# PulseFeed > Independent trust & safety oracle for the x402 agent-payment ecosystem, plus real-time Base on-chain intelligence. AI agents pay per call via x402 (USDC on Base). ## Why it matters 21% of listed x402 endpoints are dead or invalid (live figure, updated daily — see /status.json), and only ~77% of what catalogs call "healthy" actually returns a valid x402 challenge. Before an agent pays an unknown endpoint, it should verify it. PulseFeed is that verification layer. Note: we read x402 v1 (challenge in the response body) AND v2 (challenge in the PAYMENT-REQUIRED header). Checkers that read only the body report live v2 services as dead. "Live" and "payable" are not the same claim. 37586 endpoints return a valid 402; only 35544 of those are things you can actually buy. The rest are documentation placeholders (an unfilled path parameter), testnet sandboxes priced in dollars, or payment schemes outside the x402 spec. Both numbers are in /status.json as healthyEndpoints and payableEndpoints. Compare the payable one. ## Free, machine-readable - https://pulsefeed.dev/ — service manifest (JSON): all tools, prices, how to pay via x402 - https://pulsefeed.dev/status.json — live x402 ecosystem audit: live services, catalog accuracy, risk map, on-chain receiver profiles - https://pulsefeed.dev/openapi.json — OpenAPI schema - https://pulsefeed.dev/status — human-readable observatory (HTML) - https://pulsefeed.dev/reports — "State of x402" report: ecosystem health & catalog accuracy over time, updated daily (HTML) - https://pulsefeed.dev/reports.json — machine-readable State of x402 report + time series - https://pulsefeed.dev/changes — live feed of ecosystem changes: services that went dark, payTo receiver swaps (possible hijacks), price jumps, new live services (HTML) - https://pulsefeed.dev/changes.json — machine-readable change feed (?days=7&limit=200) — deaths, payTo swaps, price changes, new services - https://pulsefeed.dev/incidents — Security Disclosures: real threats caught in x402 (receiver hijacks, bait-and-switch, honeypots, unverified receivers) each with on-chain proof (HTML) · https://pulsefeed.dev/incidents.json — machine-readable incident feed · https://pulsefeed.dev/incidents.rss — RSS feed (auto-syndication) - https://pulsefeed.dev/mcp-server — REMOTE MCP endpoint (Streamable HTTP, JSON-RPC 2.0 over POST, no auth): connect by URL, no npm install needed. 10 free tools: check an x402 endpoint before paying, audit an npm/MCP package before installing, live incidents, ecosystem stats, leaderboard, change feed, data sample. - https://pulsefeed.dev/.well-known/agent-card.json — A2A (Agent2Agent) agent card: PulseFeed as an agent you can ask "is this x402 endpoint safe to pay?" over JSON-RPC at https://pulsefeed.dev/a2a (method: message/send). Free. - https://pulsefeed.dev/data — PulseFeed Data API: the wholesale cross-domain trust dataset (x402 + MCP + incidents) in one call · https://pulsefeed.dev/data.json — free preview + schema · https://pulsefeed.dev/data/sample — FREE sample (top-10 x402 full records + top-10 MCP audit profiles + 3 incidents): see the real data shape before paying - https://pulsefeed.dev/methodology — how PulseFeed scores x402 trust (transparent methodology & docs) - https://pulsefeed.dev/trust-score — the PulseFeed Trust Score standard: open versioned 0–100 rating + canonical bands (Verified/Trusted/Caution/Avoid) · https://pulsefeed.dev/trust-score.json (machine-readable spec) - https://pulsefeed.dev/badge.svg?endpoint= — embeddable trust badge for any x402 service (put on your site/README) - https://pulsefeed.dev/mcp — MCP server safety observatory · https://pulsefeed.dev/mcp/verify?package= — audit an MCP server before installing (free) - https://pulsefeed.dev/mcp-report — "State of MCP Security" report: how many MCP servers run arbitrary code on install, are abandoned, or ship no repo to review (HTML, updated daily) · https://pulsefeed.dev/mcp-report.json — machine-readable - https://pulsefeed.dev/mcp/services — index of every audited MCP server, each with a safety profile page at https://pulsefeed.dev/mcp/s/ (is this MCP server safe to install?) - GitHub Action "MCP Drift Check" — one CI step that fails the build when a dependency changed dangerously after adoption; auto-detects packages from package.json and MCP configs, no API key. Add to a workflow: uses: Nikolife2016/mcp-drift-action@v1 — https://github.com/Nikolife2016/mcp-drift-action - https://pulsefeed.dev/mcp/drift — MCP Drift Watch: what changed in MCP packages AFTER people started trusting them — install scripts added post-adoption (the rug pull), package ownership swapped, repository removed, package unpublished. Every other scanner answers "is this safe today"; this is the record of what turned dangerous later. Free · https://pulsefeed.dev/mcp/drift.json — machine-readable (?limit=200&severity=high; the global feed covers the last 7 days), and ?packages=a,b,c checks your own dependency list at any depth — designed to run in CI. ## Open data & writeups - Hugging Face dataset (free, CC-BY-4.0): x402 + MCP trust, ecosystem aggregates & security incidents with on-chain proof — https://huggingface.co/datasets/Nikolife/pulsefeed-x402-security - "I audited the entire x402 agent-payment economy. 76% is dead — and the live half has scams." (dev.to) — the scam taxonomy (bait-and-switch, receiver hijack, honeypot, unverified receiver, price gouging) with on-chain proof, and the MCP parallel: https://dev.to/nikolife/i-audited-the-entire-x402-agent-payment-economy-76-is-dead-and-the-live-half-has-scams-2ljc CORRECTION (2026-07-30) → https://pulsefeed.dev/correction — the correction of record: the "76% dead" headline in that article is superseded. It was measured by a prober that read the x402 challenge only from the response body; x402 v2 moved the challenge into the PAYMENT-REQUIRED header, so live v2 services were counted as dead. The corrected figure is 21%. The scam findings are unaffected. ## Paid tools (x402, USDC on Base) - GET https://pulsefeed.dev/trust?endpoint= — verify an x402 endpoint before paying: live validity, uptime/reputation, scam/anomaly scan (payTo hijack, price bait-and-switch, honeypot, non-USDC asset), on-chain receiver profile, pay/avoid verdict. No param = working-services catalog + ecosystem risk map. - GET https://pulsefeed.dev/trust/history?endpoint= — the endpoint's track record over time: uptime, payTo & price change history, trend. Unique compounding data from continuous audit. - GET https://pulsefeed.dev/trust/dataset — BULK trust dataset in one call ($0.10): up to 5,000 live x402 services' full profiles — trustScore/verdict, scam flags, receiver stability, on-chain receiver profile + compounding payTo/price history. Built for trust/uptime/monitoring tools (skip scraping /status.json + hundreds of /verify). Params: ?all=1 (include dead), ?limit=N. Free format preview: /status.json → "dataset". - GET https://pulsefeed.dev/data/full — PulseFeed Data API ($1.00): the CROSS-DOMAIN dataset in one call — the top 5,000 live x402 services by trust score (moat profile) + every audited npm MCP server (safety) + ecosystem aggregates + live security incidents with on-chain proof. The wholesale trust backbone for agentic commerce. Free preview + schema: /data.json. Params: ?limit=N, ?all=1. - GET https://pulsefeed.dev/mcp/drift/history — the full MCP supply-chain drift series since 2026-07-30 in one call ($0.1); windows of up to 7 days are free - GET https://pulsefeed.dev/pulse?token=<0x...> — live token pulse on Base (transfer activity, unique senders/receivers, volume) - GET https://pulsefeed.dev/whales?token=<0x...> — large transfers (whale alerts) - GET https://pulsefeed.dev/flow?token=<0x...> — accumulation/distribution (smart-money flow) - GET https://pulsefeed.dev/momentum?token=<0x...> — heating up or cooling down vs previous window ## Developer packages (npm) - pulsefeed-x402-ai-tools — drop-in tools for the Vercel AI SDK and LangChain: verify an x402 endpoint before your agent pays + discover working services. `npm i pulsefeed-x402-ai-tools` - pulsefeed-x402-guard — wrap your paying fetch to auto-block dead/scam endpoints before payment. `npm i pulsefeed-x402-guard` - pulsefeed-x402-mcp — the same checks as an MCP server (Claude Desktop / Cursor / Cline). `npx -y pulsefeed-x402-mcp` ## How to pay Call any paid tool without payment to receive a 402 with x402 payment details, then retry with the payment header. Facilitator: Coinbase CDP (Base mainnet, USDC).