Security at Agent402.
Agent402.Tools is operated by Havok Holdings LLC. This page states how the hosted service is built, what it holds, and how to report a problem. Every control named here is in the open-source server and can be read.
Report a vulnerability
Open a private advisory on GitHub or email security@agent402.tools. We acknowledge within two business days, fix through the same CI pipeline every change goes through, and note the fix in the changelog once it has shipped.
Good-faith research inside the scope below will not be met with legal action. Scope: agent402.tools, the /mcp connector, the /v1 gateway, the x402 and MPP paywall on every paid route, the prepaid credits gate, the card front door (/reports, /monitors, /credits, the Stripe webhook) and the published packages. Out of scope: the payment protocols themselves, third-party facilitators and chains, and volumetric denial of service.
What we hold
No accounts and no passwords. Agents pay per call from their own wallets; what we keep is the wallet address and transaction id, both already public on-chain. A card purchase leaves the email Stripe collected, the session id, the input and the finished report, held while the report link or subscription is live. Wallet-keyed memory belongs to its owner and lives until they delete it. Free email alerts hold an address only after it is confirmed by a signed link and drop it the moment it unsubscribes.
Operational logs carry request paths and status codes for days, not months. The full inventory, retention per class and the erasure path are in the privacy policy.
Key handling
Payments are non-custodial: buyers sign with their own keys, settlement goes to a public treasury address, and no customer key ever reaches the server. The wallets the service spends from are dedicated, low-balance and alarmed; the treasury never signs a request. Production secrets live only in the hosting platform's variable store, are never committed, and CI signing and publishing keys are scoped Actions secrets with npm publishing on OIDC provenance. Links we email (confirmations, unsubscribes, monitor management) are HMAC-signed with dedicated secrets and verified in constant time.
Controls in the serving path
Every tool that fetches a caller-supplied URL goes through a DNS-pinned SSRF guard that refuses private, link-local and metadata addresses and re-validates on redirects; the headless browser runs in a separate secretless worker behind the same egress guard. The free tier is a signed, single-use, slug-scoped proof-of-work token. Settlement runs after the handler, so an error is never charged, and a settled receipt that arrives on a failed response is ledgered as a debt with an on-chain proof step before any refund leaves. Per-IP and shared rate limits fail closed; a wallet blocklist is enforced before settlement; every response carries a strict content security policy, HSTS and no inline scripts.
Controls on the code
The server is open source under AGPL-3.0, so every control on this page can be read. Every pull request runs CodeQL, gitleaks secret scanning with a planted-canary self-check, Socket dependency review, DCO sign-off and the full test lanes, and every one is a required check before merge; every GitHub Action is pinned to a full commit SHA; the payment, gating and CI paths require code-owner review; the container image is pinned by digest and runs as a non-root user.
Availability
Uptime is measured from outside production by two independent observers on separate infrastructure, and the status page renders only what they observed: a day with no observation is shown as no data, never as uptime. A real-money canary buys through every payment rail daily. Backups of the data volume go offsite nightly with bounded retention.