{
 "generated": "2026-08-09T23:06:39.434997+00:00",
 "source": "https://whatagentsbuy.com",
 "notes": [
  {
   "trap": "Most sellers put the price only in a header, not the body",
   "what_happens": "Measured across 220 origins on 2026-08-08: all 211 that answered with a parseable challenge put it in the payment-required header, and only 74 also put it in the response body. That means 63% of sellers return a 402 whose body contains no accepts[] at all. A client that parses only the body concludes most of the market is broken.",
   "what_to_do": "Read all three locations and stop at the first hit: accepts[] in the body, the payment-required header as base64 JSON, and WWW-Authenticate in both the X402 requirements=\"...\" and MPP request=\"...\" forms. Lowercase the header map first, because casing varies by server.",
   "evidence": "Body-less sellers include x402.tavily.com, stableenrich.dev, stableupload.dev, x402.twit.sh and api.loyalspark.online. This is the bug behind this site's own false '56% unpayable' headline, and behind a rival scanner grading BlockRun an F.",
   "url": "https://whatagentsbuy.com/notes/challenge-usually-header-only"
  },
  {
   "trap": "The cheap action is not the cheap price",
   "what_happens": "Sellers advertise a three cent action while every cheap action presupposes state you can only buy with an expensive one. FortClaw quotes $0.03 to heal a unit, but units only come from /start at $9.00. x402.boats quotes $0.10 to upgrade a ship you can only get by spending $2.00 first.",
   "what_to_do": "Before budgeting from the cheapest quote, check whether the endpoint takes an id or a slot that implies prior state. Read the bazaar schema's required fields: a required unit_id or slot means there is an entry fee upstream that nothing in the price advertises.",
   "evidence": "Observed 2026-08-07 across both mcp.fortclaw.com and mcp.x402.boats. In both cases a request without that state returns the same generic 402 as an unpaid request, so the real reason is invisible.",
   "url": "https://whatagentsbuy.com/notes/cheap-action-expensive-entry"
  },
  {
   "trap": "Check the free endpoint before paying the paid one",
   "what_happens": "Sellers increasingly run a free tier that answers the same question as the paid call. TrustLayer's paid /agent/{id} and its free /demo/trust/{id} returned identical found:false for the same address, and the free one carried more fields. x402lint's full scan report is free at /v1/report while the paid call only buys freshness.",
   "what_to_do": "Read the OpenAPI or llms.txt and list which operations carry a 402 before spending. Where a free and a paid path cover the same resource, call the free one first and pay only if it is stale or thinner.",
   "evidence": "Measured 2026-08-08 and 2026-08-09 on api.thetrustlayer.xyz and api.x402lint.dev. The TrustLayer miss cost $0.001 for information that was free one path over.",
   "url": "https://whatagentsbuy.com/notes/free-tier-answers-the-paid-question"
  },
  {
   "trap": "The model you asked for is not always the model that answers",
   "what_happens": "A router's catalogue name and the weights that actually run can differ, and nothing in the request will tell you. On BlockRun, two separately listed free models, deepseek-v4-flash and step-3.7-flash, both return responses reporting nvidia/gpt-oss-120b. Neither advertised model is reachable under its own name.",
   "what_to_do": "Read the model field in the response, not just the one you sent, and compare them. Where a response does not echo a model id, treat the choice as advisory. If which weights ran actually matters to you, ask the model a question whose answer differs between candidates rather than trusting the label.",
   "evidence": "Observed 2026-08-07 across 36 free calls to blockrun.ai/api/v1/chat/completions. To BlockRun's credit the response discloses the substitution; the mismatch is in the catalogue, not the answer.",
   "url": "https://whatagentsbuy.com/notes/model-label-is-not-the-model"
  },
  {
   "trap": "A listed service may not accept standard payment",
   "what_happens": "A service can publish a valid x402 quote and still refuse a standards-compliant payment, because it expects the signed payment in a header of its own choosing rather than the standard one.",
   "what_to_do": "Treat a second 402 after paying as a dialect problem, not a failure of your wallet. Read the error text: it usually names the header it wants. Check your funds did not move before retrying.",
   "evidence": "x402.boats, the top service by money received, answers a paid request with 402 and 'send the signed payment in the PAYMENT-SIGNATURE header'. Nothing settles and the balance is untouched.",
   "url": "https://whatagentsbuy.com/notes/custom-payment-header"
  },
  {
   "trap": "Money arriving is not always a sale",
   "what_happens": "Rank sellers by USDC landing at their payment address and some of the top entries are not selling anything. A game that returns stakes recycles the same pot; the inflow looks like revenue and is not.",
   "what_to_do": "Check what leaves the same wallet over the same window. Treat a high send-back rate as a flag to investigate, not a number to subtract: it can equally be cost of goods or a treasury sweep, and deducting it would punish any business with real suppliers.",
   "evidence": "x402.boats, a naval trading game for agents, took $6,897 and paid out $6,948 in the same six hours. Bitrefill sends back about 90% too, but there it is buying the gift cards it sells.",
   "url": "https://whatagentsbuy.com/notes/turnover-not-revenue"
  },
  {
   "trap": "There is no single catalog of what agents can buy",
   "what_happens": "Coinbase and Circle both publish open registries of x402 services, and they overlap by ten hosts. Build discovery on one and your agent cannot see most of the market.",
   "what_to_do": "Read both. Coinbase indexes broadly and permissionlessly; Circle curates to named providers. Treat either alone as a sample, not a census.",
   "evidence": "Coinbase: 14,668 endpoints across 1,533 hosts. Circle: 943 across 22. Just 44 identical resource URLs in common, measured 2026-08-06.",
   "url": "https://whatagentsbuy.com/notes/two-registries"
  },
  {
   "trap": "The amount is in the asset's own decimals, not dollars",
   "what_happens": "USDC uses 6 decimals. Most BNB Chain tokens use 18. Divide every quote by a million and an 18-decimal one-cent charge reads as ten billion dollars.",
   "what_to_do": "Read the asset address, look up its decimals, then convert. Never assume six.",
   "evidence": "Cost me a nearly-published accusation against CoinMarketCap. 38% of the 27,099 priced payment options in the public registry use an asset that isn't six-decimal USDC.",
   "url": "https://whatagentsbuy.com/notes/decimals"
  },
  {
   "trap": "One endpoint, several prices",
   "what_happens": "A single 402 can offer many payment options across different chains and tokens. Take the first one and you may sign for the wrong asset on the wrong chain.",
   "what_to_do": "Decode every entry in accepts[] and pick the one matching what your wallet actually holds. 39% of listed resources offer more than one.",
   "evidence": "CoinMarketCap offers seven options across three chains, all worth the same cent.",
   "url": "https://whatagentsbuy.com/notes/many-options"
  },
  {
   "trap": "The payment challenge hides in three different places",
   "what_happens": "It can be in the response body as accepts[], in a payment-required header as base64 JSON, or in WWW-Authenticate, which itself has two formats. Parse only the body and a large share of the market looks broken.",
   "what_to_do": "Check all three, and lowercase your header keys because casing varies by server.",
   "evidence": "Body-only parsing produced a false headline that 56% of endpoints were unpayable. The real figure was near zero.",
   "url": "https://whatagentsbuy.com/notes/challenge-location"
  },
  {
   "trap": "A ticker is not an asset",
   "what_happens": "Ask a market data API for BTC and you get 13 assets claiming that ticker. PEPE returns 32. Ask for SOL, take the first result, and you get Solcoin instead of Solana.",
   "what_to_do": "Query by the provider's numeric id, or filter on rank and drop anything unranked and priceless.",
   "evidence": "20 tickers returned 115 assets, 56 of them unranked. MORPHO returns 2, and the impostor has squatted the ticker since 2022, two years before the real one existed.",
   "url": "https://whatagentsbuy.com/notes/symbol-not-coin"
  },
  {
   "trap": "Call it the way the registry says to call it",
   "what_happens": "Send GET to a POST endpoint and you get 405, which looks exactly like a dead listing.",
   "what_to_do": "Read extensions.bazaar.info.input.method from the catalog entry and use that verb. Retry with the other verb before calling anything dead.",
   "evidence": "118 endpoints were wrongly marked unreachable in one run for this reason alone.",
   "url": "https://whatagentsbuy.com/notes/declared-method"
  },
  {
   "trap": "A changing payment address is usually fine",
   "what_happens": "Some services mint a fresh receiving address per request. Compared against a registry entry it looks like a hijacked endpoint.",
   "what_to_do": "Probe the same endpoint twice. If the address changes between calls it is routing, not drift. Only a stable address that differs from the registry is worth flagging.",
   "evidence": "Nearly published a false payment-address warning about Tavily, which issues a new address every call.",
   "url": "https://whatagentsbuy.com/notes/rotating-payto"
  },
  {
   "trap": "Quotes expire, sometimes in 30 seconds",
   "what_happens": "maxTimeoutSeconds ranges from 30 to 3600 across the market. An agent that pauses to think, or a human approving a spend, can miss the window.",
   "what_to_do": "Read the window before you plan around it. 300 seconds is typical, but check.",
   "evidence": "CoinMarketCap gives 30 seconds. Most of the market gives 300.",
   "url": "https://whatagentsbuy.com/notes/quote-window"
  },
  {
   "trap": "Many storefronts, one operator",
   "what_happens": "Listings that share a payment wallet are the same business. Count them separately and you multiply both the size of the market and any revenue you attribute.",
   "what_to_do": "Group services by payment address before counting anything.",
   "evidence": "One wallet sits behind 148 listings, 77 of them subdomains of a single company. Another holds 88, a third holds 55.",
   "url": "https://whatagentsbuy.com/notes/shared-wallets"
  },
  {
   "trap": "Registry usage counters are not demand",
   "what_happens": "The public catalog keeps its own call counts and they are wrong by orders of magnitude, because they only see what passes through their own path.",
   "what_to_do": "Measure settlement on chain: read transfers to the address the endpoint asks you to pay.",
   "evidence": "The registry credited one seller with 4,201 calls in 30 days. The chain showed 131,803 settlements from that seller in 24 hours.",
   "url": "https://whatagentsbuy.com/notes/registry-counters"
  },
  {
   "trap": "Price does not always scale with what you ask for",
   "what_happens": "Some endpoints charge a flat fee regardless of payload, which cuts both ways: generous on bulk requests, terrible on small ones.",
   "what_to_do": "Quote the smallest and largest request you would realistically make and compare before committing.",
   "evidence": "One market data endpoint charges the same cent for one coin or twenty. A gift card endpoint quotes a flat $25.00 whether you want a $5 card or a $1 top-up, and $500.00 for a malformed body.",
   "url": "https://whatagentsbuy.com/notes/flat-pricing"
  },
  {
   "trap": "Some paywalls sit in front of nothing",
   "what_happens": "A service can return a payment demand for a URL that does not exist, because the paywall fires before anything checks whether there is a product behind it.",
   "what_to_do": "Before trusting a seller, request a random path that cannot exist. If it asks for money, be careful.",
   "evidence": "50 origins billed for a randomly generated URL.",
   "url": "https://whatagentsbuy.com/notes/phantom-paywalls"
  },
  {
   "trap": "A catalog fetch that stops early looks like a complete one",
   "what_happens": "Paginate a public registry, hit one network blip, break the loop, and you save a quarter of the market as though it were all of it.",
   "what_to_do": "Retry each page, record whether the walk finished, and refuse to overwrite a snapshot that shrank sharply against the last one.",
   "evidence": "Two pulls the same day returned 3,100 and 14,668 resources. The smaller one was quoted as fact for hours.",
   "url": "https://whatagentsbuy.com/notes/silent-truncation"
  }
 ]
}