com.x402-list/x402-list-mcp
REMOTE · MCP.X402-LIST.COM · 2 COMPONENTS · SCANNED AUG 3
x402-list directory MCP: services, facilitator volume, ranked picks, paid assessments.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score →
Endpoint Security57
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not fully verified: no authorisation is required to call this server, and 6 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. See how to fix → View diagnostics → Unverified
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability52
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 2154 tokens (~359/item across 6 items; 6 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
- Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage96
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 87% of tool parameters carry a description.Partial
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
remote · mcp.x402-list.com
claude mcp add --transport http com-x402-list-x402-list-mcp https://mcp.x402-list.com/mcp
[mcp_servers.com-x402-list-x402-list-mcp] url = "https://mcp.x402-list.com/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"com-x402-list-x402-list-mcp": {
"type": "remote",
"url": "https://mcp.x402-list.com/mcp",
"enabled": true
}
}
} openclaw mcp add com-x402-list-x402-list-mcp --url https://mcp.x402-list.com/mcp --transport streamable-http
mcp_servers:
com-x402-list-x402-list-mcp:
url: "https://mcp.x402-list.com/mcp" {
"mcpServers": {
"com-x402-list-x402-list-mcp": {
"type": "http",
"url": "https://mcp.x402-list.com/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
- 1 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.
- 31 Jul 26 +1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 29 Jul 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
- 28 Jul 26 +2
- Tool “find_best_service” rewrote its description, which is the text the model reads security
- Tool “search_x402_services” rewrote its description, which is the text the model reads security
- Schema quality: 316 → 359 ▼ functional
- Server version: 0.4.1 → 0.4.2 functional
- “search_x402_services” added an optional parameter “signable” cosmetic
- 27 Jul 26 −2
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 26 Jul 26 58
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Probed https://mcp.x402-list.com/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=x402-list.com | CN=WE1,O=Google Trust Services,C=US | 16 Jun 2026 | 14 Sept 2026 | ECDSA 256 | ECDSA-SHA256 | aaebd8bbd607f6dc13f4490bb603b5fa |
| SANs: x402-list.com, *.x402-list.com | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
DNSSEC insecure
Validation of mcp.x402-list.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| x402-list.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://mcp.x402-list.com/mcp | Verified | 200 | |
| http (plaintext) | http://mcp.x402-list.com/mcp | HTTPS enforced | 302 | https://mcp.x402-list.com/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
assess_services ~491
Run a fresh, PAID AI assessment comparing a shortlist of already-listed x402 services for a stated need. It charges a one-time $0.25 USDC on Base (x402) for the fresh reasoning only; reading an already-computed assessment stays free via get_service. This tool is a pure pass-through: it never holds keys, never signs, and never settles. Call it once WITHOUT payment_signature_b64 to receive the x402 payment challenge (accepts[], amount, payTo, and a base64 PAYMENT-REQUIRED header) verbatim; sign accepts[0] client-side with your own wallet; then call again with the SAME question and services plus payment_signature_b64 to receive the assessment report and a base64 PAYMENT-RESPONSE settlement receipt. Optionally include a probe target as probe { slug, endpoint_path? } to also test one listed service live: when the server has live probing armed, after the fresh reasoning it makes a real x402 payment to that endpoint and analyzes what it returns, and the challenge is then priced at $0.25 plus that endpoint price X (probe fees are non-refundable regardless of outcome); the report then carries a probe_report block with a verdict and truncated extracts, never the verbatim third-party response, and when live probing is not armed the probe is ignored. If the fresh run cannot be produced the server answers before settling, so the caller is never charged, and there is no refund. Prices are US dollars.
| Name | Type | Req | Description |
|---|---|---|---|
| payment_signature_b64 | string | — | Base64 PAYMENT-SIGNATURE for the x402 payment, produced by signing the accepts[0] challenge client-side. Omit on the first call to receive the challenge; set it on the retry to run the paid assessmen… |
| probe | object | — | Optional live-probe request: pay one listed service for real and analyze what it returns. When the server has probing armed the price becomes $0.25 plus that endpoint price X (non-refundable); the re… |
| question | string | yes | The need to assess the shortlist against (1 to 1000 characters). |
| services | array | yes | Service slugs to compare for the need (1 to 8; find them with search_x402_services or find_best_service). |
No output schema declared.
No examples provided.
check_health ~107
Check live health of x402 services. With no slug, returns a directory-wide snapshot (counts of online/degraded/offline/unknown plus per-service status). With a slug, returns that service's status, uptime windows, response time, consecutive failures, and recent daily uptime snapshots. No money fields.
| Name | Type | Req | Description |
|---|---|---|---|
| slug | string | — | Service slug for a single-service health report. Omit for the whole directory. |
| uptime_period | string | — | Daily uptime snapshot window for single-service mode. |
No output schema declared.
No examples provided.
find_best_service ~523
Recommend the best x402 service(s) for a need. Ranked mostly on per-service reliability (live status, verification, uptime, response time), x402 compliance (the share of deterministic conformance checks the service passes, capped at 0.6 out of 1, the floor of the C band, when at least one of its EVM routes is missing the EIP-712 domain parameters a standard x402 client needs in order to sign a payment: a fact about the payment envelope, not a judgement on the service), and price (USD), filtered by category and network, with a SMALL (~10%) weight on on-chain traction: settlement volume, transaction count, and unique buyers measured per service over its known payTo addresses via recognized settlers (a conservative undercount, not an estimate). Traction never dominates; a service whose payTo is shared across services has its traction attributed PRO-QUOTA (volume and buyers divided by the number of services sharing the payout), so sharing neither rewards nor spam-clones a service. A service on a network not yet measured, or a shared member whose probe has been failing, carries no traction term (the other weights are renormalized). Traction also requires recent settlement: with no on-chain settlement in the last 30 UTC days the term is 0. Each recommendation also reports top_buyer_share_30d, the 30d volume share of the single largest buyer, as a published concentration signal for the reader; it does not enter the score. The response carries ranking_version, the scoring generation it was produced under, currently 2 because of that compliance cap: scores you stored under generation 1 are not comparable with these. Optionally attach ecosystem facilitator-volume context separately.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | — | Desired service category. |
| include_facilitator_context | boolean | — | If true, also return top facilitators by 7d settlement volume as separate ecosystem context (NOT per-service). |
| limit | integer | — | How many ranked recommendations to return. |
| max_price_usd | number | — | Cap on min_price_usd in US dollars; cheaper or equal passes. |
| network | string | — | Required network name or abbreviation, e.g. 'Base' or 'BSE'; any network code returned by /api/v1/networks is accepted. |
| prefer | string | — | Tie-breaking emphasis for the ranking weights. |
| q | string | — | Free-text need description to match against name/description. |
| require_verified | boolean | — | If true, only verified services are eligible. |
No output schema declared.
No examples provided.
get_facilitator_volumes ~278
Get on-chain-verified settlement volume per x402 facilitator (the core x402-list metric). Returns USD settlement volume and transaction counts for today (UTC)/7d/30d/all-time, plus a `verification` flag ('on-chain' when volume has been observed on-chain, else 'listed'). Note: the fields named *_24h cover today (UTC) so far, not a trailing 24-hour window, so they reset at 00:00 UTC and read near zero just after midnight; prefer 7d for a stable recent-activity read. Optionally include a daily timeseries and per-chain breakdown. All volume figures are in US dollars. This is PER-FACILITATOR, not per-service.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | — | Length of the timeseries in days (only used when include_timeseries is true). |
| include_chains | boolean | — | Include a per-chain (network/asset) volume breakdown per facilitator. |
| include_timeseries | boolean | — | Include a daily volume_usd / tx_count series per facilitator. |
| page | integer | — | — |
| per_page | integer | — | — |
| timeframe | string | — | Drives the sort order of the returned facilitators. '24h' sorts by today (UTC) so far, not by a trailing 24-hour window. |
No output schema declared.
No examples provided.
get_service ~166
Get full detail for one x402 service by slug: live status, uptime over 24h/7d/30d/90d, average response time, accepted networks and settlement asset, and every priced endpoint with its USD price. Use after search_x402_services to inspect a specific service. Prices are in US dollars; the per-endpoint `price` field is a raw on-chain atomic token amount, not dollars.
| Name | Type | Req | Description |
|---|---|---|---|
| include_series | boolean | — | If true, also attach this service's daily on-chain series under `series` (settlement volume and distinct buyers, one point per UTC day over the most recent 90 days, oldest first). Off by default to k… |
| slug | string | yes | Service slug, e.g. 'my-api'. |
No output schema declared.
No examples provided.
search_x402_services ~369
Search and filter the x402-list directory of services that accept x402 payments. Filter by free-text query, category, network, live status, and whether the service's last observed 402 envelope can be signed by a standard x402 client; sort by newest, uptime, cheapest, or endpoint count. Returns service summaries with price (USD), uptime, status, and verification. Prices are in US dollars.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | — | Exact category name (see categories context). Omit for all. |
| network | string | — | Network name or abbreviation, e.g. 'Base' or 'BSE'; any network code returned by /api/v1/networks is accepted. Omit for all. |
| page | integer | — | — |
| per_page | integer | — | — |
| q | string | — | Free-text search across name, description, category, base_url. |
| signable | boolean | — | Filter on the signability of the last observed 402 envelope: true = no EVM route of the service was observed missing the EIP-712 domain parameters (extra.name and extra.version) that a standard x402… |
| sort | string | — | Server-side sort order. |
| status | string | — | Filter by live monitoring status. |
| verified_only | boolean | — | If true, return only verified services. Filtered server-side, so the result total covers the whole verified set, not just this page. |
No output schema declared.
No examples provided.