Warns
Test your agents

The scanner

The scanner checks a paid API before an agent pays it. Paste a URL: Warns asks for it the way an agent would, reads the x402 payment request it gets back, and runs the same checks it runs before a real payment. Nothing is paid and nothing is signed.

What it checks

  • The payment request itself: that it can be read, that the token is the real USDC, that the receiving address can actually receive it, and that the authorization does not stay valid longer than it should.
  • The merchant: how old the domain is, and whether the endpoint is listed in the public x402 catalog.
  • The receiving address: whether it is a plain wallet, a contract or a wallet that delegates its code, when it first received USDC, and whether security databases list it as malicious.
  • What the network knows: whether other Warns customers pay this merchant at a different address.

The result is a verdict (no red flag, be careful, high risk), the findings behind it, and the facts Warns found. A scan only knows the endpoint: what your own agents paid before, their budgets and your policies are judged by Warns on each payment, not by the scanner.

What it never does

  • It never pays and never signs anything.
  • It never reaches private addresses: local networks, internal services and cloud metadata are refused.
  • It does not keep who scanned. No IP address and no account are stored. The URL is stored without its query string, which can carry keys.

Sharing a result

Each scan has its own link, warns.xyz/scan/ followed by an identifier, that anyone can open. Shared results are not indexed by search engines. The same URL scanned again within five minutes gives the same result, without asking the merchant twice.

Limits

Five scans per ten minutes per visitor, and a limit per scanned site, so nobody can use the scanner to flood a server. Scanning only covers x402 version 2 offers on Base and Base Sepolia today.

For site owners

The scanner identifies itself with this user agent:

text
WarnsScanner/1.0 (+https://warns.xyz/docs/scanner)

It sends one request per scan, follows at most a few redirects, and reads a limited amount of the response. To report a problem or ask us to stop scanning a site, write to hello@warns.xyz.