Who Reads an x402 Catalog — 48 Hours of Gateway Logs

If you run an x402 endpoint or a directory of them, the interesting question is not how many requests you got. It is who fetched what, and what they did with it. We have our own gateway's access log, so we counted.

This is 48 hours of one marketplace, not the market. The window is 2026-10-20T12:23Z through 2026-10-22T12:24Z, and it contains 176,609 request lines from the reverse-proxy access log. Every number below is a count of requests, not unique clients: one loop is one client and ten thousand requests. User agents are self-declared and can be spoofed — treat them as labels, not identity.

The audience is machines, and mostly not the ones you hope for

Twelve distinct automated catalog consumers announced themselves by name in that window. The volumes are lopsided:

Search and assistant crawlers are present too, an order of magnitude smaller: ChatGPT-User 107, bingbot 96, ClaudeBot 59, PerplexityBot 47, Googlebot 36, OAI-AdsBot 21, Claude-User 20, Perplexity-User 17, GPTBot 16, OAI-SearchBot 12, Claude-SearchBot 11.

Two things follow. First, the machine files are the product's front door, because that is what the collectors read before they touch an endpoint. Second, an AI assistant already has a page of yours in context when a user asks about agent payments; that page is not your landing page but whichever article ranked.

What the collectors actually fetch

The MCP endpoint dominates, and 1,084 of its responses were 202, which is the correct answer to a JSON-RPC notification rather than a request. The conditional requests matter as much as the 200s: 158 of the /.well-known/x402 fetches were answered 304 Not Modified, and 216 of the robots.txt fetches were too. A crawler that revalidates is a crawler you can keep telling the truth to, cheaply — provided your file carries a validator and you do not rewrite it on every request.

A 402 is not a sale

Here is the uncomfortable part. Across the paid surface — /x402/* and the /svc/* alias — the window contains 134,066 requests:

Of the 372 responses that carried a result, 345 came from our own monitoring address and 2 from loopback. Twenty-five came from somewhere else, from eight distinct IPs.

That is what an unpaid catalog looks like from the inside, and it is worth stating precisely because the usual x402 dashboard — "calls served" — will happily report 134,066 and mean almost nothing. A 402 is a cheap, correct, honest answer to a caller who did not pay. It is also not demand. The only number that separates the two is the one behind the 200s.

The biggest consumer never paid once

The busiest single user agent in the window, Agent402/1.0, made 37,465 requests across 438 distinct endpoints. 35,746 of the responses were 402s. 1,379 were 200s. 340 were 304s. It read /.well-known/x402 805 times and /openapi.json 803 times, and then walked the catalog.

That is a verifier, and a verifier is useful: it is the mechanism by which a directory can tell whether your listed endpoints still exist, still challenge correctly, and still describe themselves. But it is not a customer, and a marketplace that counts its requests as traction is measuring its own indexers.

If you are a seller: make the machine files correct and cheap to revalidate, because that is what decides whether you appear in somebody else's catalog at all. If you are reading someone else's traffic numbers: ask what fraction of their calls returned a 402.

The cost we impose on every MCP client

One measurement we did not enjoy: our tools/list response is 439,656 bytes for 1,711 tools — roughly 110,000 tokens at four bytes per token, before a client has called anything. The result object carries only tools: no nextCursor, no ttlMs, no cacheScope. Every client that wants to see the catalog pays the whole bill at once, and pays it again next session.

Two standard mitigations exist and neither is exotic. Cursor pagination lets a client ask for a page. Cache hints let a client keep what it already fetched. We are measuring this before changing it, because the trade is real: a shorter list is cheaper to read and easier to miss in.

What this changes in practice

• Publish the machine files, and keep them boring. /.well-known/x402, an OpenAPI document, a services index, and llms.txt. Collectors read them first; if a number in them is wrong, every downstream catalog is wrong.
• Make conditional GET work. 158 revalidations in 48 hours is free accuracy for the crawler and near-zero cost for you.
• Never publish a 402 that cannot be paid. The challenge document is the product at the moment of decision — a caller that gets a 402 it cannot parse is a caller you lost silently.
• Separate 402s from 200s in your own reporting. They are different events with different causes and only one of them can become revenue.

Method notes: counts are parsed from the gateway's GIN access log for the window above; paths are counted after stripping query strings; user-agent classes are substring matches on the self-declared string. Bodies were not logged, so this says nothing about what callers sent — only what came back. For the current catalog numbers, /api/stats is the live source; for the machine view, start at /.well-known/x402.