x402-bazaar-mcp

Hosted, no install: point any MCP client at https://402.com.tr/mcp — Streamable HTTP, one tool per catalogued service, no wallet held server-side. Or run it locally with npx as described below; both talk to the same catalog. The current tool list is always the server card; a number written here would be wrong the next time a service is added.

The Base token-safety toolkit for AI agents. An MCP (Model Context Protocol) server that gives your agent the checks it needs before it touches a Base token — including a 30-tool B20 (Base-native token standard) suite covering freeze/seize powers, policy changes, mint headroom and rebase history — which also covers all 13 of Coinbase's tokenized equities, telling a real issuance apart from a token merely wearing an equity ticker by reading who administers the transfer policy on chain rather than by consulting a list of addresses, so a newly issued one is recognised the day it appears — pre-trade GO/HOLD/STOP gates, honeypot & sellability checks, wallet + approval audits, sign-guard, prices and AI reports. Every paid API in the x402 Bazaar catalog, exposed as a callable tool (Claude Desktop, Cursor, Cline, Windsurf, VS Code, Coinbase AgentKit, custom agents).

Bind these first: pre_trade_gate (any token), b20_gate (Base-native B20 tokens), sign_guard (before signing a tx).

No wallet needed to start. Run it with no key, no token and no config at all and it uses the free tier — one free call/day on each service that offers one. Roughly a third of the catalogue does not: AI and metered services are always paid, and every entry in the catalogue says which it is under freeTier. When you outgrow that, a prepaid credit token keeps it walletless: one purchase, then every call is just an HTTP header. A wallet is only needed for the third mode, per-call payment.

Each tool call is otherwise backed by an x402 micro-payment in USDC on Base — no API keys, no subscriptions, no sign-up. The agent pays only for what it uses, typically fractions of a cent per call.

Works with zero config. Run it with no wallet and no token and it uses the free tier (one free call/day on each service that offers one, then a preview) — so an agent can try most of the catalogue instantly, and sees a priced 402 on the AI and metered tools rather than a surprise. Unlock unlimited paid calls with either a prepaid credit token (one x402 purchase up front, then no wallet or signing per call) or a wallet key.

How it works

1. On startup the server fetches the live catalog from https://402.com.tr/api/catalog and auto-registers one MCP tool per service.
2. When an AI agent calls a tool the server picks a payment mode (below), hits the endpoint, and returns the response.
3. In wallet mode the x402 flow is transparent: HTTP 402 → pay USDC on Base → retry → return response, gasless for the payer (the facilitator pays gas).

Three payment modes (precedence order)

Credits are the easiest paid mode day-to-day: buying the pack takes ONE x402 settlement (call the buy_credits tool in wallet mode, or pay https://402.com.tr/api/x402/buy-credits?tier=0.25|1|5|20 from any x402 client), which returns a ck_… token. Set it as X402_CREDIT_TOKEN and every later call just draws down the balance — no private key ever touches this config again. Tiers: $0.25 starter, $1, $5 (+10%), $20 (+20%).

Requirements

• Node.js ≥ 20
• (optional, for paid calls) a prepaid credit token or a Base wallet private key whose address holds USDC on Base mainnet

Installation & running

npm install

# Zero-config — free tier on every service that offers one:
npx x402-bazaar-mcp

# Paid via prepaid credits (recommended — no wallet, no signing):
X402_CREDIT_TOKEN=ck_your_token npx x402-bazaar-mcp

# Paid via wallet:
AGENT_PRIVATE_KEY=0xYOUR_PRIVATE_KEY npx x402-bazaar-mcp

Environment variables

With none of the above set, the server runs on the free tier.

Claude Desktop configuration

Add the following to your claude_desktop_config.json (usually ~/Library/Application Support/Claude/claude_desktop_config.json on macOS or %APPDATA%\Claude\claude_desktop_config.json on Windows):

{
  "mcpServers": {
    "x402-bazaar": {
      "command": "npx",
      "args": ["-y", "x402-bazaar-mcp"],
      "env": {
        "X402_CREDIT_TOKEN": "ck_your_token"
      }
    }
  }
}

Omit the env block entirely to run on the free tier (great for a first try), or use "AGENT_PRIVATE_KEY": "0x…" instead of the credit token to pay from a wallet.

After saving, restart Claude Desktop. You should see the Bazaar tools appear in the tool list (hammer icon).

Cursor

Add to ~/.cursor/mcp.json (global) or .cursor/mcp.json in your project:

{
  "mcpServers": {
    "x402-bazaar": {
      "command": "npx",
      "args": ["-y", "x402-bazaar-mcp"],
      "env": { "X402_CREDIT_TOKEN": "ck_your_token" }
    }
  }
}

Cline (VS Code)

In the Cline panel → MCP Servers → Configure (cline_mcp_settings.json):

{
  "mcpServers": {
    "x402-bazaar": {
      "command": "npx",
      "args": ["-y", "x402-bazaar-mcp"],
      "env": { "X402_CREDIT_TOKEN": "ck_your_token" },
      "disabled": false,
      "autoApprove": []
    }
  }
}

Windsurf

Add to ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "x402-bazaar": {
      "command": "npx",
      "args": ["-y", "x402-bazaar-mcp"],
      "env": { "X402_CREDIT_TOKEN": "ck_your_token" }
    }
  }
}

VS Code (GitHub Copilot / MCP)

Add to .vscode/mcp.json in your workspace (or run MCP: Add Server):

{
  "servers": {
    "x402-bazaar": {
      "command": "npx",
      "args": ["-y", "x402-bazaar-mcp"],
      "env": { "X402_CREDIT_TOKEN": "ck_your_token" }
    }
  }
}

Every client above works the same way: omit env to run on the free tier, or swap the credit token for "AGENT_PRIVATE_KEY": "0x…" to pay from a wallet.

Use with Coinbase AgentKit, Agentic Wallet & Claude Code

Because this is a standard MCP stdio server, any MCP-capable agent runtime can load and pay for the Bazaar's tools — including Coinbase's own agent stack, with no bespoke integration:

Coinbase Agentic Wallet (npx awal)

Coinbase Agentic Wallets ship native x402 support and an MCP interface. Point the wallet's MCP config at npx x402-bazaar-mcp, and the agent can call — and pay for — any Bazaar service straight from its MPC-secured wallet, gasless on Base. The x402 payment handshake is handled for you: HTTP 402 → pay USDC on Base → retry → response.

Coinbase AgentKit

Two ways in:

1. As MCP tools — load this server into your AgentKit agent's MCP config (command: "npx", args: ["-y", "x402-bazaar-mcp"], and X402_CREDIT_TOKEN or AGENT_PRIVATE_KEY in env). The agent gains every Bazaar tool — B20 freeze/seize checks, pre-trade gates, honeypot/sellability, deployer reputation, exit liquidity, live DEX prices, gas, tx decode, Claude reports — as pay-per-call actions, no action provider to write.
2. Via AgentKit's native x402 support — AgentKit's wallet can settle x402 payments directly, so an agent can GET https://402.com.tr/api/x402/<service> and pay the returned 402 from its own wallet. The 402 body includes a machine-readable alternatives block (starter credits first) so the agent can pick the cheapest on-ramp programmatically.

Either way the agent pays only for the calls it makes, in USDC on Base, gasless.

Claude Code

Add it as an MCP server in one command:

# Free tier (zero config):
claude mcp add x402-bazaar -- npx -y x402-bazaar-mcp

# Or paid via prepaid credits:
claude mcp add x402-bazaar -e X402_CREDIT_TOKEN=ck_your_token -- npx -y x402-bazaar-mcp

Then ask Claude Code to check a token, price a portfolio, or screen an address — it calls the right Bazaar tool and settles the micro-payment automatically.

Why agents use this

Agents need fresh on-chain data and AI utilities but don't want to manage RPC endpoints, scrapers, security heuristics, or per-provider API keys. One MCP server plus a credit token (or a funded wallet) gives them everything — contract safety checks, live DEX prices, gas estimates, transaction decoding, and Claude-powered reports — all pay-per-use, with no subscriptions or sign-up required.

What your agent can do (tools)

Tools are loaded live from the catalog, so the list stays current. At the time of writing it includes:

Prices shown as of this release — the authoritative price is always in the live catalog and in each 402 challenge. The table above is a sample: the tool list is loaded live from the catalog at startup, so the server always exposes everything the marketplace currently sells — including the B20 safety suite, the web and business checks (url_extract, email_verify, domain_check) and anything added since this README was written.

Example

Once installed, just ask your agent naturally — it picks the right tool and pays per call:

"Is 0x… a safe token to buy on Base? Check the risk and current price."

The agent calls token_risk and token_price, each settling a tiny USDC payment from your wallet, and answers with the on-chain data.

"Is this NVDA token on Base the real Coinbase one?"

b20_safety answers from the chain rather than from a list: it reads who administers the token's transfer policy and reports whether that is the operator behind Coinbase's confirmed issuances. A lookalike can copy the ticker, the name and even a 0xb200… vanity address; it cannot borrow the policy administrator. The same answer carries the issuer's powers — holder-eligibility gating, gated mint, and the rebase multiplier that redenominates every balance at once — as facts about a regulated instrument, not as a risk score to be alarmed by.

Sample outputs

token_risk — low-risk token

{
  "address": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
  "isContract": true,
  "token": {
    "name": "USD Coin",
    "symbol": "USDC",
    "decimals": 6,
    "totalSupply": "4800000000000000"
  },
  "ownership": {
    "owner": "0x0000000000000000000000000000000000000000",
    "renounced": true
  },
  "upgradeableProxy": false,
  "security": {
    "isHoneypot": false,
    "buyTaxPct": 0,
    "sellTaxPct": 0,
    "isOpenSource": true,
    "isMintable": false,
    "transferPausable": false,
    "canTakeBackOwnership": false,
    "hiddenOwner": false,
    "holderCount": 182430,
    "topHolderPct": 12.47,
    "top10HolderPct": 41.22,
    "lockedLpPct": 100,
    "creatorPct": 0,
    "isInDex": true,
    "isAntiWhale": false,
    "antiWhaleModifiable": false,
    "tradingCooldown": false,
    "slippageModifiable": false,
    "isTrueToken": true,
    "isAirdropScam": false,
    "creatorAddress": "0x6B175474E89094C44Da98b954EedeAC495271d0F",
    "creatorBalance": "0"
  },
  "riskScore": 0,
  "riskLevel": "low",
  "flags": [],
  "sources": ["base-rpc", "goplus"],
  "coverage": "RPC base + GoPlus security (honeypot, taxes, holders, holder concentration, LP lock, creator holdings, source, ownership controls).",
  "checkedAt": "2026-06-23T09:14:02.381Z"
}

token_price — DEX price and liquidity

{
  "address": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
  "priceUsd": "0.9998",
  "priceChange24h": -0.03,
  "liquidityUsd": 4721850.44,
  "volume24h": 18340210.77,
  "dexId": "uniswap",
  "pairAddress": "0x88A43bbDF9D098eEC7bCEda4e2494615dfD9bB9C",
  "baseToken": {
    "name": "USD Coin",
    "symbol": "USDC"
  },
  "checkedAt": "2026-06-23T09:14:03.105Z"
}

Discovering available services

• Human-readable catalog & docs: https://402.com.tr/agents
• Machine-readable catalog (used by this server): https://402.com.tr/api/catalog
• x402 well-known: https://402.com.tr/.well-known/x402

Security note

Prepaid credits (recommended) keep wallets out of your agent config — buying the pack takes one x402 settlement, but after that the ck_… token is all the agent holds: a bearer capability worth only its remaining balance, so a leaked token can lose at most what's left on it, never a wallet. Buy a small pack and rotate it if needed.

If you use wallet mode instead, your private key is only used locally inside this process to sign payment authorizations. It is never sent to the Bazaar server or any third party. Use a dedicated spending wallet (not your main wallet) and keep only a small USDC balance on it.

License

MIT