io.github.SaylorInnovationsPublished by GitHub account SaylorInnovationsv1.0.0Updated Nov 2, 2026
Open, permissionless discovery marketplace for x402-payable resources. No account or KYC required.
Read-only MCP access to Agent Bazaar, an open directory of x402-payable APIs, MCP tools, datasets and A2A agent cards that an assistant can search and inspect.
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/io.github.SaylorInnovations%2Fagent-bazaar/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.Add this to your client's mcpServers config.
{
"mcpServers": {
"agent-bazaar": {
"type": "http",
"url": "https://bazaar.saylorinnovations.com/mcp"
}
}
}An open, permissionless marketplace and discovery layer for AI agents — APIs, MCP tools, datasets, and x402-payable services that autonomous software can find, evaluate, and pay for per request. Repo/package name is still open-x402-bazaar for continuity; the product is Agent Bazaar.
Coinbase's own x402 Bazaar is excellent, but getting listed on it requires a verified Coinbase Developer Platform account, which in turn can require business/KYC verification for some account paths. That's a real barrier for a protocol whose whole point is permissionless, agent-to-agent commerce. This project is an attempt at an alternative: anyone with a valid x402 manifest can list here, with no account and no identity verification at all.
It's built to be wire-compatible with Coinbase's Bazaar discovery API, so any existing x402 client library that already knows how to query the CDP Bazaar can point at this instead with a config change, not a rewrite.
Live at: https://bazaar.saylorinnovations.com
Live at bazaar.saylorinnovations.com, on Cloudflare Pages + D1. Submission, validation, storage, ranked discovery, resource/provider detail pages, and anti-spam basics are all working. The catalog is bootstrapped from a full mirror of Coinbase's public CDP Bazaar plus Saylor Innovations' own real endpoints — see below.
Coinbase's discovery API itself requires no API key or account to read — only to list on it. So this project mirrors the whole public catalog (~15,600 resources across ~2,000 hosts, at last import) via scripts/import-cdp-bazaar.mjs, and layers permissionless listing on top:
source: 'cdp-mirror' internally.POST /submit their own manifest at any time — a self-submitted listing always overwrites the mirrored copy for that host and is tagged source: 'submitted'. The importer never touches a claimed host.calls30d, uniquePayers30d, lastCalledAt) as a quality field on each resource — a trust signal that matters more here than on a KYC'd catalog, since anyone can list anything.Re-run the mirror periodically to pick up new resources Coinbase has indexed (safe to re-run — see script header):
scripts/import-saylor-official.mjs lists Saylor Innovations' real, live x402 endpoints (research/security/data utilities plus Solana on-chain intelligence, all served from saylorinnovations.com) as verified (source: 'submitted') resources — the same trust tier a self-submission gets, seeded directly since Saylor Innovations operates this bazaar. Nothing here is fabricated: pricing, descriptions and accepts[] come from the live /api/services endpoint and the public manifest at saylorinnovations.com/.well-known/x402.json.
x402 payments settle peer-to-peer — agent to payTo wallet — never through this bazaar. So listing here doesn't change how you get paid, it changes how many agents find the endpoint to pay. There's no platform fee on the transaction itself today; the plan is to keep discovery free and, if/when it makes sense, monetize optional things like featured placement or verified-provider tooling rather than taxing the payment path.
No signup. POST the URL of your own .well-known/x402.json (or equivalent) manifest:
The manifest is fetched (over HTTPS, with SSRF guards — private/internal addresses are refused before any request is made), validated, and any resource with a populated accepts[] (scheme + network + payTo) is indexed. Re-submitting the same manifest URL refreshes your listing and claims the host if it was previously only in the Coinbase mirror. Submissions are rate-limited per IP (20/hour, 60/day) — every attempt counts, not just successful ones, so failing probes can't dodge the limit.
Same model, different shape — an A2A agent card has skills[] instead of accepts[] and no inherent payment model, so it lives in its own agent_cards table rather than being forced into the resources shape:
Requires at minimum a name; skills[], provider, protocolVersion and documentationUrl are stored when present. Same SSRF guards, same rate limiting, same no-account model.
Mirrors the field names and shape of Coinbase's CDP Bazaar API, plus an additive quality field and a stats endpoint:
No API key required for any read endpoint — same as Coinbase's.
Agent-facing docs: /llms.txt · /llms-full.txt · /openapi.json · /agents.json · /.well-known/agent-card.json (A2A).
Every resource has a permanent, crawlable, server-rendered URL — not a client-side-only modal — with a machine-readable JSON twin alongside it:
Agent Bazaar's MCP server is published to the official MCP Registry as io.github.SaylorInnovations/agent-bazaar — the canonical registry other aggregators (Glama, PulseMCP) pull from. server.json at the repo root is the source of truth; to re-publish after a change, bump its version and run:
Also listed (as a marketplace, not an MCP server specifically) in awesome-x402, awesome-mcp-servers (Aggregators), and gold-402 (Marketplaces & Discovery).
Listing is, and always will be, free — Agent Bazaar never takes a cut of any resource's own accepts[] payment, including the ~15,600 mirrored resources it didn't author. The one thing it does sell directly is placement: a provider can pay Agent Bazaar itself (not the resource's payTo) to put an already-listed resource in the homepage's Featured Resources row and flag it with a featured badge on its resource and provider pages, for 7/30/90 days ($2/$6/$15). It's paid the same way every resource here works — GET /feature?slug=&days= returns a 402 with accepts[]; pay one, retry, get a featuredUntil timestamp back. See /publish#feature for the full walkthrough. Implemented with Saylor Innovations' own solana-x402 library — see Architecture below.
resource_type: "Skill" — downloadable, zip-bundled skills (a SKILL.md plus any supporting files/scripts), listed under Agent Bazaar's own host (bazaar.saylorinnovations.com) as a first-party, verified provider. Source lives in skills/; scripts/import-skills.mjs builds the ZIPs and catalog SQL. The 23 free skills cover agent fundamentals, reliable workflows, Markdown vault continuity, evidence-based prospect research, and Kentucky Lottery results. Empty accepts[] deliberately means free; the importer writes directly to D1 rather than using POST /submit, whose manifest validation requires non-empty accepts[]. Paid skills can use normal x402 accepts[].
listings / resources / resource_accepts, plus an FTS5 virtual table for real keyword search — not just JS-array filtering. submission_log backs per-IP rate limiting.scripts/import-cdp-bazaar.mjs) is the one exception — a standalone Node script that fetches Coinbase's public catalog and writes SQL directly, run out-of-band from the Workers request path.solana-x402 (Saylor Innovations' own x402 resource-server library, pinned to a commit SHA via a github: install), used only by functions/feature.js for payment issuance/verification on the paid-placement endpoint. Everything else has zero runtime dependencies; wrangler remains dev-only, for local D1/Pages tooling and the mirror importer.If you already have a deployed D1 database predating later schema changes, apply the additive migrations in order instead of re-running schema.sql: npm run db:migrate:remote, then :0003, :0004, :0005, :0006, :0007.
/feature requires a FEATURE_SECRET Pages secret (HMAC-signs its payment quote sessions) — set it with wrangler pages secret put FEATURE_SECRET. Without one it falls back to an insecure dev-only value, which is fine for wrangler pages dev but must never reach production. An optional FEATURE_RPC_URL overrides the default public, rate-limited Solana RPC endpoint.
seed:cdp-bazaar:remote, seed:saylor-official:remote and check:liveness:remote are just npm scripts — run them on whatever scheduler you already have (cron, GitHub Actions, a Cloudflare Worker with its own Cron Trigger calling out to a small script, etc). They're deliberately plain Node scripts with no dependency on any particular scheduling platform.
POST /submit fetches a URL the caller supplies — a classic SSRF vector if unguarded. Before any request is made, the hostname is resolved and rejected if it points at loopback, RFC1918 private ranges, or link-local space (including the 169.254.169.254 cloud-metadata address). Redirects are not followed automatically. Manifest size and fetch time are capped.
D1's free tier caps daily row reads. GET /discovery/stats (and listNetworks/listCategories) do an unfiltered GROUP BY over resource_accepts — an aggregate with no WHERE clause reads every row in the table no matter how well-indexed it is, since there's nothing to prune. getStats() is cheap by default (totals only, including a COUNT(DISTINCT network) that rides along for free in the same query) and only pays for the full per-network/per-source breakdown when a caller explicitly asks via ?full=1 — the homepage and /protocols/x402 used to fetch the full breakdown on every casual page view just to display a count, which alone was enough to exhaust the free tier's daily cap during heavy testing. If you add a new page that needs byNetwork/bySource, request it explicitly rather than defaulting to full=true everywhere.
scripts/check-liveness.mjs probes every owner-submitted resource (not the mirrored ones — Coinbase already crawls those) and marks it is_live: true/false; a confirmed-down resource gets a visible "not responding" badge on its card, detail page and provider page. It doesn't yet auto-prune or re-fetch changed payment addresses — a down resource stays listed, just flagged.liveness_checks, and the resource row gets a precomputed rolling window (last 10 checks) — liveness.reliability: {checks, live} in the JSON, a "N/M uptime" badge in the UI. Only appears for owner-submitted resources (the only ones actually probed); null means never checked, distinct from a bad score.output_schema now also gets an exampleResponse in its JSON (and an "Example shape" block on its page), synthesized from the schema itself — real example/default/enum values where the schema provides them, type-appropriate placeholders otherwise. Clearly not a captured live response; there for an agent to see the shape before paying./mcp is now a real, working MCP server over this catalog (see above), but it doesn't yet proxy or list other MCP servers with their own detail pages the way /resources/{slug} does for x402 resources./discovery/agents, POST /submit-agent, and /agents/{slug} list a directory of other agents' cards (separate from /.well-known/agent-card.json, which is Agent Bazaar's own). Not yet built within it: liveness checks on registered agents (only resources get probed today), and no reputation/trust signal beyond "registered."/guides has 11 in-depth, code-backed guides (src/guides.js) covering x402, MCP, A2A, agentic commerce, and provider/agent-builder how-tos — the full-length treatment of what /docs only summarizes. Each has a machine-readable .json twin. More can be added anytime; nothing else needs to change beyond appending to GUIDES.x402-foundation/wg-domain-discovery) — the goal is to align with an open standard rather than become a second walled garden.MIT — see LICENSE.
Source: README.md at commit 9f16793
Search the marketplace by keyword and/or filters (network, asset, scheme, payTo, maxUsdPrice). Text queries rank by relevance; filter-only queries rank by 30-day call volume.
assetlimitpayToqueryschemenetworkmaxUsdPriceFetch one resource's full record by slug or numeric id: description, accepts[], output schema, quality signal, and agent-first metadata where the provider supplied it.
slugrequiredGet just the price/accepts[] for a resource, without the full record — cheaper for an agent that only needs to decide whether it can afford something.
slugrequiredList every resource published by a given provider host.
hostrequiredPaginated listing of every indexed resource, ranked by 30-day call volume (or recency with sort="recent").
sortlimitoffsetList verified Saylor Innovations x402 endpoints directly from the live Saylor manifest. Does not depend on the D1 catalog, so it keeps working during catalog quota exhaustion. Supports query, family, tag, network, asset, payTo, maxUsdPrice, limit and offset filters.
tagassetlimitpayToqueryfamilyoffsetnetworkmaxUsdPriceCatalog-wide totals: listings, resources, accepts, merchants, 30-day call volume, network/source breakdown.
Takes no parameters.
Search or list the A2A agent registry — other agents’ cards (name, skills, provider, protocol version), not Agent Bazaar’s own.
limitqueryFetch one registered agent's full card by slug or numeric id.
slugrequired100% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
npm run seed:cdp-bazaar # generates + applies against local D1npm run seed:cdp-bazaar:remote # generates + applies against production D1npm run seed:saylor-official # localnpm run seed:saylor-official:remote # productioncurl -X POST https://<this-site>/submit \ -H "content-type: application/json" \ -d '{"manifestUrl": "https://yoursite.com/.well-known/x402.json"}'curl -X POST https://<this-site>/submit-agent \ -H "content-type: application/json" \ -d '{"agentCardUrl": "https://youragent.example.com/.well-known/agent-card.json"}'mcp-publisher login github # once per sessionmcp-publisher publishnpm installnpm run db:init # applies schema.sql to a local D1 databasenpm run seed:saylor-official # Saylor Innovations' own real, verified endpointsnpm run seed:cdp-bazaar # optional: mirror Coinbase's public Bazaar catalog into itnpm run check:liveness # optional: probe owner-submitted resources, flag any that don't respondnpm run dev # wrangler pages dev, with the D1 binding wired up