Build1 publisher2 min readPublished
Flipping the default to 402 got this Korean tax-data MCP server into the x402 Bazaar
Korea's business registry sits behind a Korean-language portal and SMS verification, so an agent cannot reach it. One developer put it behind an HTTP 402 and $0.02 in USDC, then found his free tier had disqualified him from the marketplace.
The Engineer · Build desk
What happened
- A remote MCP server fronts Korea's National Tax Service data, returning active, suspended or closed status, tax type and KYB identity matching as English JSON for a 10-digit business registration number, with no signup and no API key.
- In the first on-chain payment, an agent hit a 402, paid $0.02 and got the government data back without a human in the loop.
- The x402 Bazaar validator sent an unpaid request, got a 200 from the server's 10-calls-a-day free tier, and concluded the resource was not payable.
- Listings on the official MCP Registry, Glama and Smithery drew about 1,250 requests a day that were nearly all health-check and security-scanner bots, with external tool calls in the first week effectively zero.
- The server is now on the x402 Bazaar, Coinbase's discovery catalog for agent-payable APIs, ranking top for the query "korean business registration verification".
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- constraint A metered free tier now costs you the listing on the paying side, because the only signal the marketplace validator reads is whether an unpaid call returns 402.
- decision Anyone publishing an MCP server has to choose a success metric that survives crawlers, since directory request volume counts clients that will never invoke a tool.
- exposure An IP-keyed free allowance is an open scrape for anyone willing to rotate addresses, so the free path doubles as the abuse path until it is opt-in.
- capability Taking payment from software needs a wallet address and a facilitator, which puts a developer with no retail exchange access in the same position as one with an account.
The payment path is short. An unauthenticated REST call gets back HTTP 402 with the price attached, the agent signs a payment and retries, and Coinbase's CDP facilitator verifies settlement before the data comes back [1][8]. The server holds no private key. It knows a receiving address, and the developer's keys sit in MetaMask [20].
The x402 Bazaar validator applies one test: send an unpaid request and require a 402 [13]. A friendly free tier defeats that test by answering 200. The fix was to make 402 the default and move free access behind a query parameter, `?free=1` [14]. "Default-paid, intentionally-free turns out to be the right default for the agent economy," the developer wrote [15].
Prices are $0.02 for a status check, $0.05 for an identity verification and $0.02 per company for a batch, settled in USDC on Base [6]. A batch call covering the maximum 100 companies therefore bills $2.00 [24]. Recovering the roughly $3 of cash the build consumed, at $0.02 a call, takes 150 paid status checks [23]. Cloud Run's scale-to-zero keeps idle cost at about nothing, so there is no monthly floor to clear between calls [7].
The write-up does not report a paid call from an agent the developer does not control. It describes the total outlay as one exchange transfer fee plus test payments to himself [9], and puts external tool calls in the first week at effectively zero [10]. Some of the crawlers hitting the endpoint announce "never invokes tools" in their User-Agent string [11], which is at least honest. On what to measure instead, the developer wrote, "Count tools/call, nothing else." [25]
The hours went to version drift. The MCP registry rejected the first two publishes because the `server.json` schema had changed weeks earlier [17]. x402 is on v2, with new headers and new packages, while most tutorials still show v1 [18]. A fresh Cloud Run project took four hours to propagate its URL [19]. Within days a trust-scoring service, M8ven, auto-indexed the server and ran static analysis on it, finding no credential exfiltration and no obfuscation [21].
The $0.02 price only clears cost because the upstream is free. Korea's National Tax Service publishes the business-status data at no charge, and what blocks an agent is the Korean-language portal, the phone-verification signup and the manual API key issuance [4]. A server paying for upstream data, or holding warm instances to meet a latency target, carries a per-call floor this one does not. The code is MIT-licensed on GitHub [22].
What to watch
- Whether a paid tools/call arrives from an agent the developer does not control, which would be the first evidence of Bazaar-sourced demand.
- Whether x402's validator adds checks beyond the unpaid-402 test, which would let metered free tiers back into the discovery catalog.
- Whether the server.json schema settles enough that registry publishes stop failing on version drift.