Roundhouse

ForwardLane

List security findings detected in repository source code, newest first; each item names the repository, file, pattern and severity. For credential-class findings (hardcoded keys, passwords, tokens) the file name is withheld and only its directory is shown.

OtherLiveeip155:8453Uptovia cdp
https://agents.forwardlane.com/api/security
Code-intelligenceDue-diligenceKnowledge-graphFiboSecurity
Calls · 30d
1
This endpoint's own trailing-30-day call count, as published by the upstream catalog and snapshotted daily. 4 snapshots so far.
—
Verified settled volume
0 settlements proven x402 by their on-chain EIP-3009 marker.
$10.00
Listed price
As published in the catalog. Always read the live 402 before paying.
1
Calls · 30d
Upstream's own call count for this endpoint, not ours.
1
Unique payers · 30d
Last called 2026-10-23 01:48Z
—
Upstream on-chain volume
Reported by the source catalog.
Paid to
0xfa44101f7ac50ea37c563431e486b1c9bddb6dbc

The wallet the 402 directs payment to. Its whole payment record — every payer, every chain — is on the merchant page.

Asset 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913

Provider

The payTo wallet does not resolve to a registered ERC-8004 agent. That is not a verdict on the service — most of the catalog is unregistered.

Live 402 challenge

Captured by the enrichment pass, not read just now. Prices can change — always read the 402 the endpoint answers with.

{
  "auth": {
    "note": "Pay-as-you-go needs no registration: settle this challenge as usual. Buying a plan instead requires an agent identity credential (Authorization: Bearer, or ZC-Agent-Authorization: Bearer alongside an MPP Payment credential) on every payment rail - register once at this host's identity endpoints (anonymous registration is one free API call; credentials are shared across every storefront on this network). Full recipe: https://agents.forwardlane.com/auth.md.",
    "recipe": "https://agents.forwardlane.com/auth.md",
    "presentation": {
      "scheme": "Bearer",
      "alternateUse": "authorization_reserved",
      "standardHeader": "Authorization",
      "alternateHeader": "ZC-Agent-Authorization"
    },
    "authorizationServer": "https://agents.forwardlane.com"
  },
  "card": {
    "payUrl": "https://agents.forwardlane.com/payments/apay_Mma-uQgtzJJlOBzpjMX4z/card",
    "accepts": {
      "checkout": {
        "note": "Creating the unpaid checkout needs no funds or card. Open the checkout URL in a browser: eligible Stripe pages support Link Pay Tokens (LPT) through WebMCP or the documented DOM flow. Follow this storefront's /payment/card.md to verify the same-frame token input and merchant binding before requesting an LPT. Token submission requires payment authorization. If unavailable, privately send the checkout URL to your human to pay. Deliver the URL to your human (in chat or your final report) and poll statusUrl; once they pay, retry the original request with the zc-payment-id header.",
        "send": {
          "checkout": true
        },
        "type": "hosted_checkout"
      },
      "sharedPaymentToken": {
        "via": "www-authenticate",
        "docs": "https://docs.stripe.com/agentic-commerce/concepts/shared-payment-tokens",
        "note": "A single-use shared payment token granted for this seller's Stripe account, settled over the standard MPP lane: this 402's www-authenticate carries a method=\"stripe\" charge challenge - answer it with the credential in Authorization (Authorization: Payment <credential>); when a bearer is required, send it as ZC-Agent-Authorization: Bearer <token>. Never send the spt_ in the body. Link wallets settle automatically with `link-cli mpp pay`.",
        "type": "stripe_shared_payment_token",
        "networkId": "profile_61VNto1TpJh15szjtA6VNto107SQudIH1mWVNxY0mDlQ",
        "stripeAccountId": "acct_1UEHTQP2IVQ8kHP3"
      }
    },
    "statusUrl": "https://agents.forwardlane.com/payments/apay_Mma-uQgtzJJlOBzpjMX4z",
    "instructions": "POST exactly one accepted field as JSON to payUrl. When the payment completes (statusUrl answers complete), retry the original request unchanged with header zc-payment-id: apay_Mma-uQgtzJJlOBzpjMX4z. Per-call card payments need no registration and no bearer. This price is a CEILING: the card is only AUTHORIZED for $10.00 — no funds are captured up front. After delivery the seller reports metered usage and exactly the metered actual is charged (minimum settle $0.50); the rest of the authorization is released. The statement shows one final charge at or below the ceiling, never a refund. Relay this to your human if they approve the amount.",
    "bearerRequired": false
  },
  "plan": {
    "id": "pln_lBH0v19ZL74CtK20_3jzJ",
    "slug": "payg",
    "billingMode": "payg"
  },
  "error": "payment_required",
  "terms": {
    "note": "By paying this challenge, whether directly or through an agent acting on your behalf, you accept the platform's buyer terms of service; an agent's payment and acceptance are attributed to you and bind you as if you had taken them yourself.",
    "links": [
      {
        "url": "https://www.zeroclick.ai/legal/buyer-terms-of-service",
        "kind": "platform_terms_of_service"
      }
    ]
  },
  "usage": [
    {
      "meterSlug": "finding",
      "maxQuantity": 100
    }
  ],
  "accepts": [
    {
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "extra": {
        "name": "USD Coin",
        "billing": {
          "model": "reserve-and-pay-actual",
          "description": "amount is a ceiling, NOT the charge. Your wallet reserves up to this much, then you are debited only your actual usage after the work runs; the reserved remainder never leaves your wallet, and a failed delivery debits nothing."
        },
        "version": "2",
        "zeroclick": {
          "kind": "transaction",
          "zcRequestId": "zcreq_yrznDAOusjNyaULSUIIzH",
          "agentPaymentId": "apay_Mma-uQgtzJJlOBzpjMX4z"
        },
        "facilitatorAddress": "0x625d8a65134079f8faAAc39a7947c73d93C6aC39"
      },
      "payTo": "0x3a2219d48eb6c8aa2c7b0aadadf245974e42920b",
      "amount": "10000000",
      "scheme": "upto",
      "network": "eip155:8453",
      "maxTimeoutSeconds": 1800
    },
    {
      "asset": "USD",
      "extra": {
        "payUrl": "https://agents.forwardlane.com/payments/apay_Mma-uQgtzJJlOBzpjMX4z/card",
        "methods": {
          "checkout": {
            "send": {
              "checkout": true
            },
            "human": "required"
          },
          "sharedPaymentToken": {
            "via": "www-authenticate",
            "docs": "https://docs.stripe.com/agentic-commerce/concepts/shared-payment-tokens",
            "note": "Settled over the standard MPP lane: answer the 402's method=\"stripe\" www-authenticate challenge with the spt_ credential in Authorization (Authorization: Payment <credential>); on purchases and top-ups send your access token as ZC-Agent-Authorization: Bearer <token>. Never send the spt_ in a body.",
            "networkId": "profile_61VNto1TpJh15szjtA6VNto107SQudIH1mWVNxY0mDlQ",
            "stripeAccountId": "acct_1UEHTQP2IVQ8kHP3"
          }
        },
        "version": "1",
        "statusUrl": "https://agents.forwardlane.com/payments/apay_Mma-uQgtzJJlOBzpjMX4z",
        "cappedNote": "Amount is a CEILING: the card is only AUTHORIZED for it. After delivery exactly the metered actual is captured (minimum $0.50) and the rest of the hold is released - one final charge at or below the ceiling, never a refund.",
        "retryHeader": "zc-payment-id"
      },
      "payTo": "merchant",
      "amount": "1000",
      "scheme": "exact",
      "network": "zeroclick:card",
      "maxTimeoutSeconds": 3600
    }
  ],
  "payment": {
    "id": "apay_Mma-uQgtzJJlOBzpjMX4z",
    "amountUsd": "10.000000",
    "stripePaymentIntentId": "pi_3UTYV2P2IVQ8kHP30zkOSuuv"
  },
  "resource": {
    "url": "https://agents.forwardlane.com/api/security",
    "tags": [
      "code-intelligence",
      "due-diligence",
      "knowledge-graph",
      "fibo",
      "security"
    ],
    "iconUrl": "https://www.forwardlane.com/assets/logos/ForwardLane_Logo_Horizontal_Transparent.png",
    "mimeType": "application/json",
    "description": "List security findings detected in repository source code, newest first; each item names the repository, file, pattern and severity. For credential-class findings (hardcoded keys, passwords, tokens) the file name is withheld and only its directory is shown.",
    "serviceName": "ForwardLane"
  },
  "protocols": {
    "mpp": {
      "session": {
        "intent": "session",
        "method": "tempo",
        "challengeId": "aT7Rfcg_FmDMhanBo9VA_gKE2Al9C1YsOYvx_TaHk1Q"
      }
    },
    "x402": {
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "amount": "10000000",
      "scheme": "upto",
      "network": "eip155:8453",
      "x402Version": 2
    }
  },
  "extensions": {
    "terms": {
      "info": {
        "note": "By paying this challenge, whether directly or through an agent acting on your behalf, you accept the platform's buyer terms of service; an agent's payment and acceptance are attributed to you and bind you as if you had taken them yourself.",
        "links": [
          {
            "url": "https://www.zeroclick.ai/legal/buyer-terms-of-service",
            "kind": "platform_terms_of_service"
          }
        ]
      },
      "schema": {
        "type": "object",
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "required": [
          "links"
        ],
        "properties": {
          "note": {
            "type": "string"
          },
          "links": {
            "type": "array",
            "items": {
              "type": "object",
              "required": [
                "kind",
                "url"
              ],
              "properties": {
                "url": {
                  "type": "string"
                },
                "kind": {
                  "enum": [
                    "terms_of_service",
                    "privacy_policy",
                    "additional_terms",
                    "platform_terms_of_service"
                  ],
                  "type": "string"
                }
              }
            }
          }
        }
      }
    },
    "bazaar": {
      "info": {
        "input": {
          "type": "http",
          "method": "GET",
          "queryParams": {
            "limit": 10,
            "severity": "critical"
          }
        }
      },
      "schema": {
        "type": "object",
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "required": [
          "input"
        ],
        "properties": {
          "input": {
            "type": "object",
            "required": [
              "type",
              "method"
            ],
            "properties": {
              "type": {
                "type": "string",
                "const": "http"
              },
              "method": {
                "enum": [
                  "GET",
                  "HEAD",
                  "DELETE"
                ],
                "type": "string"
              },
              "queryParams": {
                "type": "object",
                "properties": {
                  "repo": {
                    "type": "string"
                  },
                  "limit": {
                    "type": "integer",
                    "default": 100,
                    "maximum": 1000,
                    "minimum": 1
                  },
                  "severity": {
                    "enum": [
                      "critical",
                      "high",
                      "medium",
                      "info"
                    ],
                    "type": "string"
                  }
                }
              }
            },
            "additionalProperties": false
          }
        }
      }
    },
    "zeroclick": {
      "info": {
        "payment": {
          "id": "apay_Mma-uQgtzJJlOBzpjMX4z",
          "amountUsd": "10.000000"
        },
        "service": "security-findings",
        "requestId": "zcreq_yrznDAOusjNyaULSUIIzH"
      },
      "schema": {
        "type": "object",
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "required": [
          "payment"
        ],
        "properties": {
          "agentId": {
            "type": "string"
          },
          "payment": {
            "type": "object",
            "required": [
              "id",
              "amountUsd"
            ],
            "properties": {
              "id": {
                "type": "string"
              },
              "amountUsd": {
                "type": "string"
              }
            }
          },
          "service": {
            "type": "string"
          },
          "requestId": {
            "type": "string"
          }
        }
      }
    },
    "eip2612GasSponsoring": {
      "info": {
        "version": "1",
        "description": "The facilitator accepts EIP-2612 gasless Permit to `Permit2` canonical contract."
      },
      "schema": {
        "type": "object",
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "required": [
          "from",
          "asset",
          "spender",
          "amount",
          "nonce",
          "deadline",
          "signature",
          "version"
        ],
        "properties": {
          "from": {
            "type": "string",
            "pattern": "^0x[a-fA-F0-9]{40}$",
            "description": "The address of the sender."
          },
          "asset": {
            "type": "string",
            "pattern": "^0x[a-fA-F0-9]{40}$",
            "description": "The address of the ERC-20 token contract."
          },
          "nonce": {
            "type": "string",
            "pattern": "^[0-9]+$",
            "description": "The current nonce of the sender."
          },
          "amount": {
            "type": "string",
            "pattern": "^[0-9]+$",
            "description": "The amount to approve (uint256). Typically MaxUint."
          },
          "spender": {
            "type": "string",
            "pattern": "^0x[a-fA-F0-9]{40}$",
            "description": "The address of the spender (Canonical Permit2)."
          },
          "version": {
            "type": "string",
            "pattern": "^[0-9]+(\\.[0-9]+)*$",
            "description": "Schema version identifier."
          },
          "deadline": {
            "type": "string",
            "pattern": "^[0-9]+$",
            "description": "The timestamp at which the signature expires."
          },
          "signature": {
            "type": "string",
            "pattern": "^0x[a-fA-F0-9]+$",
            "description": "The 65-byte concatenated signature (r, s, v) as a hex string."
          }
        }
      }
    }
  },
  "serviceSlug": "security-findings",
  "x402Version": 2,
  "zcRequestId": "zcreq_yrznDAOusjNyaULSUIIzH"
}

Accepts

The payment requirements as published to the catalog. Read the live 402 before paying — a price here is a claim, not a quote.

10USDC≈ $10 USD
on Base · upto scheme

Pay 10 USDC on Base to 0xfa44…b6dbc. The signed payment is good for 30 minutes.

Paid to
0xfa44…b6dbc
USD Coin contract
0x8335…02913
Payment window
30 minutes
As published
10000000 smallest units
1000units
on zeroclick:card · exact scheme

That figure is in the token’s smallest units. Roundhouse does not hold this contract’s decimals, so it is shown as published rather than converted.

Paid to
merchant
Token contract
USD
Payment window
1 hour
The catalog’s raw entry
[
  {
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "extra": {
      "name": "USD Coin",
      "billing": {
        "model": "reserve-and-pay-actual",
        "description": "amount is a ceiling, NOT the charge. Your wallet reserves up to this much, then you are debited only your actual usage after the work runs; the reserved remainder never leaves your wallet, and a failed delivery debits nothing."
      },
      "version": "2",
      "zeroclick": {
        "kind": "transaction",
        "zcRequestId": "zcreq_Idy0ji4u1fY6Mj_wGbrS3",
        "agentPaymentId": "apay_j7ev8qlbRxakri2ije7nx"
      },
      "facilitatorAddress": "0x59B7Ebc67a3d627FABAF06768c818638452Ae704"
    },
    "payTo": "0xfa44101f7ac50ea37c563431e486b1c9bddb6dbc",
    "amount": "10000000",
    "scheme": "upto",
    "network": "eip155:8453",
    "maxTimeoutSeconds": 1800
  },
  {
    "asset": "USD",
    "extra": {
      "payUrl": "https://agents.forwardlane.com/payments/apay_j7ev8qlbRxakri2ije7nx/card",
      "methods": {
        "checkout": {
          "send": {
            "checkout": true
          },
          "human": "required"
        },
        "sharedPaymentToken": {
          "via": "www-authenticate",
          "docs": "https://docs.stripe.com/agentic-commerce/concepts/shared-payment-tokens",
          "note": "Settled over the standard MPP lane: answer the 402's method=\"stripe\" www-authenticate challenge with the spt_ credential in Authorization (Authorization: Payment <credential>); on purchases and top-ups send your access token as ZC-Agent-Authorization: Bearer <token>. Never send the spt_ in a body.",
          "networkId": "profile_61VNto1TpJh15szjtA6VNto107SQudIH1mWVNxY0mDlQ",
          "stripeAccountId": "acct_1UEHTQP2IVQ8kHP3"
        }
      },
      "version": "1",
      "statusUrl": "https://agents.forwardlane.com/payments/apay_j7ev8qlbRxakri2ije7nx",
      "cappedNote": "Amount is a CEILING: the card is only AUTHORIZED for it. After delivery exactly the metered actual is captured (minimum $0.50) and the rest of the hold is released - one final charge at or below the ceiling, never a refund.",
      "retryHeader": "zc-payment-id"
    },
    "payTo": "merchant",
    "amount": "1000",
    "scheme": "exact",
    "network": "zeroclick:card",
    "maxTimeoutSeconds": 3600
  }
]

Extensions

{
  "terms": {
    "info": {
      "note": "By paying this challenge, whether directly or through an agent acting on your behalf, you accept the platform's buyer terms of service; an agent's payment and acceptance are attributed to you and bind you as if you had taken them yourself.",
      "links": [
        {
          "url": "https://www.zeroclick.ai/legal/buyer-terms-of-service",
          "kind": "platform_terms_of_service"
        }
      ]
    },
    "schema": {
      "type": "object",
      "$schema": "https://json-schema.org/draft/2020-12/schema",
      "required": [
        "links"
      ],
      "properties": {
        "note": {
          "type": "string"
        },
        "links": {
          "type": "array",
          "items": {
            "type": "object",
            "required": [
              "kind",
              "url"
            ],
            "properties": {
              "url": {
                "type": "string"
              },
              "kind": {
                "enum": [
                  "terms_of_service",
                  "privacy_policy",
                  "additional_terms",
                  "platform_terms_of_service"
                ],
                "type": "string"
              }
            }
          }
        }
      }
    }
  },
  "bazaar": {
    "info": {
      "input": {
        "type": "http",
        "method": "GET",
        "queryParams": {
          "limit": 10,
          "severity": "critical"
        }
      }
    },
    "schema": {
      "type": "object",
      "$schema": "https://json-schema.org/draft/2020-12/schema",
      "required": [
        "input"
      ],
      "properties": {
        "input": {
          "type": "object",
          "required": [
            "type",
            "method"
          ],
          "properties": {
            "type": {
              "type": "string",
              "const": "http"
            },
            "method": {
              "enum": [
                "GET",
                "HEAD",
                "DELETE"
              ],
              "type": "string"
            },
            "queryParams": {
              "type": "object",
              "properties": {
                "repo": {
                  "type": "string"
                },
                "limit": {
                  "type": "integer",
                  "default": 100,
                  "maximum": 1000,
                  "minimum": 1
                },
                "severity": {
                  "enum": [
                    "critical",
                    "high",
                    "medium",
                    "info"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "additionalProperties": false
        }
      }
    }
  },
  "zeroclick": {
    "info": {
      "payment": {
        "id": "apay_j7ev8qlbRxakri2ije7nx",
        "amountUsd": "10.000000"
      },
      "service": "security-findings",
      "requestId": "zcreq_Idy0ji4u1fY6Mj_wGbrS3"
    },
    "schema": {
      "type": "object",
      "$schema": "https://json-schema.org/draft/2020-12/schema",
      "required": [
        "payment"
      ],
      "properties": {
        "agentId": {
          "type": "string"
        },
        "payment": {
          "type": "object",
          "required": [
            "id",
            "amountUsd"
          ],
          "properties": {
            "id": {
              "type": "string"
            },
            "amountUsd": {
              "type": "string"
            }
          }
        },
        "service": {
          "type": "string"
        },
        "requestId": {
          "type": "string"
        }
      }
    }
  },
  "eip2612GasSponsoring": {
    "info": {
      "version": "1",
      "description": "The facilitator accepts EIP-2612 gasless Permit to `Permit2` canonical contract."
    },
    "schema": {
      "type": "object",
      "$schema": "https://json-schema.org/draft/2020-12/schema",
      "required": [
        "from",
        "asset",
        "spender",
        "amount",
        "nonce",
        "deadline",
        "signature",
        "version"
      ],
      "properties": {
        "from": {
          "type": "string",
          "pattern": "^0x[a-fA-F0-9]{40}$",
          "description": "The address of the sender."
        },
        "asset": {
          "type": "string",
          "pattern": "^0x[a-fA-F0-9]{40}$",
          "description": "The address of the ERC-20 token contract."
        },
        "nonce": {
          "type": "string",
          "pattern": "^[0-9]+$",
          "description": "The current nonce of the sender."
        },
        "amount": {
          "type": "string",
          "pattern": "^[0-9]+$",
          "description": "The amount to approve (uint256). Typically MaxUint."
        },
        "spender": {
          "type": "string",
          "pattern": "^0x[a-fA-F0-9]{40}$",
          "description": "The address of the spender (Canonical Permit2)."
        },
        "version": {
          "type": "string",
          "pattern": "^[0-9]+(\\.[0-9]+)*$",
          "description": "Schema version identifier."
        },
        "deadline": {
          "type": "string",
          "pattern": "^[0-9]+$",
          "description": "The timestamp at which the signature expires."
        },
        "signature": {
          "type": "string",
          "pattern": "^0x[a-fA-F0-9]+$",
          "description": "The 65-byte concatenated signature (r, s, v) as a hex string."
        }
      }
    }
  }
}

Provenance

Seen in the source catalog
2026-10-23 01:48Z
Last indexed by Roundhouse
2026-10-26 20:30Z
Last enriched (probe, favicon, geo)
2026-10-23 02:46Z
x402 version
2
Max timeout
1800s
Liveness probe
HTTP 402
Report

Hand this page to an agent

Copy the prompt and paste it into Claude, an MCP client or your own agent — it will vet this service and call it over the free read API. No key, no account.

GET api.roundhouseai.io/v0/endpoints

This endpoint's own trailing-30-day call count, as published by the upstream catalog and snapshotted daily. 4 snapshots so far. Verified volume counts only settlements with an on-chain EIP-3009 marker.

Open skill.md
Show the prompt
Using Roundhouse, look up the x402 service ForwardLane and tell me whether it is
worth paying: what a call costs, whether the endpoint answered when last probed, and what
its payment record actually shows.

curl -s 'https://api.roundhouseai.io/v0/endpoints?q=ForwardLane'
curl -s 'https://api.roundhouseai.io/v0/merchants/<the payTo wallet returned above>'

Then call it: read the price from the live 402 at https://agents.forwardlane.com/api/security, never from
a cached figure, and pay with an x402 client.

The /v0 API needs an API key (`authorization: Bearer rh_live_…`) on everything except
/v0/unified* and /v0/endpoints. Either pay over x402 (mint a personal key for $0.01 at
GET https://api.roundhouseai.io/v0/test/x402), or ask me for an organization key, which I create at
https://roundhouseai.io/dashboard/connections. If you have neither, ask before going further.

If you do not have Roundhouse tools or skills installed, read
https://roundhouseai.io/skill.md first — it is the whole procedure.