I run an x402 paid API catalog on Base (USDC) with 268 endpoints — every one priced at $0.0005–$0.005 per call. The catalog covers web security, DNS, HTTP, email auth, TLS, certificates, accessibility, sustainability, and a dozen adjacent surfaces. Each one is a real linter, real probe, real HTTP socket, real DNS query against your target.
What they cost: less than a coffeeshop dollar to test your entire prod stack.
What this looks like from the agent side
# 1. Pick what to test WORKFLOW = [ ("/api/x402-cost-quote", "path=/api/extract"), ("/api/catalog-integrity-audit", "url=https://yoursite.com"), ("/api/buyer-wallet-preflight", "path=/api/extract"), ] # 2. For each call, fetch → parse WWW-Authenticate → settle → retry for path, q in WORKFLOW: r = fetch(f"https://host{path}?{q}") if r.status == 402: pay = build_eip3009(path, r.headers["X-PAYMENT"]) r = fetch(path, headers={"X-PAYMENT": b64(pay)}) print(path, r.status, r.json()) A 5-call audit of your domain costs 268 × $0.0005 = $0.134 (about 14 USDC cents). The full pipeline — endpoint picker, payment builder, error diagnoser, retry loop, JSON report — fits in 60 lines.
What's inside the catalog
I built it because no single paid API service catalog existed with this breadth at sub-cent pricing for AI agents. The full inventory lives at the standard /.well-known/x402 discovery path. Every endpoint ships with an extensions.bazaar block describing its input/output schemas so any agent that fetches a 402 envelope can plan the next call without scraping sample bodies.
Some of the endpoints:
| Surface | What it does | Price |
|---|---|---|
| DNS | A/AAAA/MX/NS/TXT/CNAME/HTTPS/SRV/CAA/DS/DNSSEC/RPKI/AXFR/DANE-chain | $0.0005 |
| HTTP | method-policy, smuggling-evidence, hop-by-hop-strip, encoding-integrity, QPACK-fingerprint, HTTP/3 readiness, CORS-runtime-attack, cache-poisoning, rate-limit-headers | $0.0005 |
| TLS | cert-transparency monitoring, OCSP-stapling check, OCSP-must-staple, DANE/TLSA, MTA-STS policy validation, SVCB/HTTPSSVC parser | $0.0005 |
| DKIM/SPF/DMARC rollup, BIMI selector rotation, MTA-STS policy violation parser, DANE/TLSA | $0.0005 | |
| Content-security | CSP-deep, CSP-inline-fidelity, CSP-source-list extraction, CSP-violation-replay, WASM-CSP analyzer | $0.0005 |
| Performance + accessibility | Lighthouse-style performance, accessibility audit, carbon footprint, forms audit | $0.0005–$0.002 |
| Buyer-side tools | x402-cost-quote (price any cart in 1 call), catalog-integrity-audit (score any seller's defects), buyer-wallet-preflight (live x402 settlement test from ephemeral key) | $0.0005 |
The buyer-side tools are the most novel: instead of paying per-call hoping nothing breaks, an agent can now price its full cart in one call, audit the seller for defects in another, and simulate an end-to-end settle from a funding-less ephemeral key in a third — all before committing real USDC.
Why anyone would pay $0.0005 for a single test
Because time-to-insight matters more than cents-per-call:
- A web-security pen-test normally takes days of consultant time
- Running 268 domain probes in parallel costs 14 USDC cents and finishes in 90 seconds
- An AI agent doing routine CI checks pays for the whole probe suite from one cent's worth of USDC
If you run an AI agent that ships anything to the public web, this catalog turns "
