{
  "markdown": "# deadchannel & Hosaka\n\nTwo services that sell to AI agents over [x402](https://x402.org), paid per call\nin USDC. No signup, no API key, no subscription — an agent calls, pays, and gets\nan answer.\n\n| | what it sells | price |\n| --- | --- | --- |\n| **Hosaka** | which third-party vendors a company uses, proven from its own DNS, plus contacts | $0.005 – $0.40 |\n| **deadchannel** | whether an x402 endpoint is alive, honestly priced and safe to call | $0.005 |\n\n\nAgents can install Hosaka as a skill, which tells them what it is for and when\nto reach for it:\n\n```bash\nnpx skills add plus8bit/deadchannel/skills/hosaka --yes\n```\n\n## Hosaka — company data for agents\n\nAvailable as an MCP server, so any MCP client can buy from it directly:\n\n```bash\nnpx -y hosaka-mcp\n```\n\n```json\n{\n  \"mcpServers\": {\n    \"hosaka\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"hosaka-mcp\"],\n      \"env\": { \"HOSAKA_PRIVATE_KEY\": \"0x…\" }\n    }\n  }\n}\n```\n\n`HOSAKA_PRIVATE_KEY` is a wallet holding a little USDC on Base. Four tools at\nfour prices, so a cheap question never pays for an expensive answer:\n\n| tool | price | what you get |\n| --- | --- | --- |\n| `hosaka_lookup` | $0.005 | domain age, registrar, mail and DNS provider, DMARC, HTTPS, vendor count |\n| `hosaka_contacts` | $0.02 | the dossier, plus the emails and phones the company publishes about itself |\n| `hosaka_dossier` | $0.02 | every third-party vendor the company can be proven to use, each with its proof |\n| `hosaka_people` | $0.35 | the dossier, plus named people who work there |\n\n**Why the dossier is worth having.** A company proves it owns its domain to\nevery SaaS product it buys by placing a DNS verification record, and authorises\nevery sender it uses in its SPF record. Those two lists are a purchase history\nthe company published itself.\n\nAsking for `figma.com` returns Anthropic, OpenAI, Adobe, Atlassian, MongoDB\nAtlas, Greenhouse, Docusign, Stripe, Notion, Dropbox and Zendesk — each with the\nexact record that proves it, so a buyer can check rather than trust.\n\nPage fingerprints require a loaded script or CDN host, never a mention: a site\nlisting a vendor's logo among its integrations is not a site that uses it.\n\nLive at [hosaka-agents.vercel.app](https://hosaka-agents.vercel.app).\n\n## deadchannel — a risk oracle for x402 endpoints\n\nGive it a URL, it tells an agent whether that endpoint is alive, honestly priced,\nand safe to call — **without spending a cent**.\n\nRoughly 17% of probed x402 endpoints are dead or traps, and the Bazaar discovery\nlayer ships no ranking, quality, or reputation signal by its own admission. An\nagent picking from that catalog is guessing with real money.\n\n## What it checks\n\nEvery verdict comes from unpaid `402` responses, which is what makes it cheap\nenough to run across a whole catalog.\n\n| Signal | What it catches |\n| --- | --- |\n| `reachable` | Endpoint answers at all, consistently |\n| `bot-gate` | A bot wall answers agents while browsers get a clean 402 — the endpoint is invisible to indexers |\n| `speaks-402` | Returns parseable payment requirements (v1 body **and** v2 `payment-required` header) |\n| `gate-closed` | Advertises a price it does not enforce — anyone can take the content free |\n| `price-sane` | Price sits inside $0.0001–$5; above the ceiling one call can drain a budget |\n| `price-stable` | Quote does not move between probes taken seconds apart |\n| `pay-to-valid` | Payout address is well formed for its chain and is not a burn address |\n| `network-mainnet` | Settles somewhere that can hold real value, not testnet only |\n| `network-known` | Chain identifier is recognizable (CAIP-2 or friendly name) |\n| `schema-advertised` | Agent can know the response shape *before* paying |\n| `bazaar-metadata` | Publishes `serviceName` / `tags` so topic search can find it |\n| `latency` | p99 inside the 5s budget agents typically allow |\n| `spec-clean` | Payload matches the documented shape; deviations are reported, not swallowed |\n\nVerdicts: `live`, `degraded`, `trap`, `testnet`, `dead`, `unknown`, plus a\nbounded 0–100 risk score.\n\n## Use\n\nRequires Node 22+. There are **no runtime dependencies** — types are stripped\nnatively, so there is no build step and nothing to audit but this repo.\n\n```\nnode src/cli.ts https://x402.org/protected\nnode src/cli.ts --quiet --samples 5 url-a url-b url-c\nnode src/cli.ts --json url > verdict.json\n```\n\nExit code is non-zero when any target is a `trap` or `dead`, so it drops into CI\nas a guard against shipping an agent pointed at a bad endpoint.\n\n```\nTESTNET   risk 80   $0.01  355ms p99  https://x402.org/protected\n  x network-mainnet   Only testnet networks offered (base-sepolia, solana-devnet).\n                      This endpoint cannot accept real value.\n  ! schema-advertised No input or output schema. An agent has to pay before it\n                      can find out what it gets back.\n```\n\n## First full catalog scan — 20 Aug 2026\n\n`node src/scan.ts --live 150` pulls every resource the public Bazaar facilitators\npublish and audits it. Results over **14,979 resources**:\n\n| | |\n| --- | --- |\n| catalog held by the top 3 payout addresses | **18.4%**, receiving **1 call in 80** |\n| publish no discovery tags | **40.9%** — an agent searching by topic never finds them |\n| pass every check | **56.8%** |\n| of the 150 busiest, live right now | **91.3%** |\n| of the busiest, genuinely dead | **2.0%** |\n\nMedian price $0.01, range $0 to $1,000, 316,927 paid calls in 30 days.\n\nThe catalog is in better shape than the folklore suggests. What it is not is\nevenly distributed: three addresses list 2,750 resources between them and receive\none call in eighty, which makes them roughly 15x over-represented relative to the\ndemand they serve. Catalog size is not catalog depth.\n\n![catalog audit](data/x402-catalog-audit.png)\n\n### A correction, and the guard against repeating it\n\nAn earlier version of this table claimed 89.8% of the catalog published no tags.\nThat was wrong. The loader read `extensions.bazaar.tags` only, while most\npublishers put tags on the item root — the real figure is 40.9%.\n\nThe bug survived review because nothing asserted the *positive* count. A check\nthat only ever counts what is missing cannot tell \"publishers omit this\" apart\nfrom \"we are looking in the wrong place.\" `test/catalog.test.ts` now hand-counts\ntags across all three known locations in a captured 200-item slice of the live\ncatalog and asserts the loader matches exactly, in both directions.\n\n## Notes from the wild\n\nBuilt against live endpoints, not the spec alone:\n\n- **v2 moves payment requirements into a base64 `payment-required` header** and\n  leaves the body as `{}`. A parser that only reads the body marks the official\n  reference endpoint as dead.\n- **v2 sends CAIP-2 network ids** (`eip155:84532`, `solana:EtWTRA…`) where v1 sent\n  friendly names. Both are live simultaneously.\n- **v2 renames `maxAmountRequired` to `amount`** and hoists shared `resource`\n  metadata to the payload root.\n- Several servers omit the top-level `x402Version` the reference implementations\n  all send, and some nest `accepts[]` one level deeper than documented. Both are\n  parsed and reported as warnings rather than rejected.\n- **Most resources are POST.** Probing them with GET returns 404/405, which looks\n  exactly like a dead endpoint — it put our first live-probe dead rate at 25%\n  when the real figure is 2.7%. The verb comes from the catalog now, with a POST\n  retry when it is unknown. Any x402 index reporting a high dead rate is worth\n  checking for this.\n- **Discovery metadata is scattered.** The spec puts `serviceName`/`tags` on the\n  ResourceInfo object, the CDP catalog flattens them onto the item root, and a\n  minority nest them under `extensions.bazaar`. Read one location and you will\n  undercount by half.\n- **Brokered rails exist.** AWS Marketplace resources name the payee with a URN\n  under an `aws:base` network instead of a chain address. That is legitimate, but\n  the funds go to the broker, so it is reported as a warning rather than scored\n  as an invalid payout.\n\n## Selling\n\nThe service sells its own check over x402. `src/server/` implements the seller\nside of the v2 HTTP transport: `PAYMENT-REQUIRED` out, `PAYMENT-SIGNATURE` in,\n`PAYMENT-RESPONSE` back, in the authorization flow — verify, run the resource,\nthen settle.\n\n**No private key is involved.** A seller declares where settlement should land;\nthe buyer signs and the facilitator broadcasts. The payout address is therefore\npublic information and lives in `deadchannel.config.json`, where anyone can\naudit it, rather than in a dashboard where nobody can.\n\nSettlement runs only after the probe produced a result, so a failure on our side\ncosts the buyer nothing.\n\n```\nGET  /             service card, free\nGET  /health       liveness, free\nGET  /facilitator  proves credentials are accepted, free, moves no money\nPOST /probe        the check, $0.005 in USDC on Base\n```\n\n`GET /facilitator` exists because a wrong credential otherwise stays invisible\nuntil someone tries to pay, and the first to discover it would be a customer.\n\n## Live\n\nThe service is deployed at **https://deadchannel.vercel.app**, selling on Base\nmainnet at $0.005 per call and settling through the Coinbase facilitator.\n\nFirst settled payment: [`0x6ac4a22c`](https://basescan.org/tx/0x6ac4a22c0b7721c9a5103d98ee3d546c120293e97bb5b7a2ca13fabed28e319b),\nblock 50230005, 20 Aug 2026. Gas was paid by the facilitator, not the buyer —\nin x402 the buyer only signs, so a wallet holding nothing but USDC can pay.\n\n`npm run validate` re-runs the 25 preflight checks the Bazaar applies before it\nwill index a resource, and reports whether the listing is currently active. It\nneeds no key and moves no money.\n\n```\nresource : https://deadchannel.vercel.app/probe\nvalid    : true\naccepted : accepted\nchecks   : 25/25 passed\nindexed  : active=true\n```\n\n## Hosaka\n\nA second shop on the same payout address, selling company facts to agents.\n\n```\nPOST /lookup    $0.005  domain age, registrar, mail and DNS provider, DMARC, HTTPS\nPOST /dossier   $0.02   every third-party vendor we can prove, with the proof\n```\n\nLive at **https://hosaka-agents.vercel.app**, settling on Base mainnet.\n\nProfiles are assembled from four sources that need no key and no supplier: DNS\nover HTTPS, the RDAP registry, the TLS handshake and the homepage. Cost per\nprofile is zero — the margin is in the assembly.\n\nThe interesting part is vendor detection. A company proves ownership to every\nSaaS product it buys by placing a DNS verification record, and authorises every\nsender it uses in its SPF record. Those two lists are a purchase history the\ncompany published itself. Every claim carries the record that proves it, so a\nbuyer can check rather than trust.\n\n### Using it from Claude or ChatGPT\n\nThe Bazaar's search ignores the query and ranks by unique payers, so a new shop\nis invisible there regardless of quality. MCP is the channel that works on day\none — the agent is already in a client that speaks it.\n\n```json\n{\n  \"mcpServers\": {\n    \"hosaka\": {\n      \"command\": \"node\",\n      \"args\": [\"/absolute/path/to/src/hosaka/mcp/server.ts\"],\n      \"env\": { \"HOSAKA_PRIVATE_KEY\": \"0x…\" }\n    }\n  }\n}\n```\n\nThe buyer brings their own wallet: the key signs the payment locally and never\nleaves the machine. Without it the tools say what is missing instead of failing\nmid-conversation.\n\n## Development\n\n```\nnpm install     # typescript only, for typechecking\nnpm test        # 18 tests, no network required\nnpm run typecheck\n```\n\n## License\n\nMIT\n",
  "bytes": 11516,
  "sha": "8a0d26dad64cd990c248a978946abec956e8a6e7be2bf3008b74209ca0d40bf5",
  "repo_slug": "plus8bit/deadchannel",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_plus8bit_hosaka_71ad59d3/readme"
}