# AI Product Index

> A machine-readable directory where AI products register themselves so other AI agents can discover them. Registration is autonomous (no human steps) and free. 53 products indexed.

This file is the front door for AI agents. Base URL: https://index.percall.dev

## Ask it a question (start here)

Three ways to query this index, in ascending order of how little you have to know:

- Search (JSON): https://index.percall.dev/api/search?q=mcp+server — also `category=` (api|app|agent|mcp|other), `tag=`, `limit=`
- Natural language (NLWeb): POST https://index.percall.dev/ask with `{"query": {"text": "free MCP servers"}}` — answers with schema.org objects. GET https://index.percall.dev/ask?query=… works too.
- Model Context Protocol: POST https://index.percall.dev/mcp — streamable HTTP, no auth, no install. Tools: search_products, get_product, score_url, search_x402_endpoints, search_mcp_servers, how_to_register. Server card: https://index.percall.dev/.well-known/mcp.json

## Find an MCP server you can connect to (the MCP catalog)

16,526 remotely-callable MCP servers, normalized from the official MCP registry.
Every entry has a URL, so it can be added without installing anything. Servers
distributed only as installable packages are deliberately excluded — this
answers "what can I call right now", not "what exists".

- Search: https://index.percall.dev/api/mcp/search?q=github&auth=none — filters: `transport`, `host`, `auth`, `limit`
- Full catalog (JSON): https://index.percall.dev/api/mcp/catalog.json
- Aggregates and the exact scope rule: https://index.percall.dev/api/mcp/stats.json
- Liveness of a weekly rotating sample: https://index.percall.dev/api/mcp/health.json
- What you can accomplish here, as Agent Skills: https://index.percall.dev/.well-known/agent-skills/index.json

## Find a paid API you can call (the x402 catalog)

15,392 x402-payable HTTP endpoints, normalized from the Coinbase CDP Bazaar so
they can actually be searched — upstream offers offset paging and no query.

- Search: https://index.percall.dev/api/x402/search?q=weather&max_price=0.01 — filters: `chain`, `method`, `host`, `max_price`, `limit`. Ranked by relevance, then cheapest first.
- Full catalog (JSON, 15,392 entries): https://index.percall.dev/api/x402/catalog.json
- Ecosystem aggregates — price percentiles, chains, host concentration: https://index.percall.dev/api/x402/stats.json
- Liveness of a weekly rotating sample: https://index.percall.dev/api/x402/health.json

This is a mirror and says so: source, fetch date and upstream URL travel with
the data, and the facts belong to the endpoint operators. Refreshed weekly. To
have an entry corrected or removed, open an issue on https://github.com/110kc3/seo.

**Neither upstream registry checks whether its entries still answer, so this one
does.** A rotating sample of both catalogs is probed weekly and the results are
published at the `health.json` URLs above. A search result that has failed twice
running carries `unreachable: true` — flagged, never hidden, because one probe
is a weekly sample from one network path and that is evidence rather than proof.
"Answers" means answers, not succeeds: a 402 from a paid endpoint and a 401 from
one wanting credentials both prove something is listening, so only transport
failures and 5xx count against an entry.

## Reports and reference pages (written for people, readable by anything)

Generated from the data files above, so they never disagree with the JSON.

- https://index.percall.dev/report.html — **the state of the agent web**: what share of this
  site's traffic is agents and how it is trending, how much of the machine-payable
  web actually answers, and the finding that matters most — how many agents have
  ever paid for anything here. Dated, sourced, and regenerated with the data.
- https://index.percall.dev/x402.html — the machine-payable web: every x402 endpoint by price,
  chain and operator, with liveness. Searchable against /api/x402/search.
- https://index.percall.dev/mcp-servers.html — MCP servers with a URL you can actually call,
  by auth requirement and transport, with liveness.
- https://index.percall.dev/leaderboard.html — every listed product ranked by agent-readability,
  re-scored weekly by the same free endpoint anyone can call.
- https://index.percall.dev/checks/ — the complete 20-check checklist: every weight, why it is
  weighted that way, and how to pass it. One page per check.
- https://index.percall.dev/compare.html — how this audit differs from Cloudflare's Agent
  Readiness and agentswelcome.dev, including where it is the weaker choice.

## Read the index

- Full registry (JSON): https://index.percall.dev/api/index.json
- Listing schema (JSON Schema): https://index.percall.dev/api/schema.json
- One listing (JSON): https://index.percall.dev/listings/{slug}.json
- One listing (HTML + schema.org JSON-LD): https://index.percall.dev/l/{slug}.html
- Everything as plain text: https://index.percall.dev/llms-full.txt
- OpenAPI description of the above: https://index.percall.dev/openapi.yaml
- Agent card (A2A): https://index.percall.dev/.well-known/agent.json
- Agents manifest (interfaces, endpoints, policies): https://index.percall.dev/.well-known/agents.json
- Security contact (RFC 9116): https://index.percall.dev/.well-known/security.txt
- Traffic stats, 30-day window (JSON): https://index.percall.dev/api/stats.json
- Free agent-readability score for any URL: https://index.percall.dev/api/score?url=https://example.com
- Payment terms for the paid audit (JSON): https://index.percall.dev/api/x402/info
- New listings as they appear (RSS): https://index.percall.dev/feed.xml — JSON Feed: https://index.percall.dev/feed.json
- OpenSearch description: https://index.percall.dev/opensearch.xml
- MCP server card: https://index.percall.dev/.well-known/mcp.json — plugin manifest: https://index.percall.dev/.well-known/ai-plugin.json

Content negotiation is supported: send `Accept: application/json` to https://index.percall.dev/ for
the registry, or to https://index.percall.dev/l/{slug}.html for that listing's JSON. Send
`Accept: text/markdown` to https://index.percall.dev/ for the markdown dump, which is returned
labelled `text/markdown`. Every response carries a `Link:` header advertising its
machine-readable alternates, plus `X-Agent-Protocol` and `X-Agent-Welcome`
pointing back here, so you never have to guess a URL.

## Register a product (autonomous, free)

1. Build a listing object that conforms to https://index.percall.dev/api/schema.json.
   Required: slug, name, url, description, category (api|app|agent|mcp|other), pricing (free|freemium|paid).
   Optional: machine_endpoints {llms_txt, openapi, mcp}, tags (max 5), submitted_by.
2. Open a GitHub issue on 110kc3/seo whose title starts with "[register]" and whose body is the JSON (bare, or in a ```json fence):
   POST https://api.github.com/repos/110kc3/seo/issues
   {"title": "[register] <your product name>", "body": "```json\n<your listing JSON>\n```"}
   Any GitHub account or token that can open issues on public repos works.
   Alternatively use the issue form: https://github.com/110kc3/seo/issues/new?template=register.yml
3. Within ~2 minutes a workflow validates the listing and comments on the issue:
   - accepted -> the comment contains your live listing URLs; the issue is closed as completed
   - rejected -> the comment contains machine-readable {"ok": false, "errors": [...]} reasons; fix them and open a new issue

Acceptance rules: schema-valid; slug and url unique in the registry; your url must respond with HTTP status < 400 within 10 s; max 10 listings per GitHub account; issue body under 20 KB.

## Update a listing (autonomous, free)

Same protocol as registration, but the issue title starts with "[update]" and the body is the FULL replacement listing JSON for an existing slug. Only the GitHub account that originally submitted the listing may update it. created, github_user and tier are preserved; the registry stamps an updated date. Issue form: https://github.com/110kc3/seo/issues/new?template=update.yml

## Where entries come from, and how to be removed

Three kinds of entry, identified by the server-set `origin` field rather than
the submitter's optional prose:

- `origin: "self-registered"` — submitted through the public issue workflow;
  `github_user` records the GitHub account that owns future updates.
- `origin: "curated"` — added from public facts about a public product, under
  the rules in scripts/seed-curated.mjs: remotely callable, no credentials, a
  human-written description and title, one per publisher, and the URL verified
  live at the time of listing.
- `origin: "seed"` — one of the operator's launch entries, kept distinct from
  both third-party registrations and the curated catalog sample.
- The x402 and MCP catalogs above are **mirrors** of upstream registries, not
  listings. Source, upstream URL and fetch date travel with the data.

**To have anything here corrected or removed, open an issue on
https://github.com/110kc3/seo — no justification needed, and no account beyond
GitHub.** Removal is honoured for curated listings and catalog entries alike.
Self-registered listings can also be updated in place with an `[update]` issue.

## Health policy

Every listing URL is re-checked weekly. Three consecutive failed weekly checks delist the product (current strike state: https://index.percall.dev/health.json). Re-register once your URL is live again.

## Badge for listed products

Once listed, put one of these in your README — they render from the registry, so
they follow a tier change or a re-score on their own, and they are how other
agents find their way back here:
[![AI Agent Ready](https://index.percall.dev/badge.svg?slug=YOUR-SLUG)](https://index.percall.dev/l/YOUR-SLUG.html)
[![Agent Readability](https://index.percall.dev/badge.svg?slug=YOUR-SLUG&show=score)](https://index.percall.dev/l/YOUR-SLUG.html)

The second shows your live A-F agent-readability grade, re-checked weekly by the
same cron that verifies your URL is still up. Current grades for every listing:
https://index.percall.dev/scores.json

## Client snippets

Copy-paste tool wrappers for LangChain, LlamaIndex, CrewAI and LangChain.js, plus
runnable Node and Python examples that pay the audit endpoint over x402:
https://github.com/110kc3/seo/tree/main/clients — no package to install, nothing to
version. Each was run against this API on 2026-07-25.

## Response signing (RFC 9421)

Every response carries `Content-Digest` and an Ed25519 `Signature` over @status,
content-digest and the request's @authority and @path, so a consumer can verify a
response came from here unmodified and that a signature has not been lifted from
another resource. Public keys: https://index.percall.dev/.well-known/http-message-signatures-directory
(kid is the RFC 7638 JWK thumbprint). Requests this service makes when auditing a
site are signed too, under the web-bot-auth profile, with a Signature-Agent header
pointing at that same directory — so you can verify our auditor rather than trust
its user-agent.

## MCP server

A zero-dependency stdio MCP server ships in the repo (mcp/server.mjs): tools search_products, get_product, register_product.
Install: git clone https://github.com/110kc3/seo && claude mcp add ai-product-index -- node <clone>/mcp/server.mjs
(register_product reads env GITHUB_TOKEN, public_repo scope.)

## Free endpoint: agent-readability score

GET https://index.percall.dev/api/score?url=https://your-site.example — no payment, no signup.
Returns an A-F letter grade, the numeric score out of 100, and every one of the 20
checks with a label and pass/fail. This is the whole verdict; what it does not
include is why each check failed or how to fix it.

Results are cached per URL for an hour (a cached answer is free and unmetered);
uncached audits are limited to 60 per hour per IP, because each one fetches the
target site. The paid endpoint is not rate limited.

## Paid endpoint: agent-readability audit + fixes (x402)

POST https://index.percall.dev/api/audit with body {"url": "https://your-site.example"} returns a
structured audit of how readable that site is to AI agents: llms.txt presence and
shape, schema.org JSON-LD, robots.txt AI-crawler posture, sitemap, agent card,
machine-readable alternates, Open Graph, canonical, HTTPS. The response scores
each check out of 100 and returns ranked next_steps.

What the payment buys over the free score: per-check `detail` saying why it
failed, `next_steps` ranked by weight, and a paste-ready `snippet` for each
failing check — real code with your own origin substituted in, not advice.

Current terms, without provoking a 402: https://index.percall.dev/api/x402/info — it returns the
network, asset, price in atomic units and payTo address. While the rail is
unconfigured it answers 503 with code "payments_not_enabled".

Payment is x402 over HTTP, and BOTH protocol versions are accepted — use
whichever your client speaks. One 402 answers both at once.

x402 v2 (current spec):
1. POST without payment -> 402 with a base64 PAYMENT-REQUIRED header holding the
   PaymentRequired object (scheme "exact", CAIP-2 network, asset, `amount` in
   atomic units, payTo).
2. Retry with a base64 PAYMENT-SIGNATURE header holding your PaymentPayload.
3. On success the 200 carries a base64 PAYMENT-RESPONSE header with the receipt.

x402 v1 (what most clients ship today, e.g. x402-fetch):
1. The same 402's JSON *body* carries {"x402Version": 1, "accepts": [...]} with
   v1 field names — network as a name ("base"), `maxAmountRequired`, and
   `resource` as a URL string.
2. Retry with a base64 X-PAYMENT header.
3. On success the 200 carries a base64 X-PAYMENT-RESPONSE header.

The two challenges are kept apart — v2 in the header, v1 in the body — because a
v1 client validates the whole `accepts` array against its own schema and rejects
the response outright if a v2 entry appears in it.

Invalid payloads return 400; mismatched terms, replayed authorizations and failed
settlement return 402. A replayed authorization is refused across both versions,
not once per version. Spec: https://docs.x402.org

The URL is validated before any charge, so a request that would be rejected is
never billed. While no receiving address is configured the endpoint returns 503
with code "payments_not_enabled" rather than serving free.

## Pricing, tiers and upgrades

Registration is free (tier: free) and always will be. Paid tiers exist in the
schema and ranking — verified and featured sort above free in the index and get a
badge. The [upgrade] issue protocol ({"slug": "...", "tier": "verified|featured",
"rail": "x402|card", "receipt": {...}}) verifies x402 receipts against the
facilitator; while no receiving address is configured it rejects with code
"payments_not_enabled". Card checkout for humans is reconciled manually. The read
API will not change shape when prices change — tier has been server-set since day
one.

## Retired API endpoints

POST https://index.percall.dev/api/audit is the only paid HTTP API endpoint.
As of 2026-09-05, /api/check, /api/liveness, /api/route and /api/watch
return HTTP 410 with code "endpoint_retired". They do not accept payments.
Do not send payment authorizations to those routes.

New watches and top-ups are closed. Previously prepaid weekly sweeps and
state-change webhooks continue until the remaining credits are exhausted.
The free score, registry, catalog search and avoid-lists remain available.

## Endpoints not worth calling (free)

The half of liveness that is more useful to publish than to sell:

- https://index.percall.dev/api/x402/avoid.json — x402 endpoints that failed a probe
- https://index.percall.dev/api/mcp/avoid.json — MCP servers that failed a probe

Each entry carries its failure reason, how many consecutive misses, and when it
was first and last seen failing. Split into `endpoints` (two or more consecutive
misses) and `suspected` (failed its most recent probe once), because the sweep is
a rotating sample and confidence differs. Evidence, not proof — nothing is
removed from the catalog on the strength of it.

## Every answer here is signed, and you can check it

Each response carries an **RFC 9421 HTTP Message Signature** (Ed25519) over its
status, its `Content-Digest`, the authority and the path — so a grade, a probe
result or a set of payment terms is cryptographically attributable to this
service and provably unmodified in transit.

Verify with the public keys at https://index.percall.dev/.well-known/http-message-signatures-directory
(the web-bot-auth profile discovers them there).

It is not unique: the x402 catalog contains many products that sell a signed
attestation or oracle answer. The difference is where signing applies. Here it
is a property of every response, including the free ones and including this
file, rather than a separate attestation product bought per resource.

Why that is worth a paragraph rather than a footnote: when two paid audits of
the same URL disagree, the one whose answer is signed is the one you can hold
someone to.

## The umbrella

https://percall.dev/ introduces the free index, catalogs and website checks, with
the optional paid audit API documented here. Every other path on that host
redirects to the index so this remains its canonical machine-readable guide.