Parse marketplace skill catalogs

Author: TateLyman

README.md

@@ -20,7 +20,7 @@ npx --yes x402-surface-check --strict-proof https://api.example.com/openapi.json
 
 ## What It Checks
 
-- Manifest endpoint discovery from `items[]`, `endpoints[]`, object-valued `endpoints`, string-valued endpoint maps, `tools` maps, `resources[]`, `x402Endpoints`, category arrays, raw resource URL strings, method-prefixed resource strings, and OpenAPI paths
+- Manifest endpoint discovery from `items[]`, `endpoints[]`, marketplace `skills[]` / `catalog.skills[]`, object-valued `endpoints`, string-valued endpoint maps, `tools` maps, `resources[]`, `x402Endpoints`, category arrays, raw resource URL strings, method-prefixed resource strings, and OpenAPI paths
 - Streamable HTTP MCP tool catalogs via safe JSON-RPC `tools/list` probes with `Accept: application/json, text/event-stream`
 - Object-valued manifest endpoint query examples, public catalog/discovery GETs, and payment-bearing two-phase operations without treating expected public catalog reads as failed payment gates
 - Linked discovery documents via `discovery_url`, `discoveryUrl`, `resources_url`, `resourcesUrl`, string `discovery` links, nested `discovery.x402_json` / OpenAPI links, or manifest-level OpenAPI links

bin/x402-surface-check.mjs

@@ -358,6 +358,24 @@ function manifestEndpointBody(endpoint, document) {
   return exampleValue(body, document)
 }
 
+function marketplaceSkillBody(skill) {
+  return skill?.example?.input
+    ?? skill?.exampleInput
+    ?? skill?.input?.example
+    ?? skill?.input?.safe_example
+    ?? skill?.input?.safeExample
+    ?? manifestEndpointBody(skill, {})
+}
+
+function marketplaceSkillPriceUsd(skill) {
+  const value = skill?.price?.amount
+    ?? skill?.price?.usd
+    ?? skill?.priceUsd
+    ?? skill?.price_usd
+    ?? skill?.pricePerCall
+  return numberFromDecimal(value)
+}
+
 function manifestEndpointUrl(rawPath, endpoint, baseUrl, sourceUrl) {
   const url = new URL(endpointUrl(rawPath, baseUrl, sourceUrl))
   const parameters = endpoint?.parameters
@@ -404,6 +422,29 @@ function endpointEntries(document, sourceUrl, limit) {
     }
   }
 
+  const marketplaceSkillLists = [
+    document.skills,
+    document.services,
+    document.catalog?.skills,
+    document.catalog?.services,
+  ].filter(Array.isArray)
+
+  for (const skillList of marketplaceSkillLists) {
+    for (const skill of skillList) {
+      if (!skill || typeof skill !== 'object') continue
+      const rawPath = skill.endpoint ?? skill.url ?? skill.path
+      if (!rawPath) continue
+      if (redactedCredentialUrl(rawPath)) continue
+      entries.push({
+        name: skill.slug ?? skill.id ?? skill.name ?? String(rawPath).split('/').filter(Boolean).at(-1) ?? String(rawPath),
+        url: endpointUrl(rawPath, baseUrl, sourceUrl),
+        method: String(skill.method ?? 'POST').toUpperCase(),
+        expectedPriceUsd: marketplaceSkillPriceUsd(skill),
+        requestBody: marketplaceSkillBody(skill),
+      })
+    }
+  }
+
   if (Array.isArray(document.endpoints)) {
     for (const endpoint of document.endpoints) {
       const rawPath = endpoint?.url ?? endpoint?.endpoint ?? endpoint?.path

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "x402-surface-check",
-  "version": "0.2.38",
+  "version": "0.2.39",
   "description": "No-payment x402 public-surface checker for manifests, OpenAPI specs, and HTTP 402 challenges.",
   "type": "module",
   "bin": {

package.json

@@ -455,6 +455,27 @@ data: ${JSON.stringify({
     return
   }
 
+  if (request.url === '/skill-catalog.json') {
+    response.setHeader('content-type', 'application/json')
+    response.end(JSON.stringify({
+      catalog: {
+        version: '1.0',
+        protocol: 'x402',
+        skills: [{
+          id: 'fixture-skill',
+          name: 'Fixture Skill',
+          endpoint: `${serverUrl}/catalog-skill`,
+          method: 'POST',
+          price: { amount: '0.003', currency: 'USD', asset: 'USDC' },
+          example: {
+            input: { url: 'https://example.com/article' },
+          },
+        }],
+      },
+    }))
+    return
+  }
+
   if (request.url === '/string-paid' || request.url === '/string-post' || request.url === '/tool-paid') {
     response.statusCode = 402
     response.setHeader('content-type', 'application/json')
@@ -474,6 +495,40 @@ data: ${JSON.stringify({
     return
   }
 
+  if (request.url === '/catalog-skill') {
+    let body = ''
+    request.on('data', chunk => {
+      body += chunk
+    })
+    request.on('end', () => {
+      const parsed = body ? JSON.parse(body) : {}
+      if (parsed.url !== 'https://example.com/article') {
+        response.statusCode = 400
+        response.setHeader('content-type', 'application/json')
+        response.end(JSON.stringify({ error: 'missing catalog skill example' }))
+        return
+      }
+      response.statusCode = 402
+      response.setHeader('content-type', 'application/json')
+      response.setHeader('access-control-allow-origin', '*')
+      response.setHeader('cache-control', 'no-store')
+      response.end(JSON.stringify({
+        x402Version: 2,
+        error: 'Payment required',
+        accepts: [{
+          scheme: 'exact',
+          network: 'eip155:8453',
+          amount: '3000',
+          asset: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913',
+          payTo: '0x549c82e6bfc54bdae9a2073744cbc2af5d1fc6d1',
+          resource: `${serverUrl}/catalog-skill`,
+          maxTimeoutSeconds: 60,
+        }],
+      }))
+    })
+    return
+  }
+
   if (request.url === '/registry-leak.json') {
     response.setHeader('content-type', 'application/json')
     response.end(JSON.stringify({
@@ -1383,6 +1438,19 @@ try {
   assert.match(resourceManifest.stdout, /eip155:8453/)
   assert.doesNotMatch(resourceManifest.stdout, /Document does not expose/)
 
+  const skillCatalog = await execFileAsync('node', [
+    'bin/x402-surface-check.mjs',
+    `${serverUrl}/skill-catalog.json`,
+    '--origin',
+    'https://example.com',
+  ], { cwd: new URL('..', import.meta.url) })
+
+  assert.match(skillCatalog.stdout, /fixture-skill/)
+  assert.match(skillCatalog.stdout, /catalog-skill/)
+  assert.match(skillCatalog.stdout, /\$0\.003/)
+  assert.doesNotMatch(skillCatalog.stdout, /validation HTTP 400/)
+  assert.doesNotMatch(skillCatalog.stdout, /Document does not expose/)
+
   const registryLeak = await execFileAsync('node', [
     'bin/x402-surface-check.mjs',
     `${serverUrl}/registry-leak.json`,