check and standout ranking) and a plain-English summary. A long/short setup is returned ONLY for a side whose out-of-sample results pass the gate (this ticker's own gate, or the basket gate when the ticker is in the basket); otherwise the direction is withheld and the reason is given. Use for: knowing where an 11/64 EMA cross will trigger before it prints, and whether anticipating it has actually worked on this ticker and timeframe. Don't use when: you need raw OHLC bars, timeframes below 1H, spot crypto, or order execution (this tool places no orders). Research output, not financial advice.

Input parameters:

- `payment_header` (string): Base64 X-PAYMENT EIP-3009 payload (standard rail) for $0.02 USDC on Base.
- `payment_tx_hash` (string): Base USDC tx hash (sovereign rail) paying $0.02 to the canonical SML receiver.
- `symbol` (string, required): US stock/ETF ticker, e.g. AMC, GME, SPY.
- `timeframe` (string): 1h or 4h (regular-session bars) or 1d.
- `wallet_address` (string): Agent wallet address (informational).

### `omnigate_runtime_search` (~123 tokens)

OMNIGATE Runtime catalog search (FREE). Finds SML paid routes a runtime script can call with sml.call(id, {query|path|body}), with live per-call USDC prices, plus published capsules (ready-made scripts). Use this before omnigate_runtime_execute to pick route ids. Prices are the live upstream registry amounts; nothing here spends.

Input parameters:

- `limit` (integer): Max routes to return.
- `query` (string): Keywords, e.g. "short squeeze", "sec filings", "web extract". Empty lists everything (capped).

### `omnigate_runtime_execute` (~452 tokens)

OMNIGATE Runtime (PAID, USDC). Run ONE JavaScript script that calls many SML tools, in one round trip, instead of one model turn per tool call. The script is the body of an async function: `const r = await sml.call("<route-id>", { query: {...} }); return r.data;`. Available inside: sml.call, sml.tools.search, sml.tools.get, sml.budget, sml.sleep, sml.log, sml.input. Every call is metered at its live registry price against budget_usdc, charged only on upstream 2xx, and tagged with source + response sha256; a failed upstream throws TruthError (nothing charged, nothing substituted). Unused budget is returned as credit. Returns result, per-call provenance, billing and an Ed25519-signed receipt id. Without payment it returns the x402 challenge (amount = budget). Pay with payment_header (Base USDC, x402 v2), credit_token (smlrt_…), or arc_auth_id (Arc escrow, when enabled). Sandbox: no network except sml.call, no fs, 32MB, 20s CPU, 120s wall (sync).

Input parameters:

- `arc_auth_id` (string): Arc AuthCaptureEscrow authorization id (maxAmount ≥ budget, expiry ≤ 24h).
- `budget_usdc` (string): Hard spending cap for the whole run in USDC (min 0.01, max 25).
- `capsule_id` (string): Run a published capsule instead of a script (e.g. cap_name@1 or cap_name@latest).
- `credit_token` (string): Runtime credit token (smlrt_…) returned by an earlier run.
- `input` (object): JSON object exposed to the script as sml.input.
- `mode` (string): sync waits for the result (120s wall); async returns run_id to poll /runtime/runs/{id}.
- `payment_header` (string): Base64 x402 v2 payment payload for exactly budget_usdc USDC on Base (from the challenge).
- `script` (string): JavaScript async-function body. Use await; return the final result.

### `omnigate_runtime_receipt` (~106 tokens)

OMNIGATE Runtime receipt (FREE). Returns a run receipt — script sha256, payer, rail, payment tx, every upstream call with request/response hashes and charges, outcome — signed with Ed25519 and hash-chained to the previous receipt, plus a verification of signature, body hash and chain link. Use it to prove what an agent ran and paid for.

Input parameters:

- `receipt_id` (string, required): Receipt id from a runtime run (rcpt_…).

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-scriptmasterlabs-x402-gateway/mcp-x402#diagnostics

## Score history

- 2026-11-05: 67
- 2026-11-04: 67
- 2026-11-03: 66
- 2026-11-02: 66
- 2026-11-01: 65
- 2026-10-31: 65
- 2026-10-30: 64
- 2026-10-29: 63
- 2026-10-28: 63
- 2026-10-27: 63
- 2026-10-26: 63
- 2026-10-25: 70
- 2026-10-24: 70
- 2026-09-05: 57
- 2026-09-04: 57
- 2026-09-03: 56
- 2026-09-02: 56

## Common questions

### What is the SCRIPTMASTERLABS — x402 Gateway MCP server?

SCRIPTMASTERLABS — x402 Gateway is an MCP server listed in the public MCP registry as com.scriptmasterlabs/x402-gateway. OMNIGATE facilitator: settled 14 fleet services end-to-end 2026-11-02 (SELF-PROOF). Receipts public. This page covers its hosted endpoint (https://mcp-x402.onrender.com/mcp?registry=scriptmasterlabs).

### Is the SCRIPTMASTERLABS — x402 Gateway MCP server safe to use?

SCRIPTMASTERLABS — x402 Gateway scores 67 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the SCRIPTMASTERLABS — x402 Gateway MCP server expose?

SCRIPTMASTERLABS — x402 Gateway exposes 10 tools: sml_discover, sml_status, x402_contract, interfere, leviathan_interfere, and 5 more. Their descriptions and schemas cost roughly 2,563 tokens of context every time the server is loaded.

### Does the SCRIPTMASTERLABS — x402 Gateway MCP server require authentication?

No. We connected to SCRIPTMASTERLABS — x402 Gateway without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the SCRIPTMASTERLABS — x402 Gateway MCP server still maintained?

SCRIPTMASTERLABS — x402 Gateway is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://mcp-x402.onrender.com/mcp?registry=scriptmasterlabs
- Repository: https://gitlab.com/timothy.walton45/sml-portfolio
- Website: https://scriptmasterlabs.com/
- Changelog RSS feed: https://verifymcp.io/servers/com-scriptmasterlabs-x402-gateway/mcp-x402.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-scriptmasterlabs-x402-gateway/mcp-x402.json
- HTML version of this page: https://verifymcp.io/servers/com-scriptmasterlabs-x402-gateway/mcp-x402