← Home · Data hub · Commerce-backed cohort · Bazaar market map · Signpost-gap dataset

How do you know which agent is safe to pay?

Live measurement across Base + Ethereum; refreshed on every visit.

Spending caps answer how much. They do not answer who.

The OpenAI cookbook is the clearest single reference for the pattern. Its example agent researches suppliers by paying a data provider 0.25 USDC per report over x402 on Base — a real payment, a real merchant, a real HTTP 402 handshake. The whole guide is structured around limits: an approval grant, a per-run limit, a spending policy, an audit trail. The agent, in the guide's own framing, never gets a blank check. That is the how much question, and the rail answers it well. Read the guide in full at developers.openai.com/cookbook/…/controlled_agentic_commerce (dated 2026-08-13).

What the cookbook does not do — because it is not what AgentCore Payments is for — is score the data provider. There is no assertion that the merchant has ever been paid by anyone else, no history rollup of prior settlements, no independent measure of the counterparty. The agent that pays 0.25 USDC per request only knows: my spending cap allows it. Not: this counterparty is real.

The rails commoditised. The trust filter did not.

2026 is the year the agent-payments rails became a commodity, on three tracks moving in parallel:

• x402 Foundation. The Linux Foundation announced the operational launch of the x402 Foundation (2026-07-14) with premier members including Adyen, AWS, American Express, Circle, Cloudflare, Coinbase, Fiserv, Google, Mastercard, Ripple, Shopify, Stripe, and Visa. The x402 protocol (HTTP 402 payment handshake) is at V2. This is the rail AgentCore Payments uses, the rail Cloudflare Wallets ships, and the rail the Coinbase CDP Bazaar indexes against.
• Google AP2. Google's Agent Payments Protocol (announced 2025-09-16 with 60+ launch partners; specification at v0.2) authenticates the transaction via cryptographically-signed Mandates and Verifiable Credentials. It answers did the user authorise this transaction? It does not answer who is the counterparty agent? AP2 has since been donated to the FIDO Alliance.
• Cloudflare Wallets + OpenAI AgentCore. Cloudflare Wallets (2026-08-04) gives an agent a cloudflare.pay identity, an organisational binding, and a per-employee spending cap. OpenAI's AgentCore Payments cookbook (2026-08-13) ships the same pattern from the agent-runtime side. Different vendors, same category shape: identity + spending caps + rail.

Across all three tracks, the shared assumption is that counterparty quality is somebody else's problem. It has to be: none of them are on-chain long enough to have accumulated a history to score, and none of them can see across rails. This page is about the layer that has to exist regardless.

What a counterparty check actually has to prove

A useful counterparty-quality signal has four load-bearing cuts, each of which the rails cannot answer on their own:

1. Is the counterparty walkable at all? The agent-card signpost (/.well-known/agent-card.json under the A2A convention) is the machine-readable proof that the agent even publishes an endpoint at a resolvable URL. Our own measurement (snapshot 2026-09-07T08:09:08.976732+00:00): of 25,724 indexed ERC-8004 registrations on Base + Ethereum, only 1,571 (6.11%) publish a walkable agent-card. Full dataset: /erc-8004-agent-card-signpost-gap (CC BY 4.0).
2. Does anyone else pay this counterparty? A live rail with real economic demand is a much stronger signal than one advertised paid endpoint. Coinbase's public CDP Bazaar indexes many thousands of paid endpoints, but our snapshot (2026-09-07T09:00:55Z) reports only 762 of 14,689 (5.19%) cross the ≥5-unique-payer threshold in the last 30 days. Independent measurement (x402-list.com, frozen 2026-08-15) reports the top ten x402 services capture ~97.9% of settled USDC volume across 423 measured services — two operators, two methodologies, same shape. Full ladder: /how-many-x402-endpoints-are-actually-used.
3. Does the counterparty carry got-paid feedback (not self-reported endorsements)? The ERC-8004 ReputationRegistry (0x8004BAa17C55a88189AE136b182e5fdA19dE9b63) accepts a submitFeedback(agentId, tag1, tag2, uri) call from any caller. The raw feedback count is not the reputation. The subset that ties back to a real paid on-chain job under a canonical predicate — commerce-backed reputation — is what a trust signal actually looks like: 979 feedback rows across 44 distinct agents (44 on Base, 0 on Ethereum), authored by 109 distinct client addresses. Full breakdown: /can-you-trust-an-erc-8004-reputation-score.
4. Is the endpoint live right now? Of the 25,741 indexed ERC-8004 registrations, 3,719 (14%) answer at their advertised endpoint with a machine-readable capability manifest on the last probe. This is a floor (“they were reachable at check time”), not a guarantee they will be reachable when the payment lands.

Our answer: commerce-backed reputation

The honest framing of the current cohort: most advertised paid endpoints are not real counterparties. Under our ≥5-unique-payer cut, only 5.19% of the CDP Bazaar catalog cross the threshold in 30 days; on the demand side, the top ten services capture ~97.9% of settled volume. That IS the product: the trust filter that says “these are the counterparties with an actual payment history worth transacting with.”

Commerce-backed is the strict version of that signal: 44 agents whose on-chain feedback rows tie back to a real paid Virtuals ACP job outcome OR an allowlisted ERC-8183 hook contract, under the canonical predicate at smartcontractauditpro/commerce_backed.py. Same predicate the free /v1/public/stats surface, the paid /v1/intel/* endpoints, and the commerce-backed cohort hub use — so the number on this page cannot drift from the paid product.

Concrete cut on Base x402 demand (snapshot 2026-09-01). Of the ~14,300 Base x402 endpoints that earned money in the last 30 days (≥1 unique payer), 0 have commerce-backed reputation — those endpoints resolve to just 26 distinct publishers, 4 with any on-chain feedback (one event each, one unique client apiece), 0 commerce-backed, and every share here is a lower bound. The four rails (x402, AP2, AgentCore Payments, Cloudflare Wallets) all move money; none of them scores the counterparty. Full derivation: /x402-bazaar-market-map § “Reputation footprint of the earning cohort.”

Method

Rails cited. OpenAI's AgentCore Payments cookbook (dated 2026-08-13); Linux Foundation press release announcing the x402 Foundation (2026-07-14); Google Cloud AP2 announcement (2025-09-16); Cloudflare Wallets announcement (2026-08-04). Every rail claim on this page maps to one of these four dated sources.

Commerce-backed predicate. A ReputationRegistry feedback row is commerce-backed if its transaction was emitted from an allowlisted ERC-8183 hook contract, OR its feedbackURI matches a Virtuals ACP job outcome pattern, OR its tag + client-address combination passes the booster + payer test. Canonical source of truth: smartcontractauditpro/commerce_backed.py.

Bazaar cohort. Snapshot as of 2026-09-07T09:00:55Z from Coinbase's public CDP Bazaar discovery API. Cohort ladder computed via onchainagentintel-site/build_seo_pages.py::_bazaar_payer_thresholds — the same function powers Report 07, the live market map, and the canonical x402-usage answer page.

Per-publisher dedup cap (disclosed). The indexed cohort applies a per-publisher dedup cap so bulk-mint publishers do not dominate the served set. Disclosing the cap is itself the “trust filter, not biggest index” differentiation: undisclosed capping reads as undercounting; disclosed capping IS the position. Full cap value + publisher count on /how-many-erc-8004-agents-are-there.

Cadence. Chain-stats spans re-fetch on every visit from /v1/public/stats; bazaar and signpost snapshot values refresh on the daily build.

Limitations

• Commerce-backed is a strict floor, not a ceiling. Genuine peer feedback from a client who paid the agent off-chain (fiat, cross-chain, batched settlement) does not clear the commerce-backed predicate. The strict cut is deliberate because the failure mode this page exists to prevent (Sybil-inflated raw scores) is asymmetric.
• Rail identity attests wallet, not agent quality. cloudflare.pay proves wallet ownership + org binding. AP2 Mandates prove user authorisation of the current transaction. Neither is a claim about the counterparty's prior history. The commerce-backed cohort is that missing layer — it does not replace what the rails do prove.
• Bazaar catalog rotation. Endpoints get added and dropped daily. The shape (large listing surface, tiny paid cohort at the top) is stable across snapshots; the exact counts move slightly from build to build.
• Live status has cadence lag. A live-now agent last probed 40 hours ago is counted as live until the next check. Full liveness methodology: /how-many-erc-8004-agents-are-there § “Live predicate.”

Cite this answer

Scoped claim sentence. Scope: counterparty-quality signal for agent payments on x402 / AgentCore Payments / AP2 / Cloudflare Wallets rails, measured against the ERC-8004 IdentityRegistry + ReputationRegistry on Base + Ethereum, refreshed daily. On the current daily build, On-Chain Agent Intel indexes 25,741 ERC-8004 registrations across Base + Ethereum, of which 44 carry commerce-backed feedback (rows tied to a real paid on-chain job under the predicate at smartcontractauditpro/commerce_backed.py).

License. Answer prose and every rendered number published under CC BY 4.0 — free to reuse, including in commercial work, provided you attribute “On-Chain Agent Intel” and link back to https://onchainagentintel.io/how-do-you-know-which-agent-is-safe-to-pay.

Machine-readable source. Every chain-stats number is a live projection of /v1/public/stats. Bazaar snapshot backs /x402-bazaar-market-map.json. Signpost snapshot backs /erc-8004-agent-card-signpost-gap.json.

Also useful: Commerce-backed cohort hub · x402 Bazaar market map · Signpost-gap dataset · x402 usage answer · Trust the reputation score? · How many agents?