Fixed price
49.00 USDC
Base Mainnet, 49,000,000 base units. The live challenge will be authoritative once payment is promoted.
[ machine product // contract v1.0.0 ]
One agent. One tool server. One compatibility verdict you can inspect.
The Agent Infrastructure Compatibility Pack exercises one A2A agent and one MCP server against caller-declared tool, task and payment policy. It returns source-linked, hashed findings—not a generic market report or a certification badge.
Bounded scope
1 A2A + 1 MCP
One declared non-mutating skill and tool. JSON-RPC only. No open-ended scanning.
Current status
Contract published
Payment remains withheld until durable delivery and automatic refund recovery pass Production E2E.
What the report answers
Identity & protocol
Discovery bound
Agent Card, RPC URL, tools/list inventory, declared methods and schema evidence are captured with timestamps and hashes.
Policy
Allowlist enforced
The selected skill, tool, methods, timeout and per-call/task payment ceilings are evaluated without silently broadening policy.
Payment
Challenge inspected
Network, asset, payee and amount are compared with policy. Maha never holds the buyer key or settles an upstream payment.
Auditability
Evidence attached
Every finding carries a bounded observation, source URL, observed time and SHA-256 digest.
Sample decision: conditionally compatible
2 passed · 1 failed · 1 not checked · highest severity medium
identity // pass
The Agent Card was reachable, parseable and bound the declared skill to the tested RPC URL.
policy // pass
tools/list exposed the declared non-mutating tool and the allowlist admitted only that tool.
payment // fail
The upstream challenge fit the per-call ceiling but could not be proven against a durable multi-call task budget.
payment // not_checked
No upstream payment was signed or settled by this assessment.
Failure and refund behavior
- No charge: invalid schema, unsafe target, unreachable preflight target, or unsupported authentication.
- Report, no refund: incompatibility, policy rejection, target timeout/error, or payment terms outside policy. Those are the findings purchased.
- Full automatic refund: Maha fails after settlement, cannot confirm durable report storage, or misses the delivery target.
- No duplicate charge: retries bind clientRequestId to the input hash and return the original report.
Limitations
- Point-in-time compatibility evidence, not continuous monitoring or certification.
- JSON-RPC request/response only; SSE, push notifications, file parts and webhooks are not exercised.
- One caller-declared non-mutating A2A skill and one caller-declared non-mutating MCP tool are exercised.
- Upstream x402 challenges are inspected against policy, but Maha does not hold a buyer key, sign, or settle an upstream payment.
- Not a penetration test, vulnerability assessment, legal opinion, compliance certification or uptime guarantee.
- Version 1 supports public endpoints and bearer credentials supplied for the run; interactive OAuth and mTLS are out of scope.