io.github.sukrutkrdg/x402-bazaar-mcp

x402-bazaar-mcp

Hosted, no install: point any MCP client at https://402.com.tr/mcp — Streamable HTTP, one tool per catalogued service, no wallet held server-side. Or run it locally with npx as described below; both talk to the same catalog. The current tool list is always the server card; a number written here would be wrong the next time a service is added.

The Base token-safety toolkit for AI agents. An MCP (Model Context Protocol) server that gives your agent the checks it needs before it touches a Base token — including a 30-tool B20 (Base-native token standard) suite covering freeze/seize powers, policy changes, mint headroom and rebase history — which also covers all 82 of Coinbase's tokenized equities, telling a real issuance apart from a token merely wearing an equity ticker by reading who administers the transfer policy on chain rather than by consulting a list of addresses, so a newly issued one is recognised the day it appears — pre-trade GO/HOLD/STOP gates, honeypot & sellability checks, wallet + approval audits, sign-guard, prices and AI reports. Every paid API in the x402 Bazaar catalog, exposed as a callable tool (Cursor, Cline, Windsurf, VS Code, Coinbase AgentKit, desktop assistants and custom agents).

Bind these first: pre_trade_gate (any Base token), near_pre_trade_gate (NEAR tokens), b20_gate (Base-native B20 tokens), sign_guard (before signing a tx).

Then act — swap at the best price, after the check:

• base_swap — on Base, routed by 0x across Uniswap, Aerodrome, Balancer, Curve and more. Returns the route, minimum out, every fee, and a ready-to-sign transaction for your agent's own wallet. Buying an unknown token runs a sellability check first and refuses a honeypot.
• near_swap — across chains (NEAR, Base, Ethereum, Solana, Bitcoin…) through NEAR Intents. Returns a one-time deposit address; the output goes to your recipient or is refunded. Buying a NEAR token runs near_token_safety first. Track it with near_swap_status.

Funds never pass through this server or ours.

No wallet needed to start. Run it with no key, no token and no config at all and it uses the free tier — one free call/day on each service that offers one. Roughly a third of the catalogue does not: AI and metered services are always paid, and every entry in the catalogue says which it is under freeTier. When you outgrow that, a prepaid credit token keeps it walletless: one purchase, then every call is just an HTTP header. A wallet is only needed for the third mode, per-call payment.

Each tool call is otherwise backed by an x402 micro-payment in USDC on Base — no API keys, no subscriptions, no sign-up. The agent pays only for what it uses, typically fractions of a cent per call.

Works with zero config. Run it with no wallet and no token and it uses the free tier (one free call/day on each service that offers one, then a preview) — so an agent can try most of the catalogue instantly, and sees a priced 402 on the AI and metered tools rather than a surprise. Unlock unlimited paid calls with either a prepaid credit token (one x402 purchase up front, then no wallet or signing per call) or a wallet key.

How it works

1. On startup the server fetches the live catalog from https://402.com.tr/api/catalog and auto-registers one MCP tool per service.
2. When an AI agent calls a tool the server picks a payment mode (below), hits the endpoint, and returns the response.
3. In wallet mode the x402 flow is transparent: HTTP 402 → pay USDC on Base → retry → return response, gasless for the payer (the facilitator pays gas).

Three payment modes (precedence order)

Credits are the easiest paid mode day-to-day: buying the pack takes ONE x402 settlement (call the buy_credits tool in wallet mode, or pay https://402.com.tr/api/x402/buy-credits?tier=0.25|1|5|20 from any x402 client), which returns a ck_… token. Set it as X402_CREDIT_TOKEN and every later call just draws down the balance — no private key ever touches this config again. Tiers: $0.25 starter, $1, $5 (+10%), $20 (+20%).

Paying from NEAR? The same credit token can be bought with USDC, USDT or NEAR on NEAR (or any asset NEAR Intents routes) — in the browser at 402.com.tr/credits, or headlessly with POST https://402.com.tr/api/credits/near/quote. NEAR Intents swaps it to USDC on Base; no Base wallet needed.

Requirements

• Node.js ≥ 20
• (optional, for paid calls) a prepaid credit token or a Base wallet private key whose address holds USDC on Base mainnet

Installation & running

npm install

# Zero-config — free tier on every service that offers one:
npx x402-bazaar-mcp

# Paid via prepaid credits (recommended — no wallet, no signing):
X402_CREDIT_TOKEN=ck_your_token npx x402-bazaar-mcp

# Paid via wallet:
AGENT_PRIVATE_KEY=0xYOUR_PRIVATE_KEY npx x402-bazaar-mcp

In wallet mode the key only ever signs for requests to https://402.com.tr, paying the Bazaar's own address in USDC on Base, at or under X402_MAX_PRICE_USD. These are fixed in the package (or set by those env vars) — never taken from the catalog or from a 402 — so a catalog entry or a 402 that points anywhere else is called unpaid.

Environment variables

With none of the above set, the server runs on the free tier.

Desktop MCP clients

Most desktop assistants and IDEs read an mcpServers block from their MCP config file (see your client's docs for where it lives). Add:

{
  "mcpServers": {
    "x402-bazaar": {
      "command": "npx",
      "args": ["-y", "x402-bazaar-mcp"],
      "env": {
        "X402_CREDIT_TOKEN": "ck_your_token"
      }
    }
  }
}

Omit the env block entirely to run on the free tier (great for a first try), or use "AGENT_PRIVATE_KEY": "0x…" instead of the credit token to pay from a wallet.

Restart the client after saving; the Bazaar tools appear in its tool list.

Cursor

Add to ~/.cursor/mcp.json (global) or .cursor/mcp.json in your project:

{
  "mcpServers": {
    "x402-bazaar": {
      "command": "npx",
      "args": ["-y", "x402-bazaar-mcp"],
      "env": { "X402_CREDIT_TOKEN": "ck_your_token" }
    }
  }
}

Cline (VS Code)

In the Cline panel → MCP Servers → Configure (cline_mcp_settings.json):

{
  "mcpServers": {
    "x402-bazaar": {
      "command": "npx",
      "args": ["-y", "x402-bazaar-mcp"],
      "env": { "X402_CREDIT_TOKEN": "ck_your_token" },
      "disabled": false,
      "autoApprove": []
    }
  }
}

Windsurf

Add to ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "x402-bazaar": {
      "command": "npx",
      "args": ["-y", "x402-bazaar-mcp"],
      "env": { "X402_CREDIT_TOKEN": "ck_your_token" }
    }
  }
}

VS Code (GitHub Copilot / MCP)

Add to .vscode/mcp.json in your workspace (or run MCP: Add Server):

{
  "servers": {
    "x402-bazaar": {
      "command": "npx",
      "args": ["-y", "x402-bazaar-mcp"],
      "env": { "X402_CREDIT_TOKEN": "ck_your_token" }
    }
  }
}

Every client above works the same way: omit env to run on the free tier, or swap the credit token for "AGENT_PRIVATE_KEY": "0x…" to pay from a wallet.

Use with Coinbase AgentKit, Agentic Wallet & CLI agents

Because this is a standard MCP stdio server, any MCP-capable agent runtime can load and pay for the Bazaar's tools — including Coinbase's own agent stack, with no bespoke integration:

Coinbase Agentic Wallet (npx awal)

Coinbase Agentic Wallets ship native x402 support and an MCP interface. Point the wallet's MCP config at npx x402-bazaar-mcp, and the agent can call — and pay for — any Bazaar service straight from its MPC-secured wallet, gasless on Base. The x402 payment handshake is handled for you: HTTP 402 → pay USDC on Base → retry → response.

Coinbase AgentKit

Two ways in:

1. As MCP tools — load this server into your AgentKit agent's MCP config (command: "npx", args: ["-y", "x402-bazaar-mcp"], and X402_CREDIT_TOKEN or AGENT_PRIVATE_KEY in env). The agent gains every Bazaar tool — B20 freeze/seize checks, pre-trade gates, honeypot/sellability, deployer reputation, exit liquidity, live DEX prices, gas, tx decode, AI reports — as pay-per-call actions, no action provider to write.
2. Via AgentKit's native x402 support — AgentKit's wallet can settle x402 payments directly, so an agent can GET https://402.com.tr/api/x402/<service> and pay the returned 402 from its own wallet. The 402 body includes a machine-readable alternatives block (starter credits first) so the agent can pick the cheapest on-ramp programmatically.

Either way the agent pays only for the calls it makes, in USDC on Base, gasless.

Command-line agents

CLI agents that manage MCP servers with an mcp add command take the same server:

# Free tier (zero config):
<agent-cli> mcp add x402-bazaar -- npx -y x402-bazaar-mcp

# Or paid via prepaid credits:
<agent-cli> mcp add x402-bazaar -e X402_CREDIT_TOKEN=ck_your_token -- npx -y x402-bazaar-mcp

Then ask the agent to check a token, price a portfolio, or screen an address — it calls the right Bazaar tool and settles the micro-payment automatically.

Why agents use this

Agents need fresh on-chain data and AI utilities but don't want to manage RPC endpoints, scrapers, security heuristics, or per-provider API keys. One MCP server plus a credit token (or a funded wallet) gives them everything — contract safety checks, live DEX prices, gas estimates, transaction decoding, and AI-powered reports — all pay-per-use, with no subscriptions or sign-up required.

What your agent can do (tools)

Tools are loaded live from the catalog, so the list stays current. At the time of writing it includes:

Prices shown as of this release — the authoritative price is always in the live catalog and in each 402 challenge. The table above is a sample: the tool list is loaded live from the catalog at startup, so the server always exposes everything the marketplace currently sells — including the B20 safety suite, the web and business checks (url_extract, email_verify, domain_check) and anything added since this README was written.

Example

Once installed, just ask your agent naturally — it picks the right tool and pays per call:

"Is 0x… a safe token to buy on Base? Check the risk and current price."

The agent calls token_risk and token_price, each settling a tiny USDC payment from your wallet, and answers with the on-chain data.

"Is this NVDA token on Base the real Coinbase one?"

b20_safety answers from the chain rather than from a list: it reads who administers the token's transfer policy and reports whether that is the operator behind Coinbase's confirmed issuances. A lookalike can copy the ticker, the name and even a 0xb200… vanity address; it cannot borrow the policy administrator. The same answer carries the issuer's powers — holder-eligibility gating, gated mint, and the rebase multiplier that redenominates every balance at once — as facts about a regulated instrument, not as a risk score to be alarmed by.

Sample outputs

token_risk — low-risk token

{
  "address": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
  "isContract": true,
  "token": {
    "name": "USD Coin",
    "symbol": "USDC",
    "decimals": 6,
    "totalSupply": "4800000000000000"
  },
  "ownership": {
    "owner": "0x0000000000000000000000000000000000000000",
    "renounced": true
  },
  "upgradeableProxy": false,
  "security": {
    "isHoneypot": false,
    "buyTaxPct": 0,
    "sellTaxPct": 0,
    "isOpenSource": true,
    "isMintable": false,
    "transferPausable": false,
    "canTakeBackOwnership": false,
    "hiddenOwner": false,
    "holderCount": 182430,
    "topHolderPct": 12.47,
    "top10HolderPct": 41.22,
    "lockedLpPct": 100,
    "creatorPct": 0,
    "isInDex": true,
    "isAntiWhale": false,
    "antiWhaleModifiable": false,
    "tradingCooldown": false,
    "slippageModifiable": false,
    "isTrueToken": true,
    "isAirdropScam": false,
    "creatorAddress": "0x6B175474E89094C44Da98b954EedeAC495271d0F",
    "creatorBalance": "0"
  },
  "riskScore": 0,
  "riskLevel": "low",
  "flags": [],
  "sources": ["base-rpc", "goplus"],
  "coverage": "RPC base + GoPlus security (honeypot, taxes, holders, holder concentration, LP lock, creator holdings, source, ownership controls).",
  "checkedAt": "2026-06-23T09:14:02.381Z"
}

token_price — DEX price and liquidity

{
  "address": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
  "priceUsd": "0.9998",
  "priceChange24h": -0.03,
  "liquidityUsd": 4721850.44,
  "volume24h": 18340210.77,
  "dexId": "uniswap",
  "pairAddress": "0x88A43bbDF9D098eEC7bCEda4e2494615dfD9bB9C",
  "baseToken": {
    "name": "USD Coin",
    "symbol": "USDC"
  },
  "checkedAt": "2026-06-23T09:14:03.105Z"
}

Discovering available services

• Human-readable catalog & docs: https://402.com.tr/agents
• Machine-readable catalog (used by this server): https://402.com.tr/api/catalog
• x402 well-known: https://402.com.tr/.well-known/x402

Security note

Prepaid credits (recommended) keep wallets out of your agent config — buying the pack takes one x402 settlement, but after that the ck_… token is all the agent holds: a bearer capability worth only its remaining balance, so a leaked token can lose at most what's left on it, never a wallet. Buy a small pack and rotate it if needed.

If you use wallet mode instead, your private key is only used locally inside this process to sign payment authorizations. It is never sent to the Bazaar server or any third party. Use a dedicated spending wallet (not your main wallet) and keep only a small USDC balance on it.

License

MIT