{
  "markdown": "# PulseFeed\n\n**Verify before you pay or install.**\n\nTwo questions an agent has to answer before it acts, and neither is answered by a scanner that\nonly looks at the present:\n\n- **Is this x402 endpoint safe to pay?** — liveness, a 0–100 trust score, scam flags\n  (receiver swapped, catalog price ≠ challenge price, honeypot receiver, testnet listed as\n  production), with a pay/avoid verdict and on-chain proof links on Base.\n- **Did this MCP server or npm package change *after* people adopted it?** — an install\n  script added in a later version, ownership swapped, repository removed, package\n  unpublished, build provenance lost.\n\nThe second question is the one static scanners cannot answer. A rug pull is clean at review\ntime by construction: the package collects installs for weeks, and only then ships the patch\nthat runs code on `npm i`. Answering it requires yesterday's snapshot to exist, which is why\nthe series here starts on 2026-07-30 and cannot be reconstructed after the fact.\n\nPulseFeed re-audits the whole MCP registry every night and diffs it against the previous\nday's snapshot, and re-probes the x402 endpoint population daily. Everything below is free,\nneeds no key, and no account.\n\n---\n\n## MCP server\n\nHosted, no install:\n\n```\nhttps://pulsefeed.dev/mcp-server\n```\n\nStreamable HTTP. Also on the [official MCP registry](https://registry.modelcontextprotocol.io),\n[Smithery](https://smithery.ai/server/nikolife2016/pulsefeed-x402) and\n[Glama](https://glama.ai/mcp/servers/Nikolife2016/pulsefeed-x402).\n\nOr run it locally — see [`mcp/`](./mcp):\n\n```bash\nnpx pulsefeed-x402-mcp\n```\n\nTools include `check_x402_endpoint` (is this endpoint safe to pay), `mcp_check_server`\n(audit before installing), `mcp_drift_check` (**the rug-pull check** — pass your own\ndependency list), `mcp_security_report`, `x402_incidents` and `x402_changes`.\n\n## Drift badge\n\nPut it in your README. It states what changed in your package after people adopted it:\n\n```markdown\n[![MCP drift](https://pulsefeed.dev/badge/mcp.svg?package=YOUR-PACKAGE)](https://pulsefeed.dev/mcp/drift)\n```\n\nUse your registry name (`io.github.you/your-server`) or your npm package name.\n\nA green badge is a public claim about your package, so it is only issued when the package is\nactually in our snapshot. When it is not, the badge reads **`unwatched`** in grey — never\ngreen. Reporting absence of measurement as evidence of cleanliness is a mistake we made once\npublicly and will not repeat; see [the correction](https://pulsefeed.dev/correction).\n\n## CI check\n\nFails the build when something you already depend on changes dangerously:\n\n```yaml\n- uses: Nikolife2016/mcp-drift-action@v1\n```\n\n[Marketplace](https://github.com/marketplace/actions/mcp-drift-check) ·\n[source](https://github.com/Nikolife2016/mcp-drift-action). Run it on a schedule, not only on\npull requests — drift happens between your commits.\n\n## Free API\n\nNo key, CORS enabled, safe to call from a browser or a catalog page:\n\n```bash\n# what changed, whole registry\ncurl -s \"https://pulsefeed.dev/mcp/drift.json?days=7\"\n\n# only your dependencies\ncurl -s \"https://pulsefeed.dev/mcp/drift.json?packages=pkg-a,pkg-b&days=7\"\n\n# is this x402 endpoint payable\ncurl -s \"https://pulsefeed.dev/verify?endpoint=<url>\"\n```\n\nSubscribe without signing up — the filter lives in the URL, so there is no subscriber\ndatabase and nothing to leak:\n\n```\nhttps://pulsefeed.dev/mcp/drift.rss?packages=pkg-a,pkg-b\n```\n\nFull spec: [`/openapi.json`](https://pulsefeed.dev/openapi.json).\n\n## Open data\n\n- Live feed: [pulsefeed.dev/mcp/drift](https://pulsefeed.dev/mcp/drift)\n- Ecosystem state: [pulsefeed.dev/status.json](https://pulsefeed.dev/status.json)\n- Dataset: [Nikolife/pulsefeed-x402-security](https://huggingface.co/datasets/Nikolife/pulsefeed-x402-security)\n\n## On being wrong in public\n\nWe once published that 76% of x402 endpoints were dead. That measured our own parser, not the\nmarket, and the figure was corrected twice more after that — each time downward, each time for\nthe same class of reason: our own behaviour recorded as somebody else's track record. The\nwhole mechanism, every correction and the checklist that came out of it are kept at\n[pulsefeed.dev/correction](https://pulsefeed.dev/correction) rather than quietly deleted.\n\nIf you find a number here that does not hold, open an issue — that page is where it will end\nup.\n\n## What's in this repository\n\n| | |\n|---|---|\n| [`mcp/`](./mcp) | the MCP server (`pulsefeed-x402-mcp` on npm) |\n| [`lint/`](./lint) | `x402-payable` — is your x402 endpoint actually payable |\n| [`data/`](./data) | published series and snapshots |\n| `server.json` | manifest for the official MCP registry |\n\n## License\n\nMIT\n",
  "bytes": 4689,
  "sha": "d3695d56a5cb5789c7839fedc914ba3e5f5811c148a3a7005134579f50352fd4",
  "repo_slug": "nikolife2016/pulsefeed-x402",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_nikolife2016_pulsefeed_x402_81480691/readme"
}