{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-06T03:14:54.251Z","url":"https://verifymcp.io/servers/org-celo-x402-facilitator/api","markdownUrl":"https://verifymcp.io/servers/org-celo-x402-facilitator/api.md","server":{"slug":"org-celo-x402-facilitator","name":"Celo x402 Facilitator","registryName":"org.celo/x402-facilitator","description":"Check supported assets and verify x402 payments on Celo","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"api","type":"remote","identifier":"https://api.x402.celo.org/mcp","withdrawn":false,"url":"https://verifymcp.io/servers/org-celo-x402-facilitator/api","version":"1.0.0","transport":null,"scoredAt":"2026-11-05T07:30:16.927Z"},"score":{"total":77,"tier":"medium","status":"scored","weekDelta":3,"history":[{"date":"2026-11-05","total":77},{"date":"2026-11-04","total":77},{"date":"2026-11-03","total":76},{"date":"2026-11-02","total":76},{"date":"2026-11-01","total":75},{"date":"2026-10-31","total":75},{"date":"2026-10-30","total":74},{"date":"2026-10-29","total":74},{"date":"2026-10-28","total":73},{"date":"2026-10-27","total":73}]},"categories":[{"name":"Endpoint Security","score":80,"verdict":"fail","reasons":["The endpoint's TLS certificate is valid, in date, and uses a strong key.","No authorisation is required to call this server. Nothing on it is marked destructive, but we can't show that an anonymous caller can only read: full credit needs the server to list at least one tool and every tool to be verifiably read-only. We use a best-effort check of tool names and descriptions to tell read-only tools from tools that change things, so some genuinely read-only tools may not get full credit. Names that start with a read verb (get, list, read, search and similar) and accurate readOnlyHint annotations help. Meet that to earn full credit, or require authorisation.","HTTPS is enforced; there's no plaintext access path.","The HSTS (Strict-Transport-Security) header is present.","DNSSEC check failed: this domain isn't protected by DNSSEC."],"codes":[{"code":"tls.valid","args":{}},{"code":"auth.none_no_destructive","args":{}},{"code":"https.enforced","args":{}},{"code":"headers.hsts_present","args":{}},{"code":"dnssec.absent","args":{}}]},{"name":"Transport & Reachability","score":100,"verdict":"pass","reasons":["Verified streamable-http transport via a live MCP handshake."],"codes":[{"code":"transport.verified","args":{"transport":"streamable-http"}}]},{"name":"Schema Quality & AI Usability","score":71,"verdict":"fail","reasons":["AI-judged instruction clarity (good).","Tool/resource definitions use about 560 tokens (~112/item across 5 items; 5 tools + 0 resources), lean.","Usage-examples check failed: none of the tools include examples."],"codes":[{"code":"schema.ai_quality","args":{"band":"good"}},{"code":"schema.footprint_lean","args":{"avg":"112","items":"5","tools":"5","tokens":"560","resources":"0"}},{"code":"schema.examples_absent","args":{}}]},{"name":"Stability & Change Management","score":30,"verdict":"partial","reasons":["Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses."],"codes":[{"code":"stability.building_history","args":{"days":"9"}}]},{"name":"Tool Coverage","score":100,"verdict":"pass","reasons":["100% of tools have a non-trivial description (not blank, and not just the tool's name).","100% of tool parameters carry a description."],"codes":[{"code":"toolquality.descriptions","args":{"pct":"100"}},{"code":"toolquality.param_docs","args":{"pct":"100"}}]},{"name":"Tool Safety","score":100,"verdict":"pass","reasons":["No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.","We read all 5 captured tool definition(s), and no name or description among them implies an irreversible operation.","An AI judge read all 6 captured unit(s) of tool text and found none that tries to manipulate the model reading it."],"codes":[{"code":"toolsafety.injection_clean","args":{}},{"code":"toolsafety.destructive_none","args":{"tools":"5"}},{"code":"toolsafety.manipulation_clean","args":{"units":"6","judged":"6"}}]},{"name":"Capabilities","score":100,"verdict":"pass","reasons":["Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28."],"codes":[{"code":"protocol.supported","args":{"latest":"2026-07-28","version":"2025-11-25"}}]}],"inconclusive":[],"malware":[],"components":[{"slug":"api","type":"remote","identifier":"https://api.x402.celo.org/mcp","withdrawn":false,"score":77,"current":true,"url":"https://verifymcp.io/servers/org-celo-x402-facilitator/api","markdownUrl":"https://verifymcp.io/servers/org-celo-x402-facilitator/api.md"}],"facts":[{"label":"Endpoint","value":"https://api.x402.celo.org/mcp"},{"label":"Transports","value":"streamable-http"},{"label":"Auth","value":"none"},{"label":"Version","value":"1.0.0"}],"install":{"available":true,"bundleSha256":null},"tools":[{"name":"get_supported","title":"Supported payment kinds","description":"The (x402Version, scheme, network) kinds and extensions this facilitator verifies and settles. Same answer as GET /supported.","inputs":[],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":34},{"name":"get_config","title":"Assets, fee and free credits","description":"Every settleable asset with its address, decimals, transfer method and EIP-712 domain values, plus the pricing model (gas at cost, plus a fee in basis points on the payment value when the asset has a USD price), the gas fallback and the free-credit allowances. Same answer as GET /api/config.","inputs":[],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":72},{"name":"get_health","title":"Facilitator health","description":"Whether the facilitator behind this host is answering. Same answer as GET /health.","inputs":[],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":24},{"name":"verify_payment","title":"Verify an x402 payment","description":"Check a signed x402 payment against its requirements: signature, amount, balance and simulation. Moves no funds. Same answer as POST /verify, and it spends the same per-IP allowance.","inputs":[{"name":"paymentPayload","type":"object","required":true,"description":"The PaymentPayload the buyer signed."},{"name":"paymentRequirements","type":"object","required":true,"description":"The PaymentRequirements the resource server stated."},{"name":"x402Version","type":"integer","required":false,"description":"x402 protocol version of the payload, e.g. 2."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":97},{"name":"payment_status","title":"Has an authorization been used?","description":"Whether a signed payment authorization has been used on chain, for a client whose settle reply was lost. Answers unspent, consumed or expired from the chain (EIP-3009 authorizationState, or the Permit2 nonce bitmap). unspent is not final: the authorization can still be used until validBefore, and a settlement already in flight reads as unspent here. Only consumed and expired are final; expired is only reported 5 s after validBefore, so a payment still in flight is not called final. The settled and pending states need the owning API key and are only served over HTTP. Same answer as GET /settle/status, and it spends the same per-IP allowance.","inputs":[{"name":"asset","type":"string","required":true,"description":"Token address the payment was signed for."},{"name":"nonce","type":"string","required":true,"description":"EIP-3009: the 32-byte hex nonce. Permit2: the nonce as a decimal or 0x-hex uint256."},{"name":"payer","type":"string","required":true,"description":"Address that signed the authorization."},{"name":"validBefore","type":"integer","required":false,"description":"Optional. The authorization's validBefore (Permit2: deadline), in unix seconds, so an unused one more than 5 s past it reads as expired."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":247}],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-05T07:30:16.000Z","track":"remote","endpoint":"https://api.x402.celo.org/mcp","declaredUrl":null,"truncated":false,"tls":{"outcome":"valid","label":"Valid","version":"TLS 1.3","cipherSuite":"TLS_AES_128_GCM_SHA256","chainError":null,"certificates":[{"subject":"CN=api.x402.celo.org","issuer":"CN=YE2,O=Let's Encrypt,C=US","notBefore":"2026-11-03T06:43:16Z","notAfter":"2027-02-01T06:43:15Z","keyType":"ECDSA","keyBits":256,"isCa":false},{"subject":"CN=YE2,O=Let's Encrypt,C=US","issuer":"CN=Root YE,O=ISRG,C=US","notBefore":"2025-09-03T00:00:00Z","notAfter":"2028-09-02T23:59:59Z","keyType":"ECDSA","keyBits":384,"isCa":true},{"subject":"CN=Root YE,O=ISRG,C=US","issuer":"CN=ISRG Root X2,O=Internet Security Research Group,C=US","notBefore":"2026-05-13T00:00:00Z","notAfter":"2032-09-02T23:59:59Z","keyType":"ECDSA","keyBits":384,"isCa":true},{"subject":"CN=ISRG Root X2,O=Internet Security Research Group,C=US","issuer":"CN=ISRG Root X1,O=Internet Security Research Group,C=US","notBefore":"2026-05-13T00:00:00Z","notAfter":"2032-09-02T23:59:59Z","keyType":"ECDSA","keyBits":384,"isCa":true}]},"dnssec":{"result":"insecure","label":"Not signed","name":"api.x402.celo.org.","steps":[{"zone":".","outcome":"verified","label":"Verified"},{"zone":"org.","outcome":"verified","label":"Verified"},{"zone":"celo.org.","outcome":"insecure_proven","label":"Unsigned (proven)"}]},"auth":{"outcome":"none","label":"No authorisation required","gate":null,"gateLabel":null,"status":200,"authorizationServers":[]},"httpsRedirect":{"outcome":"https_enforced","label":"HTTPS enforced","status":308},"transports":[{"transport":"streamable-http","outcome":"verified","label":"Verified","status":200,"followed":false}],"provenance":null,"installScripts":[],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":null},"mismatches":[],"changelog":{"trackingSince":"2026-10-27","recent":[{"id":"chg_01a1a576-5de5-74e2-9278-a5f42d9db995","kind":"score.total_changed","summary":"Trust score (76 → 77)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/org-celo-x402-facilitator/api#chg-chg_01a1a576-5de5-74e2-9278-a5f42d9db995"},{"id":"chg_01a19b2a-0904-7721-83b7-b2f8ee27bed8","kind":"score.total_changed","summary":"Trust score (75 → 76)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/org-celo-x402-facilitator/api#chg-chg_01a19b2a-0904-7721-83b7-b2f8ee27bed8"},{"id":"chg_01a190dc-de48-72e4-85a6-6ee617b04169","kind":"score.total_changed","summary":"Trust score (74 → 75)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-31","url":"https://verifymcp.io/servers/org-celo-x402-facilitator/api#chg-chg_01a190dc-de48-72e4-85a6-6ee617b04169"},{"id":"chg_01a18692-2dfe-70e2-8ccb-e567c9175cba","kind":"score.total_changed","summary":"Trust score (73 → 74)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-29","url":"https://verifymcp.io/servers/org-celo-x402-facilitator/api#chg-chg_01a18692-2dfe-70e2-8ccb-e567c9175cba"},{"id":"chg_01a18168-88c3-76b1-b162-774cbcf41def","kind":"check.reverified","summary":"Stability (unverified → 0.03)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/org-celo-x402-facilitator/api#chg-chg_01a18168-88c3-76b1-b162-774cbcf41def"},{"id":"chg_01a17f61-0c66-74bc-b734-1835f2a5782e","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-27","url":"https://verifymcp.io/servers/org-celo-x402-facilitator/api#chg-chg_01a17f61-0c66-74bc-b734-1835f2a5782e"}],"truncated":false,"feedUrl":"https://verifymcp.io/servers/org-celo-x402-facilitator/api/changelog.json"},"links":{"html":"https://verifymcp.io/servers/org-celo-x402-facilitator/api","markdown":"https://verifymcp.io/servers/org-celo-x402-facilitator/api.md","changelogJson":"https://verifymcp.io/servers/org-celo-x402-facilitator/api/changelog.json","changelogRss":"https://verifymcp.io/servers/org-celo-x402-facilitator/api.xml","external":[{"label":"Remote endpoint","href":"https://api.x402.celo.org/mcp"}]}}