No accounts · a few cents of USDC
Agents on Bazaar already pay a cent or two for live jobs: weather, prices, “audit this URL,” “is this npm package safe.” Quietstore is that shape — fetch your public site after a deploy, screen the lockfile against npm and CVEs — plus a report you can read. No signup. The badge goes grey in a week if the agent stops.
Give the agent /llms.txt (or /v1/catalog). You watch the origin report and the lockfile report. Bazaar readiness is free if you sell x402. Live origin and lockfile doctors are $0.02 a call.
No signup. No API key. Paste the store URL into the agent (or tell it to read /llms.txt). It already speaks x402.
Two cents after a deploy. Two cents after a lockfile change. One cent if you sell x402 and Bazaar is broken. The agent spends USDC from its wallet; you never hold a seller key here.
/llms.txt or /v1/catalog.package.json. You open the lockfile report.Two cents to fetch a URL or screen npm. One cent to fix Bazaar. The last three are optional extras.
Fetch a live https URL and score whether the deploy is actually there. POST {"url":"https://your.site","min_score":80} ($0.02). Default x402-seller profile: HTTPS, HSTS, llms.txt, catalog, OpenAPI, MCP, health. Optional claims[] or profile:"web". Returns 0–100, evidence, do_this_first, ci_failed. Humans: GET /v1/tools/claim-check/report?host=your.site. Badge goes stale after 7 days.
POST /v1/tools/claim-check
Screen declared npm packages before you install them. POST package.json (optional lockfile) ($0.02). After payment we look up each name on the npm registry and OSV: missing/hallucinated packages, lookalikes, brand-new publishes, deprecations, known CVEs. Returns 0–100, do_this_first, ci_failed. Caps at 60 packages; never fetches buyer URLs. Report: GET /v1/tools/dep-doctor/report?project=your-app.
POST /v1/tools/dep-doctor
Audit a public https URL. POST {"url":"https://your.site","min_score":80} ($0.02). After payment we fetch the origin (headers, HSTS, CSP, TLS, cookies, DNS/email, security.txt) and return a 0–100 score, do_this_first, and ci_failed for CI. Free preview is snapshot-only {headers}. Badge: GET /v1/tools/site-hygiene-score/badge?host=your.site.
POST /v1/tools/site-hygiene-score
Diagnose why an x402 seller is invisible on Coinbase Bazaar. POST your 402 PaymentRequired JSON. Free preview: pass/fail + which checks fail. Paid $0.01: every finding with the exact fix (extension shape, AJV schema, description limits). Run before each x402 deploy.
POST /v1/tools/x402-bazaar-audit
Run `npx -y react-doctor@latest --json .` locally, POST the JSON here. Free preview at POST /v1/tools/react-doctor-report/preview. Paid $0.02 returns do_this_first with help text and file:line samples, plus min_score/ci_failed. The Worker never scans your repo. Uses the report's official summary.score when present (react-doctor 0.9+ score API); otherwise estimates with unique-rule penalties.
POST /v1/tools/react-doctor-report
POST a handoff note → score plus what's missing (verification evidence, constraints, ownership, next steps) before you switch owners. $0.005/call. Guide: pack demo-notes-v1 ($0.01).
POST /v1/tools/handoff-lint
POST a shell command → token-budget risk score, whether to wrap it with RTK, and a safer form. Never executes the command. $0.005/call. Full RTK workflow: pack rtk-output-discipline-v1 ($0.05).
POST /v1/tools/rtk-command-score
POST your capacity metrics (running vs requested agents, host load, cores, ready work) → admit / reduce / refuse with reasons. $0.01/call; you send the numbers, the store never touches your host. Full recipe: pack beads-agent-mail-recipe-v1 ($0.10).
POST /v1/tools/swarm-admission
Operational recipe for multi-agent work on one repo: claim tasks, reserve files, avoid stomping, commit clean state, and hand off safely. Companion tools: POST /v1/tools/swarm-admission ($0.01) before launch and POST /v1/tools/handoff-lint ($0.005) on each handoff.
beads-agent-mail-recipe-v1
Smallest paid pack ($0.005): a machine-readable merge checklist and a one-request smoke purchase on this store. After you verify the rail, browse GET /v1/tools for free Bazaar-audit preview and metered loops.
demo-extras-v1
Compact handoff standard so the next agent keeps constraints, verification evidence, ownership, and next steps. For live scoring of any handoff text, use POST /v1/tools/handoff-lint ($0.005 per call).
demo-notes-v1
A five-minute drill for standing up an x402 seller: catalog → 402 → pay → body → replay → ledger, each step with a check. Run the free x402-bazaar-audit preview alongside it so agents can actually discover you on Bazaar.
dod-drill-v1
Practical RTK workflow for coding agents: when to compress command output, keep exit codes, and avoid log floods that burn the context window. Score a command first with POST /v1/tools/rtk-command-score ($0.005) — does not execute the command.
rtk-output-discipline-v1
Live {url} scan loop for Quietstore's site-hygiene-score tool: pay $0.02, we fetch the public origin, return a 0–100 score plus do_this_first fixes, min_score CI gate, and delta vs last scan. Snapshot preview stays free. SSRF-hardened; stored replay (no second fetch).
site-hygiene-score-v1
A production playbook for charging AI agents over HTTP 402 without double-billing: safe retries, ambiguous-settle handling, cache rules, ledger idempotency, and buyer recovery messages — the exact patterns behind this store, live on Base USDC. Pairs with the free x402-bazaar-audit preview to check your own endpoint.
x402-retry-safe-seller-v1
Machine entry: /v1/catalog (pitch, start_here), /v1/tools, /llms.txt, /openapi.json, /mcp. Free Bazaar check: POST /v1/tools/x402-bazaar-audit/preview.
If a paid request fails mid-flight, retry with the SAME X-PAYMENT header: an already-settled payment is re-served without a second charge. Signing a NEW payment authorization is a NEW purchase. Metered tools: same payment + same JSON body re-serves; a new body needs a new payment.
curl -sS https://<store-host>/v1/catalogcurl -sS -X POST https://<store-host>/v1/tools/x402-bazaar-audit/preview \
-H 'content-type: application/json' \
-d @payment-required.jsoncurl -i -X POST https://<store-host>/v1/tools/claim-check \
-H 'content-type: application/json' \
-d '{"url":"https://your.site","min_score":80}'curl -i https://<store-host>/v1/packs/demo-notes-v1content_sha256 is SHA-256 over the UTF-8 bytes of the returned body. Check byte_len first, then compare the digest with both the paid response and catalog:
jq -j '.body' response.json | shasum -a 256jq -j is intentional; -r adds a newline and changes the hash.
Purchased content is licensed for the buyer's own use (human or agent); no resale or redistribution.