I asked 1,000 x402 endpoints to sell me something. 207 never quoted a price.
The Coinbase x402 discovery directory (the "Bazaar") lists 1,000 resources that are supposed to sell something to an agent. I wanted to know what happens when a stranger with no account, no credentials and no reputation simply asks for one. One GET per listing. Requirements read from the body and from the base64 PAYMENT-REQUIRED header. No keys, no payments, no retries. Raw aggregates:…
The Coinbase x402 discovery directory contains 1,000 resources listed to sell something to an agent. When a stranger queries these resources, 768 answered with machine-readable requirements, while 207 never responded at all. Out of the 768 that responded, 55 publish an outputSchema, which is only 7.2%. The remaining 713 listings leave the buyer uncertain about the structure of the response.
Six endpoints use legacy network strings (base and solana) instead of the standard CAIP-2 identifiers, which makes them incompatible with most clients. Additionally, three endpoints responded with no requirements in the body or header, making them unbuyable as listed. The initial approach of scanning only the body led to an inaccurate count of 212 listings requiring an empty accepts[] array.
A deeper examination revealed that only three listings genuinely have no requirements. This oversight could cause significant issues, as it led the reporter to incorrectly label 27% of working services as broken.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
