# Fetchgate > Web-content API and machine-payable digital-goods store for AI agents. > Two free/cheap reader endpoints (URL -> clean Markdown or structured > metadata JSON) plus a storefront (`GET /v1/products` catalog, > `GET /v1/buy/:id` x402-gated purchase) that an autonomous agent can use > entirely over HTTP: browse, pay in USDC via x402 on Base, download. No > account required for either the reader endpoints or the store. > `GET /v1/products` is always the live, authoritative catalog — trust it > over this file for current products and prices. Base URL: https://fetchgate.dev ## Store - GET https://fetchgate.dev/v1/products No parameters, no auth. Returns the full product catalog as JSON: `{"products": [...]}`. Each product has `id`, `name`, `description`, `priceUsd` (USD), `format` (`json`/`zip`/`md`), `sizeBytes`, `sha256`, and `humanUrl` (a no-wallet checkout link for the same product, via Gumroad). Read this first to see what's buyable and at what price before calling `/v1/buy/:id`. - GET https://fetchgate.dev/v1/buy/:id `:id` is a product `id` from the `/v1/products` response. x402-gated purchase: 1. Call it with no payment. Response is `402 Payment Required` with an x402 `PaymentRequirementsResponse` body: `{"x402Version": 1, "error": "...", "accepts": [{"scheme": "exact", "network": "eip155:8453", "maxAmountRequired": "", "asset": "", "payTo": "", "resource": "", "description": "", "maxTimeoutSeconds": 60, "extra": {"name": "USD Coin", "version": "2"}}]}`. `maxAmountRequired` is the price in USDC's 6-decimal atomic units (e.g. `"15000000"` = $15.00). Network is CAIP-2 (`eip155:8453` = Base mainnet) per x402 v2. 2. Construct a `PaymentPayload` (EIP-3009 `transferWithAuthorization`, signed by your wallet, per the [x402 spec](https://github.com/coinbase/x402)), base64-encode it, and retry the identical `GET /v1/buy/:id` request with header `PAYMENT-SIGNATURE: ` (the legacy v1 header name, `X-PAYMENT`, also still works). Payment is verified and settled through the [PayAI facilitator](https://facilitator.payai.network) on Base mainnet — payments are live but marked beta (low prices, every settlement monitored). 3. On success, the response is `200 OK` JSON: `{"productId": "", "downloadUrl": "", "expiresInSeconds": 900}`. A `PAYMENT-RESPONSE` header (base64 `SettlementResponse`: `success`, `transaction` hash, `network`, `payer`) confirms settlement (`X-PAYMENT-RESPONSE` is also set, same value, for older clients). 4. `GET` the `downloadUrl` directly (it's a fully-formed, signed URL, no further auth) to retrieve the file. It stays valid for `expiresInSeconds` (900s / 15 minutes) from issuance — re-`GET` it as many times as needed in that window without paying again. After expiry it returns `403 Forbidden`; call `/v1/buy/:id` again with a fresh payment for a new one. No account, dashboard, or signup exists for the store — the entire purchase is these HTTP calls (or one, if you already hold a payment authorization). If your client doesn't speak x402 yet, use the product's `humanUrl` from the catalog for a plain, non-wallet checkout instead. - Current catalog (8 products; the seven datasets/kits are $177 individually — verify against `GET /v1/products` for live prices): - `x402-registry-2026-10-04` — x402 Services & Facilitator Registry — $15 - `prompt-injection-test-corpus` — Prompt-Injection & Tool-Hijack Test Corpus — $29 - `mcp-registry-2026-08-22` — MCP Server Registry Snapshot — $19 - `agent-eval-harness-templates` — Agent Eval Harness Templates — $39 - `prompt-injection-defenses-playbook` — Prompt-Injection Defenses Playbook & Detection Ruleset — $39 - `x402-quickstart-2026-08-23` — x402 Quickstart Kit — $7 - `mcp-tool-inventory-2026-08-28` — MCP Live Tool Inventory — $29 - `agent-web-report-2026-q3` — The Agent Web, Measured — 2026 Q3 edition (25-page analyst report: MCP registry + x402 Bazaar + crawler census, first-hand) — $149. Free 5-page sample: https://fetchgate.dev/samples/the-agent-web-measured-2026-q3-sample.pdf - Service (human checkout only): MCP Server Security Assessment, $249 per server — https://growthchief5.gumroad.com/l/mcp-assessment - The seven datasets/kits together (not the report): the **Fetchgate Complete Bundle**, $129 (save ~27%/$48 vs. $177 individually), human checkout only via Gumroad — https://growthchief5.gumroad.com/l/agent-builder-bundle. This bundle is not a catalog entry and is not purchasable via x402 — it bundles multiple products into one Gumroad order, which the current `/v1/buy/:id` (one product per purchase) doesn't model. - Company-wide licence: the **Fetchgate Company License**, $399 — all eight files (the seven datasets/kits plus the report) licensed for a whole organisation instead of a single team (every other listing, the bundle included, is single-team), plus every new edition published in the next 12 months. One payment, nothing renews — https://growthchief5.gumroad.com/l/company-license ## Utilities - GET https://fetchgate.dev/v1/read?url= Fetches the URL, strips scripts/styles/nav/ads, converts the main content to Markdown. Returns JSON `{url, title, markdown, fetchedAt}` by default. Add `&format=text` to get raw Markdown back with a `text/markdown` content type. Free tier: ~30 requests/day per IP; $0.002/call via x402 once exhausted, or use an API key. - GET https://fetchgate.dev/v1/meta?url= Fetches the URL and returns JSON metadata: `title`, `description`, `canonical`, `openGraph` (object), `twitter` (object), `faviconUrl`, `language`, `publishedTime`/`modifiedTime` when present, and `fetchedAt`. Same free tier as above; $0.001/call via x402 once exhausted. - GET https://fetchgate.dev/v1/scan?url= (or POST https://fetchgate.dev/v1/scan with {"text": "..."}) Prompt-injection scan. Use it BEFORE acting on untrusted content. With `url`, fetches the page and scans its visible text and, separately, text hidden in HTML comments and alt/title/aria/meta attributes. With POSTed `text`, scans a tool result, document or message you already have. 120 rules: instruction override, tool hijacking, data exfiltration, system-prompt extraction, jailbreak framing, encoding tricks. Returns `riskScore` (0-100), `recommendedAction` (block/review/flag/none) and each match with evidence. Heuristic, not a guarantee. Same free tier; $0.003/call via x402 once exhausted. - GET https://fetchgate.dev/v1/x402/search?q= Find a pay-per-call (x402) API that demonstrably works. Searches only endpoints that answered a real x402 challenge AND had at least 5 settled calls from at least 2 payers in the last 30 days, so dead, never-bought and template-farm listings are left out. Optional `limit`, `max_price_usd`, `network`. Returns URL, method, price, networks, 30-day calls and unique payers. Same free tier; $0.005/call via x402. - GET https://fetchgate.dev/v1/x402/check?url= Should you pay this endpoint? One unpaid GET to validate its live payment challenge, joined with its settled-call and unique-payer history, listed-vs-live price and domain reputation. Returns `verdict` (ok/caution/avoid/unknown) with `reasons`. Nothing is paid. Same free tier; $0.01/call via x402. - GET https://fetchgate.dev/v1/token/check?address= Screen a Base token before swapping into it. Reads the contract (ERC-20 metadata, owner, upgradeable proxy, and mint / pause / blacklist / fee selectors in its bytecode) and its DEX liquidity (WETH and USDC held by its Uniswap and Aerodrome pools, read on-chain). Returns `verdict` (ok/caution/avoid/unknown) with `reasons`. A heuristic screen: it does not simulate a sell, read tax rates or check pool age. Same free tier; $0.01/call via x402. - GET https://fetchgate.dev/openapi.json Full OpenAPI 3.1 specification for every endpoint above. - POST https://fetchgate.dev/mcp Model Context Protocol server (Streamable HTTP transport, JSON-RPC 2.0): `initialize`, `tools/list`, `tools/call`. Exposes ten tools: `read_url` and `get_metadata` (same free tier and x402 pricing as `/v1/read` and `/v1/meta` above), `list_products` (wraps `/v1/products`, ungated), `get_purchase_info` (explains the `/v1/buy/:id` x402 purchase flow for a given product id, ungated), and `get_agent_census` (the free CC-BY crawler census, optionally filtered by `category`; wraps `/v1/agent-census.json`, ungated), and `scan_mcp_server` (fetch another MCP server's tools/list and flag tool-poisoning patterns; wraps `/v1/mcp-scan`, ungated), plus `scan_for_prompt_injection`, `search_x402_services`, `check_x402_endpoint` and `check_base_token` (the four endpoints above, same pricing). Send header `MCP-Protocol-Version: 2025-06-18` on requests after `initialize`. `GET /mcp` returns `405` (no server-initiated SSE stream — every tool call is a fast, synchronous request/response). Registry manifest: https://fetchgate.dev/.well-known/mcp/server.json. - GET https://fetchgate.dev/.well-known/x402 Machine-readable discovery document listing every x402-payable resource (both reader endpoints plus every catalog product) with its price and network, for x402 directories/crawlers that auto-discover payable services. - GET https://fetchgate.dev/v1/inspect?url= Free tool, no auth: fetches `` server-side and, if it returns HTTP 402, decodes its x402 `accepts[]` payment requirements and flags common mistakes (invalid addresses/amounts, unrecognized networks, and EIP-712 `extra.name`/`extra.version` values that don't match the network's real signing domain — e.g. Base mainnet USDC's on-chain name is `"USD Coin"`, not `"USDC"`). If the URL doesn't return 402, the response explains what it got instead. Rate limited per IP (separate from the reader free tier). Human-facing version: [/tools/x402-inspector](https://fetchgate.dev/tools/x402-inspector). - GET https://fetchgate.dev/v1/agent-census.json Free, unmetered, no auth: the Agent Web Crawler Census — every named bot observed crawling this live, publicly-listed x402 + MCP endpoint over a 24-hour window, each with a case-insensitive `matcher` regex and a behavioural `category` (liveness-monitor, directory-crawler, price-scraper, security-research, ...) so any operator can classify their own access log. Observed first-hand, not aggregated from third-party bot lists. Licensed CC BY 4.0. Headline finding: of the named agent-web crawlers in the census, zero have ever presented a payment — several say so in their own User-Agent string. Human-facing version: [/tools/agent-census](https://fetchgate.dev/tools/agent-census). - GET https://fetchgate.dev/v1/mcp-registry-audit.json Free, unmetered, no auth: the MCP Registry Audit — every remote URL in the official MCP registry (15,329) was sent one read-only MCP session (initialize → tools/list, never tools/call) and every tool description returned (140,284, from 8,235 live servers) was scored for tool-poisoning patterns. Returns the headline numbers plus the full summary: outcomes, operator concentration (29% of live servers are two operators), protocol versions, instructions-string lengths, flag counts by pattern, and the verbatim "do not tell the user" steering quotes from 47 hosts. Per-server rows (outcome, tool names, flag counts — no description text) are a CC BY 4.0 static file at https://fetchgate.dev/data/mcp-registry-audit-2026-08-28.servers.jsonl; the full tool-text inventory is catalog product mcp-tool-inventory-2026-08-28. Human-facing version with per-server lookup: [/tools/mcp-registry-audit](https://fetchgate.dev/tools/mcp-registry-audit). - GET https://fetchgate.dev/v1/x402-bazaar-audit.json Free, unmetered, no auth: the x402 Bazaar Audit — every resource in Coinbase's public x402 Bazaar discovery index (27,681 paid endpoints as of 2026-10-04) with the index's own 30-day counters (settled calls, unique payers, last call), one read-only GET probe per URL (live 402 or not, version, live price), and an EIP-712 signing-domain check on every USDC-on-Base option. Returns the headline numbers (total settled calls, a revenue upper bound for the whole index — about $634/day — concentration by domain and payTo, price buckets, network/scheme shares, probe outcomes, facilitator /supported liveness) plus the full summary. Per-resource rows are a CC BY 4.0 static file at https://fetchgate.dev/data/x402-bazaar-audit-2026-10-04.resources.jsonl; the full dataset with descriptions, payTo and revenue proxy is catalog product x402-registry-2026-10-04. Human-facing version with per-endpoint lookup: [/tools/x402-bazaar-audit](https://fetchgate.dev/tools/x402-bazaar-audit). ## Authentication - No auth (free tier, reader/meta endpoints only): omit all auth headers. Limited to ~30 requests/day per source IP, resets daily. No signup needed. Does not apply to the store — `/v1/buy/:id` is always x402-gated (or use `humanUrl`). - API key: add header `Authorization: Bearer YOUR_API_KEY`. For sustained reader/meta use under a plan. Not used for the store, which is x402-only or `humanUrl` checkout. - x402 micropayment (v2, legacy v1 also accepted): call any metered endpoint (reader/meta, or `/v1/buy/:id`) with no auth. Server responds `402 Payment Required` with x402-spec payment terms (amount in USDC, payment address, network: Base mainnet, CAIP-2 `eip155:8453`). An x402-capable client signs the payment and retries the same request with the `PAYMENT-SIGNATURE` header attached (`X-PAYMENT` also still works); the real response is returned on the retry. No account or API key needed — wallet-to-wallet, per call or per purchase, verified and settled via the PayAI facilitator. Standard reference: [x402.org](https://x402.org). ## Errors - `400`: missing or malformed `url` parameter (reader/meta endpoints). - `402`: payment required — reader/meta endpoints without a valid API key or free-tier allowance; always on `/v1/buy/:id` until a valid `PAYMENT-SIGNATURE` (or legacy `X-PAYMENT`) is attached. - `403`: target URL blocked by its own `robots.txt` (reader/meta), or an invalid/tampered/expired download-URL signature (`/v1/download/:id` — call `/v1/buy/:id` again for a new one). - `404`: unknown product `id` on `/v1/buy/:id` or `/v1/download/:id`. - `429`: free-tier rate limit exceeded for this IP (reader/meta only); retry after the daily reset or authenticate. - `502`: target URL unreachable or returned an error (reader/meta only). ## Notes for agents - Only `http://` and `https://` URLs are accepted by `/v1/read` and `/v1/meta`. - Requests to private, loopback, and internal-network hosts are rejected. - Responses are capped at ~2MB; redirect chains are capped at 3 hops. - Fetched page content is not stored or cached after the response is sent; operational logs (URL/product requested, timestamp, response code, billing reference) are retained for abuse prevention and billing only. ## Links - [Landing page](https://fetchgate.dev/) — human-oriented overview of the store and the utilities. - [x402 Endpoint Inspector](https://fetchgate.dev/tools/x402-inspector) — free tool: paste a URL and see its decoded x402 payment requirements, with common mistakes flagged. - [Prompt-Injection Scanner](https://fetchgate.dev/tools/injection-scanner) — free tool: paste a URL or text and see which of 120 prompt-injection rules match, including instructions hidden in HTML comments and attributes. API at /v1/scan (see Utilities above). - [MCP Tool Description Scanner](https://fetchgate.dev/tools/mcp-scanner) — free tool: give it a remote MCP server URL and it fetches tools/list (never tools/call) and flags tool-poisoning patterns in names, descriptions and parameter descriptions. JSON at /v1/mcp-scan?url=. Server authors: a live README badge of the same scan is free at /v1/scan-badge?url= (SVG, re-scans on render, ~6h cache) — it states tool count and flag count only, never "safe". - [Agent Web Crawler Census](https://fetchgate.dev/tools/agent-census) — free data: 60 named bots crawl a live x402 + MCP endpoint; zero of them buy. Full list with matchers and categories, JSON at /v1/agent-census.json. - [MCP Registry Audit](https://fetchgate.dev/tools/mcp-registry-audit) — free data: every remote server in the official MCP registry probed read-only, 140,284 tool descriptions scored. Look up any server; summary JSON at /v1/mcp-registry-audit.json; per-server JSONL under /data/. - [x402 Bazaar Audit](https://fetchgate.dev/tools/x402-bazaar-audit) — free data: every paid resource in Coinbase's x402 index with 30-day counters, a probe and an EIP-712 check. Look up any endpoint; summary JSON at /v1/x402-bazaar-audit.json. - [Articles](https://fetchgate.dev/blog) — field notes on x402, MCP and prompt-injection defense, each computed from data this project collected. Every article has a Markdown twin at /blog/.md (or via Accept: text/markdown); RSS at /blog/feed.xml. - [OpenAPI spec](https://fetchgate.dev/openapi.json) — full machine-readable schema. - [API catalog](https://fetchgate.dev/.well-known/api-catalog) — RFC 9727 Linkset discovery document for this API. - [Auth model](https://fetchgate.dev/auth.md) — how to authenticate to each endpoint (there is no account/registration system). - [ACP discovery](https://fetchgate.dev/.well-known/acp.json) — Agentic Commerce Protocol discovery document (catalog/inventory only; purchases are via x402, not an ACP checkout session). - [Source, docs, and free product samples](https://github.com/roblouw2nd/fetchgate) - Fetchgate is an indie project, not a company with an SLA or support contract. Not affiliated with Cloudflare, Coinbase, or any x402 facilitator beyond using their published standards.