The gold standard for x402 resources. 535 curated entries — paid endpoints probed for a live 402 before listing, libraries and repos checked for real activity, and the whole shelf re-knocked every night with the result dated. No filler.
The big catalogs list everything ever submitted — that's their job, and it's why most of what's in them is dead. We measured it: 67–79% of the free-listing catalogs no longer answer.
gold-402 is the other thing. Smaller on purpose. A person checked every entry, we publish what we checked and what we didn't, and in July 2026 we started buying services and reporting what came back. Automated monitors now do the machine half of that continuously and do it well; what they do not do — by their own published scope — is judge whether the thing that came back was any good. That judgement is what this list is.
The product. 535 entries across 13 shelves, in directory/.
| Shelf | What's on it |
|---|---|
| APIs & Services | Paid endpoints an agent can call. Every one probed for a live 402 before listing. |
| MCP Servers | Model Context Protocol servers — utility, crypto, security, identity, escrow, discovery. |
| SDKs & Libraries | Client and server libraries across languages. |
| Facilitators | Payment verification and settlement services. |
| Frameworks | Agent frameworks with x402 support. |
| Tools | CLIs, CI, monitoring, spend controls, testing, discovery. |
| Security | Audit, risk scoring, pre-execution gates, compliance. |
| Ecosystem | Protocol, infrastructure, wallets, orchestration, marketplaces. |
| Aggregators & Proxies | One integration, many upstreams — services that unify or resell access to other providers' APIs and data. |
| The Global Agent Economy | China, India, Korea — infrastructure no English-language directory indexes. |
| Learning | Quickstarts, tutorials, reference docs, news. |
| Community | Channels, newsletters, jobs, events. |
| Market Data | On-chain analytics, dashboards, adoption. |
There is no stamp. There was one — "Gold402 Verified," one tier, a gold tick — and it was retired on 2026-09-06 because it said the identical thing about a paid API we knocked last Tuesday, a community wiki with no endpoint to knock at all, and an entry we hold no dated receipt for. A mark that everything wears certifies nothing. We have made that criticism of other people's badges and it was true of ours.
What every entry now carries instead is the finding, per entry:
- A date — this endpoint answered an HTTP 402 when we knocked it, on this day. An automated gate checks the submission, a maintainer confirms it before merge, and a sweep re-knocks and writes a dated result. A date is checkable. A tick is not.
- Or "listed — no knock receipt" — a human read it and it is on the list. We hold no dated knock, and we will not backfill a date we cannot show.
- Or "listed — no endpoint to knock" — libraries, guides, wallets, clients and community resources. Nothing here answers a 402 because that is not what these things do. We read them, and we checked they were publicly reachable.
None of it is a delivery test. We have not paid these services and graded what came back. Read any of it as "we checked what is stated above," never as "this is worth the money."
Some entries carry more. Where we have paid for a service and confirmed what came back, we say so and keep the receipt — what we sent, what it cost, the transaction hash, what arrived. That is a stronger claim and we only make it about services we actually bought. Most of the list has not been through that, and we would rather say so than imply otherwise.
Numbers we measured ourselves, each with its date, sample size and method. Where measurements disagree, both are shown — they were taken on different days by different methods, and blending them into one tidy figure would be the kind of thing this directory exists to argue against.
| Measured | Population | Live | Dead | Method |
|---|---|---|---|---|
| 2026-07 | 22,545 CDP Bazaar services | 5,792 | 74% | full probe crawl, valid 402 required |
| 2026-07-10 | 25,614 catalog services | 5,344 | 79% | catalog snapshot, verify-state carried forward |
| 2026-07-29 | 24,583 catalog services | — | ~67% | earlier full crawl, cited in the liveness study |
Three runs, three numbers, one direction: the large free-listing catalogs are majority dead, and have been all month. Anyone quoting a single decimal-point figure for this is quoting a moment, not a fact.
Across four independent registries — 204,500 registered agents and services — the dead share tracks one variable: what it costs to get listed.
| Registry | Entry cost | Dead |
|---|---|---|
| CDP Bazaar | free | ~67–79% |
| ERC-8004 on-chain identity | gas only | 85–97% |
| Glama MCP registry | curation + scoring | 47% unhealthy (their own published figure) |
Free entry selects for abandonment. Full method, limits, and an open invitation to refute it: The Liveness Law →
In July 2026 we ran a paid delivery check across our own shelf — actually buying services and recording what came back.
- 16 of 126 listed services were purchasable by a machine at a discoverable address
- 8 delivered exactly what they advertised
- 0 took payment and returned nothing
- $0.054 spent, every transaction reconciled on-chain
The friction in this economy sits before the payment, not after it. Most services are fine; most front doors are not. We are not claiming that as a finding yet — the sample is 16 services and one day, 2026-07-30. A wider census was designed the same week and has not run; the blocker is ours, not the ecosystem's. We would rather say that than let the sentence stand.
x402 is a US-governed rail. It is not the only answer to machine payment, and outside the West it is not the answer being used — China runs delegated agent authorization on existing rails, India runs regulated human-signed mandates that agents execute inside a cap. Both were operating at scale before the x402 Foundation was a month old.
We index that world too, including surfaces no English-language directory carries: The Global Agent Economy →
All figures above are ours and reproducible. Where we could not reach something, we say so rather than leaving the gap invisible.
August 2026 — one pick per shelf. Each shelf opens with its pick and the write-up. Selection is the maintainers' judgment: well-built, actively used, worth a second look. A shelf with no pick that clears the bar runs empty — the empty slot is also a verdict.
| Shelf | August pick |
|---|---|
| APIs & Services | The Bot Wire |
| MCP Servers | Razorpay MCP Server |
| SDKs & Libraries | ra2a |
| Facilitators | Primev FastRPC |
| Frameworks | machi |
| Tools | portal-tunnel |
| Security | Hermes Plant Action Safety |
| Ecosystem | Glama |
| The Global Agent Economy | ONDC |
| Learning | Tangle Network: x402 Production Runway |
| Community | WorkProtocol |
| Market Data | Valoria |
| Aggregators & Proxies | — |
The wire lives at 24klabs.ai/news — dated editions with permanent links, every claim cited. Four editions so far; the most recent is 2026-08-10. It is not on a schedule.
This week (Sep 7—13)
- Gardenpatch Growth Coaches — Seven growth coaches (strategy, sales, marketing, operations, retention, technology, people) answering a mode plus messages with a typed JSON deliverable, USDC on Base at $0.18 to $0.45 per call. Example:
POST /api/v1/agents/mary/call {"mode":"diagnose_growth","messages":[{"role":"user","content":"Revenue is flat at $40k/mo. Where are we stuck?"}]}. (OpenAPI) (Catalog) (Skill) - webcap — Web capture API with five pay-per-call routes: page screenshots, structured content extraction, SEO audits, site mapping, and scroll-capture video, $0.001-$0.01 USDC on Base via x402 with no API keys. Example:
POST /v1/x402/capture {"url":"https://example.com"}. - Council of AI — Independent AI-behaviour measurement packs and EU AI Act evidence over x402 on Base; GET /api/gspc is free, paid doors answer 402 with catalog query params. Example:
GET /api/eunomia-data?feed=1. (OpenAPI) (Manifest) (MCP). - Council of AI GSPC MCP — Measurement MCP (not certification). Free board tools; paid tools over x402 (
art50_marking_evidence,rwa_evidence,receipts_batch,commission_card). Remotehttps://councilof.ai/mcp. npmcsoai-gspc-mcp. (OpenAPI) (Manifest) (x402scan). - Base toolbox — Base Uniswap v3 swap preflight, leftover allowances, tx explain, and transfer check at $0.10 USDC on Base via x402, plus $0.01 price/gas/ENS. Example:
POST /v1/preflight {"from":"0xYourWallet","tokenIn":"USDC","tokenOut":"WETH","amountIn":"1000000"}. (Skill) (OpenAPI) (Constants). - Base toolbox — Remote MCP for Base before you sign: Uniswap v3 swap preflight, leftover allowances, tx explain, transfer check ($0.10 USDC), plus $0.01 price/gas/ENS. GET /v1/constants free. (MCP) (OpenAPI) (Skill)
- Veriton HTML→JSON — Metered HTML to structured JSON for agents (title/meta/links/headings/images); $0.02 body / $0.05 fetch USDC on Base; prepaid credits or HTTP 402. Example:
POST /v1/html-to-json {"html":"<html><title>Hi</title><h1>X</h1></html>","selector":"h1"}. (Docs) (OpenAPI) (Manifest) (MCP) (GitHub)
Last week (Aug 31—Sep 6)
- Textus — Structured literary content for AI agents, including complete selected text units, metadata, characters, scenes and editable baseline reading direction, with free resource discovery and production-material JSON purchased through x402. (Catalogue) (Docs)
- Genuine Good Grants — Sourced U.S. federal grant search, official notice detail, transparent mission-fit signals, application briefs, and deterministic shortlist preflight checks from current Grants.gov public records, priced from $0.05 to $5.00 USDC on Base through x402 v2. (Manifest) (OpenAPI) (llms.txt)
- /deslop — Removes AI-writing tells (em dashes, hedging, throat-clearing) from a draft, returns cleaned text plus a changelog. $0.10 USDC on Base. Example:
POST /api/deslop {"text":"..."}. (Prompt page) - PLEXUS Intelligence API — 163 pay-per-call x402 endpoints from a single provider: US federal regulatory data (EPA, OSHA, FEC, SEC full-text, FDA, NPI, CMS, FEMA, CFPB, CourtListener, SAM.gov, Congress.gov, GLEIF, WorldBank, and 15+ more), plus 12 AI reasoning engines (Tribunal multi-model verdict, WHETSTONE adversarial stress-test, POSTCOG action-safety gate, G-Score ground truth, Verify claim verification) and 5 composite intelligence products synthesized cross-source (Company Risk $0.35, Political Intel $0.35, Supply Chain Risk $0.30, Healthcare DDIL $0.30, Nonprofit Intel $0.20). Data adapters $0.01–$0.03/call, engines $0.05–$0.15/call. Base + Solana mainnet. No API keys — wallet is auth. (OpenAPI) (Manifest) (llms.txt) (MCP)
- openzoo — OpenAI-compatible chat completions paid per request via x402 on Solana and Base, with no account or API key.
- API Acre Website Metadata — Extracts title, canonical URL, headings, hreflang, icons, feeds, Open Graph, Twitter Cards, and JSON-LD types from one public HTTPS page, with redirect and response provenance, for $0.002 USDC on Base or Solana. (Catalog) (OpenAPI) (x402 discovery)
- x402 Preflight — Audits a public x402 endpoint before payment via required
resource_urland optionalmethod=GET|HEAD,expected_network, andmax_price_usdquery parameters; the audit costs $0.05 USDC on Base. - Excelexi — Technical-indicator and market-analysis API for trading agents: 73 indicators and 24 derived signals across 100 crypto markets, plus screening, analytics snapshots/history, and a natural-language endpoint that compiles a plain sentence into a deterministic query before executing it. Every returned value carries provenance — which bars were used, whether the indicator's warm-up period was satisfied, the data's age, and the upstream source — so a caller can verify freshness before acting on it. Example:
GET /api/v1/technical-analysis?symbol=BTCUSDT&interval=1h. $0.00002-$0.0005 USDC on Base mainnet via x402 v2 (EIP-3009), 9 payable endpoints, no API key and no signup. (OpenAPI) (Discovery) (Docs) - Truth Bear (GAUGE) — 180+ official-source data signals for AI agents: US river/flood and streamflow (USGS/NOAA), air quality (EPA), drought, power grid (EIA), shipping (IMF PortWatch), and SEC EDGAR filings. Each paid record ships a canonical sha256 record_hash the caller recomputes offline; readings are stated against the source agency's own published thresholds where one exists. $0.005–$0.09 USDC on Base and Solana, no API key, no signup; a query with no data returns 422 and is not billed. Screening-level, not decision-grade. Example:
GET /gauge/air. (llms.txt) (Sample) (MCP) - x402-list — Agent-first directory of x402-payable APIs with a no-auth machine-readable REST feed and a hosted MCP server for finding and verifying endpoints before an agent pays.
- Ausca — Metered infrastructure services for agents: document OCR, document analysis, media transcription, leased browser sessions with CDP, and receive-only agent inboxes. From $0.05 USDC per call on Base via x402 v2, no accounts or API keys, every result bound to published schema digests and a terminal receipt. Unsigned
POST /v1/invocationsreturns the live payment requirement. (OpenAPI) (Manifest) (Skill) - RGX — Snap Router: task-to-tool selection over the merged x402 Bazaar and MCP Registry catalog (16k+ entries), one pass, no LLM call, $0.003 USDC. Example:
POST /v1/snap?x402force=1 {"task":"check a base token for honeypot","k":4}. Pricing-Truth: real tradeable depth vs headline TVL, depth-weighted multi-pool price corroboration, and a live buy-then-sell honeypot/transfer-tax check for tokens on Base, Ethereum, and Arbitrum, $0.005-$0.04 USDC. Example:GET /v1/base/token/0x532f27101965dd16442E59d40670FaF5eBB142E4/report?x402force=1. Free tier, CDP facilitator. (Manifest) (OpenAPI) (llms.txt) (MCP) - x402 Preflight — Audits a public x402 endpoint before payment via required
resource_urland optionalmethod=GET|HEAD,expected_network, andmax_price_usdquery parameters; the audit costs $0.05 USDC on Base. - MIDAX402 — Signed EIP-712 conformance verdicts for x402 services, appended to a public registry. Paid board position available ($1–$100 ladder) as a separate column; no payment changes a verdict or the verification-date ordering.
- WickedAPI x402 Paywall — Multi-tenant x402 paywall-as-a-service on Base mainnet via the Coinbase CDP facilitator. Self-serve signup, REST API to set price/network/payout wallet and forward to a real backend, live settlement views. Example:
GET https://paywall.wickedapi.com/wickedapi/weatherreturns a live 402. (OpenAPI, Cookbook) - How x402 paid links work (Payfirst) — Guide to x402 V2 payment headers, URL delivery, buyer-client requirements, and retry handling when settlement is uncertain.
- FractalAI x402 Proofs — Seven pay-per-call endpoints on Base (x402 v2, USDC via EIP-3009 gasless settlement) signing with ML-DSA-65/Dilithium-3 (NIST FIPS 204): message signing and verification, AI-decision attestation, and provenance/CBOM sealing, each response independently verifiable offline against the exact signed bytes returned; a companion
@x402/coreextension,@fractalai/x402-pqc-witness, adds the same post-quantum settlement attestation to any resource server. - DNS Doctor — Email-authentication and DNS diagnostics for agents: SPF, DMARC, DKIM, MX, blacklists, domain/SSL expiry and six-vantage propagation, returning deterministic copy-paste fix records. Bulk scans $0.005 per domain, 24h propagation and HTTP-ping watches $0.10–$0.25, USDC on Base (x402 v1+v2). Example:
POST https://dnsdoctor.dev/api/v1/bulk-scan {"domains":["example.com","example.org"]}(OpenAPI, docs) - Israel Invoice Payment Gate — Pre-payment gate for Israeli tax invoices and accounts-payable agents. Checks VAT arithmetic and totals, applies Israel Invoices allocation-number rules using date, amount, VAT and buyer-attested conditions, resolves the supplier against public-registry evidence, and returns deterministic PAY, HOLD, or BLOCK reason codes. $0.25 USDC per POST on Base mainnet via x402 v2, with no account or API key. It does not verify bank-account ownership or independently authenticate buyer-supplied Tax Authority results. Example:
POST /v1/invoice-gate/mainnet {"supplier_company_number":"514744887","invoice_number":"INV-2026-001","invoice_date":"2026-09-04","amount_before_vat":6000,"vat_amount":1080,"total_amount":7080}. (Free preview) (OpenAPI) (Manifest) - aiworker-data — DeFi yield pools and single-protocol snapshots from DefiLlama (refreshed every 5 minutes), plus clean-Markdown and LLM-summary fetch of any public page. Four endpoints, $0.01–$0.04 USDC per call on Base and Solana via PayAI, settled only after a successful response. Example:
GET /v1/defi/protocol/aave-v3;POST /v1/scrape/markdown {"url":"https://example.com"}. (OpenAPI) (MCP) (Site) - aiworker-data MCP — Remote streamable-http MCP with four paid tools:
defi_yieldsanddefi_protocol(DefiLlama data, refreshed every 5 minutes),scrape_markdownandscrape_summary(public page to clean Markdown, optionally LLM-summarised). $0.01–$0.04 USDC per call on Base and Solana via x402, settled only after a successful response; listed in the official MCP Registry asorg.duckdns.aiworker/aiworker-data. Example tool call:defi_protocol {"slug":"aave-v3"}. (OpenAPI) (Registry)
New to x402? Three steps to your first payment.
1. Pick a facilitator
| Use case | Facilitator |
|---|---|
| Most chains, full SDK support | Coinbase CDP |
| Edge deployment, global latency | Cloudflare x402 |
| Enterprise billing + disputes | Stripe Machine Payments |
2. Install the SDK
# TypeScript
npm install x402-express # or the core package: @coinbase/x402
# Python
pip install x402Checked 2026-08-30. There is no published x402 crate on crates.io; if you are on Rust,
call the HTTP flow directly — it is four steps and they are below.
3. Add payment middleware
import { paymentMiddleware } from '@coinbase/x402-express';
app.use(paymentMiddleware(wallet, {
'/api/data': { price: '$0.01', network: 'base-mainnet' }
}));That's it. The middleware returns 402 with payment details, verifies the client's payment header, and lets the request through.
Full quickstart → · Testnet setup →
1. Client → GET /api/data (initial request)
2. Server ← 402 Payment Required (payment details in header)
payment-required: <base64 challenge> (v2; v1 used X-Payment-Required
and put the detail in the body)
3. Client → EIP-3009 gasless USDC transfer (client signs + submits)
4. Client → GET /api/data + X-Payment: {signed tx} (retry with payment)
5. Facilitator → verify + settle on-chain (~2 seconds)
6. Server ← 200 OK + X-Payment-Response (resource returned)
No gas for the sender. No subscription. No API key. Payment IS authentication.
This README is the front door. The full curated directory — every shelf, every entry — is in directory/.
Other lists worth knowing: the community awesome-x402 accepts everything and is the right place for exhaustive coverage. Glama indexes MCP servers at enormous scale and publishes its own health data, which is rarer than it should be. Different jobs. Use all three.
gold-402 is curated, not exhaustive. Every entry earns its place.
See CONTRIBUTING.md for the curation standard, badge system, acceptance criteria, and submission process.
Quick rules:
- Entry must use the x402 protocol (HTTP 402 + X-Payment), not just USDC or general crypto payments.
- Live URL or public GitHub repo. Link must work.
- Last activity within 12 months (for libraries and resources without a live endpoint).
- One entry per pull request. Format:
[Name](url) — Description starting uppercase, ending with period. - Descriptions are factual. No marketing language.
Curated by 24K Labs
If this saved you time, star the repo.
24klabs.ai •
x402.org •
Protocol Spec •
Coinbase Docs •
Discord •
Live Dashboard