The gold standard for x402 resources. 554 curated entries — paid endpoints probed for a live 402 before listing, libraries and repos checked for real activity, and the whole shelf re-knocked every night with the result dated. No filler. Entries that stop answering move to DEPARTURES.md and keep getting knocked; the night one answers again, it comes back.
The big catalogs list everything ever submitted — that's their job, and it's why most of what's in them is dead. We measured it: 67–79% of the free-listing catalogs no longer answer.
gold-402 is the other thing. Smaller on purpose. A person checked every entry, we publish what we checked and what we didn't, and in July 2026 we started buying services and reporting what came back. Automated monitors now do the machine half of that continuously and do it well; what they do not do — by their own published scope — is judge whether the thing that came back was any good. That judgement is what this list is.
The product. 554 entries across 13 shelves, in directory/.
| Shelf | What's on it |
|---|---|
| APIs & Services | Paid endpoints an agent can call. Every one probed for a live 402 before listing. |
| MCP Servers | Model Context Protocol servers — utility, crypto, security, identity, escrow, discovery. |
| SDKs & Libraries | Client and server libraries across languages. |
| Facilitators | Payment verification and settlement services. |
| Frameworks | Agent frameworks with x402 support. |
| Tools | CLIs, CI, monitoring, spend controls, testing, discovery. |
| Security | Audit, risk scoring, pre-execution gates, compliance. |
| Ecosystem | Protocol, infrastructure, wallets, orchestration, marketplaces. |
| Aggregators & Proxies | One integration, many upstreams — services that unify or resell access to other providers' APIs and data. |
| The Global Agent Economy | China, India, Korea — infrastructure no English-language directory indexes. |
| Learning | Quickstarts, tutorials, reference docs, news. |
| Community | Channels, newsletters, jobs, events. |
| Market Data | On-chain analytics, dashboards, adoption. |
There is no stamp. There was one — "Gold402 Verified," one tier, a gold tick — and it was retired on 2026-09-06 because it said the identical thing about a paid API we knocked last Tuesday, a community wiki with no endpoint to knock at all, and an entry we hold no dated receipt for. A mark that everything wears certifies nothing. We have made that criticism of other people's badges and it was true of ours.
What every entry now carries instead is the finding, per entry:
- A date — this endpoint answered an HTTP 402 when we knocked it, on this day. An automated gate checks the submission, a maintainer confirms it before merge, and a sweep re-knocks and writes a dated result. A date is checkable. A tick is not.
- Or "listed — no knock receipt" — a human read it and it is on the list. We hold no dated knock, and we will not backfill a date we cannot show.
- Or "listed — no endpoint to knock" — libraries, guides, wallets, clients and community resources. Nothing here answers a 402 because that is not what these things do. We read them, and we checked they were publicly reachable.
None of it is a delivery test. We have not paid these services and graded what came back. Read any of it as "we checked what is stated above," never as "this is worth the money."
Some entries carry more. Where we have paid for a service and confirmed what came back, we say so and keep the receipt — what we sent, what it cost, the transaction hash, what arrived. That is a stronger claim and we only make it about services we actually bought. Most of the list has not been through that, and we would rather say so than imply otherwise.
Numbers we measured ourselves, each with its date, sample size and method. Where measurements disagree, both are shown — they were taken on different days by different methods, and blending them into one tidy figure would be the kind of thing this directory exists to argue against.
| Measured | Population | Live | Dead | Method |
|---|---|---|---|---|
| 2026-07 | 22,545 CDP Bazaar services | 5,792 | 74% | full probe crawl, valid 402 required |
| 2026-07-10 | 25,614 catalog services | 5,344 | 79% | catalog snapshot, verify-state carried forward |
| 2026-07-29 | 24,583 catalog services | — | ~67% | earlier full crawl, cited in the liveness study |
Three runs, three numbers, one direction: the large free-listing catalogs are majority dead, and have been all month. Anyone quoting a single decimal-point figure for this is quoting a moment, not a fact.
Across four independent registries — 204,500 registered agents and services — the dead share tracks one variable: what it costs to get listed.
| Registry | Entry cost | Dead |
|---|---|---|
| CDP Bazaar | free | ~67–79% |
| ERC-8004 on-chain identity | gas only | 85–97% |
| Glama MCP registry | curation + scoring | 47% unhealthy (their own published figure) |
Free entry selects for abandonment. Full method, limits, and an open invitation to refute it: The Liveness Law →
In July 2026 we ran a paid delivery check across our own shelf — actually buying services and recording what came back.
- 16 of 126 listed services were purchasable by a machine at a discoverable address
- 8 delivered exactly what they advertised
- 0 took payment and returned nothing
- $0.054 spent, every transaction reconciled on-chain
The friction in this economy sits before the payment, not after it. Most services are fine; most front doors are not. We are not claiming that as a finding yet — the sample is 16 services and one day, 2026-07-30. A wider census was designed the same week and has not run; the blocker is ours, not the ecosystem's. We would rather say that than let the sentence stand.
x402 is a US-governed rail. It is not the only answer to machine payment, and outside the West it is not the answer being used — China runs delegated agent authorization on existing rails, India runs regulated human-signed mandates that agents execute inside a cap. Both were operating at scale before the x402 Foundation was a month old.
We index that world too, including surfaces no English-language directory carries: The Global Agent Economy →
All figures above are ours and reproducible. Where we could not reach something, we say so rather than leaving the gap invisible.
October 2026 — one pick per shelf. Each shelf opens with its pick and the write-up. Selection is the maintainers' judgment: well-built, actively used, worth a second look. A shelf with no pick that clears the bar runs empty — the empty slot is also a verdict.
| Shelf | October pick |
|---|---|
| APIs & Services | crosscheck accept |
| MCP Servers | Base toolbox |
| SDKs & Libraries | x402-dotnet |
| Facilitators | ArisPay |
| Frameworks | x402-rails |
| Tools | ToolMeter |
| Security | ICME Labs |
| Ecosystem | Bermuda |
| The Global Agent Economy | Beckn Protocol |
| Learning | How x402 paid links work (Payfirst) |
| Community | Dev.to #x402 |
| Market Data | Dune Analytics x402 |
| Aggregators & Proxies | x402-list |
The wire lives at 24klabs.ai/news — dated editions with permanent links, every claim cited. Four editions so far; the most recent is 2026-08-10. It is not on a schedule.
This week (Nov 9—15)
- TRON USDT Risk Checker — Pay-per-request TRON USDT-TRC20 screening for agents, three tiers, all
POSTwith{"address":"T…"}:$0.01/v1/x402/blacklist(live TethergetBlackListStatusread),$0.10/v1/x402/screen(freeze check across three sources + OFAC + OpenSanctions + Chainabuse + explainable risk score),$1.00/v1/x402/report(full AML report: counterparty exposure, two-hop tracing, flow heuristics, 0-100 score). USDC on Base (eip155:8453), payTo0x820a7bf90d944bb26bfD9b62Ab172Fc3A0829cB9. Not charged on invalid input or upstream failure. Discovery: https://usdt.chikocorp.com/.well-known/x402.json - agent-exec RPC — Accountless JSON-RPC: one call to Base, Base Sepolia, Ethereum or Solana with no provider account, $0.002 USDC per call, your own call id echoed back, a refused call costs nothing. (OpenAPI)
- agent-exec Relay — Gasless USDC relay for wallets holding no gas: sign an EIP-3009 TransferWithAuthorization on Base and agent-exec broadcasts it with its own ETH. $0.02 USDC flat per relay, $100 max per order, a refused order costs nothing. A free 503
relay_gas_exhaustedfires before any charge if the relayer's own gas key runs dry, instead of a broadcast without a response. (OpenAPI) - agent-exec — Address, URL and x402-counterparty risk checks from public risk feeds: verdict, score and reasons, $0.02 USDC flat on Base or Solana, charged only on success.
POST /check/address,POST /check/urlandPOST /check/counterparty. (OpenAPI) - Horizon Pulse — Returns crypto market data (BTC/ETH/SOL pulse, RSI/MACD/Bollinger signals, DefiLlama yields, Base+Ethereum wallet portfolio, gas, OKX funding) and web utilities (URL to markdown, SSRF-safe HTTP proxy, structured page extract) for $0.005-$0.04 USDC per call on Base mainnet via x402 v2. Example:
GET /api/pulse. (OpenAPI) (llms.txt) - Go Bag — Prepaid travel eSIM data plans for a person's phone or tablet, bought by an AI agent per order in USDC on Base via x402, from $0.99 with no account, sign-up or ID; plans are listed free at
GET /catalog, and an emptyPOST /buyanswers 402 without buying anything. - Aura Verification — Deterministic checks for agents and x402 sellers: verify a public HTTPS page's reachability, backlink, canonical URL, noindex and content digest ($0.005 USDC), or audit an unpaid x402 v2 endpoint's challenge, price, asset, network and discovery ($0.05 USDC). Base, no API key. Example:
POST /x402/verify {"url":"https://www.cloudflare.com/"}. - AgentSearch — Web search ($0.008), page-to-Markdown extract ($0.007) and headless-browser render for JavaScript pages ($0.010), USDC per call on Base via x402 v2 and the Coinbase CDP facilitator, settled only after a successful, non-empty answer. Example:
POST /x402/v1/search {"query":"x402"}. (Docs) (OpenAPI) (llms.txt) - Scrapling Data — Pay-per-call crypto, DeFi, prediction-market, stock and GPU-price datasets and lookups for AI agents via x402 (USDC on Base, Polygon, Arbitrum or Solana; USDC or USDT on BNB Chain). Example:
GET /v1/lookup/coin?coin=bitcoin. (MCP) (OpenAPI) (llms.txt) - StockDatum — Structured SEC EDGAR records (Form 4, 8-K/6-K, Form 144, insider purchase clusters) with a source-filing link per row, $0.02 per call ($0.03 clusters) in USDC on Base. Example:
GET /v1/form4?ticker=AAPL. - SatBotly — Free, source-checked directory of what AI agents can pay for on their own: x402, L402 and MPP pay-per-call APIs priced from their unpaid HTTP 402 challenge (nothing is paid to read a price), plus agent wallets, payment services and MCP servers. (llms.txt)
- HTML Pack — Converts one caller-supplied HTML document to Markdown for 0.002 USDC on Base via x402 v2. Example:
POST /v1/html-to-markdown {"html":"<h1>Hi</h1><p>Hello</p>"}. (OpenAPI) - Bot Agora x402 Q&A desk — Pay-per-answer AI Q&A (
GET /ask?question=...) and bash lint (POST /lint) for agents at 10 sats sBTC on Stacks mainnet via the AIBTC x402 relay;POST /lint/freeandGET /healthare free. Example:GET /ask?question=hello.
Last week (Nov 2—8)
- AgentForge — DeFi safety APIs for agents: pre-sign EVM transaction simulation, sanctions and scam address screening, a risk-scored new-token launch feed, batch token rug checks, Aave liquidation risk, and transaction decode; 24 endpoints, $0.001-$0.35 USDC on Base or Solana. Example:
POST /v1/address-check {"address":"0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48"}. (MCP) (OpenAPI) - SCRYX Merchant Intelligence — Returns structured public-commerce evidence for one merchant homepage with explicit unknowns; POST only, $0.05 USDC per call on Base mainnet via x402 v2. Example:
POST /merchant/intelligence {"url":"https://merchant.example"}. (Discovery) (OpenAPI) (llms.txt) - Crypto Pulse — BTC/ETH/SOL/HYPE spots with 24h change, Fear & Greed, Hyperliquid funding and open interest, and DefiLlama TVL plus top stable yields in one call with a plain-English summary; $0.02 USDC per pulse and $0.005 for spots-only on Solana via x402, with a free stale sample and Streamable HTTP MCP. Example:
GET /v1/pulse. (OpenAPI) (Discovery) (MCP) (GitHub) - Project Zero Cited Briefs — Cited research briefs from the live web: the Research Brief endpoint searches, reads 3-6 sources and returns a structured JSON brief with source-linked findings ($0.05), Quick Brief returns a snippet-level digest ($0.01), and Wallet Balance looks up native balances across BTC/ETH/Base/Sol/Tron/Ronin ($0.001); USDC per call on Base mainnet, failed calls are not charged. Catalog: llms.txt.
- Trench Lessons — Solana meme coin research for trading bots: read-only heuristic flags for a mint (curve-skip PumpSwap pool, unlocked LP, Mayhem mode, bundle handoff), each with status and confidence, $0.01, and a structured daily findings feed on pump.fun, PumpSwap and Meteora with sources, $0.005. USDC on Solana and Base via PayAI, x402 v2 exact, no API key. Example:
GET /api/signals/risk?mint=DFMt2FyLpB6ekPNAzVErLXgpSnJ9CRf1VnxBAkTLpump. (OpenAPI) (llms.txt) - AskZephy Solana Audit — Static PATTERN scan of a Solana/Anchor Rust repository: flags risky code shapes (missing signer/owner checks, account confusion, PDA seed issues, unsafe CPI, unchecked arithmetic) with file:line, evidence and suggested fix. Deterministic, no LLM. $0.05 USDC on Base per
GET /audit?repo=owner/name; one-line verdict atGET /quick-scan?repo=owner/namefor $0.005. Honest limits: scored 0/11 recall on Anchor's labelled vulnerability corpus — findings are leads for human review, not an audit verdict. (OpenAPI) - useful-work-agent — MIT TypeScript agent and tool-maker kit for the useful-work x402 extension: the agent pays for x402 calls by passing a proofreading or link-check job instead of paying USDC, and a tool maker's server can offer those jobs and is paid 0.002 USDC per passed check on Base. (npm)
- Goldsky Edge RPC — Pay-per-call EVM JSON-RPC across 150+ chains, 5 atomic USDC ($0.000005) per call, x402 or API key. The 402 challenge asks for a 5000 atomic USDC ($0.005) prepaid top-up, which funds about 1,000 calls.
- Goldsky Feeds: Prediction markets and Chain datasets — Pay-per-call Polymarket activity and EVM block data, 10 atomic USDC ($0.00001) per request flat. The 402 challenge asks for a 5000 atomic USDC ($0.005) prepaid top-up, which funds about 500 requests.
- Goldsky Feeds: Wallets and Tokens — Pay-per-call wallet balances, transfers, and token prices, 350 atomic USDC ($0.00035) per request. The 402 challenge asks for a 50000 atomic USDC ($0.05) prepaid top-up, which funds about 142 requests.
- Useful Work tools — Reads a public web page as text, checks up to 15 links on a page, or looks up DNS records (A, AAAA, CNAME, MX, NS, TXT, CAA) for 0.002 USDC per call on Base via x402 v2, or lets an agent that sends an X-Useful-Work-Agent header pay by passing a checkable job instead. Example:
GET /tools/dns?name=example.com&type=A. - x402-sanctions-guard — Express and Hono middleware for x402 sellers that screens each payer wallet against OFAC sanctions and scam-wallet lists and refuses it with a 403 before the payment is verified or settled; payer extraction for EVM (EIP-3009, Permit2) and Solana payments, per-payer cache, screening via AgentForge at $0.003 per new payer. MIT.
- aptu.dev — Machine-payable API microservices for agents: echo probe (
POST /v1/echo, $0.01), resume ATS scoring (POST /v1/resume-eval, $0.005), domain agent-readiness audit (POST /v1/agent-readiness, $0.05), and BTC market regime check (GET /v1/btc-regime, $0.003), USDC via x402 on Base and Solana, no account or API key. Example:POST /v1/echo {"message":"hello"}. (OpenAPI) (Manifest) - OceanAlt — Pre-payment check for agents: takes a payee address and returns allow, review or decline with supporting evidence. $0.002 USDC per call on Base, X Layer or Solana.
- Momentum Brief — Pay-per-call 8–12 line crypto momentum brief (price, 24h/7d change, market cap, trending rank, top DEX pair, liquidity, volume, buy/sell mix) cited to CoinGecko or DexScreener; $0.10 USDC on Base via x402, no account; not trading advice; no charge if no data. Example:
POST /v1/brief {"query":"ETH"}. (OpenAPI) (Pricing) - Indo News MCP — Remote MCP server for Indonesian news and data: headlines by topic with entities and sentiment, keyword search, a delta feed with a since-cursor, briefings, a deterministic 0-100 sentiment index, coverage timelines and an 8-topic digest, plus USD/IDR and any published pair with a 30-day series, crypto prices in rupiah from Indodax, the Indodax-vs-global premium, BMKG earthquakes and public holidays. 31 tools, 8 free and 23 paid. Paid tools answer an unpaid call with an x402 PaymentRequired payload ($0.05–$2.50 USDC per call for the 19 news and data tools, Base, Polygon, Arbitrum or Avalanche); free preview tools return a 3-item sample of the same shape the paid tools fill to 25. The same service also sells a $49 written 30-day coverage report and unmetered licences over HTTP that differ by scope: $19/$99 for 30 days, $399 for 30 days with 1,825 prints per call of FX history, $700 for 90 days with 3,650 prints per call. (Manifest) (OpenAPI) (llms.txt)
- Indo News API — Indonesian news and reference data for agents: headlines by topic, keyword search, deduped briefings with keyword trends and top sources, an all-topics digest, FX for published pairs with daily history beyond 30 days, rupiah crypto prices, BMKG earthquake alerts, holiday and working-day decisions, and a public-page reader. $0.05–$2.50 USDC per call on the 20 news and data routes, settled by x402 v2 on Base, Polygon, Arbitrum or Avalanche (PayAI facilitator) or by MPP on Tempo from the same 402, plus a $49 written coverage report and unmetered Bearer licences from $19/30 days to $700/90 days. Example:
GET /headlines?topic=finance. (OpenAPI) (llms.txt) (Manifest) - Indo News API — Indonesian data for agents over 25 paid GET routes and 31 MCP tools at
POST /mcp(8 free): up to 25 headlines by topic, keyword search, a deduped delta feed with a since-cursor, recency-ranked briefings, an 8-topic digest, a brand coverage monitor, a deterministic 0-100 sentiment index, USD/IDR and any published pair with a 30-day series plus /series daily history beyond it, a currency converter, BTC/ETH/USDT in rupiah from Indodax plus the Indodax-vs-global premium, BMKG earthquakes with an?alert=true&minMagnitude=5alert view, public holidays with working-day, next-working-day and single-date checks, and a/readclean-text page reader. $0.05–$2.50 USDC per call on the 20 news and data routes, settled by x402 v2 on Base, Polygon, Arbitrum or Avalanche or by MPP on Tempo from the same 402, plus a $49 written 30-day coverage report and unmetered licences that differ by enforced scope: $19 and $99 for 30 days ($99 raises /series to 365 prints per call), $399 for 30 days with 1,825 prints per call, $700 for 90 days with 3,650 prints per call — the top two also take the whole series as one?format=csv|jsonldownload; no API keys, free samples (the export file shape is free at/series/preview?format=csv, with the series hash so depth can be checked before paying). Example:GET /headlines?topic=finance. (OpenAPI) (llms.txt) (Manifest) (MCP) - Penny x402 utilities — Small dev utilities per call: hash digests, base64, UUID, slug, URL parse, time, Nostr NIP-19 decode and event verify, BOLT11 invoice decode. $0.001 USDC on Base. Example:
GET /paid/hash?s=hello&alg=sha256. Also a remote MCP server at https://pennyagent.pythonanywhere.com/mcp (registry: io.github.pennyops/penny-x402-utils). - Meridian by MioDio — Read-only pre-sign checks for agents on Base USDC via x402: OFAC SDN exact-match address screen, intent-drift check, transaction dry run, recipient readiness and x402 preflight, $0.005 to $0.10 per call.
- x402nic by easyDNS — Registers domain names and provisions them into easyDNS accounts using x402 v2 USDC payments on Base, with domain-specific quotes and a prepared registration order required before payment. (Website) (Registration workflow) (OpenAPI)
- JPVerify — Japanese business document OCR and public-registry verification: receipt, invoice and business-card extraction, corporate-number and qualified-invoice (T-number) checks against NTA public data, and Japanese address normalization; 24 paid routes at $0.001–$0.10 USDC per call on Base mainnet, with invalid input rejected with HTTP 422 before payment. Example:
POST /jp-company/verify {"corporate_number":"1010001008846"}. (OpenAPI) (llms.txt) (Site) - JPVerify MCP — Remote streamable-http MCP wrapper over the JPVerify HTTP API with 12 tools for Japanese company (corporate number) and qualified-invoice T-number verification, address normalization and validation, invoice/receipt/business-card OCR, supplier resolution, and EU VAT/Peppol counterparty checks;
jpverify_guideis free and paid tools cost $0.005–$0.10 USDC on Base via x402, settled only after a successful result. Example tool call:jp_invoice_registration_verify {"registration_number":"T1013301046627"}. (Manifest) (Registry) - Vauban Pay Facilitator — Public x402 facilitator for exact USDC payments on Base (eip155:8453) and Base Sepolia (eip155:84532), x402 v2, open /supported, /verify and /settle without API key; third-party sellers register with a per-seller split contract and withdraw themselves. Docs.
- BSC Agent Utilities — 8 pay-per-call utility APIs for AI agents at $0.001 USDC per call on Base via x402 v2, no API key: BSC gas price, token price, tx status, contract safety check, email check, IP lookup, WHOIS, and QR code. Example:
GET /v1/gas. (OpenAPI) (Discovery)
New to x402? Three steps to your first payment.
1. Pick a facilitator
| Use case | Facilitator |
|---|---|
| Most chains, full SDK support | Coinbase CDP |
| Edge deployment, global latency | Cloudflare x402 |
| Enterprise billing + disputes | Stripe Machine Payments |
2. Install the SDK
# TypeScript
npm install x402-express # or the core package: @coinbase/x402
# Python
pip install x402# Rust
cargo add x402-axum x402-reqwest # x402-rs — see SDKs & Libraries shelfChecked 2026-09-20. A crate literally named x402 exists on crates.io but is a placeholder
with no working code — use x402-rs's crates (x402-axum for servers, x402-reqwest for
clients) instead.
3. Add payment middleware
import { paymentMiddleware } from '@coinbase/x402-express';
app.use(paymentMiddleware(wallet, {
'/api/data': { price: '$0.01', network: 'base-mainnet' }
}));That's it. The middleware returns 402 with payment details, verifies the client's payment header, and lets the request through.
Full quickstart → · Testnet setup →
1. Client → GET /api/data (initial request)
2. Server ← 402 Payment Required (payment details in header)
payment-required: <base64 challenge> (v2; v1 used X-Payment-Required
and put the detail in the body)
3. Client → EIP-3009 gasless USDC transfer (client signs + submits)
4. Client → GET /api/data + X-Payment: {signed tx} (retry with payment)
5. Facilitator → verify + settle on-chain (~2 seconds)
6. Server ← 200 OK + X-Payment-Response (resource returned)
No gas for the sender. No subscription. No API key. Payment IS authentication.
This README is the front door. The full curated directory — every shelf, every entry — is in directory/.
Other lists worth knowing: the community awesome-x402 accepts everything and is the right place for exhaustive coverage. Glama indexes MCP servers at enormous scale and publishes its own health data, which is rarer than it should be. Different jobs. Use all three.
gold-402 is curated, not exhaustive. Every entry earns its place.
See CONTRIBUTING.md for the curation standard, badge system, acceptance criteria, and submission process.
Quick rules:
- Entry must use the x402 protocol (HTTP 402 + X-Payment), not just USDC or general crypto payments.
- Live URL or public GitHub repo. Link must work.
- Last activity within 12 months (for libraries and resources without a live endpoint).
- One entry per pull request. Format:
[Name](url) — Description starting uppercase, ending with period. - Descriptions are factual. No marketing language.
Curated by 24K Labs
If this saved you time, star the repo.
24klabs.ai •
x402.org •
Protocol Spec •
Coinbase Docs •
Discord •
Live Dashboard