x402 resource directory

Find paid HTTP operations and MCP tools by URL, host, method or tool name. Compare payment terms across networks and catalogs.

Distinct HTTP URLs
162,919
Distinct MCP URLs
43
Catalog observations
263,972
URLs with a 402 in 7 days
1,681
Network identifiers
182

These results as JSON

GET https://2s.io/api/quakes/recent · 1 observation
Recent earthquakes near a coordinate. Returns each quake with magnitude, place name, time (ISO), latitude/longitude/depth, tsunami flag, USGS event URL, and distance-from-query in km — sorted by time descending. Real-time data, post-LLM-training-cutoff. Backed by USGS FDSN event API (public domain). Query: lat (-90..90), lon (-180..180), radius_km (1-1000, default 500), hours (1-720, default 24), min_magnitude (0-10, default 2.0).

2s profile

  • Base · exact
    $0.0010 (USDC)
    agentic.market · seen
GET https://2s.io/api/recreation/search · 1 observation
Search the Recreation Information Database (RIDB) — the single source of truth for federal recreation lands and programs across NPS, USFS, BLM, USACE, BOR, FWS, NARA. Pick a resource: recareas (designated recreation areas), facilities (individual sites — campgrounds, day-use, visitor centers), campsites (individual reservable campsites with attributes), permits (special-use permits, lotteries), tours, events, activities (taxonomy lookup). Filter by free-text query, state, activity ID, or lat/lon

2s profile

  • Base · exact
    $0.0012 (USDC)
    agentic.market · seen
GET https://2s.io/api/registry/npm-lookup · 1 observation
Look up an npm package by name (supports scoped packages like @sentry/node). Returns description, homepage, repository, license, author + maintainers list, keywords, distTags (latest/beta/rc/etc.), latest version + publication date, and the 50 most recent versions with their publish dates + deprecation status. ~3M JavaScript/TypeScript packages. npm public registry.

2s profile

  • Base · exact
    $0.0012 (USDC)
    agentic.market · seen
GET https://2s.io/api/registry/pypi-lookup · 1 observation
Look up a Python package on PyPI by name. Returns version, summary + long description, content-type, project URLs (Homepage, Source, Bug Tracker, Docs, etc.), license, author + maintainer (with emails), keywords, classifiers (top 30), requires-python spec, requires-dist (top 100 runtime deps), the 50 most recent releases with publish dates, and any yanked versions in that window. PyPI public registry.

2s profile

  • Base · exact
    $0.0012 (USDC)
    agentic.market · seen
GET https://2s.io/api/research/author · 1 observation
Resolve a researcher by ORCID iD. Pass orcid (e.g. 0000-0002-1825-0097, with or without the https://orcid.org/ prefix). Returns the researcher name, affiliations (employments and educations with organization, role, department, years, and a current flag), a total works count, and a works summary (title, type, year, DOI when present). Data: ORCID Public API, free and keyless; per-record visibility is set by the record holder. The canonical author key in scholarly metadata — pair with /api/papers/s

2s profile

  • Base · exact
    $0.0030 (USDC)
    agentic.market · seen
GET https://2s.io/api/research/funding · 1 observation
Search US federal biomedical research grants via NIH RePORTER. Filter by term (free-text over project title, terms, and abstract), org (funded institution name), pi (principal-investigator name), and/or fiscalYear; page with limit (1-50) and offset. Returns each award with project number, title, fiscal year, award amount (USD), contact PI, organization (name, city, state, country, department), funding agency/institute, and project start/end dates — newest fiscal year first, with a total match co

2s profile

  • Base · exact
    $0.0018 (USDC)
    agentic.market · seen
GET https://2s.io/api/research/org · 1 observation
Resolve a research organization via the Research Organization Registry (ROR). Pass id (a ROR id like 056y0v115 or its full URL) to fetch one org, or name to search by free text. Returns the canonical ROR id and name, organization type, status, founding year, location (city, country, GeoNames coordinates), website, Wikipedia link, external identifiers (GRID, ISNI, Wikidata, Crossref Funder), parent/child relationships, and aliases/acronyms. Data: ROR, free and CC0. The canonical institution key i

2s profile

  • Base · exact
    $0.0012 (USDC)
    agentic.market · seen
GET https://2s.io/api/search/ai · 5 observations
Search AI-related results through a paid API endpoint.

2s profile

  • Solana · exact
    $0.0450 (USDC)
    Recipient TW6ntaGzvj63ZgPjszd4FCGmVTGfzv1MAYZbjYcyWhn
    Dexter · seen
  • Base · exact
    $0.0450 (USDC)
    Recipient 0x2b6D4988Db4723E6908Db86Ab2b8dFBc51FC32C5
    Dexter · seen
  • Solana · exact
    $0.0450 (USDC)
    Recipient TW6ntaGzvj63ZgPjszd4FCGmVTGfzv1MAYZbjYcyWhn
    Coinbase CDP · seen
    Coinbase CDP reports 35 calls and 3 unique payers in 30 days. Last call .
  • Base · exact
    $0.0450 (USDC)
    Recipient 0x2b6D4988Db4723E6908Db86Ab2b8dFBc51FC32C5
    Coinbase CDP · seen
  • Base · exact
    $0.0450 (USDC)
    agentic.market · seen
GET https://2s.io/api/search/endpoints · 3 observations
Find the right 2s endpoint for a task using natural language. Pass q (e.g. 'check if a domain can be spoofed', 'is this CVE being exploited', 'screen a company for sanctions', 'decode a VIN') and get back the catalog's most relevant endpoints, ranked, each with its id, API path, method, group, description, and price. Deterministic keyword + synonym matching over the live endpoint registry (no LLM, no external calls) — a self-routing index so an agent (or its planner) can discover which paid call

2s profile

  • Solana · exact
    $0.0025 (USDC)
    Recipient TW6ntaGzvj63ZgPjszd4FCGmVTGfzv1MAYZbjYcyWhn
    Coinbase CDP · seen
    Coinbase CDP reports 1 calls and 1 unique payers in 30 days. Last call .
  • Base · exact
    $0.0025 (USDC)
    Recipient 0x2b6D4988Db4723E6908Db86Ab2b8dFBc51FC32C5
    Coinbase CDP · seen
  • Base · exact
    $0.0025 (USDC)
    agentic.market · seen
GET https://2s.io/api/search/web · 1 observation
Live web search. Returns ranked results with title, URL, snippet description, site name, and page age — fresh information past any model training cutoff. Supports count (1-20), offset for paging, country (2-letter, e.g. US), freshness (pd=past day, pw=past week, pm=past month, py=past year, or a YYYY-MM-DDtoYYYY-MM-DD range), and safesearch (off/moderate/strict). Use for current events, fact verification, finding documentation, and research. Independent search index. For news-specific results wi

2s profile

  • Base · exact
    $0.0225 (USDC)
    agentic.market · seen
GET https://2s.io/api/security/attack · 5 observations
Returns security attack data and indicators for threat analysis.

2s profile

  • Solana · exact
    $0.0025 (USDC)
    Recipient TW6ntaGzvj63ZgPjszd4FCGmVTGfzv1MAYZbjYcyWhn
    Dexter · seen
  • Base · exact
    $0.0025 (USDC)
    Recipient 0x2b6D4988Db4723E6908Db86Ab2b8dFBc51FC32C5
    Dexter · seen
  • Solana · exact
    $0.0025 (USDC)
    Recipient TW6ntaGzvj63ZgPjszd4FCGmVTGfzv1MAYZbjYcyWhn
    Coinbase CDP · seen
    Coinbase CDP reports 2 calls and 2 unique payers in 30 days. Last call .
  • Base · exact
    $0.0025 (USDC)
    Recipient 0x2b6D4988Db4723E6908Db86Ab2b8dFBc51FC32C5
    Coinbase CDP · seen
  • Base · exact
    $0.0025 (USDC)
    agentic.market · seen
GET https://2s.io/api/security/capec · 1 observation
Authoritative MITRE CAPEC (Common Attack Pattern Enumeration) lookup. Pass id (e.g. CAPEC-66, or just 66) for the canonical attack pattern — name, abstraction, description, typical likelihood + severity, mapped CWE weaknesses (with names), and related patterns (with names) — or query for a keyword search. Bundled catalog (~615 patterns), zero external calls. The attacker's-eye complement to security.cwe (the defender's weakness view) — the CAPEC↔CWE cross-links let an agent pivot between how an

2s profile

  • Base · exact
    $0.0010 (USDC)
    agentic.market · seen
GET https://2s.io/api/security/cve · 3 observations
Retrieves security vulnerability details for a given CVE identifier.

2s profile

  • Solana · exact
    $0.0018 (USDC)
    Recipient TW6ntaGzvj63ZgPjszd4FCGmVTGfzv1MAYZbjYcyWhn
    Dexter · seen
  • Base · exact
    $0.0018 (USDC)
    Recipient 0x2b6D4988Db4723E6908Db86Ab2b8dFBc51FC32C5
    Dexter · seen
  • Base · exact
    $0.0018 (USDC)
    agentic.market · seen
GET https://2s.io/api/security/cve-changes · 1 observation
CVE change feed — the CVE records MODIFIED within a time window, so an agent can incrementally maintain a vulnerability view instead of re-scanning. Pass since (YYYY-MM-DD or ISO datetime); until defaults to now (window must be ≤ 120 days, the NVD limit). Optionally narrow by keyword (product/text) or cpe (exact CPE). Returns each changed CVE with its id, published + lastModified timestamps, current vulnStatus (e.g. Modified, Analyzed, Rejected), best-available CVSS score/severity, description,

2s profile

  • Base · exact
    $0.0022 (USDC)
    agentic.market · seen
GET https://2s.io/api/security/cve-search · 1 observation
Find vulnerabilities affecting a product by searching the NIST National Vulnerability Database. Pass product (free-text keyword, e.g. "apache log4j", "openssl", "wordpress plugin contact-form-7") or cpe (an exact CPE 2.3 name, e.g. cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*). Returns matching CVEs newest-first, each with its id, description, CVSS base score/severity/vector, and dates. Optional limit (1–50). For "what CVEs affect X" / surveying a product's vulnerability history — distinct from s

2s profile

  • Base · exact
    $0.0022 (USDC)
    agentic.market · seen
GET https://2s.io/api/security/cwe · 1 observation
Authoritative MITRE CWE (Common Weakness Enumeration) lookup. Pass id (e.g. CWE-79, or just 79) for the canonical weakness — name, abstraction, description, extended description, ChildOf/ParentOf relationships (with names), and mapped CAPEC attack patterns (with names) — or query for a keyword search returning ranked matches. Bundled catalog (~970 weaknesses), zero external calls. Agents hallucinate CWE IDs and names constantly; this returns exact, citeable, version-pinned data. Pairs with secur

2s profile

  • Base · exact
    $0.0010 (USDC)
    agentic.market · seen
GET https://2s.io/api/security/exploit-availability · 1 observation
Does public exploit code exist for a CVE, and where? Pass cve (e.g. CVE-2021-44228). Returns hasPublicExploit, the count, hasMetasploitModule and hasVerifiedExploit flags, and the Exploit-DB entries (id, description, type, platform, date, verified, Metasploit flag, link). Bundled inverted index from the Exploit-DB archive (~25k CVEs). This is the triage signal BEYOND security.cve's KEV (exploited in the wild) + EPSS (exploit probability): is the vulnerability actually weaponized with available c

2s profile

  • Base · exact
    $0.0010 (USDC)
    agentic.market · seen
GET https://2s.io/api/security/http-headers · 1 observation
Fetch a URL and grade its HTTP security headers. Pass url (scheme optional — defaults to https). Returns an overall letter grade + score, the list of present/missing headers, and a per-header analysis with the live value and specific issues for: Strict-Transport-Security (HSTS max-age/includeSubDomains), Content-Security-Policy (flags 'unsafe-inline'/'unsafe-eval'/missing default-src), X-Frame-Options or CSP frame-ancestors (clickjacking), X-Content-Type-Options (nosniff), Referrer-Policy, Permi

2s profile

  • Base · exact
    $0.0045 (USDC)
    agentic.market · seen
GET https://2s.io/api/security/ics-advisories · 1 observation
CISA Industrial Control Systems (ICS) advisories — vulnerabilities in operational-technology gear (SCADA, PLCs, building automation, energy/manufacturing/transportation systems, and medical devices), from the official CISA advisory RSS feed. Each item is normalized to the canonical advisory id (ICSA-YY-DDD-NN, or ICSMA-YY-DDD-NN for medical), title, link to the full advisory, publication date (ISO), and a plain-text summary. Optionally filter by keyword (e.g. a vendor like "Siemens") and cap the

2s profile

  • Base · exact
    $0.0048 (USDC)
    agentic.market · seen
GET https://2s.io/api/security/ioc-reputation · 1 observation
Threat-intelligence reputation for an indicator of compromise (IOC) — pass ioc as an IP, domain, URL, or file hash (md5/sha1/sha256) and the type is auto-detected. Returns a malicious boolean plus a per-source breakdown: abuse.ch ThreatFox (IOC→malware/threat mapping), URLhaus (malicious URLs on a host/URL), MalwareBazaar (known malware samples by hash), Feodo Tracker (active botnet C2 IPs), Tor exit-node membership, and Spamhaus DROP (hijacked/criminal netblocks). Each source reports listed + a

2s profile

  • Base · exact
    $0.0022 (USDC)
    agentic.market · seen
GET https://2s.io/api/security/ip-abuse · 3 observations
Checks whether an IP address is flagged for abusive or malicious activity.

2s profile

  • Solana · exact
    $0.0022 (USDC)
    Recipient TW6ntaGzvj63ZgPjszd4FCGmVTGfzv1MAYZbjYcyWhn
    Dexter · seen
  • Base · exact
    $0.0022 (USDC)
    Recipient 0x2b6D4988Db4723E6908Db86Ab2b8dFBc51FC32C5
    Dexter · seen
  • Base · exact
    $0.0022 (USDC)
    agentic.market · seen
GET https://2s.io/api/security/ip-blacklist · 1 observation
AbuseIPDB bulk blacklist — the most-reported abusive IPs above a confidence threshold, the canonical fail2ban / firewall block-feed. Returns ipAddress, countryCode, abuseConfidenceScore, and lastReportedAt for each entry, plus the list's generatedAt timestamp. Tune confidenceMinimum (25-100, default 90), limit (1-10000, default 100), ipVersion (4 or 6), and onlyCountries / exceptCountries (comma-separated ISO-2). Live crowd-sourced threat feed for populating drop lists, WAF rules, and edge block

2s profile

  • Base · exact
    $0.0024 (USDC)
    agentic.market · seen
GET https://2s.io/api/security/ip-block · 1 observation
AbuseIPDB subnet (CIDR) check — which IPs inside a network block have been reported for abuse. Pass network as a CIDR (e.g. 118.25.0.0/24; AbuseIPDB supports up to /16 for IPv4, /112 for IPv6). Returns the block metadata (network/netmask/min-max addresses, possible hosts, address-space description) plus reportedAddress: each flagged IP with numReports, abuseConfidenceScore, mostRecentReport, and country. Optional maxAgeInDays (1-365, default 30) and limit. Use to vet a hosting range, score a cus

2s profile

  • Base · exact
    $0.0024 (USDC)
    agentic.market · seen
GET https://2s.io/api/security/ip-reputation · 3 observations
Multi-source IP reputation with one combined authority score (0-100). Polls four independent reputation sources in parallel and blends them: AbuseIPDB (crowd-sourced abuse confidence), abuse.ch threat-lists (Feodo botnet C2 + ThreatFox + Spamhaus DROP + Tor exit nodes), blocklist.de (fail2ban attack-report network), and StopForumSpam. Returns combinedScore, a verdict (clean / low / suspicious / malicious), which sources flagged it, per-source opinions (score + weight + detail), and enrichment (I

2s profile

  • Solana · exact
    $0.0090 (USDC)
    Recipient TW6ntaGzvj63ZgPjszd4FCGmVTGfzv1MAYZbjYcyWhn
    Coinbase CDP · seen
    Coinbase CDP reports 1 calls and 1 unique payers in 30 days. Last call .
  • Base · exact
    $0.0090 (USDC)
    Recipient 0x2b6D4988Db4723E6908Db86Ab2b8dFBc51FC32C5
    Coinbase CDP · seen
  • Base · exact
    $0.0090 (USDC)
    agentic.market · seen

Counts describe directory coverage, including testnets. Each resource groups the same URL, HTTP method or MCP tool across sources. A catalog sighting records published terms. A live 402 records the endpoint’s reply to an unpaid request.