Your x402 Endpoint Is Listed — That Doesn't Mean AWS Can Find It

2026-10-11 · minia2a

AWS shipped something quietly useful this month: AWS Bedrock AgentCore Gateway can add the Coinbase x402 Bazaar MCP server as a target, so any agent built on AgentCore can discover and pay x402 endpoints through one connection, with AgentCore handling the 402 payment flow for you. AWS's docs describe the payoff in their own words — "discover 10,000+ existing paid MCP tools that support x402 microtransactions."

If you publish an x402 endpoint, your first instinct is: good, I'm in that index, so AWS agents can find me.

We tested that instinct against the actual server AWS points at. The short version: being in the index is not the same as being discoverable, and the gap is a filter with a default most callers never change.

What we did

The AWS doc names the exact target: https://api.cdp.coinbase.com/platform/v2/x402/discovery/mcp, outbound auth "No Authorization". So on 2026-10-11 we queried that server directly — no wallet, no payment header, the anonymous-caller path a discovery client uses.

A plain GET returns 405: it is an MCP server, JSON-RPC over POST. A tools/list returns exactly three meta-tools:

• search_resources — find available x402-payable tools.
• proxy_tool_call — execute one. Returned tools are not directly callable; this is the only way to run them.
• validate_endpoint — live diagnostics on an x402 URL.

So AWS agents don't get a list of tools. They get a search box and a proxy. Which means the search box is the whole ballgame — and the search box has a default.

The default that decides whether you exist

search_resources has one parameter that matters more than the rest: curatedOnly. Its own description says it plainly:

"curatedOnly": "Return only Coinbase-curated resources. Defaults to true
  (curated-only) when curation is enabled; send false to include
  non-curated resources."

Try it as a normal agent would, with the default:

query	default (curated)	curatedOnly:false
math expression calculator	0 tools	17 tools
weather forecast	2 tools	—
ethereum gas price	2 tools	—
urlSubstring=minia2a.uk	0 tools	our resources, present

Three measurements from that table are worth sitting with:

1. A default search for "math expression calculator" returns nothing. Not "a worse result" — zero.
2. Default searches for common categories return a handful of tools. The curated set is small.
3. Our own endpoints are in the index but not in the curated set: invisible to a default search, present the moment a caller passes curatedOnly:false.

We are not special here. Any endpoint that followed the documented path — declare the bazaar extension, settle once through the facilitator, get cataloged — can end up in exactly this position: correctly registered, correctly described, and returned by zero default searches.

The funnel is now three layers deep

The CDP discovery surface has quietly become a stack, and each layer can drop you:

~34,930

CDP discovery/resources entries (HTTP resources, our count 2026-10-05)

10,000+

paid MCP tools AWS names as discoverable through the Bazaar MCP server

≈ a handful

what a default search_resources call actually returns

Indexed → MCP-exposed → curated → returned by default. A publisher can pass the first two layers — the ones every "how to list your x402 endpoint" guide covers — and still fail to reach the third. Nothing in the standard listing flow tells you which layer you landed on; you find out by querying the client side, as we just did.

What a good listing looks like on this surface

There is a bright spot. When we queried with curatedOnly:false, our endpoint came back carrying its real handler description plus an index-computed quality tag:

Safe math expressions. 🆓 5 free trial calls per signed wallet
  [Quality: 5 calls from 5 unique payers over the last 30 days,
   last called 2026-10-11T…Z]

Two things follow. First, the description your handler actually returns is what agents read — a placeholder like "minia2a service: x402-math" is useless to a search that ranks on text, and we spent real effort getting those placeholders out of the index. Second, the quality signal is computed from distinct paying wallets over a rolling 30-day window, not from call volume — a self-probe or a bot poll doesn't move it.

What to do if you publish an x402 endpoint

• Query as the client does. Hit the discovery MCP server yourself: tools/list, then search_resources with a term your endpoint should answer. If you get zero, you are not discoverable to that client by default — regardless of being "listed".
• Then try curatedOnly:false. present-but-uncurated and absent-entirely are different problems with different fixes.
• Treat the description as ranking input, not documentation. It is one of the few fields a text search can match on; a generated placeholder is a ranking anti-signal.
• Assume the layers multiply. Every aggregator that adopts the CDP index inherits its filters. AWS is the first big one; there will be more, each with its own default.

The point is not that AWS is broken — it isn't. A curated default is a reasonable way to keep a brand-new agent from drowning in 10,000 tools it can't evaluate. The point is that "listed" and "discoverable" have quietly become different words, and the listing guides only teach you the first one. If you run an endpoint, the only way to know which you have is to search for yourself the way a stranger's agent would.

We publish these field measurements because we're in the same index everyone else is, and we'd rather write down what we found than assume the funnel worked. The measurement above is reproducible on any machine with curl; the numbers are what the server returned on 2026-10-11 and will drift as the index and the curation set change.

Curious whether your term surfaces us?

1,680+ pay-per-call x402 endpoints, USDC on Base, 5 free trial calls per signed wallet — no registration.

Sources: AWS Bedrock AgentCore Developer Guide, "Coinbase Bazaar via AgentCore Gateway" (fetched 2026-10-11); direct queries to api.cdp.coinbase.com/platform/v2/x402/discovery/mcp made 2026-10-11. Index-size figures as dated. This is a field measurement, not an AWS or Coinbase statement.

---

Originally published at minia2a.uk.