Cross-checks a declared KYA (Know Your Agent) credential's scope against a declared x402 payment payload: the payload amount against the credential's spend cap, the payload network and asset against its allowed set, the payload payee against its merchant allowlist, the payload's validity window against the credential's, and scope-string coverage of the payment scheme. Returns a verdict of IN_SCOPE, OUT_OF_SCOPE, or INDETERMINATE when the credential omits a claim the payload needs; it never guesses. This tool never fetches either input, never contacts Skyfire or a facilitator, and performs no signature verification.
Documented Skyfire kya-pay claims (docs.skyfire.xyz, pinned 2026-08-06): sub, aud, ssi, iss, iat, exp, env. spend_cap_amt, allowed_networks, allowed_assets, payee_allowlist, scope are this tool's own scope-representation fields layered on top, not documented Skyfire claims.
PaymentPayload shape reused from the x402 decoder (tools/277).
It does not fetch a KYA credential or x402 payload from anywhere: you declare both. It does not verify a signature: the pinned Skyfire docs don't specify a caller-reproducible signing scheme in this context. It does not initiate, sign, or settle a payment: x402 execution is a killed ledger row. See art-26 for decoding raw x402 headers and tools/478 for the KYA policy side this tool cross-checks against a concrete payload.
Skyfire's published kya-pay token claims (docs.skyfire.xyz/docs/common-token-claims.md, /docs/token-schemas.md, pinned 2026-08-06) document identity, audience-binding, and expiry claims (sub/aud/ssi/iss/iat/exp/env) plus spend fields (amt/cur/val); they do not enumerate an explicit network-allowlist, asset-allowlist, or multi-entry payee-allowlist array, so this tool layers allowed_networks/allowed_assets/payee_allowlist/scope on top as its own scope representation.