# 402cron (slim)

> 402cron is a hosted cron service that calls an agent's HTTPS endpoint on schedule with a signed request and bills one prepaid delivery per attempt. Agents pay by x402 in USDC on Base and manage tasks over REST or MCP.

- Full: https://www.anchorterminal.com/tools/402cron.md (~9,450 tokens) · this version ~2,980 tokens · JSON https://www.anchorterminal.com/tools/402cron.json · canonical https://www.anchorterminal.com/tools/402cron
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-10-30 · pricing https://www.anchorterminal.com/tools/402cron#pricing · reviews https://www.anchorterminal.com/tools/402cron#reviews
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

**B · 63.5/100 · rank #452 of 1226 · #9 in Event delivery & webhooks · not agent-ready · confidence medium**


Assessment: A public OpenAPI 3.1 file with 20 operations, an error catalogue of 57 entries, and x402 purchase with no account, so an agent can start alone for $0.02. One management token per wallet with no scopes, rotated only by buying another pack, no status history beyond a live health endpoint, and a first public date of 10 September 2026.

## Facts

- Kind: HTTP API · vendor: Georgi Kalchev · category: Event delivery & webhooks · legal entity: Georgi Kalchev (operator, a named person; no company named) · provenance 61/100
- Endpoint: `https://402cron.com` (HTTP, Streamable HTTP)
- Auth: OAuth or key · pricing: Pay per use · x402: yes, from $0.02/call · licence: Proprietary hosted service under 402cron's terms of service, effective 23 October 2026. The server's source isn't published. The docs and examples repository is MIT
- Probe metrics: not measured yet (probes haven't run)
- Surface listed: The REST API at https://402cron.com (`/buy/{pack}`, `/api/destinations`, `/api/tasks`, `/api/pricing`, `/health`) and the remote MCP server at `/mcp`, read from the OpenAPI file, /docs, llms.txt, the manifests, the terms, privacy and abuse pages and the docs repository on 30 October 2026. No pack was bought, no API call or MCP session was made, and no destination was registered
- API: OpenAPI 3.1, 16 paths and 20 operations. Three purchase routes, four destination routes, nine task routes (list, create, get, patch, delete, run, pause, resume, restore), pricing, health, MCP and A2A. One security scheme, HTTP bearer named `apiKey`
- Payment: x402 v2 (v1 with `?x402Version=1`), USDC on Base, `exact` scheme, pay-to 0x8e37022edcf0f21cf3c9f93fee9d4d32519f36f4, settled through the Coinbase CDP facilitator. A replayed settled payment returns the receipt again without new credits. 16 payment attempts an hour per caller and 60 settlements an hour service-wide, 48 for locally verifiable signatures and 12 for smart-wallet signatures, plus a 120 an hour corridor for attempts that pass an on-chain simulation
- Credentials: One management token per paying wallet, issued once at first purchase, sent as `Authorization: Bearer`. No scopes, expiry or read-only token. Rotation is `GET /buy/<pack>?rotate=1` from the same wallet, a paid purchase that kills the old token at once. The privacy policy says only a SHA-256 hash of the token is stored
- Destinations: Up to 25 per client. `POST /api/destinations` returns a signing secret shown once and a challenge; 402cron POSTs `X-402cron-Challenge` to the URL, the endpoint echoes it within 5 seconds, and `POST /api/destinations/{id}/verify` must follow within 15 minutes. 10 verification attempts a day per destination and 40 per client, each needing a live balance. The permission covers the path and everything beneath it. An unverified destination is deleted after 7 days
- Delivery: At least once. 5-field cron, UTC only, one minute at the finest, with names, ranges, steps and the standard macros; Quartz characters, six or seven fields, `@reboot`, `@every` and time zones are refused with a sub-code. Methods GET, HEAD, POST, PUT, PATCH and DELETE, body up to 64 KB, custom headers up to 8 KB, `timeoutMs` 250 to 2,000. 50 live tasks per client. Overlap mode `skip` only; a skipped occurrence isn't charged
- Retries and pausing: A timeout or an unreachable host is retried after 60 and 120 seconds, 3 attempts in all. A 4xx (`refused`) or 5xx (`delivered_failed`) is never retried. 3 failed attempts, 20 refusals or 10 server errors in a row pause the task, as does an empty balance, a destination that stops qualifying or a long silence. One signed, uncharged `task_paused` POST carries a `reasonCode`. Missed runs aren't backfilled; resume is one call
- Signatures: `X-402cron-Signature: sha256=<hex>`, HMAC-SHA256 keyed with the destination secret over the bytes of timestamp, delivery id, attempt, METHOD, path plus query and the raw body, each on its own line. `X-402cron-Event` (`verify`, `delivery`, `task_paused`) isn't signed. The repository's verify.mjs allows 300 seconds of clock skew and compares in constant time
- Rate limits: Published as numbers for payments (16 an hour per caller, 60 settlements an hour service-wide), verifications (10 a day per destination, 40 per client, plus a per-target-host cap across clients) and runs (daily caps per client and per destination). A full limit answers `limit_reached`, 409 when deleting something frees it and 429 when time does, with `retryAfterSeconds` and a `retry-after` header on hourly limits. No per-second limit on the management routes was found
- Pagination: `GET /api/tasks` takes `limit` 1 to 100 (default 50), an `after` cursor and a `state` filter with 10 accepted values; an unknown value is refused with 400 `unknown_state`. `GET /api/destinations` always returns the whole list of up to 25
- Errors: JSON `{error, message}` with 57 catalogued entries in /docs, including `invalid_cron` with 10 sub-codes, `too_long` with `field`, `maxBytes` and `got`, and `limit_reached` with `limit`, `max` and `used`. Codes are never renamed per the docs. The one exception is a payment header that won't parse, where `error` is a sentence and `rejectedBy: "us"` is the machine signal. A resource that isn't yours answers 404, never 403
- MCP server: Streamable HTTP at https://402cron.com/mcp, POST only. `get_pricing`, `get_docs` and `get_service_status` need no token; `list_tasks`, `get_task`, `create_task`, `update_task`, `pause_task`, `resume_task`, `run_task_now`, `delete_task`, `restore_task`, `register_destination`, `verify_destination`, `list_destinations` and `delete_destination` read the bearer header on the connection. No OAuth and no purchase tool. In the official MCP registry as `com.402cron/402cron`, 1.0.1 of 21 September 2026. Tool schemas and annotations weren't read, since no session was opened
- A2A: An agent card at /.well-known/agent-card.json and a JSON-RPC endpoint at /a2a (A2A 1.0, header `A2A-Version: 1.0`) that answers every message with the same guide. It can't take payment or create tasks
- Data retention: Delivery attempt log (time, outcome, status, latency, error code, no reply body) 90 days; per-destination daily counters 90 days; per-client usage counters 400 days; payment attempt counters by network address 7 days; failed payment attempts 30 days; settled payments and the credit ledger indefinitely; deleted tasks 30 days; unverified destinations 7 days. Signing secrets and task headers encrypted at rest, the task body not. Cloudflare Workers, D1 and Durable Objects host it with a 10 per cent log sample
- Status: No status page. `GET /health` answers 200 or 503 with the live state, including sweep age, the hourly settlement budget, a kill switch and whether the service is selling. /status and /changelog answer 404. security.txt answers 404
- Operator: Georgi Kalchev, named in the terms, privacy policy and the home page. No company is named. The domain was registered on 22 August 2026, the MCP registry entry dates from 10 September 2026 and the first Wayback Machine capture from 13 September 2026
- Prices: Delivery attempt, trial pack (20 attempts for $0.02) $0.001 per call; Delivery attempt, starter (2,000 for $1) and month (50,000 for $25) packs $0.0005 per call; 1,000 delivery attempts at the volume rate $0.50 per 1,000 tool calls

- Scores: Reliability 45, Performance pending, Schema & documentation 81, Agent ergonomics 76, Security & auth 41, Payments & pricing 86, Task success pending, Maintenance & community 62, Transparency & trust 64 · total over the 7 assessed categories
- Why: Reliability, Graded as a hosted API. · Schema & documentation, A public OpenAPI 3.1 file with 16 paths and 20 operations, one bearer security scheme and schemas for the purchase receipt and every refusal… · Agent ergonomics, Graded as an API. · Security & auth, One management token per paying wallet, shown once, with every write it can do; no scopes, no expiry, no read-only token. · Payments & pricing, x402 v2, with v1 on request, on the service's own pack URLs, USDC on Base through the Coinbase CDP facilitator, documented in the OpenAPI fi… · Maintenance & community, The last published service change is the starter pack moving to 2,000 deliveries for $1, recorded in the docs repository on 9 October 2026… · Transparency & trust, The service is closed and its source isn't published; the terms are short and dated, with a liability cap, a 30-day shutdown notice with ref…
- Sources: 19, open questions: 8, both in the full twin
- Capabilities: events.schedule, events.webhooks-send
- JSON: https://www.anchorterminal.com/api/v1/tools/402cron.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/402cron.svg` or a link to https://www.anchorterminal.com/tools/402cron from a page on 402cron.com or one of its subdomains, or the README of github.com/402cron/402cron, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.
- Support: abuse@402cron.com; https://402cron.com/abuse; https://402cron.com/docs; more in the full twin

## Before you call it

1. Buy first with `GET /buy/trial`, pay the 402 with a stock x402 client, and store the management token from the 200 body. It's shown once; losing it costs another purchase with `?rotate=1`.
2. Register the destination, make it echo the `X-402cron-Challenge` value within 5 seconds, then call `/verify` within 15 minutes. A fixed-response catch URL can't pass.
3. Branch on the `error` code and the HTTP status, never on `message`. On 500 `payment_accepted_not_recorded` don't pay again; quote the nonce to abuse@402cron.com.
4. Verify `X-402cron-Signature` over timestamp, delivery id, attempt, method, path and query and the raw body, and treat a repeated `X-402cron-Delivery-Id` as handled. Delivery is at least once.
5. Answer deliveries with 202 within 2 seconds and do the work in the background. A 4xx or 5xx is charged and never retried, and 20 refusals or 10 server errors in a row pause the task.
6. Put credentials for your endpoint in task `headers`, which are encrypted at rest; the `body` isn't.

## Connect

```bash
curl -i https://402cron.com/buy/trial
```

```bash
claude mcp add --transport http 402cron https://402cron.com/mcp --header "Authorization: Bearer $CRON402_TOKEN"
```
Full config and headless snippets are in the full page. Through letme (picks today, calling later): https://letme.dev/402cron

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| Amazon EventBridge | BB | 75.1 | events.webhooks-send, events.schedule | https://www.anchorterminal.com/tools/amazon-eventbridge.min.md |
| Upstash QStash | BB | 72.3 | events.schedule, events.webhooks-send | https://www.anchorterminal.com/tools/upstash-qstash.min.md |
| Webhook Relay | C | 57.8 | events.webhooks-send, events.schedule | https://www.anchorterminal.com/tools/webhook-relay.min.md |
| Hookdeck | BB | 76 | events.webhooks-send | https://www.anchorterminal.com/tools/hookdeck.min.md |
| Ably | BB | 75.2 | events.webhooks-send | https://www.anchorterminal.com/tools/ably.min.md |


## Panel reviews (0, desk reviews from public material, no calls made)