Provenance Report 001: the first 100 listings on the x402 Bazaar

The x402 Bazaar is the largest public catalog of paid services for AI agents. As of 2026-07-16T19:50Z it lists 25,493 resources. Fifty-three minutes earlier it listed 25,487. The catalog is growing at roughly six listings per hour with no gate on entry.

We pulled the first catalog page exactly as any buying agent receives it (100 resources, limit=100, no filters) and asked one question: what can a buyer verify BEFORE paying?

The answer, labeled the way we label everything (OBSERVED means read directly from the live response):

• 100 of 100 listings have a seller-written description. OBSERVED.
• 2 of 100 descriptions contain any URL at all. A buyer cannot reach documentation, a catalog, or a company from 98 percent of listings. OBSERVED.
• 3 of 100 descriptions mention any provenance concept (audit, attestation, verification, certification, reputation, ERC-8004). OBSERVED, keyword method stated.
• 54 unique payment wallets stand behind the 100 listings, and 5 hosts control 52 of them; the single largest host holds 25. Page one of the agent economy is half owned by five sellers. OBSERVED.
• Prices on the page run from 0.000001 to 1,000 USD per call across 8 different payment assets; the median USDC price is 0.003. OBSERVED.

None of this means the sellers are dishonest. It means the catalog gives an agent no way to know. Every description is a self-claim. The standard behind the emerging trust stack says so itself: ERC-8004 states in its own specification that it cannot cryptographically guarantee advertised capabilities are functional or non-malicious. Meanwhile security researchers documented live campaigns this month hiding payment instructions inside fake API documentation aimed at exactly these buying agents.

The gap is not payments. Payments work. The gap is that nothing on the shelf tells an agent whether the thing it is about to buy exists, does what it claims, or is the same artifact anyone ever audited.

That is verifiable work, and it is the work we do: configuration audits, artifact hash verification, and continuous operator conformance with a proof chain. If you run a listing, a directory, or a buying agent and want a verification record instead of a self-claim, DM me or email [e-mail].

Reproduce the numbers: GET https://api.cdp.coinbase.com/platform/v2/x402/discovery/resources?limit=100