Solidity security reports your agent can buy in one HTTP call.

Any x402 v2 client works. An unpaid request returns 402 with a payment-required header (scheme exact, network eip155:8453, USDC). Sign it and retry with payment-signature.

The payment authorization is verified, the analysis runs in an isolated sandbox, and settlement is attempted only after a signed report exists. Invalid input (400) or failed analysis (422) is never settled and says charged:false. The report is released only when the USDC transfer is proven on Base. If settlement is still unconfirmed, you get 202 SETTLEMENT_PENDING: resend the identical request to collect the report once it confirms, or a 402 charged:false if it never does. One authorization buys exactly one report and is never charged twice.

Input is {"address","chain_id"} for a Sourcify-verified contract, {"source"} for one file, or {"sources":{path:src},"target"} for several.

curl -i -X POST https://omni-audit.pplx.app/port/5000/v1/contract-audit/quick \
  -H 'content-type: application/json' \
  -d '{"address":"0x4200000000000000000000000000000000000006","chain_id":8453}'
# → 402 payment-required (1000000 = 1.00 USDC)

# with an x402 client, e.g. @x402/fetch:
const res = await fetchWithPayment(URL, {
  method: "POST", headers: {"content-type":"application/json"},
  body: JSON.stringify({ source: soliditySource })
});