[Extension]: Add prepay-audit

[shawn93676]

Extension ID

prepay-audit

Extension Name

AgentPay Pre-Pay Audit — Grade an endpoint before your agent pays it

Version

1.0.0

Description

Audit a paid API before money moves: grade the endpoint's 402 terms, see what the live market actually charges, and confirm the wallet can complete the payment right now.

Author

AgentPay Team

Repository URL

https://github.com/shawnhvac/spec-kit-prepay-audit

Download URL

https://github.com/shawnhvac/spec-kit-prepay-audit/archive/refs/tags/v1.0.0.zip

License

MIT

Homepage (optional)

https://x402-agent-pay.com

Documentation URL (optional)

https://github.com/shawnhvac/spec-kit-prepay-audit#readme

Changelog URL (optional)

https://github.com/shawnhvac/spec-kit-prepay-audit/blob/main/CHANGELOG.md

Required Spec Kit Version

=0.1.0

Required Tools (optional)

• none — all commands call free, keyless HTTPS endpoints

Number of Commands

3

Number of Hooks (optional)

1 (optional after_plan)

Tags

payments, x402, audit, api, usdc

Key Features

• /speckit.prepay-audit.check — grade a paid endpoint's 402 terms from outside with no credentials: 0-100 score, each defect with severity and buyer workaround, all-in cost of one call (price + measured settlement gas against live Base gas and Chainlink ETH/USD), and whether the Payment-Required header survives a default 4KB proxy buffer.
• /speckit.prepay-audit.ready — buyer-side handshake before signing: terms complete enough to sign, named facilitator actually answering, gas priced, wallet USDC balance vs price with the exact shortfall when short. Missing/dead facilitator is a warning (buyer can carry its own); gas never blocks a facilitator-settled payment (EIP-3009).
• /speckit.prepay-audit.market — the live x402 market scan: hosts probed, which are still live behind a paywall, per-endpoint price/score/pay-to and buyer_notes turning each defect into a concrete workaround. Weekly re-probe; an old scan is labeled, never hidden.
• Optional after_plan hook prompts to audit the plan's paid APIs before implementation starts.

Testing Performed

• All three commands verified against live endpoints (report, handshake, heatmap) — the same rails the community can call: https://x402-agent-pay.com/facilitator/report, /handshake, /heatmap.
• Install tested with specify extension add from the release zip; command files load and instructions execute against live infrastructure.
• Verified against Spec Kit v1.0.4.
• Companion extension pay-x402 is already in the community catalog; this extension pairs with it (audit first, then pay under a cap).

Testing Checklist

• Extension installs successfully via download URL
• All commands execute without errors
• Documentation is complete and accurate
• No security vulnerabilities identified
• Tested on at least one real project

Submission Requirements

• Valid extension.yml manifest included
• README.md with installation and usage instructions
• LICENSE file included
• GitHub release created with version tag
• All command files exist and are properly formatted
• Extension ID follows naming conventions (lowercase-with-hyphens)

Proposed Catalog Entry

- [AgentPay Pre-Pay Audit](https://github.com/shawnhvac/spec-kit-prepay-audit) - Grade an x402 endpoint before an agent pays it: inspect its live 402 terms, estimate the all-in settlement cost, check buyer-side payment readiness, and read the current market heatmap.

Testing Details

The three commands were tested against the live, keyless AgentPay endpoints documented in the repository. The release archive is pinned to v1.0.0, and the repository contains the manifest, README, LICENSE, command files, and optional hook.

[github-actions]

cc @github/spec-kit-maintainers — new catalog submission for review.

[github-actions]

Validation failed for prepay-audit.

Passed checks:

• Issue title starts with [Extension]:.
• Extension ID prepay-audit matches ^[a-z][a-z0-9-]*$.
• Version 1.0.0 is valid semver.
• Repository shawnhvac/spec-kit-prepay-audit is publicly accessible and contains extension.yml, README.md, and LICENSE.
• Download URL belongs to the submitted repository and uses the accepted tag-pinned archive pattern.
• Download tag v1.0.0 matches the submitted version.
• GitHub release v1.0.0 exists.
• No sha256 was supplied, so checksum verification is not applicable.

Failed or incomplete checks:

• Proposed Catalog Entry: the required catalog-entry field is missing from the issue body.
• Testing Checklist: the required checklist section is missing, so the required checkboxes cannot be confirmed as checked.
• Submission Requirements: the required checklist section is missing, so the required checkboxes cannot be confirmed as checked.
• Download URL HTTP status: the archive request could not be completed in this run because the execution environment blocked the network request; the URL pinning and release checks passed, but HTTP 200 remains unverified.

Please update the submission with the missing catalog entry and both completed checklist sections, then resubmit after the pinned archive URL can be verified as accessible. No catalog files or pull request were created.

Posted by GitHub Copilot (model: gpt-5.2-codex) on behalf of the Spec Kit catalog maintainers.

Generated by 🧩 Add Community Extension from Issue Submission for issue #4518 · 33.3 AIC · ⌖ 10.6 AIC · ⊞ 29.5K · ◷

[shawn93676]

Updated the submission to address the validator’s exact findings:

• added the required Proposed Catalog Entry field;
• added the completed Testing Checklist and Submission Requirements sections;
• verified the pinned v1.0.0 archive live — HTTP 200, downloadable ZIP.

The repository, tag, and release were already present and valid. Please rerun the catalog validator when convenient.