Methodology v1 · Published formula
What the index measures
An unpaid HTTP probe is one piece of evidence. It cannot tell you whether a seller will deliver after payment. We operate this index and the SpendPreflight screening service.
Five visible components, 100 possible points
| Component | Points | Rule |
|---|---|---|
| Sampled HTTP availability | 40 | 40 × successful / usable probes in the last seven days. A valid 402 or 2xx for the advertised GET counts as success. Connection/TLS errors or a failed comparable GET count as failure. Missing slots, robots blocks, and method-mismatched responses are unknown. This is sampled availability, not continuous uptime. |
| Challenge validity | 25 | 25 for a fresh, parseable v1/v2 HTTP 402 challenge; 0 for an invalid challenge or failed comparable probe; otherwise unknown. Parsing is not payment verification. |
| Price context | 10 | Known mainnet USDC at face value only. Cheapest exact quote ÷ category median: ≤1× = 10, ≤2× = 8, ≤5× = 4, >5× = 0. Unknown currency or insufficient comparison data is unknown. |
| Domain age | 10 | RDAP registration age: ≥365 days = 10, ≥90 = 7, ≥30 = 4, <30 = 0. Unavailable data is unknown. An old domain is not proof of safety. |
| OFAC address screening | 15 | 15 for no observed payTo address match in fresh OFAC SDN data; 0 for a match. A match forces the overall score to 0 and must be verified before action. Missing or stale screening is unknown. |
Round the total to the nearest whole point. We publish a 0–100 score only when all components are known and the latest observation is at most 26 hours old, or a fresh sanctions match forces zero. Otherwise the score is Unknown; the possible range shows earned points through earned points plus all missing components. Unknown earns neither a penalty nor a claim of safety. Every row links to its components and observed history.
How comparisons and coverage work
Categories come from recognized public directory tags (AI, Crypto, Search, Utility, Trading, Random), otherwise Uncategorized. A category median is the median of per-host price medians, with at least three distinct hosts and fresh quotes. One host with many routes has one vote. USDC is assumed to be worth one US dollar for comparison; other tokens, testnets and non-exact schemes are not assigned USD prices. This is not a live exchange-rate feed.
The crawler uses only publicly listed Bazaar or x402scan URLs, honors robots.txt and allows at most one request per host every ten seconds. It makes GET requests only and never sends payment, authentication, wallet signatures or caller request bodies. For an advertised POST route, a GET 404/405 or landing-page response is inconclusive. A valid challenge can still be observed by GET. No paid delivery or settlement is tested.
At most 28 observations per endpoint are retained for seven days. Freshness, usable sample count, unsampled slots, advertised method and source coverage remain visible. Seven-day summaries are rolling windows updated with each crawl. Coverage uses the full reported Bazaar count; exclusions and deferred work do not become successful probes. x402scan's public sitemap is limited and rotated, so its coverage is explicitly partial. A changing discovery catalog can shift during pagination.
RDAP registration data is cached for seven days. OFAC data must be at most 26 hours old. No-match is informational and is not a sanctions-compliance certification. Third-party metadata can be wrong or manipulated; this score is a rule-based observation, not an endorsement.