Add x402 Bazaar plugin (read-only onchain data & AI reports, x402) - #129
Add x402 Bazaar plugin (read-only onchain data & AI reports, x402)#129sukrutkrdg wants to merge 11 commits into
Conversation
🟡 Heimdall Review Status
|
|
Friendly bump 🙏 Happy to make any changes that'd help this land x402 Bazaar is a read-only external-mcp data/intelligence plugin (token risk, wallet intel, OFAC, AI reports) for Base agents. Live at 402.com.tr, MCP on the official registry. Thanks for maintaining this |
|
B20 is now live on mainnet — and as of this launch, x402 Bazaar's Believe this is the first B20-aware safety check on Base. It's read-only (returns data, never transacts) and complements Base MCP's action side. Happy to adjust the plugin doc to any review notes. Thanks for taking a look! |
|
Quick correction to my note above: B20 mainnet activation slipped a few hours (a GitHub issue) and is expected shortly — saying it was "now live" was premature, apologies. The |
|
Confirmed live ✅ — tested |
|
👋 Friendly ping on this one — it's been green and mergeable for a couple of weeks, just waiting on a maintainer review (Heimdall shows 0/1). The plugin is read-only (onchain data + AI reports over x402), no write actions or funds movement. Happy to rebase or address anything a reviewer flags. Thanks! |
…credit-token install
|
Refreshed and brought in line with the existing plugin files. The doc now follows the same structure as the merged plugins (Auth / Endpoints / Risks & Warnings / Notes were missing), declares No rush on my side, and I realise CONTRIBUTING currently limits contributions to the core team — happy to leave this open until that changes, or to close it if external plugins are not being taken at the moment. Either answer is useful. |
… 124 The doc told an agent in three places that an unpaid call gets a free answer. That stopped being true on 2026-07-31: the trial is opt-in behind ?free=1, and a plain unpaid call returns 402 with the price. The change was made because answering 200 to an unpaid GET is what kept our resources out of the CDP discovery index -- a crawler reading the catalog got output where it needed a declaration, so nothing got catalogued. But a reader following this doc would probe unpaid, receive a 402, and conclude the service was broken. Wrong instructions are worse than none. Also 118 -> 124 services.
v0.2.2 on npm, and the standalone repo the MCP registry scans, both still make a bare fetch for free-mode calls. The main repo added the x-402-free: 1 header on 2026-07-31 -- the trial became opt-in so that an unpaid GET shows a crawler the price instead of an answer, which is what had kept our resources out of the discovery index -- but that change was never copied across. So every zero-config install has been getting a 402 on every call while the README, and base/skills#129, advertise "try it instantly, no key needed". Verified against production: unpaid fx-convert answers 402 without the header and 200 with it. Also 118 -> 124 tools in the README, and VERSION in index.mjs was still 0.2.2 while package.json said otherwise -- that constant is what the registry reports, so it is now commented as one of the three places a release has to move.
v0.2.2 on npm, and the standalone repo the MCP registry scans, both still make a bare fetch for free-mode calls. The main repo added the x-402-free: 1 header on 2026-07-31 -- the trial became opt-in so that an unpaid GET shows a crawler the price instead of an answer, which is what had kept our resources out of the discovery index -- but that change was never copied across. So every zero-config install has been getting a 402 on every call while the README, and base/skills#129, advertise "try it instantly, no key needed". Verified against production: unpaid fx-convert answers 402 without the header and 200 with it. Also 118 -> 124 tools in the README, and VERSION in index.mjs was still 0.2.2 while package.json said otherwise -- that constant is what the registry reports, so it is now commented as one of the three places a release has to move.
The endpoints table and example prompt 3 both told an agent to call `token_approvals`. There is no such tool — the service is hidden, so it is absent from every MCP tool list the plugin can reach, and an agent following the doc gets tool-not-found. Both now name `approval_advisor`, which is the visible equivalent and returns a ranked revoke queue rather than a raw list. The service count said 124; the catalogue is at 131.
|
Pushed a correction rather than a bump. The plugin doc listed My question from 2026-07-30 still stands, and either answer is genuinely useful to me: if external plugin PRs are not being accepted while CONTRIBUTING limits contributions to the core team, say so and I will close this. The doc is published and maintained on our side either way, and I would rather not leave a stale one sitting in your queue. |
The paragraph already says the agent reads the tool list from the catalog at startup, so the count tracks the marketplace rather than this document — and then wrote a number anyway. That number has now gone stale three times (124, 131, and 142 as of today). Removing it makes the paragraph agree with itself. Everything a reader needs is one line down, and the catalogue link is already in the doc.
Tokenized stocks on Base run on B20, so the suite already reached them and the doc did not say so. What the check distinguishes: a Coinbase issuance sets holder eligibility and gates mint/redeem because the spec requires an issuer to, while a token merely wearing an equity ticker sets neither. Measured against the two issuances live in the Base app (GOOGLc, METAc) and against a token calling itself COIN that carries none of it.
The doc named two of the thirteen tokenized equities and did not say how any of them are identified. All 13 are covered, and they are recognised by reading the transfer-policy administrator on chain rather than from a stored address list — so a lookalike cannot pass by copying the ticker, the name and a 0xb200… vanity address, and a fourteenth is covered the day it is issued. Also tells an agent what NOT to conclude: holder-eligibility gating and gated mint are what a regulated instrument must have, not red flags, and there is no corporate-action history to report — across all thirteen the number of multiplier changes to date is zero.
Two corrections in one line. The suite grew to 30 alongside nineteen new business primitives in the catalogue. And the superlative was retired from every other surface when it stopped being true — another seller lists a B20 suite now — but survived here. Describing it by size is both accurate and checkable.
2 participants
Adds x402 Bazaar — a read-only
external-mcpplugin exposing Base data, safety and AI services through thex402-bazaar-mcpserver. Paid per call in USDC over x402; no transactions (Submission:none). Base MCP lets an agent act; this lets it know what to act on.The catalogue is live at https://402.com.tr/api/catalog — 162 services today. This body links it rather than fixing a number in place: earlier revisions said 131 and then 142, and both were out of date within days.
What it covers:
burnBlocked)AAPLc,AMZNc,COINc,CRCLc,GOOGLc,INTCc,METAc,MSFTc,MSTRc,NVDAc,SNDKc,SPCXc,TSLAc). A real issuance is told apart from a token merely wearing an equity ticker by reading who administers the transfer policy on chain, not from a stored address list — so a lookalike cannot pass by copying the ticker, the name and a0xb200…vanity address, and a fourteenth is covered the day it is issued. Holder-eligibility gating and gated mint are reported as the regulated shape they are, so an agent does not read a compliant issuer as a red flag.Two claims were removed rather than defended. "The only B20 suite anywhere" was true when this was opened and another seller now lists one too. And there is no corporate-action feed for the tokenized equities: across all thirteen the number of
MultiplierUpdatedevents to date is zero, so the plugin doc tells an agent not to claim a split or dividend history that does not exist yet.Install is walletless by default: the plugin doc's config uses a prepaid credit token (
X402_CREDIT_TOKEN) rather than a private key, with the wallet mode documented as the alternative. A free call per day is available on the 71 services that offer one, opted into with?free=1(off by default so an unpaid probe always sees the price rather than an answer); AI and metered services are always paid, and each catalogue entry says which it is underfreeTier.MCP: https://www.npmjs.com/package/x402-bazaar-mcp · registry
io.github.sukrutkrdg/x402-bazaar-mcp· live catalog: https://402.com.tr/.well-known/x402Every paid response carries a decision receipt (input hash, policy version, confidence band, and a refusal shape instead of a guess when a feed is unavailable), documented at https://github.com/sukrutkrdg/402/blob/main/docs/decision-receipt.md.