Field notes · 2026-08-24

Can agents find you, trust you, and pay you? Scan it. It's free.

A radar screen sweeping over a dark grid of website icons, some lighting up blue as the beam passes over them

One character over an undocumented 500-character limit makes an x402 listing silently unpurchasable. A manifest served at .jsonbut not the extensionless path kills some crawlers mid-parse. Four missing boolean hints cap your trust grade in directories you never submitted to. We didn't read any of that in a spec — we hit every one of them operating 19 paid MCP servers in production. This week we taught all of it to our scanners. They're free, and they don't ask for a signup.

Who is ForgeMesh, and why do we have scanners?

We're operators, not a tools startup. We run a fleet of paid x402 and MPP services on Base — government transparency data, crypto signals, TTS, travel, anomaly detection, image generation, and a dozen more — with 800+ indexed resources that real agents pay real USDC to use. Every scanner we publish started as an internal check we needed after something broke with money on the line. When a directory graded our servers before we'd ever heard of it, we built the checks that would have passed. When 43% of the x402 catalog vanished overnight, our crawler snapshots were how anyone found out. The scanners are those instruments, pointed outward.

The free instruments

Endpoint Scanner — can agents actually pay you?

Paste any URL at forgemesh.io/scan. A no-spend x402 v2 audit: nine weighted checks (402 status, payment-required header, base64 challenge, CAIP-2 networks, complete payment fields…) with a letter grade. It never signs a payment, so it can never spend anything — yours or ours.

aso-audit-mcp — the full agent-readiness sweep (open source)

30+ checks across six categories: discoverability (robots.txt, llms.txt, DNS-AID), content accessibility, AI-bot access rules, API/auth/MCP surfaces (server cards, A2A agent cards, OAuth discovery), commerce (x402, MPP, UCP, ACP), and identity & trust. MIT-licensed, runs from npm, works in Claude Code, Cursor, or any MCP client.

agent-readiness-mcp + aso-score-mcp — the score, portable

The same framework as a single 0-100 Agent Signal Optimization score, as an MCP server your own agent can call. The framework definition and scoring model are public.

The seller pre-flight checklist

A free, no-code 16-point checklist for anyone about to ship a paid endpoint — the questions we wish someone had asked us before our first zero-sale weekend.

What the scanners just learned (v0.4.0)

This week's update folds our three newest field findings into the free audit — things no spec documents and no other scanner checks:

The 500-character cliff

We measured the Bazaar indexer dropping any listing whose description exceeds exactly 500 characters — no error, no warning, the resource just becomes unpurchasable through discovery. The audit now counts your descriptions and flags every one over the line.

The extensionless manifest rule

Most ecosystem crawlers request /.well-known/x402 without the .json extension first — a survey in the x402 DNS-discovery spec thread found extensionless outnumbering .json 11-to-1, and at least one major indexer aborts mid-crawl on an HTML 404 there. Serving only the .json variant now scores partial, with the fix spelled out.

Empty descriptions are invisible descriptions

Discovery indexes rank listings on how closely descriptions match agent task language. A missing description isn’t neutral — it’s invisible. The audit now warns when your accepts[] carries none.

30+

agent-readiness checks in the free open-source audit

to scan — no signup, no wallet, no spend. The x402 audit is cryptographically unable to pay.

production MCP servers we run every check against first — we are our own test fleet

Two tests, two questions — run the right one

They answer different questions, so don't stop at one. The payment test is for anyone selling a paid API: paste your x402 endpoint at forgemesh.io/scan and get the A–F grade on whether an agent's money can actually reach you. The readiness test is for any website, paid endpoint or not: the ASO sweep checks whether agents can find, crawl, trust, and cite you at all. Take the free self-assessment in the browser, or run the automated scanner from any MCP client — claude mcp add aso -- npx -y @forgemeshlabs/aso-audit-mcp — then ask your agent to scan any domain. Your own site. Your competitors. The API you're about to build on. What it finds is yours.

When the scan finds problems

The scan tells you what's broken for free. The Complete Bundle is the fix manual: the Server Starter Kit plus the Distribution Playbook — every gotcha above with its repair, the directory-by-directory listing chain, and living updates as we hit the next one. And if you'd rather have it handled than documented, email [email protected] — done-for-you agent-readiness is what we do all day for our own fleet.

Run the free scan Get the Complete Bundle — $99