Security

cron402

Try it

Operate an existing cron402 or agentcron.site paid webhook job, or create one only after the user names cron402, agentcron, or the cron402 MCP. Covers check_wallet, preview_schedule, create_cron, topup_cron, get_cron, list_crons, pause_cron, resume_cron, and delete_cron. Do not use for reminders, local timers, "run this later", "while I am away", or any schedule the user did not explicitly assign to cron402. Wallet secrets via abracadabra — never paste private keys in chat.

What it does

cron402 calls a URL you choose on a repeating schedule, forever, from Cloudflare's network. It keeps firing when your agent, laptop, and session are all switched off.

The skill document

Scheduling recurring jobs with cron402

cron402 calls a URL you choose on a repeating schedule, forever, from Cloudflare's network. It keeps firing when your agent, laptop, and session are all switched off.

Each fire costs $0.008 USDC on Base, paid by a wallet over the x402 protocol. There are no accounts and no API keys — the wallet is the credential.

Before you start

Check that the cron402 MCP server is connected. If its tools are not available, see Installing the MCP server at the bottom, then stop and ask the user to restart their client.

The procedure

Follow these steps in order. Do not skip step 2.

1. Check the wallet — check_wallet (free)

Confirms a wallet is configured and holds USDC. If ready_to_pay is false, give the user the address and the network from the response and stop — do not attempt a paid call. Once per session is enough.

2. Preview the schedule — preview_schedule (free)

Pass the user's own words. It accepts plain English or cron:

What the user saysWhat you passWhat you get back
"every 15 minutes"schedule: "every 15 minutes"*/15 * * * *
"every weekday at 9am"schedule: "every weekday at 9am"0 9 * * 1-5
"every Monday at 5pm"schedule: "every monday at 5pm"0 17 * * 1
"twice a day"ambiguous — ask which two times
"*/5 * * * *"schedule: "*/5 * * * *"*/5 * * * *

Everything runs in UTC. If the user names a time of day, either confirm it is UTC or pass their IANA timezone as timezone (e.g. America/New_York) and the tool converts it. Note the daylight-saving caveat it returns.

Show the user the next_5_runs_utc list and get confirmation. This tool is free, so iterate here until the schedule is right — never guess at the paid step.

3. Create the job — create_cron (costs $0.008)

create_cron({ schedule: "0 9 * * 1-5", url: "https://example.com/hook", method: "POST" })
  • Call it exactly once. It is not idempotent: a second call creates a second job and charges again. If it errors, read the next_step in the response and follow it — do not retry blindly.
  • The URL must be publicly reachable. localhost will never fire.
  • Optional: body, headers (e.g. an auth token for the target), and notifyUrl, which receives a POST with the result of every fire.
  • Report the jobId to the user. Without it, they cannot manage the job from anywhere else.

4. Buy credits — topup_cron (costs $0.008 per credit)

A new job has 1 credit, so it fires once and then stops. This surprises people. Always tell the user, and offer to top up:

PackCostLasts (every 15 min)Lasts (hourly)Lasts (daily)
1$0.008one fireone fireone fire
10$0.082.5 hours10 hours10 days
100$0.80~1 day~4 days~3 months

Like create_cron, call it once per request.

5. Check on it — get_cron / list_crons (free)

get_cron returns status, remaining credits, next run time, and the last 20 fires with HTTP status codes and errors — this is how you answer "is my cron working?". list_crons lists the jobs created from this machine, for when the id is lost.

Statuses mean:

  • active — running normally.
  • exhausted — out of credits. topup_cron restarts it.
  • paused — someone paused it, or it failed 3 times in a row. Read the executions to find out why, fix the target, then resume_cron.
  • deleted — gone for good.

6. Manage it — pause_cron, resume_cron, delete_cron (free)

Each signs an authorization with the wallet, so only the wallet that paid for a job can manage it. delete_cron is permanent and does not refund unused credits — confirm with the user first, and suggest pause_cron if they only want it to stop for now.

Rules

  1. Paid tools spend real money. create_cron and topup_cron are the only two. Call each at most once per user request, and never in a retry loop.
  2. Always preview before paying. Step 2 is free; step 3 is not.
  3. Always surface the jobId and the schedule in plain English.
  4. Say when the job will actually run, in UTC and in the user's timezone.
  5. If you are missing the URL or the schedule, ask. Do not invent either one.

Worked example

User: ping my health endpoint every 15 minutes

  1. check_walletready_to_pay: true
  2. preview_schedule({ schedule: "every 15 minutes" })*/15 * * * *, next runs listed. Ask the user for the URL if they have not given one.
  3. Confirm: "That's */15 * * * * — next runs 14:00, 14:15, 14:30 UTC. Creating it costs $0.008. Go ahead?"
  4. create_cron({ schedule: "*/15 * * * *", url: "https://example.com/health" })jobId.
  5. "Created — job abc-123. It has 1 credit, so it fires once and stops. 100 credits is $0.80 and covers about a day at this rate. Want me to top it up?"
  6. On yes: topup_cron({ jobId: "abc-123", pack: 100 }).

Installing the MCP server

Add to the MCP config (.mcp.json, .cursor/mcp.json, or Claude Desktop's claude_desktop_config.json):

{
  "mcpServers": {
    "cron402": {
      "command": "npx",
      "args": ["-y", "cron402-mcp"],
      "env": { "CRON402_PRIVATE_KEY": "0x..." }
    }
  }
}

CRON402_PRIVATE_KEY is an EVM private key funded with USDC on Base mainnet, plus a little ETH for gas. Never ask the user to paste a private key into a chat — tell them to put it in the config file, or to reference an environment variable if their client supports it.

Optional: CRON402_NETWORK=eip155:84532 to use Base Sepolia testnet, and CRON402_API_URL to point at a different cron402 deployment.

Without the MCP server, the same operations are available over plain HTTP — see .

Related skills

Join a video meeting as an AI bot with voice, avatar, and screenshare across four operating modes.

by johnpatternai21 installs8 stars

Generate and edit Draw.io, Mermaid, and Excalidraw diagrams from natural language using a structured JSON spec.

by nssa.io1.0k installs47 stars

Read and write Excel workbooks, worksheets, ranges, tables, and charts in OneDrive through Microsoft Graph with managed OAuth.

by byungkyu800 installs42 stars

Stores durable facts in a categorized, plain-markdown vault on disk, alongside your agent's built-in memory.

by Iván1 installs

Find why your productivity system keeps failing, then apply the smallest fix — capacity math, bottleneck routing, durable local notes.

by Iván1 installs

More from userdefault13

Browse all skills

Operate the abracadabra local secrets vault (abra CLI, abra serve, abra MCP) only when the user names abracadabra or abra, the abracadabra MCP is registered, or ABRA_KEY is already set for this project. Covers discovering key names, reading secrets the human has scoped to this agent (issued abra key or Touch ID grant), key issue/scope/revoke, health checks, keygen/connectors, USB/LAN sync, cartridge checkpoints, and treasury USDC payments (Touch ID). Do not use for generic env var, API token, wallet, or SSH key questions, or for other vaults or .env files. Never print secret values in chat.

by userdefault131 installs

Operate the abracadabra local secrets vault (abra CLI, abra serve, abra MCP) only when the user names abracadabra or abra, the abracadabra MCP is registered, or ABRA_KEY is already set for this project. Covers discovering key names, reading secrets the human has scoped to this agent (issued abra key or Touch ID grant), key issue/scope/revoke, health checks, keygen/connectors, USB/LAN sync, cartridge checkpoints, and treasury USDC payments (Touch ID). Do not use for generic env var, API token, wallet, or SSH key questions, or for other vaults or .env files. Never print secret values in chat.

by userdefault131 installs