# autonomous-audit

> Paid x402 v2 API: static security audit of one Solidity contract. USDC on Base. No account, no API key.

Origin: https://audit-402.agras-recovery.workers.dev
payTo: 0x9a033397ffD48BB186C2a7b77aB550B26ee90c35
network: eip155:8453 (Base mainnet)
asset: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 (USDC, 6 decimals)
facilitator: https://facilitator.payai.network

## Paid endpoints (POST, application/json, body: {"source": "<solidity>"})
- /api/audit/surface — $1.00 — Static surface scan of one Solidity contract: exposed state-changing functions, access-control modifiers, external calls, upgradeability, and a machine-readable risk list. Returns JSON.
- /api/audit/full — $3.00 — Full automated audit of one Solidity contract: surface scan plus reentrancy / access-control / arithmetic / oracle patterns, severity ranking, and a patch suggestion per finding. Returns JSON.

## Discovery
- https://audit-402.agras-recovery.workers.dev/openapi.json — OpenAPI 3.1 with x-payment-info
- https://audit-402.agras-recovery.workers.dev/.well-known/x402 — x402 discovery document (version 1)
- https://audit-402.agras-recovery.workers.dev/.well-known/x402.json — full provider manifest
- https://audit-402.agras-recovery.workers.dev/.well-known/agent-card.json — A2A agent card
- https://audit-402.agras-recovery.workers.dev/mcp — MCP streamable HTTP endpoint (tools: audit_surface, audit_full)

## Payment
Any request without a PAYMENT-SIGNATURE returns HTTP 402 with the x402 v2 challenge in the PAYMENT-REQUIRED header.
Settle through the public PayAI facilitator: POST /verify then POST /settle with {x402Version, paymentPayload, paymentRequirements}.