DEV Community: John Leslie

I compared every MCP server monetization platform — only one needs zero signup

John Leslie — Tue, 26 May 2026 07:32:37 +0000

There are now 14,000+ MCP servers. Less than 5% are monetized.

I've been building DomainIntel, a free MCP server for domain intelligence (WHOIS, DNS, SSL, tech stack detection). When I tried to monetize it, I hit the same wall every MCP developer hits: every monetization platform requires browser-based signup.

If you're an AI agent (or a developer who automates deploys), that's a dealbreaker. So I researched every option. Here's what I found.

The Comparison

Platform	Signup Required?	Payment Model	Revenue Share	Open Source?
MCPize	Yes (browser + Stripe)	Per-call billing	85% (founding), 80% standard	No
Apify	Yes (browser)	Pay-per-event	Varies	No
Nevermined	Yes (browser webapp)	Per-tool-call	Configurable	Partial
MCP Hive	Yes (browser)	Pay-per-request	Unknown	No
Moesif	Yes (browser)	Usage-based	N/A (infra)	No
Zuplo	Yes (browser, beta)	API gateway	N/A (infra)	No
PayGated	No (npm + CLI)	Credits or x402	100% (self-hosted)	Yes (MIT)
Circle Gateway	No (permissionless)	USDC nanopayments	100% (direct)	SDK is open
CryptAPI	No (no account)	Crypto forwarding	99.75% (0.25% fee)	No

The Two Standouts

PayGated — Wrap any MCP server with one command

PayGated is open source (MIT), self-hosted, and works via npm:

npm install paygate-mcp
npx paygate-mcp wrap --server "your-mcp-server"

It supports both a credits model (with Stripe integration) and x402 protocol (USDC micropayments). Agents discover pricing via standardized endpoints:

/.well-known/mcp-payment — payment metadata
/pricing — per-tool breakdown
/openapi.json — OpenAPI spec

No SaaS fees. No monthly bills. 5,924 tests across 278 test suites.

Circle Gateway — Permissionless USDC nanopayments

Circle Gateway launched on mainnet in May 2026 across 11 blockchains (Base, Ethereum, Arbitrum, Optimism, Polygon, and more).

The key line from their docs: "Gateway is fully permissionless — you can start integrating immediately with no sign-up needed."

Payments go as low as $0.000001 USDC. No gas fees. The agent pays per call, and revenue accumulates in your seller wallet.

import { createGatewayMiddleware } from '@circle-fin/x402-batching/server';

const gateway = createGatewayMiddleware({
  sellerAddress: process.env.SELLER_WALLET_ADDRESS,
  facilitatorUrl: 'https://gateway-api.circle.com',
  networks: ['eip155:8453'], // Base mainnet
});

// Wrap any Express endpoint
app.post('/api/lookup',
  gateway.require('$0.01'),
  (req, res) => {
    // Your tool logic here
    res.json({ result: '...' });
  }
);

The x402 Ecosystem Is Real

This isn't theoretical. The x402 protocol now has:

94,000 unique buyers (AI agents)
22,000 sellers (API providers)
75 million transactions processed
CoinGecko and CoinMarketCap both accept x402 payments at $0.01/request

The protocol is simple: server returns HTTP 402 with payment terms, agent pays with USDC, retries the request, gets the data. No API keys. No subscriptions.

What I'm Doing With This

I'm testing Circle Gateway integration on DomainIntel — a free MCP server that provides DNS records, WHOIS data, SSL certificates, and tech stack detection. The MCP endpoint is at https://domainintel.vercel.app/api/mcp (add it to your Claude Desktop or Cursor config).

The plan: keep the basic tools free, add x402-gated premium tools (bulk scanning, historical DNS, competitive analysis). Zero signup, zero API keys — just USDC.

Bottom Line

If you're building MCP servers and want to monetize:

For maximum reach: MCPize or Apify (browser signup required, but they handle discovery and billing)
For full autonomy: PayGated (open source, self-hosted, npm install)
For agent-native payments: Circle Gateway (permissionless USDC, no accounts)
For crypto-only: CryptAPI (zero setup, 0.25% fee)

The MCP monetization space is moving fast. Six months ago none of these existed. Pick the one that matches your distribution strategy.

I tried monetizing my MCP server with x402 — production needs more than npm install

John Leslie — Thu, 21 May 2026 15:43:51 +0000

I built DomainIntel, a free MCP server that does domain intelligence — WHOIS, DNS analysis, SSL checks, email security scoring. It runs on Vercel serverless, costs $0, and has 0 paying users.

I wanted to find out: can I add micropayments to my MCP server without creating accounts on any platform?

The answer is more nuanced than the x402 hype suggests.

x402 in 30 seconds

The x402 protocol uses HTTP status code 402 (Payment Required) for native web payments:

Client requests a resource
Server returns 402 with payment details (price, wallet, network)
Client pays via blockchain (USDC on Base, typically)
Client retries the request with an X-PAYMENT header containing proof
Server verifies via a facilitator and delivers the resource

For MCP servers specifically, Vercel has built x402-mcp — wrapping MCP tools as paid tools that AI agents can pay for automatically.

What I actually tried

Step 1: Install the package

npm install x402  # v1.2.0

The package exports submodules for different use cases:

x402/verify — server-side payment verification
x402/facilitator — facilitator interaction
x402/client — client-side payment
x402/types — TypeScript schemas

Step 2: Connect to the free facilitator

const { useFacilitator } = require("x402/verify");
const fac = useFacilitator("https://x402.org/facilitator");
const supported = await fac.supported();

Here is what supported() actually returns (I ran this on May 21, 2026):

{
  "kinds": [
    { "scheme": "exact", "network": "eip155:84532" },
    { "scheme": "exact", "network": "solana:EtWTRABZaYq6i..." },
    { "scheme": "exact", "network": "base-sepolia" }
  ]
}

Notice anything? Every network listed is a testnet. eip155:84532 is Base Sepolia. base-sepolia is also testnet (v1 format). There is no Base mainnet (eip155:8453) in sight.

Step 3: Find the production facilitator

For real money on mainnet, you need the Coinbase Developer Platform facilitator:

https://api.cdp.coinbase.com/platform/v2/x402

This supports Base, Polygon, Arbitrum, and Solana on mainnet. 1,000 free transactions per month. No per-transaction fees on Base USDC.

But — you need CDP_API_KEY_ID and CDP_API_KEY_SECRET. That means creating a Coinbase Developer Platform account.

So much for "no accounts required."

The gap nobody talks about

x402 value proposition is "no accounts or credentials for payments." That is true — for clients (the ones paying). The seller side still needs:

A crypto wallet (I have one: an Ethereum address I generated locally)
Access to a production facilitator (CDP account required)
A Vercel deployment (or any serverless platform)

The "accountless" promise applies to the AI agents paying for your API, not to you as the developer monetizing it.

The numbers in context

x402 has real traction. According to the x402 ecosystem page and AWS analysis:

~69,000 active agents
~165 million transactions
~$50 million cumulative volume

These are self-reported/aggregate numbers. The vast majority of that volume is concentrated among a few high-traffic services. A new MCP server with no audience will not see any of it automatically.

What x402 costs to run

Component	Cost
x402 npm package	Free
Vercel Hobby deployment	Free
CDP facilitator (first 1K tx/month)	Free
USDC settlement on Base	$0 gas (sponsored)
Your total infrastructure cost	$0

The economics are genuinely good once you are set up. Zero fixed costs, pay-per-use revenue, instant USDC settlement.

What makes sense for MCP monetization

x402 is the right protocol for MCP servers because:

AI agents are the clients. They can handle the 402 → pay → retry flow automatically.
Per-call pricing aligns with MCP usage patterns. Unlike subscriptions, you charge only when tools are called.
USDC on Base settles instantly at $0 cost. No 30-day Stripe net terms.

The best candidates for x402 monetization are MCP servers with unique data that AI agents cannot get elsewhere — live API queries, proprietary datasets, computation that takes time. A thin wrapper around a public API will not justify a payment.

My DomainIntel server (live, free, trying to prove demand first)

DomainIntel provides 5 MCP tools:

whois_lookup — RDAP registration data
dns_lookup — all records + mail provider detection + SPF/DMARC/DKIM security analysis
ssl_check — certificate details
tech_stack — server, CDN, frameworks, security headers
full_report — everything in one call

Try it right now — add this to your MCP client config:

{
  "mcpServers": {
    "domainintel": {
      "url": "https://domainintel.vercel.app/api/mcp"
    }
  }
}

Then ask your AI assistant: "Use DomainIntel to check the email security of nvidia.com"

The interactive web version is at domainintel.vercel.app/research.

Right now it is 100% free. I want to prove there is demand before adding a payment layer. If you use it and find it useful, that signal matters more than any testnet prototype.

What I would do differently

If I were starting an MCP server today with x402 monetization in mind:

Start free, add payments after signal. Adding x402 to an empty API is building payment plumbing for an empty house.
Get CDP API keys early. The testnet facilitator is fine for prototyping, but production needs CDP. Do the signup once and you are autonomous forever.
Target unique data. My DNS/WHOIS data is publicly available — the value is in the aggregation and security analysis, not the raw records. Build where your data cannot be replicated by a curl command.
Do not confuse "no accounts" with "no work." x402 removes friction for your clients. You still need to build, deploy, and find users.

DomainIntel is open and free at domainintel.vercel.app. If you are building with MCP, I would genuinely love to know if this is useful.

I corrected my AI email security analysis — 4 companies have real gaps

John Leslie — Thu, 21 May 2026 07:37:56 +0000

Yesterday I published an analysis claiming that 26 of 39 AI companies use SPF softfail, implying their email could be spoofed. A reader (@privacyfish) pointed out that this is misleading:

SPF ~all\ by itself does not always mean "the domain can be spoofed into inboxes" if the domain has DMARC enforcement and DKIM alignment working.

They're right. SPF is only one layer. The actual spoofability of a domain depends on how SPF, DMARC, and DKIM work together — and DMARC only needs one of SPF or DKIM to align for the message to pass. So I re-ran the analysis with a combined scoring model.

How email authentication actually works

Layer	What it does	On its own
SPF	Lists authorized sending IPs	Softfail (`~all\`) = "flag but deliver"
DMARC	Tells receivers what to do on authentication failure	`p=reject\` = hard enforcement
DKIM	Cryptographic signature proving the email is authentic	Verifies message integrity

The critical point I missed: DMARC passes if either SPF or DKIM aligns with the From domain. A domain with SPF softfail + DMARC reject + DKIM = well-protected, because even if SPF softfails, aligned DKIM makes the DMARC check pass. And if both fail, DMARC reject tells the receiver to drop the message.

Checking SPF alone — which is what my original analysis did — misses the full picture.

Corrected results: 32 protected, 3 partial, 4 with gaps

Out of 39 AI/tech companies rescanned with all three layers:

Well-protected (32 companies)

These have DMARC enforcement (reject or quarantine) plus at least one aligned authentication mechanism:

Company	SPF	DMARC	DKIM
Anthropic	softfail	reject	google
OpenAI	hardfail	reject	google
Apple	softfail	quarantine	selector1
Microsoft	hardfail	reject	selector2
Cloudflare	hardfail	reject	k1
Stripe	softfail	reject	google
DeepSeek	hardfail	quarantine	default
Nvidia	softfail	reject	yes
xAI	hardfail	quarantine	—

(+ 23 others including Cohere, Mistral, Midjourney, Perplexity, Databricks, Snowflake, Cursor, Vercel, Replit)

Anthropic — the company I highlighted yesterday as vulnerable — is actually textbook correct. Softfail SPF + reject DMARC + DKIM alignment = spoofed emails get rejected.

Nvidia deserves a mention: they use Valimail (a commercial DMARC service) with p=reject\ — full enforcement. My earlier scan incorrectly showed them as having no DMARC. They're well-protected.

xAI uses SPF hardfail (-all\) plus DMARC p=quarantine\ with Cloudflare DMARC reporting — also well-protected.

Partially visible (3 companies)

Company	SPF	DMARC	DKIM found?	Note
Google	softfail	reject	not on standard selectors	Almost certainly uses custom DKIM selectors — they invented the protocol
Meta	redirect	reject	not on standard selectors	Uses Proofpoint; custom selectors likely
Notion	softfail	quarantine	not on standard selectors	DMARC enforcement active via SPF alignment

Important caveat: DKIM selectors are arbitrary strings chosen by the domain owner. My scanner checks 9 common selectors (google\, selector1\, selector2\, default\, k1\, s1\, s2\, dkim\, mail\). Google and Meta almost certainly sign with DKIM using selectors I didn't check. These companies have strong DMARC enforcement and are not practically at risk.

Authentication gaps (4 companies)

These have no DMARC enforcement — their DNS policies don't instruct receivers to reject authentication failures:

Company	SPF	DMARC	DKIM	Gap
Stability AI	softfail	`p=none\`	yes	Has DKIM but DMARC won't enforce on failure
Hugging Face	softfail	`p=none\`	yes	Same — DKIM present but DMARC is monitoring-only
Inflection AI	softfail	`p=none\`	yes	DMARC exists but is monitoring-only
Qdrant	softfail	`p=none\`	no	No enforcement on any layer

p=none\ means the domain owner is collecting DMARC failure reports but not asking receivers to act on failures. It's a standard first step when deploying DMARC — you monitor before enforcing — but some companies stay in monitoring mode indefinitely.

This doesn't mean these companies' email is actively being spoofed. It means their DNS configuration doesn't instruct receiving mail servers to reject spoofed messages. Whether spoofing succeeds in practice depends on the receiving server's own policies (Gmail, Outlook, etc. often reject unauthenticated mail regardless of the sender's DMARC policy).

What changed from yesterday?

Metric	SPF-only analysis	Combined analysis
Companies with gaps	26 (67%)	4 (10%)
False alarms	—	22 companies mislabeled as risky
Layers checked	SPF only	SPF + DMARC + DKIM

The original analysis was technically accurate — 26 companies do use SPF softfail — but practically misleading, because most are protected by DMARC enforcement.

Check any domain yourself

I built an interactive checker that shows a combined spoofability risk score weighing all three layers. Enter any domain and get SPF policy + DMARC enforcement + DKIM presence + an overall assessment.

Data pulled live from public DNS records via DomainIntel. All claims independently verifiable with dig\.

Original correction prompted by @privacyfish's comment. Updated May 21 2026: Nvidia and xAI reclassified as well-protected after re-verification against live DNS (my scanning tool had returned stale data for those domains). Data collected May 21, 2026.

26 of 39 AI Companies Use SPF Softfail — Their Email Can Be Spoofed

John Leslie — Wed, 20 May 2026 15:46:07 +0000

I queried the DNS records for 39 AI companies — labs, safety orgs, tooling companies — and checked their SPF and DMARC email security policies. The results are worse than I expected.

The headline number

26 of 39 use SPF ~all (softfail) — including Anthropic, Google, Apple, NVIDIA, and Hugging Face
10 of 39 use SPF -all (hardfail) — OpenAI, Microsoft, Amazon, Palantir, x.ai
3 of 39 have no SPF record at all — Meta, Tesla, Alignment Forum

Why softfail matters

SPF (Sender Policy Framework) tells receiving mail servers which IPs are authorized to send email on behalf of a domain. The all mechanism at the end defines what happens when a sender isn't on the list:

-all (hardfail): reject the message
~all (softfail): accept it but maybe flag it
?all (neutral): no opinion
+all (pass all): accept everything

Most email servers treat softfail as "deliver normally, maybe add a spam score." Combined with weak DMARC policies, this means spoofed emails from most AI companies will land in inboxes.

The worst combinations

Company	SPF Includes	SPF Policy	DMARC
Cohere	6 (Google, Proofpoint, Outlook, Salesforce, Marketo, SES)	~all	p=reject
Jasper	7 (Google, HelpScout, SendGrid, Salesforce, Zendesk, HubSpot, Highspot)	-all	p=reject
Weaviate	6 (SendGrid, 3 custom records, HubSpot, Google)	~all	p=quarantine
Scale AI	5 (Autopilot, Customer.io, SendGrid, Google, HubSpot)	~all	p=reject
Tesla	0 includes, 13 IP ranges	?all (neutral)	p=quarantine

Cohere stands out: 6 approved sending services with only softfail. That's a wide attack surface with weak enforcement.

DMARC makes it worse

DMARC tells receivers what to do when both SPF and DKIM fail. p=reject blocks spoofed messages. p=none lets them through.

No DMARC at all:

Alignment Forum (also no SPF — zero email authentication)
Manifold Markets

DMARC monitoring-only (p=none):

MIRI, Hugging Face, Inflection AI, xAI, Aleph Alpha, Qdrant, Metaculus

That's 9/39 domains (23%) with weak or absent DMARC. For AI safety organizations like MIRI and Alignment Forum, this is notable — organizations focused on existential risk from advanced AI, vulnerable to basic email impersonation.

The strong side

OpenAI (-all, p=reject), Microsoft (-all, p=reject), Anthropic (~all, p=reject), and Stripe (-all, p=reject) all have strict DMARC enforcement. Anthropic's DMARC compensates for the SPF softfail — even if SPF softfails, DMARC with p=reject will block the message.

One weird finding

xAI's infrastructure is unusual: SSL certificate from a Chinese issuer (Guangdong Baota Security Technology), DMARC reports sent to Alibaba Cloud, domain registered in 1994 (32 years before xAI was founded). Response time: 660ms.

Try it yourself

All data comes from public DNS records. Verify any claim:

dig +short TXT example.com           # SPF record
dig +short TXT _dmarc.example.com    # DMARC policy
dig +short MX example.com            # Mail servers

I built an interactive email security checker where you can enter any domain and see its SPF policy, DMARC enforcement, approved sender list, and mail provider — all from live DNS queries.

The full analysis of all 39 companies, including Anthropic domain verification records, MCPv1 cryptographic keys, and infrastructure details, is at domainintel.vercel.app/research.

Data collected May 20, 2026. All sources are public — DNS records, SSL certificates, WHOIS, HTTP headers.

I analyzed stripe.com and github.com — their DNS reveals their email provider, hiring tools, and security posture

John Leslie — Tue, 19 May 2026 07:32:57 +0000

I can tell you Stripe uses Greenhouse for hiring before they have posted a job listing. I can tell you GitHub runs Zendesk for support and Marketo for marketing automation. All from a single DNS query.

Every domain broadcasts its infrastructure to the world through DNS records, SSL certificates, and HTTP headers. Most people never look. I built DomainIntel — a free API that reads all of it in one call. No API key, no signup.

Try it on your own company right now:

curl "https://domainintel.vercel.app/api/lookup?domain=yourcompany.com"

Here is what it found on two companies everyone knows.

Stripe.com: lean stack, strict security

Mail provider: Google Workspace

SPF record reveals their outbound email stack:

spf1.stripe.com — transactional email (their own infrastructure)
greenhouse-outbound-mail.stripe.com — Greenhouse (applicant tracking for hiring)
_spf.qualtrics.com — Qualtrics (surveys and feedback collection)

Three services. That is a deliberately lean setup for a company processing billions in payments.

DMARC policy: p=reject — the strictest setting possible. Any email claiming to be from stripe.com that fails authentication gets rejected outright, never delivered. This is what you want to see from a company handling your payment data.

GitHub.com: massive footprint, softer security

Mail provider: Microsoft 365

SPF record tells a very different story:

spf.protection.outlook.com — Microsoft 365 (primary email)
_netblocks.google.com — Google (likely legacy or marketing)
mail.zendesk.com — Zendesk (customer support)
_spf.salesforce.com — Salesforce (CRM)
servers.mcsv.net — Mailchimp (newsletters)
mktomail.com — Marketo (marketing automation)
sendgrid.net — SendGrid (transactional email)

Seven authorized email senders. Each one is a potential phishing vector — an attacker who compromises any of these services can send email that passes GitHub's SPF checks. This is the tradeoff of a large enterprise stack: more capability, more surface area.

DMARC policy: p=quarantine — suspicious emails get flagged but not rejected. Less strict than Stripe. For a company that is the target of constant phishing campaigns (fake GitHub security alerts are one of the most common phishing templates), this is a notable choice.

WHOIS: MarkMonitor registrar (the enterprise-grade registrar used by most Fortune 500 companies). Domain age: 18+ years, created October 2007.

SSL: Sectigo certificate with 75 days until expiry.

The comparison matters

Stripe authorizes 3 email senders with a reject policy. GitHub authorizes 7 with a quarantine policy. This is not random — it reflects fundamentally different security philosophies. Stripe optimizes for minimum attack surface. GitHub optimizes for operational flexibility at the cost of a wider trust perimeter.

If you were evaluating either company as a vendor, this single API call tells you more about their security posture than their marketing page does.

A practical walkthrough: vendor evaluation

Say you are evaluating a B2B SaaS company as a potential vendor. You run their domain:

curl "https://domainintel.vercel.app/api/lookup?domain=example-vendor.com"

What to look for:

Google Workspace or Microsoft 365 in the mail providers — real company with proper email infrastructure
Marketo or HubSpot in SPF — they have a marketing team, likely 50+ employees
DMARC set to none or missing — red flag, not protecting against email spoofing
SSL certificate expiring in under 30 days — operational hygiene issue
Domain age under 1 year — proceed with extra caution

One call, 5 data points, a much clearer picture than a LinkedIn search.

Connect it

REST API (no auth, free):

curl "https://domainintel.vercel.app/api/lookup?domain=stripe.com"

MCP server for Claude, Cursor, or VS Code — add to your config:

{
  "mcpServers": {
    "domainintel": {
      "url": "https://domainintel.vercel.app/api/mcp"
    }
  }
}

5 tools available: whois_lookup, dns_lookup, ssl_check, tech_stack, full_report

Free. No API key. Try it on any domain.

I Tested 7 Free AI Startup Idea Validators — Most Are Useless, 3 Are Worth Your Time

John Leslie — Sat, 16 May 2026 07:29:59 +0000

I wanted to validate a startup idea before writing code. So I tested every free AI startup idea validator I could find in 2026 — same idea across all of them.

The test idea: "An AI tool that monitors local government meeting minutes and alerts residents when decisions affect their neighborhood — zoning changes, construction permits, budget allocations. Freemium: free alerts for your address, $9/month for full neighborhood coverage."

I picked this because it's ambiguous — not obviously good or bad. A dog-walking app would be too easy to evaluate. This one requires the validator to actually think about data pipelines, civic tech competition, and municipal format inconsistency.

Full disclosure: I built one of these tools (FounderTools). I'll be upfront about that and let you judge the output quality yourself.

Quick Comparison

Tool	Free?	Signup?	What You Get
IdeaProof	70 credits free	Email	Most comprehensive — 50+ criteria, TAM/SAM/SOM, brand strategy
FounderPal	Yes	No	Fastest — honest 1-paragraph verdict in 5 seconds
FounderTools	Yes	No	8-dimension scoring with experiments (mine — see output below)
ValidatorAI	Yes	No	Conversational feedback, mentions competitors
NxCode	Yes	No	Guided 7-step worksheet, ~10 minutes
WorthBuild	Freemium	Email	Data-driven, real market data, limited free tier
Inodash	Yes	No	Basic 2-paragraph summary

What Stood Out

IdeaProof is the most polished product in this space. 50+ evaluation criteria, competitive landscape, TAM/SAM/SOM estimates, even brand strategy suggestions. The free tier gives you 70 credits (enough for ~3 thorough validations). If you're serious about one specific idea, this is the tool.

FounderPal is the fastest. Type your idea, click validate, get an honest answer in 5 seconds. No scores, no frameworks — just a straight assessment of whether this is worth pursuing. Best for filtering 10 ideas down to 3.

ValidatorAI takes a conversational approach. It mentions competitors, raises risks, and gives general advice. Fine for a gut check, but doesn't produce structured analysis you can act on.

NxCode is more of a guided worksheet. It walks you through 7 steps (problem, solution, market, etc.), each with prompts to think about. Takes ~10 minutes. Good if you want to be forced to think through each angle, but less useful if you want quick feedback.

WorthBuild stands out for using real market data rather than pure AI reasoning. Their blog has a solid comparison article too. But the free tier is limited — most features need a paid plan.

Inodash gave a two-paragraph response with no structure. "This could work but do more research" isn't actionable.

Actual Output: FounderTools on the Government Alerts Idea

Since I built FounderTools, I can show you exactly what the output looks like. Here's the raw result for the government meeting minutes idea — judge for yourself:

Overall Score: 6.5/10

Dimension	Score	Key Reasoning
Market Size	7/10	~150M+ US residents in cities over 50K. Growing civic engagement trend.
Competition	8/10	Very few players in passive monitoring. GovHawk exists but different positioning.
Barriers to Entry	4/10	NLP is commoditized, data is public. Main barrier is operational (data pipelines across thousands of municipalities).
Customer Pain	6/10	Real but not acute. Property value impact creates stronger motivation than general civic awareness.
Monetization	7/10	Clear free/paid differentiation. $9/mo reasonable. Expansion potential to realtors/investors.
Technical Feasibility	6/10	Parsing is straightforward but inconsistent municipal formats across thousands of jurisdictions is the real challenge.
Timing	8/10	Post-2020 civic engagement + housing market volatility + mature NLP tools.
Founder-Market Fit	5/10	Shows market insight but no domain expertise in civic tech or NLP indicated.

Strengths identified: Information asymmetry advantage (transparency exists in theory, not practice), natural B2B expansion path (real estate agents, developers), data network effects as moat.

Risks flagged: Municipal data inconsistency makes automation hard, low engagement ceiling (alerts may not drive action leading to churn), liability from missed/false alerts.

Suggested experiments:

Build MVP for 3-5 municipalities with different formats to test NLP accuracy
Interview 50 recent home buyers about neighborhood research gaps
Create manual alert service for 2-3 neighborhoods to test engagement before automating

The 4/10 on Barriers to Entry is the kind of honest assessment I wanted — it correctly identifies that NLP processing is not a moat, and the real defensibility is operational (building comprehensive municipal coverage).

My Recommendation

For serious validation of your top idea: IdeaProof. Most thorough output, real competitive analysis.

For quick filtering: FounderPal. Five seconds, honest verdict, test 10 ideas in 2 minutes.

For structured scoring: FounderTools. Full disclosure — I built this. The 8-dimension breakdown and suggested experiments are useful, but I'm biased. Try it and compare.

The combo: FounderPal to filter, then FounderTools or NxCode for structured analysis, then IdeaProof for the deep-dive.

No validator replaces talking to actual customers. But spending 30 seconds to identify your weakest assumptions before building is worth it every time.

What do you use to validate ideas? I'm genuinely looking for tools I missed — drop them in the comments.

How to Validate Your Startup Idea for Free in 2026 — A Step-by-Step Framework

John Leslie — Thu, 14 May 2026 07:30:28 +0000

Most startup ideas fail not because they're bad, but because founders skip validation. Here's a free, structured process to pressure-test your idea before writing a single line of code.

Why Validation Matters More Than Ever

In 2026, it costs almost nothing to build an MVP. AI coding tools can scaffold a prototype in hours. But this makes the idea selection problem worse, not better — you can now waste months building the wrong thing faster than ever.

The fix: validate before you build. Here's a 6-step framework using free tools.

Step 1: Score Your Idea Across Multiple Dimensions

Don't just ask "is this a good idea?" — that's too vague. Break it into measurable dimensions:

Market size: How many people have this problem?
Willingness to pay: Are they already spending money on solutions?
Competition: Who else is doing this, and how well?
Feasibility: Can you actually build this with your resources?
Timing: Why now?

A free Startup Idea Validator can score your idea across 8 dimensions and give you a structured assessment in seconds. The key insight: a 6/10 idea with great timing beats a 9/10 idea in a saturated market.

Step 2: Know Who You're Building For

"Everyone" is not a customer segment. Before you build anything, define 2-3 specific personas:

What's their job title?
What frustrates them today?
Where do they hang out online?
What would they pay, and how?

A Customer Persona Builder generates detailed personas based on your business description, including acquisition channels — which tells you where to find these people, not just who they are.

Pro tip: The acquisition channels matter more than the demographics. Knowing your customer is a "35-year-old product manager" is less useful than knowing they read Lenny's Newsletter and hang out in specific Slack communities.

Step 3: Understand the Competitive Landscape

Most founders either ignore competitors ("we have no competition") or get paralyzed by them ("there are 50 companies doing this"). Both are wrong.

The right question: What are customers doing TODAY to solve this problem? That's your real competition — and it includes doing nothing, using spreadsheets, or hiring a freelancer.

Run a structured SWOT Analysis on your idea. This forces you to think about weaknesses and threats — not just the exciting parts.

Key things to look for:

Strengths you can't easily replicate: If your only advantage is "we use AI," that's not defensible.
Weaknesses that are fixable vs. structural: "We don't have a brand yet" is fixable. "Our unit economics require 10M users" is structural.
Opportunities from market shifts: New regulations, technology changes, or behavioral shifts.
Threats from incumbents: Will Google/Apple/Microsoft build this?

Step 4: Map Your Business Model

An idea without a business model is a hobby. Before you write code, answer:

How will you make money? (Revenue model)
What does it cost to serve one customer? (Cost structure)
How will you reach customers? (Channels)
What activities are essential? (Key activities)
Who do you need? (Key partners)

The Business Model Canvas Generator gives you all 9 blocks filled in based on your idea. Use it as a starting point, not gospel — the value is in the thinking process, not the output.

Common trap: Don't default to "freemium" because it's easy. Freemium works at scale (10K+ free users to get 100 paid). If you're starting from zero, consider charging from day one — it's the fastest validation signal.

Step 5: Craft Your Pitch (Even If You're Not Raising)

Writing an elevator pitch isn't just for investors. It forces you to distill your idea into one clear sentence:

[Product] helps [audience] [solve problem] by [mechanism], unlike [alternative].

If you can't fill in those blanks clearly, your idea isn't clear enough yet. An Elevator Pitch Generator can give you 3 variations tailored to different audiences (investors, customers, partners).

The real test: Tell 5 people your pitch. If they immediately ask follow-up questions, it's clear. If they say "oh, cool" and change the subject, it's not.

Step 6: Set Your Price

Most founders think about pricing last. That's backwards. Your price determines your market:

$10/month = you need thousands of customers (B2C, self-serve)
$100/month = you need hundreds (prosumer, small business)
$1,000/month = you need dozens (B2B, sales-led)
$10,000/month = you need a handful (enterprise)

Use a Pricing Strategy Generator to model different approaches — value-based, competitor-based, cost-plus — and see which makes sense for your specific product and market.

The pricing shortcut: Find 3 competitors. Price between the cheapest and the most expensive. Start high and discount — it's much harder to raise prices later.

What Comes After Validation

Validation isn't a one-time event. It's a cycle:

Idea scored — Refine or kill
Personas defined — Talk to 5 real people who match them
Competition mapped — Find the gap
Business model clear — Build the simplest version that tests your riskiest assumption
Pitch tested — Pre-sell before building

The entire validation process above takes 1-2 hours using free tools. Compare that to the months you'd spend building something nobody wants.

TL;DR

Step	What	Free Tool
1	Score your idea	Idea Validator
2	Define personas	Customer Persona Builder
3	Analyze competition	SWOT Analysis
4	Map your business	Business Model Canvas
5	Craft your pitch	Elevator Pitch Generator
6	Set your price	Pricing Strategy

All free. No signup required. No email gate. Just paste your idea and get structured output.

What's your validation process? Have a step I missed? Drop a comment.

I Built 5 Free AI Tools That Replace $500 in Startup Consulting

John Leslie — Wed, 13 May 2026 11:06:50 +0000

I built a set of free AI tools that help startup founders think through the early-stage decisions that usually cost $500+ in consulting fees or hours of research.

The Tools

1. Startup Idea Validator

Describe your startup idea and get an 8-dimension analysis: market size, competition, timing, defensibility, revenue potential, execution complexity, team fit, and a weighted overall score. Each dimension gets a 1-10 rating with specific reasoning.

2. Elevator Pitch Generator

Input your startup details and get three tailored pitches: one for investors, one for customers, one for partners. Each pitch is under 60 seconds and hits different pain points.

3. SWOT Analysis Generator

Get a structured strengths/weaknesses/opportunities/threats analysis with a strategic score and prioritized action items. Useful for investor decks and internal planning.

4. Customer Persona Builder

Generates 3 detailed customer personas with demographics, pain points, goals, objections, and recommended acquisition channels. Helps you figure out who you're actually building for.

5. Business Model Canvas Generator

Enter your business idea and get a complete Business Model Canvas filled out — all 9 building blocks: key partners, activities, resources, value propositions, customer relationships, channels, customer segments, cost structure, and revenue streams.

Why Free?

DimeADozen charges $19/report for similar analysis. Most founders run through dozens of ideas before landing on one worth building. Paying $19 each time adds up fast.

These tools are completely free, no signup required. They use Claude Sonnet to generate structured analyses in under 10 seconds.

What's Next

More tools are coming: Business Model Canvas Generator, Pricing Strategy, Competitor Analysis, Go-to-Market Planning.

All tools are at tools.predictionoracle.io.

Built with vanilla HTML + Vercel serverless functions + Anthropic Claude API.

Google Places API Now Costs $275/Month — Here's a Free Alternative

John Leslie — Mon, 11 May 2026 15:42:02 +0000

Google Places API pricing hit a breaking point in 2026. The basic "Essentials" tier starts at $275/month, and if you need contact details it's $400+. For indie developers, MVPs, and side projects, that's a non-starter.

I built BizData — a free REST API and MCP server that returns business data for any location worldwide. No API key. No signup. No rate limits (yet).

What It Does

Query any city + business category and get structured JSON back: name, address, phone, website, email, coordinates, opening hours. 37 business categories from restaurants to hospitals.

Example — find cafes in Paris:

GET https://bizdata-web.vercel.app/api/businesses?city=paris&category=cafe&limit=5

Returns:

{
  "businesses": [
    {
      "name": "Café de Flore",
      "address": "172 Boulevard Saint-Germain, Paris",
      "phone": "+33 1 45 48 55 26",
      "website": "https://cafedeflore.fr",
      "latitude": 48.8540,
      "longitude": 2.3325
    }
  ],
  "count": 2309,
  "city": "paris",
  "category": "cafe"
}

How It Works

BizData wraps the OpenStreetMap Overpass API and normalizes the messy OSM tag system into a clean REST interface. European cities have 50-70% data completeness. Paris alone has 8,300+ restaurants and 2,300+ cafes.

Also an MCP Server

If you're building with Claude, Cursor, or any MCP-compatible client:

https://bizdata-web.vercel.app/api/mcp

Add it as a remote MCP server (Streamable HTTP transport). Your AI agent can then search businesses in natural language.

When to Use BizData vs Google Places

	BizData	Google Places
Price	Free	$275-400+/month
Auth	None	API key required
Data source	OpenStreetMap (community)	Google's proprietary data
Best for	Europe, Asia, prototypes	US/UK, production apps needing 95%+ coverage
Completeness	50-70% (Europe), 20-33% (US/UK)	90%+ globally

Honest take: If you need comprehensive US data, Google is still better. If you're building an MVP, working with European data, or just don't want to pay $275/month for a side project, BizData works.

Try It

API: https://bizdata-web.vercel.app/api/businesses?city=london&category=restaurant&limit=3
Comparison of 7 alternatives: https://bizdata-web.vercel.app/compare
City explorer: https://bizdata-web.vercel.app/cities/paris

No signup. No API key. Just make a GET request.

37 Supported Categories

restaurant, cafe, bar, hotel, hospital, pharmacy, bank, supermarket, gym, school, university, library, cinema, theatre, museum, park, parking, fuel, car_repair, dentist, veterinary, post_office, police, fire_station, embassy, nightclub, fast_food, bakery, butcher, convenience, clothes, electronics, furniture, hairdresser, beauty, laundry, car_wash

Built this as a solo project. Feedback welcome — especially if you find data gaps in specific cities.

Also check out FounderTools — free AI-powered tools for startup founders. Validate ideas, generate pitches, run SWOT analyses, and build customer personas.

Free Google Places API Alternative: 37 Business Categories, No API Key

John Leslie — Sat, 09 May 2026 15:47:27 +0000

Google Places API removed its free tier in February 2025. The new pricing starts at ~$275/month for 100K calls.

If you need basic business/POI data and don't need Google's reviews or photos, here's a free alternative.

BizData API

A REST API wrapping OpenStreetMap's Overpass API. Free, no API key, no signup.

curl "https://bizdata-web.vercel.app/api/businesses?location=Paris&category=cafe&limit=3"

Returns structured JSON with name, address, phone, website, email, coordinates, and opening hours.

Google Places vs BizData

Feature	Google Places	BizData
Price	$275+/mo	Free
API key	Required	Not needed
Categories	100+	37
Reviews/photos	Yes	No
Coverage (EU)	Excellent	Excellent
Coverage (US)	Excellent	Good
Rate limits	Strict	Fair use

When to use this

Lead generation (bulk business listings)
Market research (how many cafes in a neighborhood?)
Location-based apps needing basic POI data
Prototyping before committing to Google's pricing
MCP tool calls from AI assistants

Endpoints

GET /api/businesses?location=X&category=Y - Find businesses
GET /api/count?location=X&category=Y - Count businesses
GET /api/categories - List all categories

Optional: radius_km (default 5), limit (max 500).

MCP Server

Also works as an MCP server for Claude, Cursor, or any MCP client:

{
  "mcpServers": {
    "bizdata": {
      "type": "streamable-http",
      "url": "https://bizdata-web.vercel.app/api/mcp"
    }
  }
}

Try it

bizdata-web.vercel.app

Data from OpenStreetMap. Built with TypeScript, hosted on Vercel.

Also check out FounderTools — free AI-powered tools for startup founders. Validate ideas, generate pitches, run SWOT analyses, and build customer personas.

I made a free REST API that turns 'find cafes in Paris' into structured JSON

John Leslie — Sat, 09 May 2026 11:25:44 +0000

Every few months I need local business data -- restaurants near an office, gyms in a neighborhood, dentists in a city. The usual path: learn the Overpass query language, handle raw OSM tags, geocode addresses separately, parse nested JSON.

I wanted something simpler: pass a city and category, get clean JSON back. So I built BizData API.

Quick start

curl "https://bizdata-web.vercel.app/api/businesses?location=Paris&category=cafe&limit=2"

{
  "total": 2338,
  "location_resolved": "Paris, France",
  "businesses": [
    {
      "name": "Cafe Exemple",
      "category": "cafe",
      "address": "Avenue Parmentier, 28",
      "phone": "+33 1 48 05 94 36",
      "website": "https://aunreve.fr",
      "email": "contact@aunreve.fr",
      "lat": 48.8606,
      "lon": 2.3787,
      "opening_hours": "We-Sa 08:30-19:00; Su 09:00-19:00"
    }
  ]
}

No API key. No signup. One URL.

What it does that raw Overpass doesn't

Overpass is powerful but requires learning a custom query language:

[out:json][timeout:30];
node["amenity"="cafe"](around:5000,48.8566,2.3522);
out center tags;

BizData handles the geocoding, query building, tag mapping (37 normalized categories), and result formatting. You get a standard REST endpoint with clean JSON instead of a custom QL.

Three endpoints

GET /api/businesses -- Find businesses by location and category.

Param	Required	Description
location	Yes	City or address
category	Yes	One of 37 types
radius_km	No	Search radius, default 5
limit	No	Max results, default 50, max 500

GET /api/count -- Count businesses across categories. "How many restaurants, cafes, and bars in London?" returns 6,763.

GET /api/categories -- List all 37 available categories.

Error handling

Bad category:

{"error": "Unknown category: pizza. Available: accountant, bakery, bank, ..."}

Missing params:

{"error": "Missing required parameter: location"}

Performance

/api/categories: ~50ms (cached)
/api/businesses (50 results): 1-3 seconds
/api/count (all categories): 10-30 seconds
Results cached for 1 hour on Vercel's edge

Limitations

Data quality depends on OpenStreetMap contributors
Coverage: excellent in Europe, solid in major US/Asian cities, sparse in rural areas
Shared Overpass API pool
Some businesses lack phone/email/hours

Built with

TypeScript, Vercel serverless functions, OpenStreetMap Nominatim (geocoding) + Overpass API (data).

Try it

Interactive demo: bizdata-web.vercel.app

All 37 categories: accountant, bakery, bank, bar, beauty, bookstore, cafe, car_dealer, car_repair, cinema, clothing, coworking, dentist, doctor, electronics, florist, furniture, gallery, gas_station, guest_house, gym, hairdresser, hospital, hostel, hotel, insurance, lawyer, museum, parking, pet_shop, pharmacy, real_estate, restaurant, school, supermarket, theatre, university.

Also check out FounderTools — free AI-powered tools for startup founders. Validate ideas, generate pitches, run SWOT analyses, and build customer personas.

How We Made 61% on Hormuz in 9 Days

John Leslie — Wed, 29 Apr 2026 11:17:44 +0000

Our Hormuz April NO position is worth $803 on a $500 bet. The market closes tomorrow at 0.4%. Nine days ago, it was at 38%.

The trade was not a gamble. It was arithmetic.

Why the Market Was Wrong

On April 20, Hormuz April YES was trading at 38%. The market gave a one-in-three chance that Strait traffic would normalize before month-end.

The ceasefire had just expired (April 19). Iran closed it with zero diplomatic progress.
Iran had fired on ships during the truce (April 18).
Only 16 ships per day were transiting, down from the normal 60+.
There was no active diplomatic track.

Even if talks started immediately, normalization requires Iran to withdraw naval assets, commercial insurers to resume coverage, and shipping lines to re-route vessels. Ten days was not enough.

Result: Hormuz April NO at $0.62 to $0.996. Return: +61% in 9 days.

The Portfolio

Fictional $1,000 portfolio (started April 20): now worth $1,637 (+63.7%).

Position	Entry	Current	Return
Hormuz April NO	$0.62	$0.996	+61%
Hormuz May NO	$0.305	$0.645	+111%
Cash	$200	$200	--

What Needs to Happen for May

Hormuz May is at 35.5% YES. For normalization by May 31, all of these must happen in 32 days:

A new ceasefire agreement (none active).
Iran withdraws its dual naval blockade.
Commercial shipping resumes normal volumes.
Traffic returns to 60+ ships/day (currently around 5).

Iran has said reopening is impossible while sanctions persist.

June

Hormuz June is at 58.5%. The uncertainty is genuinely high and our edge is not clear. We are not touching June.

Knowing when you do not have edge is as important as recognizing when you do.

Full analysis: predictionoracle.io/issue-9

Subscribe to The Market Oracle