Agent Bazaar

Agent Bazaar

_by Saylor Innovations_

An open, permissionless marketplace and discovery layer for AI agents — APIs, MCP tools, datasets, and x402-payable services that autonomous software can find, evaluate, and pay for per request. Repo/package name is still open-x402-bazaar for continuity; the product is Agent Bazaar.

Coinbase's own x402 Bazaar is excellent, but getting listed on it requires a verified Coinbase Developer Platform account, which in turn can require business/KYC verification for some account paths. That's a real barrier for a protocol whose whole point is permissionless, agent-to-agent commerce. This project is an attempt at an alternative: anyone with a valid x402 manifest can list here, with no account and no identity verification at all.

It's built to be wire-compatible with Coinbase's Bazaar discovery API, so any existing x402 client library that already knows how to query the CDP Bazaar can point at this instead with a config change, not a rewrite.

Live at: https://bazaar.saylorinnovations.com

Status

Live at bazaar.saylorinnovations.com, on Cloudflare Pages + D1. Submission, validation, storage, ranked discovery, resource/provider detail pages, and anti-spam basics are all working. The catalog is bootstrapped from a full mirror of Coinbase's public CDP Bazaar plus Saylor Innovations' own real endpoints — see below.

Seeded from Coinbase's Bazaar

Coinbase's discovery API itself requires no API key or account to *read* — only to *list* on it. So this project mirrors the whole public catalog (~15,600 resources across ~2,000 hosts, at last import) via scripts/import-cdp-bazaar.mjs, and layers permissionless listing on top:

• Every mirrored listing is tagged source: 'cdp-mirror' internally.
• Any owner can POST /submit their own manifest at any time — a self-submitted listing always overwrites the mirrored copy for that host and is tagged source: 'submitted'. The importer never touches a claimed host.
• Mirrored resources carry Coinbase's own 30-day usage stats (calls30d, uniquePayers30d, lastCalledAt) as a quality field on each resource — a trust signal that matters more here than on a KYC'd catalog, since anyone can list anything.

Re-run the mirror periodically to pick up new resources Coinbase has indexed (safe to re-run — see script header):

npm run seed:cdp-bazaar          # generates + applies against local D1

npm run seed:cdp-bazaar:remote # generates + applies against production D1

Saylor Innovations' own listings

scripts/import-saylor-official.mjs lists Saylor Innovations' real, live x402 endpoints (research/security/data utilities plus Solana on-chain intelligence, all served from saylorinnovations.com) as verified (source: 'submitted') resources — the same trust tier a self-submission gets, seeded directly since Saylor Innovations operates this bazaar. Nothing here is fabricated: pricing, descriptions and accepts[] come from the live /api/services endpoint and the public manifest at saylorinnovations.com/.well-known/x402.json.

npm run seed:saylor-official          # local

npm run seed:saylor-official:remote # production

How providers actually get paid

x402 payments settle peer-to-peer — agent to payTo wallet — never through this bazaar. So listing here doesn't change *how* you get paid, it changes *how many agents find the endpoint to pay*. There's no platform fee on the transaction itself today; the plan is to keep discovery free and, if/when it makes sense, monetize optional things like featured placement or verified-provider tooling rather than taxing the payment path.

How listing works

No signup. POST the URL of your own .well-known/x402.json (or equivalent) manifest:

curl -X POST https://<this-site>/submit \

-H "content-type: application/json" \ -d '{"manifestUrl": "https://yoursite.com/.well-known/x402.json"}'

The manifest is fetched (over HTTPS, with SSRF guards — private/internal addresses are refused before any request is made), validated, and any resource with a populated accepts[] (scheme + network + payTo) is indexed. Re-submitting the same manifest URL refreshes your listing and claims the host if it was previously only in the Coinbase mirror. Submissions are rate-limited per IP (20/hour, 60/day) — every attempt counts, not just successful ones, so failing probes can't dodge the limit.

Registering an A2A agent

Same model, different shape — an A2A agent card has skills[] instead of accepts[] and no inherent payment model, so it lives in its own agent_cards table rather than being forced into the resources shape:

curl -X POST https://<this-site>/submit-agent \

-H "content-type: application/json" \ -d '{"agentCardUrl": "https://youragent.example.com/.well-known/agent-card.json"}'

Requires at minimum a name; skills[], provider, protocolVersion and documentationUrl are stored when present. Same SSRF guards, same rate limiting, same no-account model.

Discovery API (agent-facing)

Mirrors the field names and shape of Coinbase's CDP Bazaar API, plus an additive quality field and a stats endpoint:

No API key required for any read endpoint — same as Coinbase's.

Agent-facing docs: /llms.txt · /llms-full.txt · /openapi.json · /agents.json · /.well-known/agent-card.json (A2A).

Human-facing pages

Every resource has a permanent, crawlable, server-rendered URL — not a client-side-only modal — with a machine-readable JSON twin alongside it:

Listed in

Agent Bazaar's MCP server is published to the official MCP Registry as io.github.SaylorInnovations/agent-bazaar — the canonical registry other aggregators (Glama, PulseMCP) pull from. server.json at the repo root is the source of truth; to re-publish after a change, bump its version and run:

mcp-publisher login github   # once per session

mcp-publisher publish

Also listed (as a marketplace, not an MCP server specifically) in awesome-x402, awesome-mcp-servers (Aggregators), and gold-402 (Marketplaces & Discovery).

Featured placement

Listing is, and always will be, free — Agent Bazaar never takes a cut of any resource's own accepts[] payment, including the ~15,600 mirrored resources it didn't author. The one thing it does sell directly is placement: a provider can pay Agent Bazaar itself (not the resource's payTo) to put an already-listed resource in the homepage's Featured Resources row and flag it with a featured badge on its resource and provider pages, for 7/30/90 days ($2/$6/$15). It's paid the same way every resource here works — GET /feature?slug=&days= returns a 402 with accepts[]; pay one, retry, get a featuredUntil timestamp back. See /publish#feature for the full walkthrough. Implemented with Saylor Innovations' own solana-x402 library — see Architecture below.

Verified agent skills

resource_type: "Skill" — downloadable, zip-bundled skills (a SKILL.md plus any supporting files/scripts), listed under Agent Bazaar's own host (bazaar.saylorinnovations.com) as a first-party, verified provider. Source lives in skills/; scripts/import-skills.mjs builds the ZIPs and catalog SQL. The 23 free skills cover agent fundamentals, reliable workflows, Markdown vault continuity, evidence-based prospect research, and Kentucky Lottery results. Empty accepts[] deliberately means free; the importer writes directly to D1 rather than using POST /submit, whose manifest validation requires non-empty accepts[]. Paid skills can use normal x402 accepts[].

Architecture

• Runtime: Cloudflare Pages Functions (Workers runtime).
• Storage: D1 (SQLite), normalized across listings / resources / resource_accepts, plus an FTS5 virtual table for real keyword search — not just JS-array filtering. submission_log backs per-IP rate limiting.
• Ingestion: pull-based. Sellers submit a manifest URL; nothing is pushed. Re-submitting the same manifest URL deletes and re-inserts its resources (a full refresh, not a merge). The Coinbase-mirror importer (scripts/import-cdp-bazaar.mjs) is the one exception — a standalone Node script that fetches Coinbase's public catalog and writes SQL directly, run out-of-band from the Workers request path.
• **One runtime dep