Skip to content

TRX-006Buy

Machine Payments Protocol (MPP) discovery published

Checks whether your shop publishes Machine Payments Protocol (MPP) discovery, or answers with an MPP payment challenge.

What we check

The Machine Payments Protocol, from Tempo and Stripe, is defined by two Internet-Drafts dated 2026-09-23: draft-payment-discovery-01 and draft-httpauth-payment-01. They are drafts, not finished standards. Discovery is an OpenAPI document at /openapi.json in which each payable operation carries x-payment-info: one offer, or an offers list, each with an intent of "charge" or "session" and a method. At runtime, a payable request is answered with HTTP 402 and a WWW-Authenticate: Payment challenge, which the draft treats as authoritative.

Why it matters

Like x402, MPP is built for agents paying per request for APIs and services; it has no cart or shipping model. For a shop selling physical goods it is usually not relevant. If you do sell API or service access to agents, discovery lets an agent see which operations cost money, and how to pay, before it calls them.

How we check

We request /openapi.json once, and reuse the /api request from the x402 check. PASS when /api answers 402 with WWW-Authenticate: Payment, or when /openapi.json is an OpenAPI JSON document with at least one operation carrying valid x-payment-info, served as application/json, application/openapi+json or application/vnd.oai.openapi+json. WARN when the body is not JSON, is not an OpenAPI document, has x-payment-info without a valid intent or method, or has another media type. FAIL when there is no document (404, 410, or your HTML page), or when it is an OpenAPI document with no x-payment-info, such as an ordinary REST API description. We SKIP when /openapi.json was bot-blocked, refused, or answered 429 or 5xx, unless a Payment challenge was seen. The draft's amount field is not graded.

How to fix it

  1. Only act on this if agents can pay per request for your APIs or services; most product shops can ignore it.
  2. Serve an OpenAPI document at /openapi.json as application/json, and on each payable operation add x-payment-info with intent (charge or session), method and amount.
  3. Have those operations answer 402 with a WWW-Authenticate: Payment challenge, as described in draft-httpauth-payment.

What good looks like

GET /openapi.json   (Content-Type: application/json)
{
  "openapi": "3.1.0",
  "info": { "title": "Shop data API", "version": "1" },
  "paths": {
    "/api/stock": {
      "get": {
        "x-payment-info": {
          "intent": "charge",
          "method": "tempo",
          "amount": "1000"
        },
        "responses": { "200": { "description": "OK" },
                       "402": { "description": "Payment required" } }
      }
    }
  }
}

Sources