io.github.SaylorInnovations由 GitHub 帳號 SaylorInnovations 發布v1.0.0更新於 Nov 2, 2026
Open, permissionless discovery marketplace for x402-payable resources. No account or KYC required.
以唯讀方式存取 Agent Bazaar：一個開放目錄，可搜尋並檢視支援 x402 付費的 API、MCP 工具、資料集與 A2A 代理卡片。
Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。
把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。
閱讀 https://sourceweft.com/mcp/io.github.SaylorInnovations%2Fagent-bazaar/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。把它新增到你客戶端的 mcpServers 設定中。
{
"mcpServers": {
"agent-bazaar": {
"type": "http",
"url": "https://bazaar.saylorinnovations.com/mcp"
}
}
}An open, permissionless marketplace and discovery layer for AI agents — APIs, MCP tools, datasets, and x402-payable services that autonomous software can find, evaluate, and pay for per request. Repo/package name is still open-x402-bazaar for continuity; the product is Agent Bazaar.
Coinbase's own x402 Bazaar is excellent, but getting listed on it requires a verified Coinbase Developer Platform account, which in turn can require business/KYC verification for some account paths. That's a real barrier for a protocol whose whole point is permissionless, agent-to-agent commerce. This project is an attempt at an alternative: anyone with a valid x402 manifest can list here, with no account and no identity verification at all.
It's built to be wire-compatible with Coinbase's Bazaar discovery API, so any existing x402 client library that already knows how to query the CDP Bazaar can point at this instead with a config change, not a rewrite.
Live at: https://bazaar.saylorinnovations.com
Live at bazaar.saylorinnovations.com, on Cloudflare Pages + D1. Submission, validation, storage, ranked discovery, resource/provider detail pages, and anti-spam basics are all working. The catalog is bootstrapped from a full mirror of Coinbase's public CDP Bazaar plus Saylor Innovations' own real endpoints — see below.
Coinbase's discovery API itself requires no API key or account to read — only to list on it. So this project mirrors the whole public catalog (~15,600 resources across ~2,000 hosts, at last import) via scripts/import-cdp-bazaar.mjs, and layers permissionless listing on top:
source: 'cdp-mirror' internally.POST /submit their own manifest at any time — a self-submitted listing always overwrites the mirrored copy for that host and is tagged source: 'submitted'. The importer never touches a claimed host.calls30d, uniquePayers30d, lastCalledAt) as a quality field on each resource — a trust signal that matters more here than on a KYC'd catalog, since anyone can list anything.Re-run the mirror periodically to pick up new resources Coinbase has indexed (safe to re-run — see script header):
scripts/import-saylor-official.mjs lists Saylor Innovations' real, live x402 endpoints (research/security/data utilities plus Solana on-chain intelligence, all served from saylorinnovations.com) as verified (source: 'submitted') resources — the same trust tier a self-submission gets, seeded directly since Saylor Innovations operates this bazaar. Nothing here is fabricated: pricing, descriptions and accepts[] come from the live /api/services endpoint and the public manifest at saylorinnovations.com/.well-known/x402.json.
x402 payments settle peer-to-peer — agent to payTo wallet — never through this bazaar. So listing here doesn't change how you get paid, it changes how many agents find the endpoint to pay. There's no platform fee on the transaction itself today; the plan is to keep discovery free and, if/when it makes sense, monetize optional things like featured placement or verified-provider tooling rather than taxing the payment path.
No signup. POST the URL of your own .well-known/x402.json (or equivalent) manifest:
The manifest is fetched (over HTTPS, with SSRF guards — private/internal addresses are refused before any request is made), validated, and any resource with a populated accepts[] (scheme + network + payTo) is indexed. Re-submitting the same manifest URL refreshes your listing and claims the host if it was previously only in the Coinbase mirror. Submissions are rate-limited per IP (20/hour, 60/day) — every attempt counts, not just successful ones, so failing probes can't dodge the limit.
Same model, different shape — an A2A agent card has skills[] instead of accepts[] and no inherent payment model, so it lives in its own agent_cards table rather than being forced into the resources shape:
Requires at minimum a name; skills[], provider, protocolVersion and documentationUrl are stored when present. Same SSRF guards, same rate limiting, same no-account model.
Mirrors the field names and shape of Coinbase's CDP Bazaar API, plus an additive quality field and a stats endpoint:
No API key required for any read endpoint — same as Coinbase's.
Agent-facing docs: /llms.txt · /llms-full.txt · /openapi.json · /agents.json · /.well-known/agent-card.json (A2A).
Every resource has a permanent, crawlable, server-rendered URL — not a client-side-only modal — with a machine-readable JSON twin alongside it:
Agent Bazaar's MCP server is published to the official MCP Registry as io.github.SaylorInnovations/agent-bazaar — the canonical registry other aggregators (Glama, PulseMCP) pull from. server.json at the repo root is the source of truth; to re-publish after a change, bump its version and run:
Also listed (as a marketplace, not an MCP server specifically) in awesome-x402, awesome-mcp-servers (Aggregators), and gold-402 (Marketplaces & Discovery).
Listing is, and always will be, free — Agent Bazaar never takes a cut of any resource's own accepts[] payment, including the ~15,600 mirrored resources it didn't author. The one thing it does sell directly is placement: a provider can pay Agent Bazaar itself (not the resource's payTo) to put an already-listed resource in the homepage's Featured Resources row and flag it with a featured badge on its resource and provider pages, for 7/30/90 days ($2/$6/$15). It's paid the same way every resource here works — GET /feature?slug=&days= returns a 402 with accepts[]; pay one, retry, get a featuredUntil timestamp back. See /publish#feature for the full walkthrough. Implemented with Saylor Innovations' own solana-x402 library — see Architecture below.
resource_type: "Skill" — downloadable, zip-bundled skills (a SKILL.md plus any supporting files/scripts), listed under Agent Bazaar's own host (bazaar.saylorinnovations.com) as a first-party, verified provider. Source lives in skills/; scripts/import-skills.mjs builds the ZIPs and catalog SQL. The 23 free skills cover agent fundamentals, reliable workflows, Markdown vault continuity, evidence-based prospect research, and Kentucky Lottery results. Empty accepts[] deliberately means free; the importer writes directly to D1 rather than using POST /submit, whose manifest validation requires non-empty accepts[]. Paid skills can use normal x402 accepts[].
listings / resources / resource_accepts, plus an FTS5 virtual table for real keyword search — not just JS-array filtering. submission_log backs per-IP rate limiting.scripts/import-cdp-bazaar.mjs) is the one exception — a standalone Node script that fetches Coinbase's public catalog and writes SQL directly, run out-of-band from the Workers request path.solana-x402 (Saylor Innovations' own x402 resource-server library, pinned to a commit SHA via a github: install), used only by functions/feature.js for payment issuance/verification on the paid-placement endpoint. Everything else has zero runtime dependencies; wrangler remains dev-only, for local D1/Pages tooling and the mirror importer.If you already have a deployed D1 database predating later schema changes, apply the additive migrations in order instead of re-running schema.sql: npm run db:migrate:remote, then :0003, :0004, :0005, :0006, :0007.
/feature requires a FEATURE_SECRET Pages secret (HMAC-signs its payment quote sessions) — set it with wrangler pages secret put FEATURE_SECRET. Without one it falls back to an insecure dev-only value, which is fine for wrangler pages dev but must never reach production. An optional FEATURE_RPC_URL overrides the default public, rate-limited Solana RPC endpoint.
seed:cdp-bazaar:remote, seed:saylor-official:remote and check:liveness:remote are just npm scripts — run them on whatever scheduler you already have (cron, GitHub Actions, a Cloudflare Worker with its own Cron Trigger calling out to a small script, etc). They're deliberately plain Node scripts with no dependency on any particular scheduling platform.
POST /submit fetches a URL the caller supplies — a classic SSRF vector if unguarded. Before any request is made, the hostname is resolved and rejected if it points at loopback, RFC1918 private ranges, or link-local space (including the 169.254.169.254 cloud-metadata address). Redirects are not followed automatically. Manifest size and fetch time are capped.
D1's free tier caps daily row reads. GET /discovery/stats (and listNetworks/listCategories) do an unfiltered GROUP BY over resource_accepts — an aggregate with no WHERE clause reads every row in the table no matter how well-indexed it is, since there's nothing to prune. getStats() is cheap by default (totals only, including a COUNT(DISTINCT network) that rides along for free in the same query) and only pays for the full per-network/per-source breakdown when a caller explicitly asks via ?full=1 — the homepage and /protocols/x402 used to fetch the full breakdown on every casual page view just to display a count, which alone was enough to exhaust the free tier's daily cap during heavy testing. If you add a new page that needs byNetwork/bySource, request it explicitly rather than defaulting to full=true everywhere.
scripts/check-liveness.mjs probes every owner-submitted resource (not the mirrored ones — Coinbase already crawls those) and marks it is_live: true/false; a confirmed-down resource gets a visible "not responding" badge on its card, detail page and provider page. It doesn't yet auto-prune or re-fetch changed payment addresses — a down resource stays listed, just flagged.liveness_checks, and the resource row gets a precomputed rolling window (last 10 checks) — liveness.reliability: {checks, live} in the JSON, a "N/M uptime" badge in the UI. Only appears for owner-submitted resources (the only ones actually probed); null means never checked, distinct from a bad score.output_schema now also gets an exampleResponse in its JSON (and an "Example shape" block on its page), synthesized from the schema itself — real example/default/enum values where the schema provides them, type-appropriate placeholders otherwise. Clearly not a captured live response; there for an agent to see the shape before paying./mcp is now a real, working MCP server over this catalog (see above), but it doesn't yet proxy or list other MCP servers with their own detail pages the way /resources/{slug} does for x402 resources./discovery/agents, POST /submit-agent, and /agents/{slug} list a directory of other agents' cards (separate from /.well-known/agent-card.json, which is Agent Bazaar's own). Not yet built within it: liveness checks on registered agents (only resources get probed today), and no reputation/trust signal beyond "registered."/guides has 11 in-depth, code-backed guides (src/guides.js) covering x402, MCP, A2A, agentic commerce, and provider/agent-builder how-tos — the full-length treatment of what /docs only summarizes. Each has a machine-readable .json twin. More can be added anytime; nothing else needs to change beyond appending to GUIDES.x402-foundation/wg-domain-discovery) — the goal is to align with an open standard rather than become a second walled garden.MIT — see LICENSE.
來源：README.md，提交 9f16793
Search the marketplace by keyword and/or filters (network, asset, scheme, payTo, maxUsdPrice). Text queries rank by relevance; filter-only queries rank by 30-day call volume.
assetlimitpayToqueryschemenetworkmaxUsdPriceFetch one resource's full record by slug or numeric id: description, accepts[], output schema, quality signal, and agent-first metadata where the provider supplied it.
slug必填Get just the price/accepts[] for a resource, without the full record — cheaper for an agent that only needs to decide whether it can afford something.
slug必填List every resource published by a given provider host.
host必填Paginated listing of every indexed resource, ranked by 30-day call volume (or recency with sort="recent").
sortlimitoffsetList verified Saylor Innovations x402 endpoints directly from the live Saylor manifest. Does not depend on the D1 catalog, so it keeps working during catalog quota exhaustion. Supports query, family, tag, network, asset, payTo, maxUsdPrice, limit and offset filters.
tagassetlimitpayToqueryfamilyoffsetnetworkmaxUsdPriceCatalog-wide totals: listings, resources, accepts, merchants, 30-day call volume, network/source breakdown.
無需輸入參數。
Search or list the A2A agent registry — other agents’ cards (name, skills, provider, protocol version), not Agent Bazaar’s own.
limitqueryFetch one registered agent's full card by slug or numeric id.
slug必填已滿足適用檢查項的 100%
該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。
npm run seed:cdp-bazaar # generates + applies against local D1npm run seed:cdp-bazaar:remote # generates + applies against production D1npm run seed:saylor-official # localnpm run seed:saylor-official:remote # productioncurl -X POST https://<this-site>/submit \ -H "content-type: application/json" \ -d '{"manifestUrl": "https://yoursite.com/.well-known/x402.json"}'curl -X POST https://<this-site>/submit-agent \ -H "content-type: application/json" \ -d '{"agentCardUrl": "https://youragent.example.com/.well-known/agent-card.json"}'mcp-publisher login github # once per sessionmcp-publisher publishnpm installnpm run db:init # applies schema.sql to a local D1 databasenpm run seed:saylor-official # Saylor Innovations' own real, verified endpointsnpm run seed:cdp-bazaar # optional: mirror Coinbase's public Bazaar catalog into itnpm run check:liveness # optional: probe owner-submitted resources, flag any that don't respondnpm run dev # wrangler pages dev, with the D1 binding wired up