# Openmail - Agent Payment Report

- Domain: openmail.sh
- Category: Email & Messaging
- Company type: machine api
- Payment systems found: None detected
- Agent interfaces found: None detected
- Payer platforms or methods: None detected
- Vendor roles: None cataloged
- Strongest evidence: **Not evaluated**
- Score version: `agent-payments-v4`
- Last scanned: 2026-08-20T19:16:21.756468+00:00

## Payment documentation

- No payment protocols documented.

## Scores

| Dimension | Score |
|-----------|-------|
| Payment readiness | 0 |
| Agent access | — |
| Overall readiness | 0 |

An em dash means there is not enough evidence to calculate that dimension. A public support claim is not treated as a completed payment.

## Payment Checks

Each section shows what was found, what still needs work, and the strongest available evidence. Not-applicable systems do not reduce the score.

### x402 payments

- Company signal: Not detected

#### Is at least one accepted payment option complete enough for a payer to execute?

- Status: Needs fix
- Result: The x402 challenge is missing a complete accepted payment option or paid-resource binding.
- Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence.
- How to fix: Include scheme, network, asset, positive amount, recipient/payTo, and resource binding for at least one accepted option.

#### Is the payment challenge protected from stale public caching?

- Status: Needs fix
- Importance: Recommended
- Result: No x402 challenge was detected.
- Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence.
- How to fix: Return Cache-Control: no-store on unpaid x402 challenge responses.

#### Is there a concrete paid endpoint or tool the agent can discover?

- Status: Needs fix
- Result: A URL, OpenAPI operation, or protocol mention is not enough to prove a concrete payable x402 resource.
- Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence.
- How to fix: Publish a concrete paid endpoint with method, price behavior, scheme, network, asset, and expected result.

#### Are HTTP, MCP, and A2A x402 claims evaluated separately?

- Status: Not applicable
- Result: Transport separation is not scored because no x402 challenge or explicit x402 claim was detected.

#### Does an unpaid request return an x402 challenge?

- Status: Needs fix
- Result: The unpaid response did not include a decodable x402 V2 payment challenge.
- Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence.
- How to fix: Return HTTP 402 with a decodable x402 V2 PAYMENT-REQUIRED challenge.

### MPP payments

- Company signal: Not detected

#### Can the agent understand the shared and method-specific payment terms before payment?

- Status: Needs fix
- Result: Observed amount=None, currency=None, recipient=None, resource=None.
- Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence.
- How to fix: Include the shared amount and currency or asset fields, plus any fields required by the selected MPP method and intent. Recipient and description are method-specific and are not universally required.

#### Are MPP challenges and receipts cache-safe?

- Status: Needs fix
- Importance: Recommended
- Result: Cache headers were not scored because no MPP Payment challenge was detected.
- Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence.
- How to fix: Return Cache-Control: no-store on MPP challenge responses.

#### Is the MPP challenge identifiable and bound to a payment intent?

- Status: Needs fix
- Result: The challenge must include id, realm, a lowercase method, and a registered intent.
- Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence.
- How to fix: Include id, realm, a lowercase method, a registered intent, and a decodable request parameter in the MPP challenge.

#### Does an unpaid request return an MPP Payment challenge?

- Status: Needs fix
- Result: The endpoint did not return an MPP Payment challenge.
- Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence.
- How to fix: Return HTTP 402 with WWW-Authenticate: Payment.

#### Is the MPP service discoverable from the canonical OpenAPI route?

- Status: Needs fix
- Result: Agents need a public OpenAPI 3.1 /openapi.json document with x-payment-info.offers to discover MPP paid operations.
- Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence.
- How to fix: Serve GET /openapi.json with OpenAPI 3.1 and x-payment-info.offers for each MPP paid operation; validate it with mppx discover validate.

#### Is the MPP service publicly listed?

- Status: Needs verification
- Importance: Optional
- Result: Public listing is curated and not automatic after protocol validation.
- Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence.
- How to fix: Register the deployed API in MPPScan and, if it accepts live MPP payments, submit a service-directory pull request to tempoxyz/mpp.

#### Is there a concrete payable resource or tool?

- Status: Needs fix
- Result: A URL, OpenAPI operation, or protocol mention is not enough to prove a concrete payable MPP resource.
- Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence.
- How to fix: Publish a concrete MPP-protected endpoint or OpenAPI operation with payment information.

#### Is the challenge bounded to the current request and validity window?

- Status: Needs fix
- Result: The challenge does not include enough request-bound payment terms to verify it safely.
- Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence.
- How to fix: Bind the challenge ID to amount, currency, recipient, intent, protected route, and request digest where applicable; verify this with negative runtime tests.

### UCP checkout

- Company signal: Not detected

#### Are declared external UCP service endpoints reachable?

- Status: Not applicable
- Result: No external UCP service endpoint is declared; the registries may be empty or embedded-only.

#### Is the UCP business profile publicly discoverable?

- Status: Needs fix
- Result: No usable resource was found at /.well-known/ucp (HTTP 404).
- Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence.
- How to fix: Serve a schema-valid public UCP business profile at /.well-known/ucp without authentication.

#### Is checkout capability claimed with enough structure to test later?

- Status: Needs fix
- Result: No structurally valid dev.ucp.shopping.checkout capability was declared.
- Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence.
- How to fix: Declare dev.ucp.shopping.checkout with version and schema when UCP checkout is supported.

#### Does the profile declare payment handlers?

- Status: Needs fix
- Result: The UCP profile does not contain a valid payment-handler registry.
- Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence.
- How to fix: Include the payment_handlers registry. Each declared handler entry requires version and id; config is optional.

#### Are signing keys published for message verification?

- Status: Needs fix
- Result: Signed messages, webhooks, or signing keys are claimed, but no valid keys array was found.
- Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence.
- How to fix: Publish public JWKs in top-level keys[]. Each key requires kid and kty; EC keys require crv/x/y and OKP keys require crv/x. alg is optional.

#### Does the profile follow the UCP business-profile registries?

- Status: Needs fix
- Result: The UCP profile exists, but its services, capabilities, or payment handlers use the wrong structure.
- Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence.
- How to fix: Declare a YYYY-MM-DD ucp.version plus services and payment_handlers registries. Capabilities are optional; declared services, capabilities, and handlers must follow their transport/entity schemas.

### Not applicable

ACP, AP2, Visa TAP, Mastercard Agent Pay

### Agent access

#### Agent readiness scan could not complete

- Status: Needs verification
- Result: ValueError: The target site could not be scanned
- Why it matters: The report is incomplete and should not be treated as verified.
- How to fix: Retry the static scan after confirming the public site is reachable.

## Executed Agent Tests

| Agent | Status | Score |
|-------|--------|-------|
| Claude Code | Not run | — |
| Codex | Not run | — |

## Services and Endpoints

- No endpoint inventory attached.

## External Website Benchmarks

- No external website benchmark attached.

External scores provide website context and do not contribute to Lightsage's payment-readiness score.

## Evidence

- [Sapient backend static agent-payment scan](https://lightsage.com/agent-experience-arena/payments/methodology)
- [Lightsage backend static agent-payment scan](https://lightsage.com/agent-experience-arena/payments/methodology)

Canonical URL: https://lightsage.com/agent-experience-arena/payments/openmail-sh