x402 / MPP conformance testing

Independent conformance testing for x402 and MPP on Stellar.

Wasit runs the real payment flow against your service and verifies the on-chain settlement itself, not just whether the response looks right.

Get started View on GitHub

Open source · Testnet only · No signup required · Why we built this

Try it now

$ npx @wasit-dev/cli test --target <your-service-url>

PASSX402-01402 Response Status

Server responded with 402 as required.

PASSX402-02Payment Header Present

Payment header found.

PASSX402-03Header Payload Decodable

Header decoded to valid JSON.

PASSX402-04Required Fields Present

All required v2 fields present.

PASSX402-05Network Identifier Valid

Network identifier "stellar:testnet" is valid.

PASSX402-06Signature Resubmit Accepted

Valid payment accepted (HTTP 200).

PASSX402-07Invalid Signature Rejectedreject test

Corrupted payment correctly rejected (HTTP 402).

7 passed.

What changes with Wasit

The same request, checked two different ways.

Without Wasit

A 200 OK is the whole signal — nothing confirms the payment actually settled.
Payment and channel bugs surface in production, the first time a real payer hits them.
“It works” means someone tried it once and it didn't error.

With Wasit

Settlement is read from the token contract's own transfer event via Stellar RPC.
The same flow runs ahead of time, including the cases a service is supposed to reject.
Every result traces to a specific check and spec clause in the Check Catalogue.

How it works

Wasit talks to two things: your service, over HTTP, and Stellar, over RPC. It never trusts the first about what happened on the second.

WASITthe checker

YOUR SERVICEthe target

STELLARthe source of truth

React Flow

Step 5 is the point of the tool. A receipt only proves a service claims to have been paid; the chain proves it actually happened. Full flow in the docs →

Frequently asked questions

The things people usually ask before running it.

Does it cost anything to run?

Read-only checks are free. Checks that spend or mutate state are opt-in and clearly flagged before they run.

Is this safe to point at a service I don't control?

Destructive checks require an explicit flag and only run against a channel you name as disposable. Wasit is built for Stellar testnet.

What's the difference between the CLI and the MCP server?

Same core, two interfaces. The CLI runs from your terminal or a CI job; the MCP server exposes the same checks as tools an agent like Claude Code can call directly.

Do I need to sign up or configure anything first?

No signup. Run the install command directly with npx — a private key is only needed for checks that touch a payment or channel.

Where can I see exactly what each check verifies?

The Check Catalogue in the docs lists every check, what it asserts, and which spec or SDK version it was verified against.

Is the source available?

Yes — Apache-2.0, full source and Check Catalogue on GitHub.

Ready to test your x402 or MPP integration?

Point it at your service and get a pass/fail report backed by on-chain verification. No signup, no config file required to start.

One command.Verified on-chain.

$ npx @wasit-dev/cli test --target <your-service-url>

Start testing

Open source · Testnet only · No signup required