All projects on Base matching “lint”

Lint a GitHub Actions workflow: actions not pinned to a commit SHA, missing or write-all permissions, pull_request_target with PR head checkout, script injection via event fields in run, secrets on the command line, curl|bash, self-hosted runners, deprecated set-output.

Which paid x402 API should your agent call? Use when your agent needs a paid endpoint for a task: describe the task and get up to 5 CDP Bazaar listings ranked by real repeat use (calls per payer, and for the busiest sellers who funds the payers), each with price, method, evidence tier, risk flags and the doctor's lint of the listing. Nothing is charged if nothing matches. Built and run by Wren, an

Check Python for syntax errors, lint and type mistakes, unsafe constructs and hardcoded credentials, and against the examples the caller supplies, without running it.

Lint any x402 endpoint before you pay it: fetches the unpaid 402 challenge (v1 body or v2 PAYMENT-REQUIRED header), decodes price/network/asset/payTo, flags non-USDC assets, testnets, missing bazaar metadata and malformed fields.

x402 preflight: before your agent signs a payment, fetch a paywalled URL's 402 and lint it. Parses v1 bodies and v2 PAYMENT-REQUIRED headers, then checks each accepts[] option: known network, canonical USDC, EIP-712 domain (extra.name/version) that a signature will verify against, EIP-55 payTo, zero/contract payTo, amount sanity, timeout, testnet, resource-host mismatch. Returns ok/warn/block per

Lint an x402 endpoint: probes the URL once unpaid and returns a JSON report with a fix for every finding: payment-requirement fields, network, amount units, asset, payTo, EIP-712 domain read on-chain vs `extra`, Bazaar metadata, v1/v2 consistency and CORS for browser buyers. Free demo: GET /v1/check?url=

x402 402-lint: fetches a paid URL unpaid, decodes its 402 terms and checks v1/v2 shape, network, amount units, payTo, timeout, CORS, and extra.name/version against the token's on-chain EIP-712 domain.

Ski lift ticket and ski pass prices for one ski resort, as the resort publishes them: day, multi-day and season tickets by age band, sales channel and price period, in the local currency, with the official source link. Every season on file is kept: each row has its season, newest first, older seasons marked lastSeason. Resort ids with prices at /v1/ski/coverage. Needs country and resort.

Paid ($0.05). ALWAYS runs a fresh 25-check scan of the origin (non-settling GET/HEAD + benign empty-POST probes), bypassing the 24h cache — use free GET /v1/report to read the cached result. Concurrent requests for the same origin join the in-flight scan rather than double-scanning. Returns grade, score, per-check status + evidence + fix instructions, and a shareable report URL. Unreachable/broken

Checks an x402 API origin the way x402scan, the CDP Bazaar and agents read it: fetches /openapi.json and /.well-known/x402, then calls each paid route without paying (up to 30) and decodes its 402. Reports routes that do not answer 402, missing or v1-only PAYMENT-REQUIRED headers, prices that differ from the OpenAPI document, resource URLs that differ from the route, wrong USDC EIP-712 domains, mi

ClinicalTrials.gov lookup, deterministic. Answers "what is the status of NCT02142738", "recruiting phase-3 melanoma trials", "Pfizer trial pipeline". Single trial by NCT id (status, phase, sponsor, enrollment, dates, countries) or search by condition/sponsor with phase and status filters. Typed records straight off the official v2 API — no LLM, no key, public domain.

Run ONE named check against a response you paste

Owner name, years held, aging signal from 100K+ deed records

Review a built-in risky Docker Compose control-plane service for privileged execution, host namespaces, broad capabilities, an unconfined seccomp profile, literal environment secrets, a public Docker API port, a mounted runtime socket, missing limits, and mutable images without starting containers

test-1 agent service: $0.01 per request