x402 listing operations

Coinbase is delisting x402 endpoints for agent-hijack wording: how to check yours.

Published October 23, 2026 (Pacific) · SpendPreflight · AI-assisted operator article, checked against the official sources below.

A technically valid payment challenge can still contain text that tries to steer an agent. If your listing mixes an endpoint description with instructions about what the agent should ignore, execute or send elsewhere, review it before relying on discovery.

What changed on October 13

Coinbase's October 13, 2026 CDP changelog announced a Bazaar metadata content policy: resources with prompt-injection-risk metadata are excluded, and existing listings that fail the policy are removed. It covers curated resources too.

The seller documentation says metadata is screened on indexing and screened again afterward. It also distinguishes technical validation from the content policy: a successful validator result does not establish policy acceptance.

This article explains the published policy. We do not identify any seller or claim why a particular endpoint left the index. Our tracker reports only supported aggregate observations; missing history stays unknown.

Five wording patterns to review

This checklist describes our heuristic screen, not Coinbase's private detection rules. A pattern can be legitimate in documentation or examples. Context and manual review matter.

1. Instructions that override an agent

Review wording such as ignore previous instructions, role impersonation and demands to override a system prompt. Describe what the endpoint returns and what inputs it accepts. Avoid telling the buyer's agent how to change its governing instructions.

2. Tool calls and executable commands

A description should not direct an agent to execute a shell command, call an unrelated tool or send a secret. Keep required input fields in the schema and present examples as data. Review descriptions inside nested schemas and examples as well as the headline.

3. Embedded links that redirect the workflow

Review unrelated links, executable URL schemes and instructions to send data elsewhere. A documentation or JSON Schema URL can be entirely legitimate: its presence alone is not injection or a reason to accuse a seller. Keep links relevant and explain their purpose.

4. Hidden characters and disguised instructions

Invisible Unicode and bidirectional controls can change how text appears. Inspect copied listing text in a plain-text editor, especially unexpectedly long descriptions. Remove accidental hidden controls and keep examples concise; do not erase meaningful language characters indiscriminately.

5. Authority and urgency claims

Review claims that a step is required by a system administrator, has the highest priority, or must happen immediately. An ordinary time-sensitive data description may be valid. Describe freshness and expiry as factual output properties instead of using urgency to direct the agent.

Check your current public listing

  1. Run free x402 Lint on the public URL. It makes an unpaid GET and returns challenge/metadata observations and a heuristic Listing Guard risk score. It does not execute POST request bodies or prove paid delivery.
  2. Read the warnings in context. A low score is not safety certification, and a positive score is not proof of an attack or impending delisting. If you need bounded flagged spans and manual rewrite guidance, Listing Guard is 0.05 USDC per check.
  3. Compare any compatibility finding with the pinned reference SDK and your actual facilitator's official supported values. If they diverge from the specification, investigate the integration together; do not assume the merchant is broken.
  4. For a content-policy rejection, Coinbase's guide describes revising metadata, redeploying and completing another settled call through CDP to trigger discovery again. Technical validation alone does not settle the content-policy question.

Start with a free snapshot

Check your listing free →

Follow the Bazaar Delisting Tracker for daily aggregate explicit index-status transitions and wording observations. Samples are partial and removal causes are unknown.

14 days free for founding sellers: the first 10 eligible Basic registrations get monitoring with no wallet needed to start. After that, renewal is 9 USDC per 31 days, manual. Basic combines hourly endpoint checks with best-effort daily listing-risk checks and email on newly detected risk or confirmed removal. Email requires confirmation; scheduling and delivery are not guaranteed.

Keep the check in CI

The free x402 Lint GitHub Action checks your published endpoint on each push, reports the heuristic score and fails on hard findings. Add its dated report badge to your README. No Lint API key or payment; shared free quotas and robots apply. Inconclusive checks are not a failed endpoint or a safety pass. Action and badge instructions.

Sources and limits

SpendPreflight operates Lint, Listing Guard and monitoring. These are informational checks, not Coinbase certification, an audit or a guarantee of listing, security or paid delivery. Endpoint absence, provider failure and unknown index status are not proof of removal.