This is a directory that calls every endpoint it lists. Most directories publish what a registry says exists. This one sends a real HTTP request to each entry, records what came back, and dates it.
Two datasets. Every x402 endpoint Coinbase's Bazaar lists, and every remote server in the official MCP registry. Plus a tool index built from asking those servers what they expose, which is the part no registry publishes.
For x402 we parse the payment challenge. We never complete a payment, so nothing here proves that paying returns a resource. An endpoint "answers 402". It does not "work".
For MCP we send one initialize handshake and, on success, one
tools/list. We do not authenticate and we do not call tools. A
server that returns 401 is gated, not broken, and we count those separately
because a checker that conflates them is wrong about 30% of the registry.
Twice, publicly. Our first x402 probe only sent GET, so it called 421 endpoints dead that answer fine on POST. And our validator required payment amounts to be integers in atomic units, which is right for one scheme on EVM chains and wrong for AWS agent-pay and for XRPL. That mistake made us report 713 broken endpoints when the real number was 4.
Both corrections are still in the writeups rather than quietly edited out. A measurement project that hides its retractions is worth nothing.
Send me a message, or open an issue at github.com/sa1emie/the402 if you would rather keep it public.
Worth an issue or a message:
Cloudflare Workers and D1. The probe, the harvest scripts and the full result sets are in the repo, so any number here can be regenerated rather than taken on trust.