We health-checked every seller in the x402 Bazaar. One in four can't take an agent's money.

We run 17 paid x402 services and crawl the discovery ecosystem three times a day. Yesterday we pointed the crawler at a different question: not what's listed in the x402 Bazaar, but what works. One probe against a live endpoint from every single seller in the catalog — all 1,225 of them.

The numbers

• 74% pass (905 sellers): reachable, correct HTTP 402, and a parseable payment envelope an agent can actually pay against
• 206 sellers (17%) are dead — their listed endpoint 404s. A storefront with no store behind it
• 40 sellers serve their paid product with HTTP 200 and no challenge — the paywall never fires; agents get the goods for free and the seller has no idea
• 15% are already dual-stack — answering both an x402 envelope and an MPP (WWW-Authenticate: Payment) challenge on the same 402

How we almost got it wrong

Our first pass checked response bodies for the x402 envelope and flagged nearly half the catalog as broken — including our own fleet. The envelope was in the base64 payment-required header the whole time. We're publishing the mistake because it's the point: even people who run x402 services for a living misread a 402 at first glance. An agent's client library gets no second glance.

We were also careful with the 143 sellers who answered 405 to a GET — mostly POST-only services. Each got a second probe as POST before judgment; 128 turned out perfectly healthy and are counted in the 74%.

The three checks that would catch almost every failure

1. Hit your own listed URL from outside your network and confirm you get a 402 — not a 200, not a 404.
2. Base64-decode your payment-required header and confirm it parses with x402Version and a non-empty accepts[].
3. If your routes are POST-only, make sure GET still answers the challenge instead of a bare 405 — you don't know which verb a discovering agent tries first.

We turned the census probe into a free scanner: paste your URL at forgemesh.io/scan and get an A–F grade in five seconds. Agents can run the same check machine-to-machine for $0.05 over x402 itself (POST https://x402.forgemesh.io/x402-endpoint-scan) — yes, an x402 API for checking x402 APIs.

Full census with methodology and caveats: the original post. We'll re-run it monthly and publish the movement.