{
  "note": "Demo sellers never accept payment. Pass `listing` as `expected` to POST /probe-payment or POST /check-payment.",
  "scenarios": [
    {
      "key": "honest",
      "title": "Honest seller",
      "story": "Charges the listed 0.001 USD₮0 to the listed wallet with the correct EIP-712 domain.",
      "expected_verdict": "ALLOW",
      "endpoint": "https://guardian-mcp-rho.vercel.app/demo/x402/honest",
      "listing": {
        "endpoint": "https://guardian-mcp-rho.vercel.app/demo/x402/honest",
        "feeAmount": 0.001,
        "feeToken": "0x779ded0c9e1022225f8e0630b35a9b54be713736",
        "payTo": "0xe1c6f89df50fb68282d52e34d6001d65005ff67b"
      }
    },
    {
      "key": "price-bait",
      "title": "Price bait-and-switch",
      "story": "Listed at 0.001 USD₮0, but the 402 asks for 1.0 USD₮0, 1000 times the listing.",
      "expected_verdict": "DENY",
      "endpoint": "https://guardian-mcp-rho.vercel.app/demo/x402/price-bait",
      "listing": {
        "endpoint": "https://guardian-mcp-rho.vercel.app/demo/x402/price-bait",
        "feeAmount": 0.001,
        "feeToken": "0x779ded0c9e1022225f8e0630b35a9b54be713736",
        "payTo": "0xe1c6f89df50fb68282d52e34d6001d65005ff67b"
      }
    },
    {
      "key": "payee-swap",
      "title": "Poisoned payee",
      "story": "The payee starts with 0xe1c6 and ends with f67b like the wallet the buyer expects, but the middle differs.",
      "expected_verdict": "DENY",
      "endpoint": "https://guardian-mcp-rho.vercel.app/demo/x402/payee-swap",
      "listing": {
        "endpoint": "https://guardian-mcp-rho.vercel.app/demo/x402/payee-swap",
        "feeAmount": 0.001,
        "feeToken": "0x779ded0c9e1022225f8e0630b35a9b54be713736",
        "payTo": "0xe1c6f89df50fb68282d52e34d6001d65005ff67b"
      }
    },
    {
      "key": "fake-token",
      "title": "Fake stablecoin",
      "story": "The asset looks like USD₮0 (0x779d…3736) but is a different address with no token contract.",
      "expected_verdict": "DENY",
      "endpoint": "https://guardian-mcp-rho.vercel.app/demo/x402/fake-token",
      "listing": {
        "endpoint": "https://guardian-mcp-rho.vercel.app/demo/x402/fake-token",
        "feeAmount": 0.001,
        "feeToken": "0x779ded0c9e1022225f8e0630b35a9b54be713736",
        "payTo": "0xe1c6f89df50fb68282d52e34d6001d65005ff67b"
      }
    },
    {
      "key": "wrong-domain",
      "title": "Wrong EIP-712 domain",
      "story": "Declares the token name \"USDT\". The USD₮0 contract signs as \"USD₮0\" version 1, so a signature built from this challenge fails at settlement. Seen on live OKX.AI listings.",
      "expected_verdict": "WARN",
      "endpoint": "https://guardian-mcp-rho.vercel.app/demo/x402/wrong-domain",
      "listing": {
        "endpoint": "https://guardian-mcp-rho.vercel.app/demo/x402/wrong-domain",
        "feeAmount": 0.001,
        "feeToken": "0x779ded0c9e1022225f8e0630b35a9b54be713736",
        "payTo": "0xe1c6f89df50fb68282d52e34d6001d65005ff67b"
      }
    },
    {
      "key": "field-injection",
      "title": "Shell payload in the challenge",
      "story": "The token name breaks out of quotes and chains a curl command, the same shape found on a live OKX.AI listing.",
      "expected_verdict": "DENY",
      "endpoint": "https://guardian-mcp-rho.vercel.app/demo/x402/field-injection",
      "listing": {
        "endpoint": "https://guardian-mcp-rho.vercel.app/demo/x402/field-injection",
        "feeAmount": 0.001,
        "feeToken": "0x779ded0c9e1022225f8e0630b35a9b54be713736",
        "payTo": "0xe1c6f89df50fb68282d52e34d6001d65005ff67b"
      }
    },
    {
      "key": "header-body-split",
      "title": "Header and body disagree",
      "story": "The 402 JSON body shows the listed wallet, but the PAYMENT-REQUIRED header pays a different address. An agent that reads only the body sees an honest payment.",
      "expected_verdict": "DENY",
      "endpoint": "https://guardian-mcp-rho.vercel.app/demo/x402/header-body-split",
      "listing": {
        "endpoint": "https://guardian-mcp-rho.vercel.app/demo/x402/header-body-split",
        "feeAmount": 0.001,
        "feeToken": "0x779ded0c9e1022225f8e0630b35a9b54be713736",
        "payTo": "0xe1c6f89df50fb68282d52e34d6001d65005ff67b"
      }
    }
  ]
}