One character over an undocumented 500-character limit makes an x402 listing silently unpurchasable. A manifest served at .json but not the extensionless path kills some crawlers mid-parse. Four missing boolean hints cap your trust grade in directories you never submitted to.
We didn't read any of that in a spec — we hit every one of them operating 19 paid MCP servers in production. This week we taught all of it to our scanners. They're free, and they don't ask for a signup.
Who is ForgeMesh, and why do we have scanners?
We're operators, not a tools startup. We run a fleet of paid x402 and MPP services on Base — government transparency data, crypto signals, TTS, travel, anomaly detection, image generation, and a dozen more — with 800+ indexed resources that real agents pay real USDC to use.
Every scanner we publish started as an internal check we needed after something broke with money on the line. When a directory graded our servers before we'd ever heard of it, we built the checks that would have passed. When 43% of the x402 catalog vanished overnight, our crawler snapshots were how anyone found out. The scanners are those instruments, pointed outward.
The free instruments
Endpoint Scanner — can agents actually pay you? Paste any URL at forgemesh.io/scan. A no-spend x402 v2 audit: nine weighted checks (402 status, payment-required header, base64 challenge, CAIP-2 networks, complete payment fields…) with a letter grade. It never signs a payment, so it can never spend anything — yours or ours.
aso-audit-mcp — the full agent-readiness sweep (open source). 30+ checks across six categories: discoverability (robots.txt, llms.txt, DNS-AID), content accessibility, AI-bot access rules, API/auth/MCP surfaces (server cards, A2A agent cards, OAuth discovery), commerce (x402, MPP, UCP, ACP), and identity & trust. MIT-licensed, runs from npm, works in Claude Code, Cursor, or any MCP client:
npx @forgemeshlabs/aso-audit-mcp
agent-readiness-mcp + aso-score-mcp — the same framework as a single 0–100 Agent Signal Optimization score, as an MCP server your own agent can call.
The seller pre-flight checklist — a free, no-code 16-point checklist for anyone about to ship a paid endpoint — the questions we wish someone had asked us before our first zero-sale weekend.
What the scanners just learned (v0.4.0)
This week's update folds our three newest field findings into the free audit — things no spec documents and no other scanner checks:
The 500-character cliff. We measured the Bazaar indexer dropping any listing whose description exceeds exactly 500 characters — no error, no warning, the resource just becomes unpurchasable through discovery. The audit now counts your descriptions and flags every one over the line.
The extensionless manifest rule. Most ecosystem crawlers request /.well-known/x402 without the .json extension first — a survey in the x402 DNS-discovery spec thread found extensionless outnumbering .json 11-to-1, and at least one major indexer aborts mid-crawl on an HTML 404 there. Serving only the .json variant now scores partial, with the fix spelled out.
Empty descriptions are invisible descriptions. Discovery indexes rank listings on how closely descriptions match agent task language. A missing description isn't neutral — it's invisible. The audit now warns when your accepts[] carries none.
Run it right now
Browser: paste your endpoint at forgemesh.io/scan. Terminal or agent: npx @forgemeshlabs/aso-audit-mcp works as an MCP server inside Claude Code, Cursor, or anything else that speaks the protocol.
Scan your own site. Scan your competitors. Scan the API you're about to build on. It's the same instrument either way, and what it finds is yours.
The scan tells you what's broken for free. If you want the fix manual — every gotcha above with its repair, the directory-by-directory listing chain, and living updates as we hit the next one — that's the Complete Bundle. And if you'd rather have it handled than documented: hello@forgemesh.io. Done-for-you agent-readiness is what we do all day for our own fleet.
