x402 Agent Safety Store

Endpoints (27 live)

• GET /v1/listing/visibility — Why isn't my x402 listing getting discovered/sold? ?domain=you.com returns your Bazaar ranking inputs as cohort percentiles — last-30-day calls & unique payers, staleness, resource count, live health — so you can see where you sit vs the catalog. No args = cohort distribution + zero-call (invisible) listings. The visibility companion to listing-doctor. Descriptive percentiles, not a verdict. (0.02 USDC on Base)
• GET /v1/ecosystem/services — Machine-readable map of the x402 service ecosystem on Base: price range, category, endpoint count, live health & latency per service — built from our continuous catalog+reliability scan. ?since=<unix> for newly-launched services; ?category=/?health=/?sort= to filter & rank. Skip scanning the whole Bazaar yourself. Objective facts, machine-readable. (0.005 USDC on Base)
• GET /v1/market/pulse — Census of the x402 ecosystem from our daily Bazaar snapshots: which domains launched or disappeared since yesterday, price-median drift, and network mix. ?kind=new|gone for the machine-actionable churn roster, or full pulse with aggregate + timeline. Only a holder of past snapshots can compute churn — objective counts, no quality judgment, machine-readable. (0.02 USDC on Base)
• POST /v1/recipient-check — Pre-send safety check: is this recipient a known malicious address (caught live on Base seeding address-poisoning via zero-value transfer sprays), or a look-alike of an address you trust? Checks our continuously-updated threat DB + deterministic look-alike logic. Answers an agent's 'is it safe to send here?' before every transfer. (0.005 USDC on Base)
• GET /v1/listing/watch — Is your x402 service still listed? The Bazaar removes resources that go without settlement, and no one tells you. We keep a daily snapshot of the whole catalog since June, so we can show whether your domain is present today, how its resource count moved day by day, and how long since each resource was last paid for. In our latest scan 620 of 2,147 domains are no longer present. Measured from our own snapshots. (0.01 USDC on Base)
• GET /v1/sales/gap — Listed, able to charge, and still not selling? We join the Bazaar catalog with measured on-chain revenue and report the median profile of the top fifth of earners, of everyone earning anything, and of those earning nothing, alongside your own. In our data the top fifth list 14 resources to the zero group one, and write 190-character descriptions to their 370. Correlations across services, not advice. ?domain=. (0.03 USDC on Base)
• GET /v1/threats/recent — Live feed of freshly-detected malicious addresses on Base — address-poisoning seeders caught via zero-value transfer sprays, updated continuously by our on-chain collector. Poll ?since=<unix> to ingest only new threats into your agent's blocklist. Deterministic, evidence-backed, machine-readable. (0.005 USDC on Base)
• GET /v1/rpc/health — Which Base public RPCs serve a stale chain tip. Every 30s we ask all major public RPCs for eth_blockNumber in parallel and record how many blocks behind the fastest peer each was, plus latency and error rate. An RPC never reports its own lag, so an agent reading a balance from a lagging endpoint cannot tell. Omit ?rpc for the full map; ?rpc=<host> for one. (0.01 USDC on Base)
• GET /v1/reliability/recent — Returns recent reliability data for assets or services. (0.005 USDC on Base)
• GET /v1/catalog/changes — What changed in the x402 Bazaar catalog since yesterday: price changes and payTo changes (the address you'd pay moved — a pre-payment guard). ?type=price,payto to filter. Objective a->b diff, no labels — only a holder of past daily snapshots can compute it. For registries/agents that must not route on stale data. (0.02 USDC on Base)
• GET /v1/reliability/recent — Live reliability feed of x402 endpoints on Base: which services are up, return a valid 402 envelope, and how fast — free-probed across the CDP Bazaar catalog. A real share of listed endpoints are broken/misconfigured; poll ?since=<unix> (or ?health=healthy) to route your agent to endpoints that actually work. Objective measurement, no accusation, machine-readable. (0.005 USDC on Base)
• POST /v1/preflight — One-call pre-transaction guard for agents: bundle the transaction you're about to sign/send and get every applicable safety check in a single payment — signature-intent decode, live threat-DB + address-poisoning look-alike on the recipient, and a drainer audit of standing approvals. By design no combined safe/danger verdict is emitted; each sub-check's flags & evidence come back verbatim so your agent decides. Replaces 4 separate 402 round-trips with 1. Deterministic, no LLM. (0.02 USDC on Base)
• POST /v1/listing-doctor — Why is my x402 service not listed — or listed but never paid? Send your endpoint URL; we fetch your 402 envelope, run the exact SDK validation the CDP facilitator runs, check catalog presence, and return per-check pass/fail with concrete fix hints. Includes two undocumented traps we verified against the live facilitator: a buyer must echo your bazaar extension into the settle payload, and a description over 500 characters makes the facilitator reject every payment. Deterministic, no LLM. (0.25 USDC on Base)
• POST /v1/approval-risk — Audit standing ERC-20/Permit2 approvals for danger. Raw allowance lookups exist elsewhere; this is the risk layer: pass your current approvals and we rank which to revoke — unlimited allowance, unknown (non-registry) spender, or the classic drainer pattern (unlimited AND unknown). Deterministic, no LLM, no external calls. Answers an agent's question 'which of my approvals are dangerous?' (0.005 USDC on Base)
• GET /v1/revenue/scope — How much does your x402 service actually earn, and where does that put you among your peers? We measure real USDC inflows to every payTo address in the Bazaar catalog over 30 days and return the distribution. Pass ?domain=<yours> for your own revenue, calls, unique payers and percentile, plus the cohort of services in your price band. Omit it for the market distribution alone. Individual competitors are never listed. Measured, not estimated. (0.25 USDC on Base)
• GET /v1/payment/debug — Your 402 envelope can pass every static check and still not get you paid. We build a real signed payment at your listed price and submit it to the CDP facilitator verify endpoint, which checks signature, requirements and the on-chain transfer simulation. Nothing settles, so no money moves. You get back whether a real payment would be accepted, and if not, the facilitator own reason verbatim. Pass ?url= or ?domain=. (0.25 USDC on Base)
• GET /v1/buyers/profile — Who actually pays you, and what else do they buy? We build the payer-to-service map across the whole Bazaar catalog from on-chain settlement, so we can tell you how many distinct agents paid you, how often each returns, and what share of your buyers also pay other x402 services. Pass ?domain=<yours>; omit for the market-wide buyer pool. Individual buyer addresses are never disclosed. (0.02 USDC on Base)
• POST /v1/address-poison-check — Before sending funds, check if the recipient is an address-poisoning look-alike. Give us the recipient and your known/intended addresses; we flag when the recipient shares the displayed head AND tail of one you know but differs in the middle — the exact signature of a poisoning attack that fools copy-paste. Deterministic, no LLM, no external calls. Answers an agent's question 'is this really the address I mean?' (0.005 USDC on Base)
• POST /v1/sign-decode — Decode an EVM signature request (EIP-712 typed data, Permit/Permit2, or ERC-20 approve calldata) into a structured intent: what token, which spender, how much, until when, plus risk_flags and an action_hint. Deterministic, no LLM. Answers an agent's question 'what am I about to sign?' (0.005 USDC on Base)
• GET /v1/reliability/broken (0.02 USDC on Base)

+7 more endpoints.