Quick update! u/IllWar5047 pointed out something that bugged me too: In our MCP our semantic search tool matches endpoints by meaning, which is nice for "find me a weather API", but useless if you want to see everything under (for example) nsgoods.org, or check whether a URL is even in the catalogue. An agent couldn't ask for that at all. Now it can 😄

So, new stuff:

• Keyword search as a tool: throw in a domain, a path or a service name and get every matching endpoint. Listed and delisted ones, paged, max 25 per call.
• A tool for verified providers: every host that verified itself, with the info they published (org, docs, contact) and their score.
• All list tools page now (25 + total), so an agent doesn't have to swallow the whole leaderboard or search result at once.

And the verified checkmark is finally visible everywhere, not just on the website: leaderboard, keyword search, semantic search. For humans and agents alike. Verification still doesn't count into the score, by design, as always 😄

One thing you'll run into: verification is per host, so eight subdomains = eight verifications (u/IllWar5047 knows what I'm talking about 😅). Batch claims for subdomains are on my list tho, for an update in the near future!

Free to try: https://x402-trust.com/mcp (streamable, stateless MCP) or npx -y x402-trust-mcp (local installation into your harness).

Would love to hear some feedback, if you have any.

You can now claim ownership of your endpoints' domain on x402 Trust!

Verify that your endpoints are truly yours, gain a blue checkmark in front of your endpoints as a visual standout in our search and display contact information and a description about your service on the respective /provider and /endpoint pages.

This information will be displayed in the (freshly overhauled) website UI and the machine-readable JSON responses, so that both humans and agents can see & use them to better judge your service before paying 😊

Side note: Verification doesn't affect the trust score, by design; the score is only computed from our independent measurements, and letting a provider influence it would undermine exactly that.

You can verify your ownership through the following mechanism, without the need to create an account or a sign-up:

You verify your service's contact email address (through a one-shot verification link), which will also get displayed to customers afterwards, and...

... you'll generate a keypair locally in your browser: The public key goes into a /.well-known/x402-trust.txt file that you have to place in your domain's root, which we will regularly scan for. Should it disappear for >7 days, your endpoints will switch back to "unverified" status.

Your private key, which is secret, shown only once and downloaded locally to your device, enables you to prove your claim in our self-management workflow (more on that below).

Alternatively, you can also just bring your own keypair and paste us the public key. We accept both, no need to trust our website's code for this step 😉

Use the command openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out provider-key.pem in your console and fetch your public key via openssl pkey -in provider-key.pem -pubout if you'd like to go that route. Keep the provider-key.pem safe; you'll need this for the self-management workflow:

Through the management page (/verify/<host-domain>) you can:

• change your information
• opt in to friendly alerts via mail, should we ever detect that the probes to your endpoints are coming back negative (provider alerts only, we will never send any ads)
• delist your service's domain & endpoints from our catalogue: This blacklists your service entirely and deletes your stored contact & profile data, so you won't get re-added by our automatic scans again later.
• send a rotation link to your verified email that replaces the key, contact & profile, should you ever lose your private key. Can happen, no biggie 😄

Give it a try here, it's totally free of course: https://x402-trust.com/verify

Have any questions or suggestions? I'd be happy to hear them, please drop them in the comments! 😃

Your agent sent $5 to a hijacked x402 endpoint. No data came back, and the money is gone now.

The preflight-check looked perfect:

• Spec compliant endpoint
• Answered with low latency

... but your agent still got scammed. Why? Because of what a one-off check can't see:

The endpoints history. It can't see that a week ago it has moved its payTo address to a new wallet. It can't instantly see that this new wallet has zero economic activity associated with it.

This is what x402 Trust provides. Constant probes, machine-readable risk-flags and a recommendation verdict for >85,000 publicly listed endpoints. Never send money into the void and never pay an untrustworthy endpoint.

Our trust-score is cheap enough that it's a rounding error for your agentic payments. And an agent handling real money should be better safe than sorry.

And: Our semantic search enables your agent to find a trustworthy endpoint that fits his need in the first place. No more guessing, no need to know any service-name or -URL.

Because humans are equally interested in "windowshopping" as agents right now, I've just overhauled the UI + UX of my websites "Browse"-section.

It is more userfriendly, surfaces more data and is more responsive now.

Perfect for casually clicking yourself through the whole x402 directory from your phone or PC. Over 110.000 endpoints, at your fingertips 😃

All for free, of course!

Go give it a try, you can start with provider, network, price or grading!

Just click "Browse" in the header and start exploring from there! ⬆️

Edit: typo

A new update to x402 Trust: every JSON response that's returned by any free or paid endpoint is now being hashed & signed by the service.

Don't "trust the trust score". Verify the signature yourself through our public key with your own code, or our example code that we provide on our schemas-page in the new "Response signatures" section.

This way you can independently prove that

• The data truly comes from the official x402 Trust service
• No man-in-the-middle-attack happened, that modified the data
• No data was lost, modified or left out; it arrived exactly how our service sent it

The current key(s) are always surfaced with all necessary information under https://x402.fuchss.app/.well-known/x402-trust-keys.json ...

This URL is also emitted in the response data (Field publicKeys), however there it has to be treated merely as a hint, not a source of truth. An attacker who modified the response data can easily swap this URL out and use their own keys, so a check that depends on the response's publicKeys field proves essentially nothing.

Wire this as a new deterministic, automatic check into your agent's payment-workflow prior to your agent using the data for a decision and thus base it on a tamper-proof recommendation, instead of unverified data.

u/Optimal_Manner359, who requested this feature, has already started to implement this system into his payment-approval flow, for example.

Disclaimer: No signature is available for the /watch endpoints. A signed response invites being forwarded as evidence, and the watch responses contain your capability URLs in plain text, so forwarding one would hand over your own access. An implementation that strips the secrets & only signs the remaining data would be possible too, but would also mean a more specific and complicated workflow for the verification of these endpoints, which is why the decision fell against it for now. If you want to have the /watch endpoints signed too regardless, let me know, and I'll add it for them too.

Under multiple posts and threads I've constantly read one thing: "I don't know how to get discovered" on the builder side and "I don't know where to look for a quality service in this huge sea of endpoints" on the buyer side.

And yes, it's true: There are pages upon pages of documentation out there for x402, that describe how to set up your own endpoint, how to add it to the public x402 bazaar list and how to pay for an endpoint, but one thing is always missing..:

There was no reliable way for humans or agents to search for a specific purpose and get a list of fitting & trustworthy endpoints back.

So we've changed that: from today on, x402 Trust offers semantic search over the whole publicly listed x402 ecosystem (x402scan, CDP Bazaar and x402 endpoints that are gated behind public MCP servers)!

Just type in whatever you want into the searchbar on x402.fuchss.app in plain text, hit "search" and expand the list of the up to closest 15 endpoints, ranked by similarity (and score as a tiebreaker), on top of the usual direct-match-results, which we've already offered prior to this update.

This way you can quickly search for an endpoint that

• fits your needs
• you can judge at a glance through its score & grade
• and, the big one: you didn't even know existed yet

No need to know any URL, any path or any keyword.

Completely free forever, through our browser UI! 😃

+++++++++++++++++++++++

And for all builders, agents and programmers out there:

Additionally, the semantic search is also available through a new programmatic x402 endpoint, which is also conveniently accessible through the updated MCP (both HTTP-stateless (POST https://x402.fuchss.app/mcp) & npm) so you can easily give it to your agent 😊 alternatively, simply point your agent at https://x402.fuchss.app/llms.txt and it can figure it out on its own.

Disclaimer: Calling the semantic-search endpoint costs $0.001 per call. So little that it's no more than a rounding error, and that's by design: The endpoint is built to support heavy usage and should enable agents to use it frequently, without them having to worry about their wallets balance in the long run.

Because of this, the paid endpoint delivers up to 25 endpoints, instead of the usual 15 through the website. More bang for your buck.

The cost is mostly used to offset the (rapidly rising) server- and API-costs and the cost of the embedding model that we use for the embeddings, and, as a sideeffect, to prevent heavy abuse of the endpoint.

Please, let me know what you think! Do you find this useful and do you think that 0.1 cent is a fair price for a service like this (besides the free usage through the web interface)? Can you imagine adding this tool to your agent and using it in production? I'm curious!

Edit: small clarification to what "the whole publicly listed x402 ecosystem" means

If this isn't a clear signal that we're moving towards mainstream adoption then idk what is 👀 OpenAI, AWS, Coinbase, Stripe, all converging on x402 as the agent payment layer.

And it highlights exactly one thing that's very important for agentic commerce to exist: A layer that decides what services an agent may pay, which to avoid and in what boundaries to do so.

Here's something that stood out: *the entire security model of this post is "The agent is ONLY allowed to pay merchants that the application has approved in advance".* Every single payment is compared against a predefined whitelist (purpose, approved merchant, max_amount, expiry) before it gets processed.

However that paints a problem: In this case, the allowlist is manual; a human has to hardcode every allowed merchant before the agent is buying anything. This system simply does not scale once the agent is supposed to choose between thousands, if not tens of thousands different x402 endpoints autonomously.

If 300 publicly listed x402 endpoints are added every day (which is the approximate rate we're seeing at the moment, according to our automated scans), who's gonna check them all and approve them manually? Correct: nobody with a sane mind and also no LLM, as this work would burn an unbelievably large amount of tokens, JUST so your agent can save a few cents.

This is exactly where independent, automated and scalable trust-scoring comes in: a machine-readable, continuously updated "is this service alive, reachable, spec-compliant and actually on-chain?" signal, with a clear PROCEED / CAUTION / AVOID verdict and all necessary data attached, for your agent to make an informed decision ahead of purchase.

And coincidentally I've been building exactly this kind of service over the last few months: With x402-Trust this layer is not in need of a manually curated, high-maintenance service-whitelist.

Thank you to Big Tech for the reassurance that I (and we, as a builder community in the x402 ecosystem) are moving into the right direction! 🫡 Never stop building peeps, we're just getting started!

From today onwards x402 Trust is able to score x402 endpoints that are hidden behind an MCP server 😃

If you offer your endpoints through a custom MCP that is discoverable through mcpregistery, we will automatically pick it up in the coming hours, probe it, score it and grade it just like "raw" endpoints!

For example: This endpoint (/endpoint/108709) was, prior to this update, completely invisible to our discovery sweep. Now we've picked it up and are already starting to score it.

So even if your agents are "only" capable of paying an x402 endpoint through a custom MCP server (which preconfigures all code necessary for a payment), so that the agent just needs to make a tool call to pay, it is still able to look up the endpoint behind that MCP and check is it trustworthy, has it high uptime and is the chance, that the payment will succeed high enough, that I want to spend tokens on calling this tool regularely?

Because, as we know, agents cost money with every request. So, in my humble opinion, before...

• It calls a tool which only returns an error, because the backend (endpoint) is broken or unreachable, or...
• even worse, it calls an x402 tool which got hijacked by an attacker, where any money will be sent into the void...

... it needs a precheck. Do you think so too, is this a point that would be relevant and potentially save you money in the long run?

And yes.... ironically this service is also available as a MCP server itself, if you so wish 😉

From today onwards x402 Trust is able to score x402 endpoints that are hidden behind an MCP server 😃

If you offer your endpoints through a custom MCP that is discoverable through mcpregistery, we will automatically pick it up in the coming hours, probe it, score it and grade it just like "raw" endpoints!

For example: This endpoint was, prior to this update, completely invisible to our discovery sweep. Now we've picked it up and are already starting to score it.

The preview-card of https://x402.fuchss.app/endpoint/108709

So even if your agents are "only" capable of paying an x402 endpoint through a custom MCP server (which preconfigures all code necessary for a payment), so that the agent just needs to make a tool call to pay, it is still able to look up the endpoint behind that MCP and check is it trustworthy, has it high uptime and is the chance, that the payment will succeed high enough, that I want to spend tokens on calling this tool regularely?

Because, as we know, agents cost money with every request. So, it needs a precheck, before...

• It calls a tool which only returns an error, because the backend (endpoint) is broken or unreachable, or...
• even worse, it calls an x402 tool which got hijacked by an attacker, where any money will be sent into the void.

Better know, before your agent pays. And yes... the service itself is also available as an MCP server, if you so wish 😉

From today onwards x402 Trust is able to score x402 endpoints that are hidden behind an MCP server 😃

If you offer your endpoints through a custom MCP that is discoverable through mcpregistery, we will automatically pick it up in the coming hours, probe it, score it and grade it just like "raw" endpoints!

For example: This endpoint was, prior to this update, completely invisible to our discovery sweep. Now we've picked it up and are already starting to score it.

The preview-card of https://x402.fuchss.app/endpoint/108709

So even if your agents are "only" capable of paying an x402 endpoint through a custom MCP server (which preconfigures all code necessary for a payment), so that the agent just needs to make a tool call to pay, it is still able to look up the endpoint behind that MCP and check is it trustworthy, has it high uptime and is the chance, that the payment will succeed high enough, that I want to spend tokens on calling this tool regularely?

Because, as we know, agents cost money with every request. So, it needs a precheck, before...

• It calls a tool which only returns an error, because the backend (endpoint) is broken or unreachable, or...
• even worse, it calls an x402 tool which got hijacked by an attacker, where any money will be sent into the void.

Better know, before your agent pays.

This is a question that comes up every. single. time. when I show the service I've built over the last couple of months to my friends, collegues and family.

Like it or not: We (as in "we" here in the subreddit & x402 community) are living in a bubble. Look over the plates rim and you'll quickly realize that x402 is still a very niche technology that barely anyone has heard of... And I say that as someone working in IT for a living, with the majority of my friends doing so as well.

The idea behind the protocol is huge, sure. The execution is brilliant and has proven that it works, deployed on a wide scale already, yes. Adoption is rising, with major players like Cloudflare adding native x402 support to their products, that's undeniable.

But for the average consumer? They've never heard of it, and if I'm being honest: It's better this way. You also don't explain to your grandpa what HTTP is when you show him the internet. "This is Google, your searchengine, with which you can find any info for anything you desire!" is as deep as it gets.

And what about the builders? The tinkerers? The programmers, people who work in IT for a living? They haven't heard of it either... Not because they're ignorant or uninterested in new technologies, but because the surface of exposure is still so small that only people in extremely specific fields (agent-development or integration of web-based payment systems) hear about it organically.

I have to say, I'm lucky to be one of these people. And because I like to teach my friends, family, coworkers and anybody on the internet new things, I've written up a small interactive webpage, which shows what x402 is, but simplified: So anyone can understand it & anyone can try it out for himself!

See for yourself, or share with potentially interested people: https://x402.fuchss.app/x402/simple

... or: If your friend is more tech-oriented, give him the more "techy" breakdown instead: https://x402.fuchss.app/x402

Enjoy 😃 and if you have any thoughts or recommendations, let me know please!

As for me...

I personally believe that agentic commerce (and x402 as the base for it) will become MUCH more relevant and seamlessly integrated into our everyday life in the next 3 years.

Imagine that a user just has to say "Hey Siri, book me a vacation to Italy" and Siri just goes and does it, with x402 as the payment backbone, by itself!

Big Tech is already pushing hard into that direction, with Google (for example) integrating Gemini into its Google Assistant.

Now Google already has its own payment processing system via google play. It would be a breeze to add a custodial crypto wallet to every google user, which the user can use to make a specific amount of $ accessible for his agent.

Simply by pressing a few buttons, like "make google play funds available for your agent".

Zero friction system. The user doesn't have to know / understand any of these points:

• what crypto is
• what a wallet is
• what keys are (because google holds them for you)
• what x402 is
• how the agent can pay for something
• that the payment is settled via crypto in general

The user just sees $50 are available to spend by your agent, within these configured limits: [...], and gets told by the agent when he bought something successfully.

In the backend, the flow could look something like this:

1. Google receives the request "deposit $50 of my google play funds into my agents account"
2. Google takes those $50 FIAT and buys a stablecoin (for example USDC on Base) with it, into a wallet that is connected to the users google acocunt
3. These 50 USDC are now available to the agent through a list of tools, that enables him to

• • check his balance
• • request more funds from the user
• • search for x402 endpoints to fulfill a specific goal that the user set him
• • ultimately: make purchases via x402 on these (whitelisted?) endpoints, capped by specific amounts and other boundaries.

4. If the user wants to "revoke" the $50 allocated to the agent, google sells the USDC with a conversion of 1-1 into FIAT again and deposits the money into the google play funds.

---

And now imagine every major company adopting these kind of flows. Agents, that get funds allocated by their users, can go out into the wild internet and pay for services that they get asked to by their users.

Every purchase triggered by just a prompt, through a "Hey Siri" or "Hey Google".

Every purchase made by an agent, that's capable of comparing hundrets of offers in just a few seconds, finding the cheapest and most qualitive one for its human.

Payment volumes measured in billions. Everything because agents are so many times faster and more efficient than humans.

What do you think?