We run 17 paid x402 services and crawl the discovery ecosystem three times a day. Yesterday we pointed the crawler at a different question: not what's listed in the x402 Bazaar, but what works. One probe against a live endpoint from every single seller in the catalog — all 1,225 of them.
The numbers
- 74% pass (905 sellers): reachable, correct HTTP 402, and a parseable payment envelope an agent can actually pay against
- 206 sellers (17%) are dead — their listed endpoint 404s. A storefront with no store behind it
- 40 sellers serve their paid product with HTTP 200 and no challenge — the paywall never fires; agents get the goods for free and the seller has no idea
-
15% are already dual-stack — answering both an x402 envelope and an MPP (
WWW-Authenticate: Payment) challenge on the same 402
How we almost got it wrong
Our first pass checked response bodies for the x402 envelope and flagged nearly half the catalog as broken — including our own fleet. The envelope was in the base64 payment-required header the whole time. We're publishing the mistake because it's the point: even people who run x402 services for a living misread a 402 at first glance. An agent's client library gets no second glance.
We were also careful with the 143 sellers who answered 405 to a GET — mostly POST-only services. Each got a second probe as POST before judgment; 128 turned out perfectly healthy and are counted in the 74%.
The three checks that would catch almost every failure
- Hit your own listed URL from outside your network and confirm you get a 402 — not a 200, not a 404.
- Base64-decode your
payment-requiredheader and confirm it parses withx402Versionand a non-emptyaccepts[]. - If your routes are POST-only, make sure GET still answers the challenge instead of a bare 405 — you don't know which verb a discovering agent tries first.
We turned the census probe into a free scanner: paste your URL at forgemesh.io/scan and get an A–F grade in five seconds. Agents can run the same check machine-to-machine for $0.05 over x402 itself (POST https://x402.forgemesh.io/x402-endpoint-scan) — yes, an x402 API for checking x402 APIs.
Full census with methodology and caveats: the original post. We'll re-run it monthly and publish the movement.
