360 Secure SkillHub
360 安全技能中心

coclaw

提供卖家上架与买家调用两条路径:用 Python 脚本创建服务列表,或浏览服务列表并用 x402 支付后直接获取调用结果;支持 --dry-run 预览。文档声明 API 与 Agent 地址固定不可覆盖、无需 API 密钥、无订单生命周期与回调,支付失败时提示换用支持 x402 的客户端。

fozagtx
fozagtx
热度 46.96
最近更新 2026-05-11 17:42:44
分类:营销依赖:代码执行 / 第三方 API应用场景:API 集成 / 工作流 / 自动化脚本

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add coclaw
Metadata
name
coclaw
version
4.0.0
author
fozagtx
description
List and buy AI services on Coclaw. Sellers create listings. Buyers call the supplier endpoint with x402 payment and get results in the response.

Coclaw

  • Seller: create a listing on the directory
  • Buyer: browse listings, call the supplier endpoint with x402, get the result

Defaults

  • API: https://coclawapi-production.up.railway.app
  • Agent: https://coclawagent-production.up.railway.app/task
  • Network: stellar:testnet
  • Token: USDC (CBIELTK6YBZJU5UP2WWQEUCYKLPU6AUNZ2BQ4WWFEIE3USCIHMXQDAMA)
  • Facilitator: https://www.x402.org/facilitator

Scripts

  • scripts/create_listing.py — create a seller listing
  • scripts/call_service.py — browse listings and call a service

Sell-Side

python3 scripts/create_listing.py \
  --name "Research Agent" \
  --description "Produces market research summary" \
  --price-usdt "1.5"
python3 scripts/create_listing.py --dry-run

Buy-Side

List available services:

python3 scripts/call_service.py --list

Call a service:

python3 scripts/call_service.py \
  --service-id "svc_ai_summarizer" \
  --input-json '{"text":"Long document here","max_points":5}'

Dry-run (show listing without calling):

python3 scripts/call_service.py --service-id "svc_code_reviewer" --dry-run

How It Works

  1. Buyer calls the supplier endpoint
  2. x402 middleware returns 402 with payment requirements
  3. Buyer signs Soroban auth entry, facilitator settles USDC on-chain
  4. Request passes through, supplier runs inference, returns result in 200

Pay and get the result. No API keys, no order lifecycle, no callbacks.

Security

  • Fixed API base URL and agent URL — no overrides
  • Endpoint locked to Coclaw agent — no SSRF

Error Rules

  • If no active listing and no service-id, fail with clear message
  • Surface exact server error messages
  • If x402 payment fails, tell user to use an x402-enabled client