x402-surface-check 0.2.38 → 0.2.39

package/README.md

@@ -20,7 +20,7 @@ npx --yes x402-surface-check --strict-proof https://api.example.com/openapi.json
 
 ## What It Checks
 
-- Manifest endpoint discovery from `items[]`, `endpoints[]`, object-valued `endpoints`, string-valued endpoint maps, `tools` maps, `resources[]`, `x402Endpoints`, category arrays, raw resource URL strings, method-prefixed resource strings, and OpenAPI paths
+- Manifest endpoint discovery from `items[]`, `endpoints[]`, marketplace `skills[]` / `catalog.skills[]`, object-valued `endpoints`, string-valued endpoint maps, `tools` maps, `resources[]`, `x402Endpoints`, category arrays, raw resource URL strings, method-prefixed resource strings, and OpenAPI paths
 - Streamable HTTP MCP tool catalogs via safe JSON-RPC `tools/list` probes with `Accept: application/json, text/event-stream`
 - Object-valued manifest endpoint query examples, public catalog/discovery GETs, and payment-bearing two-phase operations without treating expected public catalog reads as failed payment gates
 - Linked discovery documents via `discovery_url`, `discoveryUrl`, `resources_url`, `resourcesUrl`, string `discovery` links, nested `discovery.x402_json` / OpenAPI links, or manifest-level OpenAPI links

package/bin/x402-surface-check.mjs

@@ -358,6 +358,24 @@ function manifestEndpointBody(endpoint, document) {
   return exampleValue(body, document)
 }
 
+function marketplaceSkillBody(skill) {
+  return skill?.example?.input
+    ?? skill?.exampleInput
+    ?? skill?.input?.example
+    ?? skill?.input?.safe_example
+    ?? skill?.input?.safeExample
+    ?? manifestEndpointBody(skill, {})
+}
+
+function marketplaceSkillPriceUsd(skill) {
+  const value = skill?.price?.amount
+    ?? skill?.price?.usd
+    ?? skill?.priceUsd
+    ?? skill?.price_usd
+    ?? skill?.pricePerCall
+  return numberFromDecimal(value)
+}
+
 function manifestEndpointUrl(rawPath, endpoint, baseUrl, sourceUrl) {
   const url = new URL(endpointUrl(rawPath, baseUrl, sourceUrl))
   const parameters = endpoint?.parameters
@@ -404,6 +422,29 @@ function endpointEntries(document, sourceUrl, limit) {
     }
   }
 
+  const marketplaceSkillLists = [
+    document.skills,
+    document.services,
+    document.catalog?.skills,
+    document.catalog?.services,
+  ].filter(Array.isArray)
+
+  for (const skillList of marketplaceSkillLists) {
+    for (const skill of skillList) {
+      if (!skill || typeof skill !== 'object') continue
+      const rawPath = skill.endpoint ?? skill.url ?? skill.path
+      if (!rawPath) continue
+      if (redactedCredentialUrl(rawPath)) continue
+      entries.push({
+        name: skill.slug ?? skill.id ?? skill.name ?? String(rawPath).split('/').filter(Boolean).at(-1) ?? String(rawPath),
+        url: endpointUrl(rawPath, baseUrl, sourceUrl),
+        method: String(skill.method ?? 'POST').toUpperCase(),
+        expectedPriceUsd: marketplaceSkillPriceUsd(skill),
+        requestBody: marketplaceSkillBody(skill),
+      })
+    }
+  }
+
   if (Array.isArray(document.endpoints)) {
     for (const endpoint of document.endpoints) {
       const rawPath = endpoint?.url ?? endpoint?.endpoint ?? endpoint?.path

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "x402-surface-check",
-  "version": "0.2.38",
+  "version": "0.2.39",
   "description": "No-payment x402 public-surface checker for manifests, OpenAPI specs, and HTTP 402 challenges.",
   "type": "module",
   "bin": {