Skip to content

v0.9.0 — OSS launch

Latest
Latest

Choose a tag to compare

View all tags
@ryanthegentry ryanthegentry released this 22 May 17:53
· 62 commits to master since this release
v0.9.0
376f05b

402 Index is now public. Live directory: https://402index.io · MCP server: npm install -g @402index/mcp-server (v0.3.0 on the official MCP Registry) · API docs: https://402index.io/api-docs.

What it is

A protocol-agnostic registry of paid APIs across every major machine-payment protocol — L402 (Lightning), x402 (stablecoins on Base/Solana), and MPP (Stripe/Tempo) — surfaced to AI agents via HTTP, RSS, Nostr, webhooks, and MCP. Tens of thousands of indexed endpoints, hundreds of verified providers.

Launch state

  • All runtime dependencies current. express 5, helmet 8.2, better-sqlite3 12.10, nostr-tools 2.23.5, @modelcontextprotocol/sdk 1.29, zod 4. npm audit returns 0 vulnerabilities.
  • CI green. Six required checks gate every PR: test (Node 20/24), mcp-server-test (20), e2e (Playwright), security (npm audit), and scan (gitleaks against the in-tree allowlist).
  • Architecture decisions documented. Four ADRs under docs/decisions/ cover the SQLite-over-Postgres choice, DELETE journal mode (over WAL on network-attached storage), the no-frontend-framework decision, and SSRF-safe health-check construction.
  • Threat model summarized in SECURITY.md: SSRF on probes, malicious-listing escaping, resource exhaustion, credential leakage, registration abuse.
  • Agent-collaboration documented. AGENTS.md + CLAUDE.md describe the test-first protocol, the assertion-flip guardrail in CONTRIBUTING.md, and the dispatch pipeline that drove most of the project's PRs.

Distribution surfaces

  • HTTP API — GET /api/v1/services, /api/v1/health, /api/v1/opportunities, POST /api/v1/register.
  • MCP server — @402index/mcp-server on npm and the official MCP Registry. 4 tools: search, detail, categories, stats.
  • RSS feed — GET /feed.xml with a custom l402:service XML namespace. Filter by protocol, health, or type.
  • Webhooks — POST /api/v1/webhooks, HMAC-SHA256 signed delivery, auto-deactivate after 10 failures.
  • Nostr — NIP-99 kind 30402 events.
  • Skill — SKILL.md teaches agents to discover + pay against the directory.

Contributing

  • New listings: self-register via POST /api/v1/register, open a YAML PR under listings/, or (most common) come in via the Bazaar / Satring / MPP aggregators.
  • Code or docs: see CONTRIBUTING.md. Failing-test-first protocol; conventional commits; BEHAVIOR-CHANGE: / ASSERTION-REFACTOR: keywords required when modifying existing test assertions.

License

MIT.

Assets 2
Loading