Skip to content

feat(discovery): serve /.well-known/x402 on nixamp.com (#409) - #424

Merged
ralyodio merged 1 commit into
mainfrom
fix/well-known-x402
Nov 11, 2026
Merged

ralyodio merged 1 commit into
mainfrom
fix/well-known-x402

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Closes #409.

  • GET /.well-known/x402 (and .json) on nixamp.com: {version: 1, resources: ["https://nixamp.com/crawl"], items, mcp, oauth, llms, openapi}. The crawl day pass is the one fixed paid resource; ticketed shows are described as /live/{slug}/tickets.
  • llms.txt gets an ## x402 section.
  • The probe's second finding (/mcp 401 on initialize) is by design: the 401 + WWW-Authenticate: Bearer resource_metadata=... is how MCP clients find OAuth. /mcp/public answers initialize with no account; the new document points at it.

Tests: bun test test/discovery.test.ts (6 pass), paywall/access/server tests (73 pass), tsc --noEmit clean.

🤖 Generated with Claude Code

Machine buyers that enumerate x402 sellers by convention found no
/.well-known/x402 and skipped nixamp.com. It now lists the crawl day pass
(/crawl) as a resource, describes per-show tickets, and points at both MCP
endpoints. /mcp stays a 401 with WWW-Authenticate on purpose (OAuth
discovery); /mcp/public is the open one, and the document says so.
llms.txt gains an x402 section.

Closes #409

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@ralyodio
ralyodio merged commit 455f51d into main Nov 11, 2026
3 checks passed
@ralyodio
ralyodio deleted the fix/well-known-x402 branch November 11, 2026 08:36
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

0 finding(s) in the 2 file(s) this pull request changes.

Nothing in the files this pull request changes.

56 pre-existing finding(s) elsewhere in the repository — **HIGH**: 17 | **MEDIUM**: 15 | **LOW**: 24

Not introduced by this pull request.

Severity Rule Location
HIGH secret-database-url .github/workflows/translation.yml:31
HIGH secret-generic-credential src/hls.ts:81
HIGH js-ssrf-outbound-request src/music-hub.ts:304
HIGH js-host-header-trust src/server.ts:3111
HIGH js-host-header-trust src/server.ts:3125
HIGH js-host-header-trust src/server.ts:3142
HIGH js-host-header-trust src/server.ts:3151
HIGH js-host-header-trust src/server.ts:3156
HIGH js-host-header-trust src/server.ts:3259
HIGH js-host-header-trust src/server.ts:3325
HIGH js-host-header-trust src/server.ts:3412
HIGH js-host-header-trust src/server.ts:3440
HIGH js-host-header-trust src/server.ts:3610
HIGH js-host-header-trust src/server.ts:3626
HIGH js-ssrf-outbound-request web/src/app.ts:115
HIGH js-ssrf-outbound-request web/src/app.ts:163
HIGH js-ssrf-outbound-request web/src/app.ts:167
MEDIUM js-unescaped-html-sink backtoschool/src/main.ts:95
MEDIUM js-unescaped-html-sink backtoschool/src/main.ts:241
MEDIUM js-unescaped-html-sink backtoschool/src/main.ts:257

…and 36 more; the full set is in the SARIF artifact.

Snippets are redacted; ThreatCrush never prints matched credential material.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

nixamp.com: live 402 with a machine-buyer defect (no_well_known)

1 participant