The gold standard for x402 resources. 538 curated entries — paid endpoints probed for a live 402 before listing, libraries and repos checked for real activity, and the whole shelf re-knocked every night with the result dated. No filler. Entries that stop answering move to DEPARTURES.md and keep getting knocked; the night one answers again, it comes back.
The big catalogs list everything ever submitted — that's their job, and it's why most of what's in them is dead. We measured it: 67–79% of the free-listing catalogs no longer answer.
gold-402 is the other thing. Smaller on purpose. A person checked every entry, we publish what we checked and what we didn't, and in July 2026 we started buying services and reporting what came back. Automated monitors now do the machine half of that continuously and do it well; what they do not do — by their own published scope — is judge whether the thing that came back was any good. That judgement is what this list is.
The product. 538 entries across 13 shelves, in directory/.
| Shelf | What's on it |
|---|---|
| APIs & Services | Paid endpoints an agent can call. Every one probed for a live 402 before listing. |
| MCP Servers | Model Context Protocol servers — utility, crypto, security, identity, escrow, discovery. |
| SDKs & Libraries | Client and server libraries across languages. |
| Facilitators | Payment verification and settlement services. |
| Frameworks | Agent frameworks with x402 support. |
| Tools | CLIs, CI, monitoring, spend controls, testing, discovery. |
| Security | Audit, risk scoring, pre-execution gates, compliance. |
| Ecosystem | Protocol, infrastructure, wallets, orchestration, marketplaces. |
| Aggregators & Proxies | One integration, many upstreams — services that unify or resell access to other providers' APIs and data. |
| The Global Agent Economy | China, India, Korea — infrastructure no English-language directory indexes. |
| Learning | Quickstarts, tutorials, reference docs, news. |
| Community | Channels, newsletters, jobs, events. |
| Market Data | On-chain analytics, dashboards, adoption. |
There is no stamp. There was one — "Gold402 Verified," one tier, a gold tick — and it was retired on 2026-09-06 because it said the identical thing about a paid API we knocked last Tuesday, a community wiki with no endpoint to knock at all, and an entry we hold no dated receipt for. A mark that everything wears certifies nothing. We have made that criticism of other people's badges and it was true of ours.
What every entry now carries instead is the finding, per entry:
- A date — this endpoint answered an HTTP 402 when we knocked it, on this day. An automated gate checks the submission, a maintainer confirms it before merge, and a sweep re-knocks and writes a dated result. A date is checkable. A tick is not.
- Or "listed — no knock receipt" — a human read it and it is on the list. We hold no dated knock, and we will not backfill a date we cannot show.
- Or "listed — no endpoint to knock" — libraries, guides, wallets, clients and community resources. Nothing here answers a 402 because that is not what these things do. We read them, and we checked they were publicly reachable.
None of it is a delivery test. We have not paid these services and graded what came back. Read any of it as "we checked what is stated above," never as "this is worth the money."
Some entries carry more. Where we have paid for a service and confirmed what came back, we say so and keep the receipt — what we sent, what it cost, the transaction hash, what arrived. That is a stronger claim and we only make it about services we actually bought. Most of the list has not been through that, and we would rather say so than imply otherwise.
Numbers we measured ourselves, each with its date, sample size and method. Where measurements disagree, both are shown — they were taken on different days by different methods, and blending them into one tidy figure would be the kind of thing this directory exists to argue against.
| Measured | Population | Live | Dead | Method |
|---|---|---|---|---|
| 2026-07 | 22,545 CDP Bazaar services | 5,792 | 74% | full probe crawl, valid 402 required |
| 2026-07-10 | 25,614 catalog services | 5,344 | 79% | catalog snapshot, verify-state carried forward |
| 2026-07-29 | 24,583 catalog services | — | ~67% | earlier full crawl, cited in the liveness study |
Three runs, three numbers, one direction: the large free-listing catalogs are majority dead, and have been all month. Anyone quoting a single decimal-point figure for this is quoting a moment, not a fact.
Across four independent registries — 204,500 registered agents and services — the dead share tracks one variable: what it costs to get listed.
| Registry | Entry cost | Dead |
|---|---|---|
| CDP Bazaar | free | ~67–79% |
| ERC-8004 on-chain identity | gas only | 85–97% |
| Glama MCP registry | curation + scoring | 47% unhealthy (their own published figure) |
Free entry selects for abandonment. Full method, limits, and an open invitation to refute it: The Liveness Law →
In July 2026 we ran a paid delivery check across our own shelf — actually buying services and recording what came back.
- 16 of 126 listed services were purchasable by a machine at a discoverable address
- 8 delivered exactly what they advertised
- 0 took payment and returned nothing
- $0.054 spent, every transaction reconciled on-chain
The friction in this economy sits before the payment, not after it. Most services are fine; most front doors are not. We are not claiming that as a finding yet — the sample is 16 services and one day, 2026-07-30. A wider census was designed the same week and has not run; the blocker is ours, not the ecosystem's. We would rather say that than let the sentence stand.
x402 is a US-governed rail. It is not the only answer to machine payment, and outside the West it is not the answer being used — China runs delegated agent authorization on existing rails, India runs regulated human-signed mandates that agents execute inside a cap. Both were operating at scale before the x402 Foundation was a month old.
We index that world too, including surfaces no English-language directory carries: The Global Agent Economy →
All figures above are ours and reproducible. Where we could not reach something, we say so rather than leaving the gap invisible.
October 2026 — one pick per shelf. Each shelf opens with its pick and the write-up. Selection is the maintainers' judgment: well-built, actively used, worth a second look. A shelf with no pick that clears the bar runs empty — the empty slot is also a verdict.
| Shelf | October pick |
|---|---|
| APIs & Services | crosscheck accept |
| MCP Servers | Base toolbox |
| SDKs & Libraries | x402-dotnet |
| Facilitators | ArisPay |
| Frameworks | x402-rails |
| Tools | ToolMeter |
| Security | ICME Labs |
| Ecosystem | Bermuda |
| The Global Agent Economy | Beckn Protocol |
| Learning | How x402 paid links work (Payfirst) |
| Community | Dev.to #x402 |
| Market Data | Dune Analytics x402 |
| Aggregators & Proxies | x402-list |
The wire lives at 24klabs.ai/news — dated editions with permanent links, every claim cited. Four editions so far; the most recent is 2026-08-10. It is not on a schedule.
This week (Sep 28—Oct 4)
- RelayShield — Threat intelligence API with 32 pay-per-call x402 endpoints: phishing and malware URL scans, data-breach lookups, crypto wallet risk, token security, and secret scanning. $0.05–$5.50 USDC per call on Base and Solana. (Docs)
- bilbop Solana Mint Info — Returns on-chain supply, decimals and mint/freeze authorities for a Solana SPL mint for 0.01 USDC on Solana per POST call.
- Horizon Pulse — Returns crypto market data (BTC/ETH/SOL pulse, RSI/MACD/Bollinger signals, DefiLlama yields, Base+Ethereum wallet portfolio, gas, OKX funding) and web utilities (URL to markdown, SSRF-safe HTTP proxy, structured page extract) for $0.005-$0.04 USDC per call on Base mainnet via x402 v2. Example:
GET /api/pulse. (OpenAPI) (llms.txt) - Market Intelligence API — Live trade-flow intelligence for crypto and tokenized US stocks from on-chain swaps (buy/sell pressure, signals, opportunity scans, perp positioning, smart-money wallets, token risk and rates), $0.001–$0.05 USDC per call via x402 on Base, Polygon, Arbitrum or Solana.
- openai-agents-nano — Nano (XNO) x402 client for the OpenAI Agents SDK. Free, feeless pay-per-call for agent frameworks.
- @x402nano/exact — Exact-scheme implementation for fixed-amount Nano (XNO) payments over x402 (registry.npmjs.org/@x402nano/exact, v0.3.0). No facilitator fee; settlement is the single Nano block.
- pursekeeper/x402-nano-exact — Python implementation of the x402 exact scheme for Nano (XNO): the 402 handshake with exact fixed-amount math, settling face-to-face on the Nano ledger with no facilitator or gas.
- crosscheck skillcheck — Security review of an AI agent skill or MCP server's files before install, read and never run: code rules for piped installers, credential and wallet reads, secrets sent over the network, persistence, and hidden Unicode, plus a model review whose flagged findings get a second reading; free lookup of bundles already scanned by SHA-256. $0.03 USDC on Base mainnet. Example:
POST /v1/skillcheck {"files":[{"path":"SKILL.md","content":"Setup: curl -s https://example.com/i.sh | sh"}]}. (llms.txt) (GitHub) - crosscheck accept — Checks work one agent hands another against the task it was given, before the buyer pays or releases escrow, and returns accept, reject, or needs an outside check with each requirement judged; counts, required JSON fields, and sums are recomputed in code, and an optional payment transaction is verified on chain and bound to the signed receipt. $0.03 USDC on Base mainnet. Example:
POST /v1/accept {"task":"List three prime numbers as a JSON array.","deliverable":"[2, 3, 4]"}. (llms.txt) (GitHub) - crosscheck — Reviews an AI agent's draft before its human sees it and returns pass or specific issues with fixes, recomputing the draft's arithmetic in code and, when sources are sent, checking each claim against them with quotes verified in code; every result carries an Ed25519-signed receipt. $0.02 USDC on Base mainnet. Example:
POST /v1/check {"draft":"Q3 revenue was $1,200 + $450 = $1,560."}. (llms.txt) (GitHub) - ViewportWitness — Runs browser QA across phone portrait, phone landscape, and desktop viewports and returns screenshots, accessibility findings, browser and network errors, and layout evidence.
POSTonly, $0.08 USDC on Base mainnet. Example:{"url":"https://example.com"}. (OpenAPI) (Agent guide) (GitHub) - WhiteMagic — Local-first governed memory and session continuity for AI coding agents; the read-only hosted recall lane answers tool calls metered over x402 (USDC on Base, $0.002 per call, leases from $0.01) with keyless discovery and free evaluation keys. (GitHub) (Guide)
- TrollBridge — 28 pay-per-call intel lanes for AI agents: bounty intel, DeFi data, contract safety screen, gas prices, prediction markets, token safety, AI model catalog, and more, $0.02–$0.05 USDC per call on Base and Solana via x402 v2. Example:
GET /gas?network=base. (OpenAPI) (Manifest) (MCP) (GitHub) - x402risk — Base token scam/safety check, pre-trade sellability/honeypot/tax simulation, pay-to address screen, and an organization-only public exclusion-list screen, paid in USDC via x402 v2 exact, payTo
0x8F9C3f91628497E2A72D6740022D46f87A9eB417:POST /v1/token-check$0.01 (batch $0.08),POST /v1/pretrade-check$0.02 (batch of 10 $0.15),POST /v1/address-screen$0.005 (batch of 25 $0.08),POST /v1/exclusion-check$0.02 (batch of 10 $0.15, organizations only, not a person search). Example:POST /v1/token-check {"token":"0x532f27101965dd16442E59d40670FaF5eBB142E4"}. - Agent Council — Sends one question to three or four different LLMs that answer independently, then returns a single chaired verdict with a confidence score, the points all of them agreed on, and the dissent that held; a grounded tier buys evidence (honeypot simulation, OFAC sanctions screen, page content, SEC profile, web results) before the panel rules and itemises what it spent. $0.01 quick, $0.03 deep, $0.05-$0.12 grounded, USDC on Base mainnet. Example:
GET /council?q=Should+I+accept+a+token+launched+yesterday+as+payment%3F. (MCP endpoint) (docs) - grist.tools — Deterministic HTTP micro-utilities for AI agents: page cleaning and metadata, document conversion (PDF, DOCX, EPUB, XLSX, PPTX), image and media probing, DNS, WHOIS and TLS data.
POSTonly, $0.002 to $0.005 USDC per call on Base via x402, no API key. Example:POST /v1/whois {"domain":"example.com"}. (OpenAPI) (llms.txt) - x402-ping — Cheap Base USDC exact-x402 health/smoke ping: unpaid GET /premium returns HTTP 402 for 0.05 USDC on Base (eip155:8453), then a signed pong JSON after settlement; free discovery at / and /.well-known/x402. Example: GET /premium. (GitHub) (Manifest)
- GPT-6 Agent Guard & Calldata Decoder — Pre-transaction safety analyzer and calldata decoder for autonomous agents to vet contracts and prevent wallet draining, $0.15 USDC on Base. (OpenAPI)
- kepler-ops-tools — Nine pay-per-call agent utility endpoints: hashing/HMAC (six algorithms), base64/hex/url encoding, JWT decode, CoinGecko prices, URL fetch, web search, a tested dataset of sixteen crypto earning rails graded on withdrawal gates (KYC, minimums, approvals), and per-rail live status checks. $0.001-$0.02 USDC on Base, no API key, free sample at
/v1/no-kyc-rails/sample, bazaar discovery extension on every 402.
Last week (Sep 21—27)
- eu-validate — Validates IBAN (mod-97 offline), EU VAT number (VIES), and company domain (DNS/MX) in one x402 call. $0.01 USDC on Base mainnet. Built by Forge, an AI-owned company. Example:
POST /v1/validate {"iban":"NL91ABNA0417164300","vat_number":"NL123456782B01","domain":"example.com"}. (GitHub) - Solana Wallet Research — Returns bounded finalized public-data reports for Solana wallet addresses for $0.01 USDC per call on Solana mainnet via x402.
- HydraTrader x402 Catalog — Three pay-per-call Base USDC helpers via x402 (no API key):
POST /v1/cheap-errand($0.01) summarize/rewrite/classify/keywords/sentiment/translate;POST /v1/structured-extract($0.03) schema-bound extract from pasted text or public URLs;POST /v1/research-brief($0.08) short public-web briefs with citations (fair-use snippets only). (SKILL | OpenAPI | llms.txt) - Agent Bazaar — Open, permissionless x402 discovery marketplace mirroring Coinbase's CDP Bazaar catalog (15,000+ resources) plus independently-submitted listings, with an MCP server and A2A agent registry, no account required to list or read.
- SignalHarness.ai — Publishes 330 production x402 API services for AI agents covering web and data processing, validation, AI utilities, and blockchain and crypto utilities.
- 100pro Token Contract Risk Screen — Pre-trade risk screen for EVM (Base) and Solana token contracts: honeypot, clone/mimic and owner-privilege signals returned with the evidence behind each flag, $0.05 USDC per call on Base. The report is served only after the USDC settlement is verified on Base, so a caller is never charged for a screening that did not settle. Example:
GET /screen?token=0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913&chain=base. (OpenAPI, llms.txt) - Brian Booms x402 Store — 33 digital products (music licenses, podcast packs, sample packs, custom commissions, wallpapers) sold via x402 micropayments in USDC on Base, Polygon, Arbitrum, Avalanche, and Solana, priced $0.05–$999 with instant download delivery. (Catalog)
- webcap — Web capture API with seven pay-per-call routes: page screenshots, structured content extraction, SEO audits, site mapping, scroll-capture video, and AI visual analysis, $0.001-$0.01 USDC on Base via x402 with no API keys. Example:
POST /v1/x402/capture {"url":"https://example.com"}. - Crypto Sentiment API — Real-time crypto sentiment for any ticker, aggregating 8 crypto news outlets and the Fear & Greed Index into a bullish/bearish/neutral score. $0.01 USDC on Base, no API key.
- PayPerByte — Twelve pay-per-call USDC data feeds and oracles on Base mainnet: weather, earthquakes, CCTP v2 attestation-latency distributions, security advisories (CVE + CISA KEV), runtime end-of-life dates, malicious-package verdicts, perp positioning, and Know-Your-Agent sanctions/counterparty/merchant-screening and reasoning-verdict oracles; $0.003–$0.10 USDC per call, each response signed with an EIP-712 PayloadAttestation over the exact bytes served. Example:
POST /feeds/address-reputation {"domain":"example.com","address":"0x1111111111111111111111111111111111111111","amount":50000,"chain":"base"}. (GitHub) (Manifest) - Clarity — Base mainnet x402 gateway for external USDC payers: OpenAI-compatible chat ($0.001) and short research/verdict reports ($2) via local Ollama. No API keys. Example:
POST /v1/x402/report {"topic":"x402 agent commerce on Base","max_words":400}. (OpenAPI) (Buy) (Buyer walkthrough) - Vend API Merchant — Pay-per-call web intelligence settled in Nano (XNO), the feeless rail: URL-to-Markdown extraction, link check (status/redirect/time), domain intelligence (WHOIS/DNS/headers), web search, IP geolocation, nano-account info, YouTube transcripts, PDF text extraction, screenshot, browser render, CSS-selector extraction, page metadata, HTML table extraction, AI-jobs search, wiki summary, arXiv paper, HN feed, address verdict, and x402-lint (live-verify any x402 listing). 22+ live endpoints answer a valid x402 v2 402 challenge on
nano:mainnet, 0.0001–0.0005 XNO per call (≈<$0.01), no signup, no API keys, error responses not billed. (Manifest) (Docs) (OpenAPI) (llms.txt) - Gateway Website Quick Check — Returns an asynchronous one-page website metadata report for $0.05 USDC on Base via x402, with private status and result retrieval.
New to x402? Three steps to your first payment.
1. Pick a facilitator
| Use case | Facilitator |
|---|---|
| Most chains, full SDK support | Coinbase CDP |
| Edge deployment, global latency | Cloudflare x402 |
| Enterprise billing + disputes | Stripe Machine Payments |
2. Install the SDK
# TypeScript
npm install x402-express # or the core package: @coinbase/x402
# Python
pip install x402# Rust
cargo add x402-axum x402-reqwest # x402-rs — see SDKs & Libraries shelfChecked 2026-09-20. A crate literally named x402 exists on crates.io but is a placeholder
with no working code — use x402-rs's crates (x402-axum for servers, x402-reqwest for
clients) instead.
3. Add payment middleware
import { paymentMiddleware } from '@coinbase/x402-express';
app.use(paymentMiddleware(wallet, {
'/api/data': { price: '$0.01', network: 'base-mainnet' }
}));That's it. The middleware returns 402 with payment details, verifies the client's payment header, and lets the request through.
Full quickstart → · Testnet setup →
1. Client → GET /api/data (initial request)
2. Server ← 402 Payment Required (payment details in header)
payment-required: <base64 challenge> (v2; v1 used X-Payment-Required
and put the detail in the body)
3. Client → EIP-3009 gasless USDC transfer (client signs + submits)
4. Client → GET /api/data + X-Payment: {signed tx} (retry with payment)
5. Facilitator → verify + settle on-chain (~2 seconds)
6. Server ← 200 OK + X-Payment-Response (resource returned)
No gas for the sender. No subscription. No API key. Payment IS authentication.
This README is the front door. The full curated directory — every shelf, every entry — is in directory/.
Other lists worth knowing: the community awesome-x402 accepts everything and is the right place for exhaustive coverage. Glama indexes MCP servers at enormous scale and publishes its own health data, which is rarer than it should be. Different jobs. Use all three.
gold-402 is curated, not exhaustive. Every entry earns its place.
See CONTRIBUTING.md for the curation standard, badge system, acceptance criteria, and submission process.
Quick rules:
- Entry must use the x402 protocol (HTTP 402 + X-Payment), not just USDC or general crypto payments.
- Live URL or public GitHub repo. Link must work.
- Last activity within 12 months (for libraries and resources without a live endpoint).
- One entry per pull request. Format:
[Name](url) — Description starting uppercase, ending with period. - Descriptions are factual. No marketing language.
Curated by 24K Labs
If this saved you time, star the repo.
24klabs.ai •
x402.org •
Protocol Spec •
Coinbase Docs •
Discord •
Live Dashboard