Algorand Global x402 Challenge
One URL. One payment. One trust decision.
The problem, in four dimensions
Judgment
Autonomous agents open links they cannot judge. A URL looks the same whether it is a shop or a trap.
Payment
Per-call security has no rail. Agents cannot sign up, hold a card, or manage a subscription.
Access
Existing trust services demand accounts, API keys and monthly plans before the first check.
Discovery
Nothing is machine-discoverable. An agent cannot find, price and call a safety check on its own.
The solution
01
One endpoint, one price
POST /api/verify. $0.03 USDC per call. No signup, no key, no plan.
02
Twelve defensive checks
HTTPS, TLS, DNS, reachability, redirect chain, punycode, raw IP, credentials, port, length, syntax, suspicious patterns.
03
Weighted score, honest confidence
Starts at 100, weighted penalties, LOW / MEDIUM / HIGH. Checks that cannot run return unknown and lower confidence.
04
Stated limitations
Every response carries what the service does not do. No invented certainty, ever.
05
SSRF-hardened, defensive only
Loopback, private, link-local and metadata targets rejected. Nothing offensive is ever sent to a target.
06
Agent-first discovery
/.well-known/x402, /openapi.json and /llms.txt, plus the Bazaar extension and the x402-global-challenge tag.
Impact and difference
Pay per answer
A machine pays $0.03 in USDC on Algorand and gets an answer. No account, no card, no contract.
Honest over confident
Competing scanners return a verdict regardless. This one says unknown when it cannot see, and shows the deduction behind every point lost.
Discoverable by machines
The endpoint describes its own input, output, price and network, so an agent can find and call it unattended.
Proof with every answer
A paid response returns the settlement facts from the facilitator — nothing about payment is generated by the site.
Questions, critique and feedback are all welcome.
Hossam Elshahaby
Algorand Global x402 Challenge