Developer builds HTTP 402 reverse proxy to charge AI agents per API call

·3 views

A developer has released x402-micro-tollgate, an open-source Express-based tool that acts as both an HTTP 402 reverse proxy and an MCP server. The project was built to enable per-call payments for existing HTTP APIs without distributing API keys. Ungated routes return a 402 Payment Required response, and requests are only forwarded to the upstream URL after payment is settled. The tool also exposes MCP tools, with some available for free and others requiring payment. It can be self-hosted via npx and is available on both GitHub and npm.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How Well-Written Pull Requests Make Code Review Faster and More Effective

A poorly documented pull request with a blank description, a vague title, and 600 lines of unexplained changes once slipped past review and crashed a production checkout flow. The incident highlights how PRs are often treated as bureaucratic checkboxes rather than collaborative conversations, undermining their core purpose. A pull request is a formal request to merge code changes into a main branch, but its real value lies in the social layer — the discussion, decisions, and context it preserves for future developers. Experts recommend that PR titles clearly state the change in imperative form, while descriptions should answer why the change was made, what it includes, and how to test it. Following these practices can significantly reduce review turnaround time and improve overall code quality across engineering teams.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Smart Contract Token Approvals Are Transactions, Not Toggles

Token approvals on ERC-20 contracts are stored on-chain as allowance entries, not app-level settings, meaning any system relying on them must treat that on-chain record as the sole source of truth. Revoking an approval is itself a full blockchain transaction that must be signed, broadcast, and confirmed — it is not instant and can be delayed by network congestion. Services that cache approval states locally risk acting on stale data, either attempting to spend tokens already revoked or blocking valid spends when a revocation is still unconfirmed. The safest engineering practice is to read the allowance directly from the chain immediately before executing any token transfer, rather than relying on a database record. This approach adds RPC latency and infrastructure load but prevents a class of bugs where a system's internal state diverges from what the token contract will actually permit.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Attackers Can Silently Disable AWS CloudTrail Logging With a Single API Call

Security researchers warn that an attacker who gains access to an AWS account can halt audit logging with a single command — aws cloudtrail stop-logging — leaving the trail's configuration visually intact while new events stop being recorded. The technique, catalogued under MITRE ATT&CK as T1562.008, is well-documented in Mandiant incident reports and AWS security guidance. Because standard inspection commands like describe-trails and GetTrail do not reveal the logging state, only get-trail-status exposes the critical IsLogging: false flag. Inside this blind window, attackers can exfiltrate secrets, create persistent backdoor IAM users, and rotate KMS keys to prevent decryption of existing log archives — all without generating a CloudTrail record. Security teams are advised not to treat 'trail configured' as equivalent to 'trail running,' and to actively monitor the logging status field rather than relying solely on static configuration audits.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Silent calendar bug corrupted five years of Korean astrology charts, tests missed it

A developer building a Korean saju (BaZi) astrology service discovered that a third-party calendar library was returning the same solar term timestamp for every year, regardless of the year passed as input. The bug meant that birth charts for anyone born on or near a solar term boundary between 2020 and 2030 — except 2026 — may have been calculated incorrectly, sometimes by as much as twelve hours. The flaw went undetected for five years because the test suite's expected values had been derived from the same faulty library, making the tests confirm the library's output rather than astronomical reality. A secondary issue compounded the problem: all test probes had been chosen on the same side of the real boundary, so they would have passed even against an independent correct dataset. The developer has since replaced the dependency with verified astronomical data and redesigned the tests to assert that different years must produce distinct solar term instants.

0 comments Read more at DEV Community