Onrender

Onrender is an x402-native service at https://x402-api-catalog.onrender.com, indexed from the x402 Bazaar (Coinbase's public discovery directory). It charges callers itself in USDC on Base and is paid directly at its own wallet; Monex Protocol passes your request and payment headers through untouched. 6 endpoints listed.

Base

Offers

Offer	Endpoint	Price
Api Contract Check EVM token contract safety check: honeypot detection, mint/blacklist/pausable/self-destruct capability, ownership renouncement, transfer tax, and a real token-impersonation check (does the symbol claim to be USDC/WETH/DAI/cbBTC at the wrong address — the token equivalent of npm typosquatting).	`/m/bz-x402-api-catalog-onrender-com/api/contract-check`	0.05 USDC
Api Domain Check Domain liveness check / verify / audit: DNS resolution (A/MX/NS/TXT records), whether mail routing exists, HTTP reachability.	`/m/bz-x402-api-catalog-onrender-com/api/domain-check`	0.02 USDC
Api Mcp Audit MCP server safety audit: completes a real initialize+tools/list handshake, then statically scans every tool's name/description/schema for hidden unicode (tool-poisoning), prompt-injection-style phrasing, and tools that quietly combine multiple high-privilege capabilities (network+filesystem+exec+credential access). If a GitHub repo is supplied, folds in a real software-supply-chain signal too.	`/m/bz-x402-api-catalog-onrender-com/api/mcp-audit`	0.06 USDC
Api Repo Health GitHub repo health check / audit / verify: stars, forks, open issues, last commit age, archived status, license.	`/m/bz-x402-api-catalog-onrender-com/api/repo-health`	0.02 USDC
Api Trust Check npm package trust check / risk score / security audit: registry age, weekly downloads, GitHub org/stars, OSV.dev vulnerabilities, typosquat detection.	`/m/bz-x402-api-catalog-onrender-com/api/trust-check`	0.02 USDC
Api X402 Doctor Audits another x402 service for the exact failure modes that cause aggregators (agent-tools.cloud, x402scan, Bazaar) to mark it 'down' or make its 402 challenge unreadable: missing/invalid /.well-known/x402 descriptor, an unpaid request returning 500/404 instead of a clean 402, a malformed or missing payment-required challenge, and drift between the descriptor's advertised terms and the live chall	`/m/bz-x402-api-catalog-onrender-com/api/x402-doctor`	1 USDC

Machine-readable: openapi.json with x-payment-info offers.

Try it live

Run the full MPP flow from your browser: catch the 402, sign the payment with your wallet, and watch it settle on-chain.

This merchant settles over the mppx rail; pay it from an agent with the snippet below.

Pay with an agent

Any MPP or x402-compatible client works. With mppx, payment is automatic:

import { Mppx, evm } from 'mppx/client'
import { privateKeyToAccount } from 'viem/accounts'

const mppx = Mppx.create({
  methods: [evm({
    account: privateKeyToAccount(process.env.KEY),
    currencies: [evm.assets.base.USDC],
  })],
})

const res = await mppx.fetch('https://api.meshgateway.co/m/bz-x402-api-catalog-onrender-com/api/contract-check')
// 402 challenge signed and settled automatically; response includes Payment-Receipt

Or inspect the challenge yourself:

curl -i https://api.meshgateway.co/m/bz-x402-api-catalog-onrender-com/api/contract-check
# HTTP/1.1 402 Payment Required
# WWW-Authenticate: Payment id="…", method="evm", intent="charge", …