{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-30", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "tool": { "slug": "402cron", "name": "402cron", "vendor": "Georgi Kalchev", "vendorUrl": "https://402cron.com", "kind": "http-api", "category": "webhooks", "summary": "402cron is a hosted cron service that calls an agent's HTTPS endpoint on schedule with a signed request and bills one prepaid delivery per attempt. Agents pay by x402 in USDC on Base and manage tasks over REST or MCP.", "url": "https://www.anchorterminal.com/tools/402cron", "markdownUrl": "https://www.anchorterminal.com/tools/402cron.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/402cron.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/402cron.json", "repo": "https://github.com/402cron/402cron", "license": "Proprietary hosted service under 402cron's terms of service, effective 23 October 2026. The server's source isn't published. The docs and examples repository is MIT", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://402cron.com", "packages": [], "auth": "mixed", "authNotes": "No account, password or card. `GET /buy/{pack}` answers 402 with x402 payment requirements; a paid repeat answers 200 with a management token, shown once and tied to the wallet that paid. Every `/api/` call sends it as `Authorization: Bearer \u003ctoken\u003e`. One token per wallet, no scopes and no read-only token. Rotation is another purchase from the same wallet with `?rotate=1` (the $0.02 trial pack is the cheapest), which kills the old token at once. `/api/pricing`, `/health`, `/docs` and the MCP tools `get_pricing`, `get_docs` and `get_service_status` need no token.", "pricing": "usage", "pricingNotes": "Prepaid packs paid by x402 in USDC on Base, counted in delivery attempts that never expire. Trial 20 attempts for $0.02 ($0.001 each), starter 2,000 for $1 and month 50,000 for $25 ($0.0005 each), per https://402cron.com/api/pricing on 30 October 2026. Every attempt is charged, whether the endpoint answered 2xx, 4xx or 5xx, timed out or was unreachable. 402cron's own failures and skipped overlapping runs aren't charged, and a failing cycle costs at most 3 attempts. The trial isn't free, and no card is involved (checked 2026-10-30).", "priceSummary": "$0.02 / call", "where": "hosted", "x402": { "level": "yes", "evidence": "x402 v2 (v1 with `?x402Version=1`) on the three pack URLs, USDC on Base (eip155:8453), settled through the Coinbase CDP facilitator per the privacy policy, with the requirements in the PAYMENT-REQUIRED header and the body. Documented in the OpenAPI file, /docs, llms.txt and /.well-known/x402, which lists the trial and starter URLs. Read on 2026-10-30; we didn't request the 402 challenge, by the batch's rules.", "endpoints": [ { "url": "https://402cron.com/buy/trial", "priceUsd": 0.02, "network": "eip155:8453" }, { "url": "https://402cron.com/buy/starter", "priceUsd": 1, "network": "eip155:8453" }, { "url": "https://402cron.com/buy/month", "priceUsd": 25, "network": "eip155:8453" } ] }, "toolCount": 16, "popularity": { "githubStars": 0, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-30" }, "docsUrl": "https://402cron.com/docs", "llmsTxt": "https://402cron.com/llms.txt", "openapi": "https://402cron.com/openapi.json", "registryName": "com.402cron/402cron", "capabilities": [ "events.schedule", "events.webhooks-send" ], "tags": [ "hosted", "closed-source", "openapi", "llms-txt", "mcp", "x402", "prepaid", "usage-priced", "no-card", "webhooks", "new" ], "lastRelease": "2026-10-09", "graded": true, "anchor": { "graded": true, "score": 63.5, "grade": "B", "agentReady": false, "rank": 452, "ranked": true, "rankOf": 1226, "categoryRank": 9, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 76, "maintenance": 62, "payments": 86, "reliability": 45, "schema": 81, "security": 41, "transparency": 64 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 45, "points": 9, "reason": "Graded as a hosted API. No status page. `GET /health` answers 200 or 503 with the live state (sweep age, the hourly settlement budget, a kill switch, whether the service is selling) and keeps no history, and /status answers 404 (0, and 5 of 30 for the incident record, since no history can be read). Rate limits are published as numbers, 16 payment attempts an hour per caller, 60 settlements an hour service-wide, 10 verifications a day per destination and 40 per client, 50 live tasks and 25 destinations (15). Hourly limits answer 429 with a `retry-after` header and `retryAfterSeconds`, daily ones with `retryTomorrow`, every refusal carries a `retryable` flag where it matters, a replayed settled payment returns the receipt instead of charging again, and the delivery id is stable across attempts for the receiver (15). No SLA; the terms promise only that a request was attempted and cap liability at the credits in question (0). Live and selling, with no beta label, though the earliest public date is 10 September 2026 (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.", "checked": "2026-10-30" }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 81, "points": 13.16, "reason": "A public OpenAPI 3.1 file with 16 paths and 20 operations, one bearer security scheme and schemas for the purchase receipt and every refusal (25). llms.txt and a JSON docs document with `?section=` for agents (10). Descriptions say what to do and what not to, for example that `/run` is charged either way and must not be retried on 200, that HEAD can't settle a payment, that there is no purchase tool over MCP and why; `getTask`, `pause` and `resume` have empty descriptions but their response text carries the rules (17 of 20). Enums on method, task state, overlap and x402 version, minimum and maximum on `limit` and `timeoutMs`, `format: uri` and required fields; `body` is a free string or object by design and `headers` an open map (12 of 15). An example cron and URL, an error catalogue of 57 entries with statuses and sub-codes, and Node and Python receivers plus a client in the repository, but the 200 bodies for task lists and destinations have no schema (12 of 15). `info.version` 1.0.0 and registry versions 1.0.0 and 1.0.1, the docs promise that codes are never renamed and older snake_case fields stay, but there is no changelog page (/changelog answers 404) and no dated list of API changes (5 of 15). 25 + 10 + 17 + 12 + 12 + 5 = 81.", "checked": "2026-10-30" }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 76, "points": 12.35, "reason": "Graded as an API. Responses are small, task lists take `limit` up to 100, `/docs?section=` fetches one part of the documentation, and the MCP server has 16 tools in one set; no field selection (18 of 25). Cursor pagination with `after` and a `state` filter of 10 values on tasks, an unknown value refused rather than answered with an empty page; the destination list is unpaginated at 25 (17 of 20). Every refusal is `{error, message}` with a stable snake_case code, `limit_reached` names the limit with `max` and `used`, `too_long` names the field and the bytes, `invalid_cron` carries a sub-code, and the one place that answers a sentence is flagged in the docs (19 of 20). A replayed payment nonce returns the receipt, verify and pause are no-ops when repeated, `already_run` stops a second concurrent run, and the delivery id is stable across attempts, but `/run` is charged on every call and `POST /api/tasks` has no idempotency key; MCP annotations weren't read (14 of 20). Three required fields to create a task with method and timeout defaulted, but no official SDK in any language; paying needs a stock x402 client, and the repository's examples are the only client code (8 of 15). 18 + 17 + 19 + 14 + 8 = 76.", "checked": "2026-10-30" }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 41, "points": 7.18, "reason": "One management token per paying wallet, shown once, with every write it can do; no scopes, no expiry, no read-only token. Rotation exists but only as a paid purchase from the same wallet with `?rotate=1`, which kills the old token. The token travels only in the Authorization header (13 of 30). No read-only mode. Pause and resume are separate from PATCH so an edit can't revive a task, a PATCH with an unknown field is refused whole, delete is soft with a 30-day restore, and a destination with a task on it can't be deleted; the three keyless MCP tools are reads (10 of 20). The API returns the agent's own data and delivery outcomes only, and the reply body from the destination isn't stored or returned, so no third-party content reaches the model; the docs tell agents to branch on codes, not prose (10 of 15). A task shows `failsInARow`, `refusedInARow`, `lastRunAt` and `deliveriesLeft`, and deliveries carry `X-402cron-Deliveries-Left`, but no endpoint returns the 90-day attempt log the privacy policy describes (5 of 15). security.txt answers 404, and no disclosure policy, bug bounty or certification was found; an abuse page explains the headers and how to stop deliveries, secrets and task headers are encrypted at rest, and the destination fence refuses private, link-local and internal targets (3 of 20). 13 + 10 + 10 + 5 + 3 = 41.", "checked": "2026-10-30" }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 86, "points": 10.75, "reason": "x402 v2, with v1 on request, on the service's own pack URLs, USDC on Base through the Coinbase CDP facilitator, documented in the OpenAPI file, /docs, llms.txt and /.well-known/x402, with the client example built on @x402/core. Every sale goes through it. We didn't request the 402 challenge, since the batch's rules forbid calling the API, so 4 are held back for an unprobed flow (36 of 40). Per-attempt prices are public as JSON and on the home page, $0.001 on the trial and $0.0005 on the other packs (20). The trial pack costs $0.02 in USDC rather than being free; no card is involved, and the docs, pricing, health and three MCP tools are free to read (10 of 20). An agent gets the token from the paid 402 exchange with no signup, form or human step (20). 36 + 20 + 10 + 20 = 86.", "checked": "2026-10-30" }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 62, "points": 5.43, "reason": "The last published service change is the starter pack moving to 2,000 deliveries for $1, recorded in the docs repository on 9 October 2026, and the terms and privacy policy took effect on 23 October (30). In the 90 days to 30 October we count registry versions 1.0.0 on 10 September and 1.0.1 on 21 September, the blog post of 19 September, the tariff change of 9 October and the policies of 23 October, dated changes but not a changelog (12 of 20). The docs repository's two open issues, of 23 September and 17 October 2026, have no reply, and support is an email address with no community channel (3 of 25). In the official MCP registry as com.402cron/402cron under the vendor's domain (15). No packages, no CI; the examples pin @x402/core ^2.24.0 (2 of 10). 30 + 12 + 3 + 15 + 2 = 62.", "checked": "2026-10-30" }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 64, "points": 5.6, "note": "editorial 66, provenance 61", "reason": "The service is closed and its source isn't published; the terms are short and dated, with a liability cap, a 30-day shutdown notice with refund of unused credits and a promise that a tariff change never re-prices held credits; the examples are MIT (17 of 30). The privacy policy of 23 October 2026 gives a retention period for every record it names (attempt log 90 days, usage counters 400 days, payment attempt counters 7 days, failed payments 30 days, settled payments indefinitely, deleted tasks 30 days, unverified destinations 7 days) and agrees with section 7 of the terms; no DPA (25 of 30). A 30-day shutdown notice and a statement that error codes are never renamed, with older response fields kept for compatibility, but no deprecation policy for API changes (10 of 20). Cloudflare Workers, D1 and Durable Objects with a 10 per cent log sample, Coinbase's CDP facilitator and two public Base RPC hosts are named, as is Cloudflare Web Analytics on the public pages; no data location is stated (14 of 20). 17 + 25 + 10 + 14 = 66.", "checked": "2026-10-30" } ], "assessment": { "date": "2026-10-30", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Graded as an API. Responses are small, task lists take `limit` up to 100, `/docs?section=` fetches one part of the documentation, and the MCP server has 16 tools in one set; no field selection (18 of 25). Cursor pagination with `after` and a `state` filter of 10 values on tasks, an unknown value refused rather than answered with an empty page; the destination list is unpaginated at 25 (17 of 20). Every refusal is `{error, message}` with a stable snake_case code, `limit_reached` names the limit with `max` and `used`, `too_long` names the field and the bytes, `invalid_cron` carries a sub-code, and the one place that answers a sentence is flagged in the docs (19 of 20). A replayed payment nonce returns the receipt, verify and pause are no-ops when repeated, `already_run` stops a second concurrent run, and the delivery id is stable across attempts, but `/run` is charged on every call and `POST /api/tasks` has no idempotency key; MCP annotations weren't read (14 of 20). Three required fields to create a task with method and timeout defaulted, but no official SDK in any language; paying needs a stock x402 client, and the repository's examples are the only client code (8 of 15). 18 + 17 + 19 + 14 + 8 = 76.", "maintenance": "The last published service change is the starter pack moving to 2,000 deliveries for $1, recorded in the docs repository on 9 October 2026, and the terms and privacy policy took effect on 23 October (30). In the 90 days to 30 October we count registry versions 1.0.0 on 10 September and 1.0.1 on 21 September, the blog post of 19 September, the tariff change of 9 October and the policies of 23 October, dated changes but not a changelog (12 of 20). The docs repository's two open issues, of 23 September and 17 October 2026, have no reply, and support is an email address with no community channel (3 of 25). In the official MCP registry as com.402cron/402cron under the vendor's domain (15). No packages, no CI; the examples pin @x402/core ^2.24.0 (2 of 10). 30 + 12 + 3 + 15 + 2 = 62.", "payments": "x402 v2, with v1 on request, on the service's own pack URLs, USDC on Base through the Coinbase CDP facilitator, documented in the OpenAPI file, /docs, llms.txt and /.well-known/x402, with the client example built on @x402/core. Every sale goes through it. We didn't request the 402 challenge, since the batch's rules forbid calling the API, so 4 are held back for an unprobed flow (36 of 40). Per-attempt prices are public as JSON and on the home page, $0.001 on the trial and $0.0005 on the other packs (20). The trial pack costs $0.02 in USDC rather than being free; no card is involved, and the docs, pricing, health and three MCP tools are free to read (10 of 20). An agent gets the token from the paid 402 exchange with no signup, form or human step (20). 36 + 20 + 10 + 20 = 86.", "reliability": "Graded as a hosted API. No status page. `GET /health` answers 200 or 503 with the live state (sweep age, the hourly settlement budget, a kill switch, whether the service is selling) and keeps no history, and /status answers 404 (0, and 5 of 30 for the incident record, since no history can be read). Rate limits are published as numbers, 16 payment attempts an hour per caller, 60 settlements an hour service-wide, 10 verifications a day per destination and 40 per client, 50 live tasks and 25 destinations (15). Hourly limits answer 429 with a `retry-after` header and `retryAfterSeconds`, daily ones with `retryTomorrow`, every refusal carries a `retryable` flag where it matters, a replayed settled payment returns the receipt instead of charging again, and the delivery id is stable across attempts for the receiver (15). No SLA; the terms promise only that a request was attempted and cap liability at the credits in question (0). Live and selling, with no beta label, though the earliest public date is 10 September 2026 (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.", "schema": "A public OpenAPI 3.1 file with 16 paths and 20 operations, one bearer security scheme and schemas for the purchase receipt and every refusal (25). llms.txt and a JSON docs document with `?section=` for agents (10). Descriptions say what to do and what not to, for example that `/run` is charged either way and must not be retried on 200, that HEAD can't settle a payment, that there is no purchase tool over MCP and why; `getTask`, `pause` and `resume` have empty descriptions but their response text carries the rules (17 of 20). Enums on method, task state, overlap and x402 version, minimum and maximum on `limit` and `timeoutMs`, `format: uri` and required fields; `body` is a free string or object by design and `headers` an open map (12 of 15). An example cron and URL, an error catalogue of 57 entries with statuses and sub-codes, and Node and Python receivers plus a client in the repository, but the 200 bodies for task lists and destinations have no schema (12 of 15). `info.version` 1.0.0 and registry versions 1.0.0 and 1.0.1, the docs promise that codes are never renamed and older snake_case fields stay, but there is no changelog page (/changelog answers 404) and no dated list of API changes (5 of 15). 25 + 10 + 17 + 12 + 12 + 5 = 81.", "security": "One management token per paying wallet, shown once, with every write it can do; no scopes, no expiry, no read-only token. Rotation exists but only as a paid purchase from the same wallet with `?rotate=1`, which kills the old token. The token travels only in the Authorization header (13 of 30). No read-only mode. Pause and resume are separate from PATCH so an edit can't revive a task, a PATCH with an unknown field is refused whole, delete is soft with a 30-day restore, and a destination with a task on it can't be deleted; the three keyless MCP tools are reads (10 of 20). The API returns the agent's own data and delivery outcomes only, and the reply body from the destination isn't stored or returned, so no third-party content reaches the model; the docs tell agents to branch on codes, not prose (10 of 15). A task shows `failsInARow`, `refusedInARow`, `lastRunAt` and `deliveriesLeft`, and deliveries carry `X-402cron-Deliveries-Left`, but no endpoint returns the 90-day attempt log the privacy policy describes (5 of 15). security.txt answers 404, and no disclosure policy, bug bounty or certification was found; an abuse page explains the headers and how to stop deliveries, secrets and task headers are encrypted at rest, and the destination fence refuses private, link-local and internal targets (3 of 20). 13 + 10 + 10 + 5 + 3 = 41.", "transparency": "The service is closed and its source isn't published; the terms are short and dated, with a liability cap, a 30-day shutdown notice with refund of unused credits and a promise that a tariff change never re-prices held credits; the examples are MIT (17 of 30). The privacy policy of 23 October 2026 gives a retention period for every record it names (attempt log 90 days, usage counters 400 days, payment attempt counters 7 days, failed payments 30 days, settled payments indefinitely, deleted tasks 30 days, unverified destinations 7 days) and agrees with section 7 of the terms; no DPA (25 of 30). A 30-day shutdown notice and a statement that error codes are never renamed, with older response fields kept for compatibility, but no deprecation policy for API changes (10 of 20). Cloudflare Workers, D1 and Durable Objects with a 10 per cent log sample, Coinbase's CDP facilitator and two public Base RPC hosts are named, as is Cloudflare Web Analytics on the public pages; no data location is stated (14 of 20). 17 + 25 + 10 + 14 = 66." }, "sources": [ { "what": "OpenAPI 3.1 file, 20 operations", "url": "https://402cron.com/openapi.json", "seen": "2026-10-30" }, { "what": "machine docs (signature, retries, billing, limits, error catalogue)", "url": "https://402cron.com/docs", "seen": "2026-10-30" }, { "what": "llms.txt, packs, MCP tools, operator", "url": "https://402cron.com/llms.txt", "seen": "2026-10-30" }, { "what": "tariff as JSON", "url": "https://402cron.com/api/pricing", "seen": "2026-10-30" }, { "what": "terms of service, effective 23 October 2026", "url": "https://402cron.com/terms", "seen": "2026-10-30" }, { "what": "privacy policy, retention periods and processors", "url": "https://402cron.com/privacy", "seen": "2026-10-30" }, { "what": "abuse page, headers and how to stop deliveries", "url": "https://402cron.com/abuse", "seen": "2026-10-30" }, { "what": "live health, no history", "url": "https://402cron.com/health", "seen": "2026-10-30" }, { "what": "x402 discovery descriptor", "url": "https://402cron.com/.well-known/x402", "seen": "2026-10-30" }, { "what": "service manifest, limits and pay-to address", "url": "https://402cron.com/.well-known/402cron.json", "seen": "2026-10-30" }, { "what": "home page, pricing, failure handling and operator section", "url": "https://402cron.com/", "seen": "2026-10-30" }, { "what": "blog post of 19 September 2026 on building the paid API", "url": "https://402cron.com/blog/silent-failures-paid-agent-api", "seen": "2026-10-30" }, { "what": "docs and examples repository README, MIT, 4 commits", "url": "https://github.com/402cron/402cron", "seen": "2026-10-30" }, { "what": "signature verification example", "url": "https://raw.githubusercontent.com/402cron/402cron/main/receiver/node/verify.mjs", "seen": "2026-10-30" }, { "what": "repository commits, tree and issues through the GitHub API", "url": "https://api.github.com/repos/402cron/402cron/commits", "seen": "2026-10-30" }, { "what": "MCP registry entries 1.0.0 and 1.0.1", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=402cron", "seen": "2026-10-30" }, { "what": "MCP listing metadata, 16 tool names", "url": "https://raw.githubusercontent.com/paranormalen2/402cron-mcp/main/README.md", "seen": "2026-10-30" }, { "what": "RDAP, registered 22 August 2026", "url": "https://rdap.verisign.com/com/v1/domain/402cron.com", "seen": "2026-10-30" }, { "what": "earliest Wayback Machine capture, 13 September 2026", "url": "https://archive.org/wayback/available?url=402cron.com", "seen": "2026-10-30" } ], "openQuestions": [ "unchecked: the live x402 402 challenge and its PAYMENT-REQUIRED header, since the batch's rules forbid calling the API; the payments line rests on the OpenAPI file, /docs, llms.txt and the client example", "unchecked: the MCP tools' input schemas and readOnlyHint or destructiveHint annotations, since no MCP session was opened; the 16 tool names and one-line descriptions come from the paranormalen2/402cron-mcp README", "unchecked: whether the x402 Bazaar lists 402cron. The CDP discovery list had 104,082 entries on 30 October with no search parameter we could use; 5,000 entries at the end of the list held none, and the operator's blog says a resource is dropped after 30 days without a settlement through the CDP facilitator", "unchecked: the GitLab repository named by the registry's 1.0.0 entry (gitlab.com/georgikalchev/402cron), which answered 403 behind a bot check; GitLab's robots.txt disallows its API", "Whether POST /api/tasks upserts on a repeated name or refuses it. The docs call the name the key we upsert on, while name_taken_by_live_task is documented for PATCH and restore only", "What the starter pack held before the 9 October 2026 change; the README commit records only the new size", "Whether a per-second limit applies to the management routes; none is published, and the blog post describes a per-isolate limiter on Workers without numbers for the live service", "It doesn't do LocalGhost's or letme's job" ] }, "negative": 0, "verdict": "A public OpenAPI 3.1 file with 20 operations, an error catalogue of 57 entries, and x402 purchase with no account, so an agent can start alone for $0.02. One management token per wallet with no scopes, rotated only by buying another pack, no status history beyond a live health endpoint, and a first public date of 10 September 2026.", "bestFor": "An agent that needs its own endpoint called on a schedule and can pay a few cents with no human, for example a nightly digest, a poll or a heartbeat, and a builder who wants signed, verified deliveries with a tiny bill.", "strengths": [ "An agent can buy credits, register and verify a destination and schedule a task with no account, card or human step, paying $0.02 for 20 attempts by x402", "A public OpenAPI 3.1 file with 20 operations, a JSON docs document with `?section=` and an llms.txt, all on the vendor's domain", "Signed deliveries with a stable delivery id across retries, a documented canonical string, and verification examples in Node and Python in the MIT repository", "Refusals carry stable snake_case codes with `retryable`, `retryTomorrow` and `retryAfterSeconds` fields, and the payment path says which 500 must never be retried", "The privacy policy states a retention period for every record it names and the parties that see data" ], "weaknesses": [ "One management token per wallet with no scopes or read-only token, rotated only by buying another pack with `?rotate=1`", "No status page or incident history; /health reports the live state only, and no SLA is published", "No security.txt, disclosure policy, bug bounty or certification was found", "No endpoint returns the delivery log the privacy policy says is kept 90 days; a task shows only counters and the last run time", "The service's first public date is 10 September 2026, the domain was registered on 22 August 2026, and the two GitHub issues on the docs repository have no reply", "Schedules are 5-field cron in UTC at one-minute resolution with no time zones, and a run is skipped while the previous one is still in flight" ], "agentNotes": [ "Buy first with `GET /buy/trial`, pay the 402 with a stock x402 client, and store the management token from the 200 body. It's shown once; losing it costs another purchase with `?rotate=1`.", "Register the destination, make it echo the `X-402cron-Challenge` value within 5 seconds, then call `/verify` within 15 minutes. A fixed-response catch URL can't pass.", "Branch on the `error` code and the HTTP status, never on `message`. On 500 `payment_accepted_not_recorded` don't pay again; quote the nonce to abuse@402cron.com.", "Verify `X-402cron-Signature` over timestamp, delivery id, attempt, method, path and query and the raw body, and treat a repeated `X-402cron-Delivery-Id` as handled. Delivery is at least once.", "Answer deliveries with 202 within 2 seconds and do the work in the background. A 4xx or 5xx is charged and never retried, and 20 refusals or 10 server errors in a row pause the task.", "Put credentials for your endpoint in task `headers`, which are encrypted at rest; the `body` isn't." ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 63.5 } ], "editorialScores": { "ergonomics": 76, "maintenance": 62, "payments": 86, "reliability": 45, "schema": 81, "security": 41, "transparency": 66 }, "provenanceScore": 61, "checked": { "categories": { "ergonomics": "2026-10-30", "maintenance": "2026-10-30", "payments": "2026-10-30", "reliability": "2026-10-30", "schema": "2026-10-30", "security": "2026-10-30", "transparency": "2026-10-30" }, "last": "2026-10-30", "oldest": "2026-10-30", "stale": false, "staleAfterDays": 90 }, "scoreHistory": [ { "date": "2026-10-30", "grade": "B", "kind": "listed", "method": "0.7", "score": 63.5 } ] }, "connect": { "http": "curl -i https://402cron.com/buy/trial", "claudeCode": "claude mcp add --transport http 402cron https://402cron.com/mcp --header \"Authorization: Bearer $CRON402_TOKEN\"", "config": { "mcpServers": { "402cron": { "headers": { "Authorization": "Bearer \u003cmanagement token\u003e" }, "url": "https://402cron.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/events.schedule", "tool": "https://letme.dev/402cron" }, "notable": [ "A public OpenAPI 3.1 file with 16 paths and 20 operations covers purchase, destinations, tasks, the MCP and A2A endpoints and health, and its `x-guidance` field walks an agent from purchase to first task (https://402cron.com/openapi.json)", "Every delivery carries `X-402cron-Signature`, an HMAC-SHA256 over timestamp, delivery id, attempt, method, path and query and the raw body, keyed with a per-destination secret shown once at registration (https://402cron.com/docs)", "A destination must echo a one-time challenge within 5 seconds before a task can point at it, and the permission covers that path and everything beneath it, not the whole domain (https://402cron.com/docs)", "A timeout or unreachable host is retried 60 and 120 seconds later, at most 3 attempts; a 4xx or 5xx is never retried, and 3 failed attempts, 20 refusals or 10 server errors in a row pause the task with one signed `task_paused` notice (https://402cron.com/terms)", "Refusals carry a snake_case `error` code and a `message`, with 57 catalogued entries, `retryable` flags and `retryAfterSeconds` on hourly limits; the docs say codes are never renamed (https://402cron.com/docs)", "Deliveries go to public HTTPS hostnames only on ports 80 and 443; IP literals, internal names, credentials in the URL, redirects and paths that hide a dot segment are refused (https://402cron.com/terms)", "The privacy policy gives retention periods for everything stored, names Cloudflare, the Coinbase CDP facilitator and two public Base RPC hosts as the parties that see data, and says the request body isn't encrypted at rest (https://402cron.com/privacy)", "The remote MCP server at /mcp has 3 keyless tools and 13 that take the management token as a bearer header, with no purchase tool by design (https://402cron.com/llms.txt)" ], "area": "developer", "details": [ { "label": "Surface listed", "value": "The REST API at https://402cron.com (`/buy/{pack}`, `/api/destinations`, `/api/tasks`, `/api/pricing`, `/health`) and the remote MCP server at `/mcp`, read from the OpenAPI file, /docs, llms.txt, the manifests, the terms, privacy and abuse pages and the docs repository on 30 October 2026. No pack was bought, no API call or MCP session was made, and no destination was registered" }, { "label": "API", "value": "OpenAPI 3.1, 16 paths and 20 operations. Three purchase routes, four destination routes, nine task routes (list, create, get, patch, delete, run, pause, resume, restore), pricing, health, MCP and A2A. One security scheme, HTTP bearer named `apiKey`" }, { "label": "Payment", "value": "x402 v2 (v1 with `?x402Version=1`), USDC on Base, `exact` scheme, pay-to 0x8e37022edcf0f21cf3c9f93fee9d4d32519f36f4, settled through the Coinbase CDP facilitator. A replayed settled payment returns the receipt again without new credits. 16 payment attempts an hour per caller and 60 settlements an hour service-wide, 48 for locally verifiable signatures and 12 for smart-wallet signatures, plus a 120 an hour corridor for attempts that pass an on-chain simulation" }, { "label": "Credentials", "value": "One management token per paying wallet, issued once at first purchase, sent as `Authorization: Bearer`. No scopes, expiry or read-only token. Rotation is `GET /buy/\u003cpack\u003e?rotate=1` from the same wallet, a paid purchase that kills the old token at once. The privacy policy says only a SHA-256 hash of the token is stored" }, { "label": "Destinations", "value": "Up to 25 per client. `POST /api/destinations` returns a signing secret shown once and a challenge; 402cron POSTs `X-402cron-Challenge` to the URL, the endpoint echoes it within 5 seconds, and `POST /api/destinations/{id}/verify` must follow within 15 minutes. 10 verification attempts a day per destination and 40 per client, each needing a live balance. The permission covers the path and everything beneath it. An unverified destination is deleted after 7 days" }, { "label": "Delivery", "value": "At least once. 5-field cron, UTC only, one minute at the finest, with names, ranges, steps and the standard macros; Quartz characters, six or seven fields, `@reboot`, `@every` and time zones are refused with a sub-code. Methods GET, HEAD, POST, PUT, PATCH and DELETE, body up to 64 KB, custom headers up to 8 KB, `timeoutMs` 250 to 2,000. 50 live tasks per client. Overlap mode `skip` only; a skipped occurrence isn't charged" }, { "label": "Retries and pausing", "value": "A timeout or an unreachable host is retried after 60 and 120 seconds, 3 attempts in all. A 4xx (`refused`) or 5xx (`delivered_failed`) is never retried. 3 failed attempts, 20 refusals or 10 server errors in a row pause the task, as does an empty balance, a destination that stops qualifying or a long silence. One signed, uncharged `task_paused` POST carries a `reasonCode`. Missed runs aren't backfilled; resume is one call" }, { "label": "Signatures", "value": "`X-402cron-Signature: sha256=\u003chex\u003e`, HMAC-SHA256 keyed with the destination secret over the bytes of timestamp, delivery id, attempt, METHOD, path plus query and the raw body, each on its own line. `X-402cron-Event` (`verify`, `delivery`, `task_paused`) isn't signed. The repository's verify.mjs allows 300 seconds of clock skew and compares in constant time" }, { "label": "Rate limits", "value": "Published as numbers for payments (16 an hour per caller, 60 settlements an hour service-wide), verifications (10 a day per destination, 40 per client, plus a per-target-host cap across clients) and runs (daily caps per client and per destination). A full limit answers `limit_reached`, 409 when deleting something frees it and 429 when time does, with `retryAfterSeconds` and a `retry-after` header on hourly limits. No per-second limit on the management routes was found" }, { "label": "Pagination", "value": "`GET /api/tasks` takes `limit` 1 to 100 (default 50), an `after` cursor and a `state` filter with 10 accepted values; an unknown value is refused with 400 `unknown_state`. `GET /api/destinations` always returns the whole list of up to 25" }, { "label": "Errors", "value": "JSON `{error, message}` with 57 catalogued entries in /docs, including `invalid_cron` with 10 sub-codes, `too_long` with `field`, `maxBytes` and `got`, and `limit_reached` with `limit`, `max` and `used`. Codes are never renamed per the docs. The one exception is a payment header that won't parse, where `error` is a sentence and `rejectedBy: \"us\"` is the machine signal. A resource that isn't yours answers 404, never 403" }, { "label": "MCP server", "value": "Streamable HTTP at https://402cron.com/mcp, POST only. `get_pricing`, `get_docs` and `get_service_status` need no token; `list_tasks`, `get_task`, `create_task`, `update_task`, `pause_task`, `resume_task`, `run_task_now`, `delete_task`, `restore_task`, `register_destination`, `verify_destination`, `list_destinations` and `delete_destination` read the bearer header on the connection. No OAuth and no purchase tool. In the official MCP registry as `com.402cron/402cron`, 1.0.1 of 21 September 2026. Tool schemas and annotations weren't read, since no session was opened" }, { "label": "A2A", "value": "An agent card at /.well-known/agent-card.json and a JSON-RPC endpoint at /a2a (A2A 1.0, header `A2A-Version: 1.0`) that answers every message with the same guide. It can't take payment or create tasks" }, { "label": "Data retention", "value": "Delivery attempt log (time, outcome, status, latency, error code, no reply body) 90 days; per-destination daily counters 90 days; per-client usage counters 400 days; payment attempt counters by network address 7 days; failed payment attempts 30 days; settled payments and the credit ledger indefinitely; deleted tasks 30 days; unverified destinations 7 days. Signing secrets and task headers encrypted at rest, the task body not. Cloudflare Workers, D1 and Durable Objects host it with a 10 per cent log sample" }, { "label": "Status", "value": "No status page. `GET /health` answers 200 or 503 with the live state, including sweep age, the hourly settlement budget, a kill switch and whether the service is selling. /status and /changelog answer 404. security.txt answers 404" }, { "label": "Operator", "value": "Georgi Kalchev, named in the terms, privacy policy and the home page. No company is named. The domain was registered on 22 August 2026, the MCP registry entry dates from 10 September 2026 and the first Wayback Machine capture from 13 September 2026" } ], "unitPrices": [ { "item": "Delivery attempt, trial pack (20 attempts for $0.02)", "unit": "call", "usd": 0.001, "note": "Paid by x402 in USDC on Base, per /api/pricing on 30 October 2026. Charged per attempt, including 4xx, 5xx, timeouts and unreachable hosts" }, { "item": "Delivery attempt, starter (2,000 for $1) and month (50,000 for $25) packs", "unit": "call", "usd": 0.0005, "note": "The volume rate, called an intro price for the starter pack, per /api/pricing on 30 October 2026. Credits never expire" }, { "item": "1,000 delivery attempts at the volume rate", "unit": "1k-calls", "usd": 0.5, "note": "Prepaid in packs of 2,000 or 50,000 attempts, per /api/pricing on 30 October 2026" } ], "provenance": { "legalEntity": "Georgi Kalchev (operator, a named person; no company named)", "domain": "402cron.com", "domainRegistered": "2026-08-22", "endpointOnVendorDomain": true, "terms": "https://402cron.com/terms", "privacy": "https://402cron.com/privacy", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-10-30", "notes": [ "The terms and the privacy policy, both effective 23 October 2026, say \"Operated by Georgi Kalchev\" with abuse@402cron.com as the contact. No company, registration number or address is given anywhere on the site.", "RDAP for 402cron.com gives a registration date of 2026-08-22 and a last change on 2026-08-27.", "The API, the MCP endpoint, the A2A endpoint and all manifests are on 402cron.com.", "No status page exists; /health is a live liveness check. /status and /changelog answer 404. /.well-known/security.txt and /security.txt answer 404.", "The official MCP registry lists com.402cron/402cron 1.0.0 on 10 September 2026 (repository gitlab.com/georgikalchev/402cron) and 1.0.1 on 21 September 2026 (repository github.com/402cron/402cron). The GitLab page answered 403 behind a bot check and wasn't read.", "firstReleased is the registry's 10 September 2026 entry, the earliest first-hand date found; the first Wayback Machine capture of the home page is 13 September 2026. lastRelease is the 9 October 2026 README commit recording the starter pack's change to 2,000 deliveries for $1." ], "score": 61, "checks": [ { "check": "Legal entity named", "value": "Georgi Kalchev (operator, a named person; no company named)", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "402cron.com, registered 2026-08-22 (under a year)", "points": 0, "max": 15, "state": "no" }, { "check": "Endpoint on the vendor's domain", "value": "402cron.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "Privacy policy", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "People named", "value": "1 named with their role, 1 with a public profile", "points": 10, "max": 10, "state": "ok" }, { "check": "Support route", "value": "a support address, help pages, a community", "points": 5, "max": 5, "state": "ok" } ] }, "humans": { "slug": "402cron", "checked": "2026-10-30", "company": "402cron", "people": [ { "name": "Georgi Kalchev", "role": "Operator", "linkedin": "https://www.linkedin.com/in/georgikalchev-bg/", "x": "https://x.com/AiGenMaster", "github": "https://github.com/paranormalen2", "bio": "Georgi Kalchev operates 402cron. The home page says he builds and maintains his own small web services, working with AI coding agents, and also runs AISkills402, 402post and 402registry. He wrote the blog post of 19 September 2026 on building a paid x402 API on Cloudflare Workers.", "bioSources": [ "https://402cron.com/", "https://402cron.com/blog/silent-failures-paid-agent-api", "https://402cron.com/llms.txt" ], "page": "/people/georgi-kalchev/" } ], "peopleNote": "The terms and privacy policy (effective 23 October 2026) say the service is operated by Georgi Kalchev, and the home page's Who runs it section names him and links his LinkedIn and X accounts. llms.txt names github.com/paranormalen2 as his account and github.com/402cron as the docs repository. No page calls him a founder or names a company, registration number or address, so the service is recorded as a person's project. Investors were looked for on the home page, the blog, the terms, llms.txt, the docs repository README and the GitHub organisation and user records; nothing on 402cron.com or in the repositories mentions funding, backers or a company, and no outside search was made for a one-person service with no company named.", "companySocial": { "github": "https://github.com/402cron" }, "support": { "emails": [ "abuse@402cron.com" ], "urls": [ "https://402cron.com/abuse", "https://402cron.com/docs" ], "community": [ { "label": "Docs repository issues", "url": "https://github.com/402cron/402cron/issues", "kind": "github" } ], "contactEmails": [ "abuse@402cron.com" ] }, "sources": [ "https://402cron.com/", "https://402cron.com/terms", "https://402cron.com/privacy", "https://402cron.com/llms.txt", "https://402cron.com/abuse", "https://402cron.com/blog/silent-failures-paid-agent-api", "https://api.github.com/orgs/402cron", "https://api.github.com/users/paranormalen2", "https://registry.modelcontextprotocol.io/v0/servers?search=402cron" ], "ownership": { "status": "project", "checked": "2026-10-30", "sources": [ "https://402cron.com/terms", "https://402cron.com/privacy", "https://402cron.com/" ] } }, "pageJsonUrl": "https://www.anchorterminal.com/tools/402cron.json", "live": { "slug": "402cron", "probe": { "target": "https://402cron.com", "method": "get", "lastAt": "2026-10-30T13:20:07.465738146Z", "lastOk": true, "lastStatus": 200, "lastMs": 115, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 115, "p95ms24h": 348, "samples24h": 17, "samples30d": 17, "days": [ { "date": "2026-10-30", "probes": 17, "ok": 17 } ] }, "updatedAt": "2026-10-30T13:20:07.465738146Z" } } }