Add x402 Bazaar plugin (read-only onchain data & AI reports, x402)

[sukrutkrdg]

Adds x402 Bazaar — a read-only external-mcp plugin exposing 124 Base data, safety and AI services through the x402-bazaar-mcp server. Paid per call in USDC over x402; no transactions (Submission: none). Base MCP lets an agent act; this lets it know what to act on.

What it covers:

• Token safety — risk, honeypot/sellability, rug score, pre-trade GO/HOLD/STOP gates
• B20 safety suite (~29 tools) — the only coverage of Base's native token standard, where an issuer can freeze or seize a holder's balance at the protocol level (Policy Registry / burnBlocked)
• Wallet intelligence — net worth, age/activity, approvals, EIP-7702 delegation and spend permissions as a single drain-surface verdict
• Compliance — OFAC screening for wallets and, separately, for people and companies
• Off-chain counterparty checks — page-to-text, email deliverability and domain registration age, for the moment an agent has to trust something that is not onchain
• AI reports — Claude-written token and wallet due diligence
• Business primitives — the non-crypto arithmetic an agent still needs: FX at ECB reference rates, business-day/holiday math per country, inflation adjustment, and live fiat on-ramp pricing and country coverage

Install is walletless by default: the plugin doc's config uses a prepaid credit token (X402_CREDIT_TOKEN) rather than a private key, with the wallet mode documented as the alternative. A free trial call is available per service per day for anything non-AI, opted into with ?free=1 (it is off by default so that an unpaid probe always sees the price rather than an answer), so the plugin is testable without paying anything.

MCP: https://www.npmjs.com/package/x402-bazaar-mcp · registry io.github.sukrutkrdg/x402-bazaar-mcp · live catalog: https://402.com.tr/.well-known/x402

Every paid response carries a decision receipt (input hash, policy version, confidence band, and a refusal shape instead of a guess when a feed is unavailable), documented at https://github.com/sukrutkrdg/402/blob/main/docs/decision-receipt.md.

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 1 Sum 2

[sukrutkrdg]

Friendly bump 🙏 Happy to make any changes that'd help this land x402 Bazaar is a read-only external-mcp data/intelligence plugin (token risk, wallet intel, OFAC, AI reports) for Base agents.

Live at 402.com.tr, MCP on the official registry. Thanks for maintaining this

[sukrutkrdg]

B20 is now live on mainnet — and as of this launch, x402 Bazaar's b20_safety reads the B20 token precompiles directly (supplyCap, isPaused, policyId(TRANSFER_SENDER/RECEIVER_POLICY), multiplier) to flag freeze and burnBlocked-seize risk into a single hold/caution/avoid verdict. Per the IB20 spec, burnBlocked can only hit a holder that isn't authorized under TRANSFER_SENDER_POLICY, so the seize surface maps cleanly to whether a sender policy is set — no role enumeration needed.

Believe this is the first B20-aware safety check on Base. It's read-only (returns data, never transacts) and complements Base MCP's action side. Happy to adjust the plugin doc to any review notes. Thanks for taking a look!

[sukrutkrdg]

Quick correction to my note above: B20 mainnet activation slipped a few hours (a GitHub issue) and is expected shortly — saying it was "now live" was premature, apologies. The b20_safety code is wired and ready (reads supplyCap/isPaused/policyId/multiplier from the token precompiles); I'll confirm live precompile reads the moment activation lands.

[sukrutkrdg]

Confirmed live ✅ — tested b20_safety against a real B20 stablecoin (NADT, 0xb20000000000000000000186a08e781c38059eec) on mainnet. It reads the token precompiles and returns isB20: true, variant: stablecoin, symbol: NADT, and a risk verdict (no sender/receiver policy → not freezable/seizable, not paused, supply-capped → hold). The earlier RPC flakiness is fixed (sequential reads + retry instead of parallel calls that tripped the public RPC rate limit). Working end-to-end — believe it's the first B20-aware safety check on Base. Happy to adjust the plugin doc to any review notes.

[sukrutkrdg]

👋 Friendly ping on this one — it's been green and mergeable for a couple of weeks, just waiting on a maintainer review (Heimdall shows 0/1). The plugin is read-only (onchain data + AI reports over x402), no write actions or funds movement. Happy to rebase or address anything a reviewer flags. Thanks!

[sukrutkrdg]

Refreshed and brought in line with the existing plugin files. The doc now follows the same structure as the merged plugins (Auth / Endpoints / Risks & Warnings / Notes were missing), declares risk: [irreversible] since each call settles a USDC payment, and no longer quotes a service count that had gone stale — it points at the live catalogue and lists the tools an agent actually reaches for, with the free tier and the walletless credit-token install documented so the plugin is testable without a private key in the host config.

No rush on my side, and I realise CONTRIBUTING currently limits contributions to the core team — happy to leave this open until that changes, or to close it if external plugins are not being taken at the moment. Either answer is useful.