x402 payments in the MCP Registry: a 1,583-endpoint census
Every endpoint in the MCP Registry that advertises x402 or HTTP-402 payments, probed read-only and re-probed weekly. This is a dataset, not a product page: the numbers below are measured, the files are downloadable, and the definition of the cohort is fixed so the series stays comparable. No API key, no wallet, no signature, no settlement.
Key numbers, 2026-11-02 sweep
| measure | x402 cohort | whole registry (same sweep) |
|---|---|---|
| endpoints | 1,583 | 35,327 |
| share of registry | 4.5% | 100% |
| clean anonymous handshake (PASS) | 65.6% | 58.6% |
| behind an auth gate (AUTH_GATED) | 1.9% | 29.0% |
Endpoints that advertise payments complete an anonymous handshake 7.0 pp more often than the registry as a whole, and sit behind an auth gate 27.1 pp less often. Both follow from the same mechanical reason: an endpoint that wants an agent to pay it has to stay callable by an agent that has not been given a key yet.
1,039 of 1,583 endpoints answer with a tool list, publishing 23,360 tools in total.
The other side of that gap is visibility, not quality: 32.0% of the cohort gave no anonymous response at all, against 12.0% registry-wide. Addresses that were published recently, or that answer only on a paid path, have not been smoke-tested by anyone yet — which is exactly the population a preflight run is for.
Weekly series
| date | cohort | pass | pass rate | auth-gated | unknown | fail |
|---|---|---|---|---|---|---|
| 2026-10-15 | 293 | 218 | 74.4% | 0 | 74 | 1 |
| 2026-10-19 | 293 | 213 | 72.7% | 2 | 77 | 1 |
| 2026-10-30 | 293 | 226 | 77.1% | 4 | 62 | 1 |
| 2026-11-01 (cohort widened) | 1,583 | 1,059 | 66.9% | 19 | 501 | 4 |
| 2026-11-02 | 1,583 | 1,039 | 65.6% | 30 | 507 | 7 |
Cohort break: rows above the 2026-11-01 line were a 293-endpoint subset, rows below are the full-registry filter at 1,583. Compare like with like.
Status distribution
| status | x402 cohort | share | whole registry | share |
|---|---|---|---|---|
| PASS | 1,039 | 65.6% | 20,701 | 58.6% |
| AUTH_GATED | 30 | 1.9% | 10,236 | 29.0% |
| UNKNOWN | 507 | 32.0% | 4,223 | 12.0% |
| FAIL | 7 | 0.4% | 167 | 0.5% |
Failure and finding codes in the cohort
| code | occurrences |
|---|---|
PROPERTY_DESCRIPTION_MISSING | 16,832 |
STATIC_SCHEMA_CHECKS_PASSED | 568 |
NO_RESPONSE | 507 |
AUTH_GATE_DETECTED | 19 |
AUTH_GATE_VERIFIED | 11 |
TOOLS_LIST_INVALID | 7 |
INITIALIZE_RESPONSE_INVALID | 6 |
TOOL_DESCRIPTION_MISSING | 5 |
NO_TOOLS | 1 |
Counts are finding occurrences, not endpoints: a schema code such as PROPERTY_DESCRIPTION_MISSING fires once per undocumented tool property, so its total legitimately exceeds the cohort size, while NO_RESPONSE matches the UNKNOWN endpoint count one for one. Codes are the raw findings from the same read-only probe, uncollapsed, so a reader can re-derive them from x402-summary.json (findingCodes) instead of trusting this table; the per-endpoint code list is in the cohort CSV.
Payment-challenge drift
Paid resources are re-probed weekly and the 402 challenge shape is fingerprinted per resource. Discovery is partial by design: /.well-known/x402 is not universal, so discoverable counts only endpoints that publish their paid resources.
| date | cohort | discoverable | paid resources | real 402 | drifted |
|---|---|---|---|---|---|
| 2026-10-17 | 293 | 61 | 509 | 49 | 0 |
| 2026-10-19 | 293 | 58 | 505 | 46 | 5 |
| 2026-10-30 | 293 | 59 | 579 | 46 | 34 |
| 2026-11-02 | 1,583 | 298 | 2,757 | 243 | 8 |
Generated 2026-11-02T13:21:39.344Z from the read-only sweep of 2026-11-02. Fields, definitions and raw counts: x402-summary.json.
Definition, so the number can be checked
A registry entry joins the cohort when its title, description or URL matches x402 or http-402 case-insensitively. The rule was fixed on 2026-10-15 and is not tuned per sweep. Each endpoint is probed read-only: one anonymous initialize plus tools/list for the handshake status, and the HTTP response for the 402 challenge shape. PASS means a clean anonymous handshake; AUTH_GATED means a confirmed intentional gate (401 with WWW-Authenticate, or live RFC 9728 resource metadata); UNKNOWN means no anonymous response at all; FAIL means a response that arrived but broke the handshake.
PASS is a reachability and shape measurement. It is not a security audit, a payment-success guarantee, or a claim that the endpoint is worth paying.
Read the series with the cohort change in mind
The cohort was 293 endpoints until 2026-10-30. From 2026-11-01 the filter was widened to the full registry and the cohort became 1,583, which is roughly the whole addressable population rather than a named subset. The clean-handshake share moves from the mid-70s to the mid-60s at that boundary because a larger, less curated sample entered — a composition change, not a quality collapse. Only rows with the same cohort size are strictly comparable, which is why both columns are published side by side.
How this differs from other x402 counts
Other published x402 ecosystem numbers measure a different thing on a different sample: whether a seller can be listed or discovered. This dataset measures whether an endpoint completes an anonymous MCP handshake. A listing rate and a handshake rate are not interchangeable, and neither is a refutation of the other. Where a number here disagrees with a number elsewhere, the first thing to compare is the denominator and the operation being counted, not the percentage.
Download and cite
The files are plain CSV and JSON, MIT licensed, refreshed on the same weekly cadence as the series:
- x402-cohort-latest.csv — one row per endpoint: name, url, status, protocol version, tool count, finding codes, checked at.
- x402-history.csv — the weekly series used for the table above.
- x402-summary.json — definitions, counts, distributions and the citation string, so a downstream tool does not have to scrape this page.
Cite as: mcpreflight, "x402 payments in the MCP Registry: a 1,583-endpoint census", 2026-11-02, https://xka0085-byte.github.io/mcpreflight/x402-mcp-payments-data.html
Probe your own endpoint
Same read-only check the census uses, on one endpoint: npx @eidonze/mcpreflight inspect <url> for the 402 challenge and the payment document, npx @eidonze/mcpreflight schema <url> for the MCP handshake, npx @eidonze/mcpreflight baseline <paid-url> then drift to catch a challenge shape that moved. The tool guide lives at x402 endpoint inspector.