A directory of paid endpoints.

A registry of machine-payable endpoints. A merchant lists an endpoint and a price in USDG; an agent finds it in the directory, calls it through the marketplace, answers the 402, and the money lands in the merchant’s own wallet.

Endpoints

The catalogue as an MCP server

POST /mcp speaks MCP over Streamable HTTP with four read-only tools: search_endpoints, get_endpoint, list_merchants and list_services. It is how an agent shops the rail without reading an OpenAPI document.

claude mcp add --transport http aeron-market https://market.aeron.sh/mcp

{
  "mcpServers": {
    "aeron-market": { "type": "streamable-http", "url": "https://market.aeron.sh/mcp" }
  }
}

Listed in the Cursor directory, which installs it in one click. In Claude’s own apps, add the URL under Settings → Connectors.

The server is stateless and issues no session id. GET /mcp answers 405: nothing here subscribes to anything, so an event stream would hold a socket open to say nothing.

Listing without an account

There are no accounts. A merchant proves control of an address by signing a statement that names exactly what it authorises:

Aeron Marketplace
Sign to prove this wallet controls the listing. This authorises no payment.

action: register
slug: acme-ocr
address: 0x…
issued: 2026-08-30T09:00:00.000Z
body: <sha256 of the request body>

Sent as x-aeron-address, x-aeron-signature, x-aeron-issued. Change the action, the slug, or a byte of the body after signing and the signature stops matching, so one signature cannot be reused for a different call. Signatures expire after five minutes and are spendable exactly once.

What a listing may point at

Every listing becomes a URL this Worker fetches on a buyer’s behalf, so an unchecked endpoint is an SSRF hole. Plaintext http, embedded credentials, loopback, private and link-local ranges, cloud metadata, and internal-only suffixes are rejected — at registration and again at call time, so a listing edited after the rules tightened is not reachable.

It matches on the hostname as written, so it cannot stop a public name that resolves to a private address. It is a filter on obvious abuse, not a guarantee.

Requests to merchants are rebuilt rather than forwarded: the buyer’s payment header, cookies, and credentials never cross over. Only the body and two identifying headers do — x-aeron-buyer and x-aeron-payment-ref — and the marketplace signs its forwarded calls so a merchant can tell a paid call from a stranger’s.

Order of operations

Nothing settles until the merchant has answered 2xx.

verify -> call merchant -> was anything delivered? -> settle -> respond
                                 |
                                 no -> merchant's own answer, nothing charged

Settling first was simpler, and it was wrong: it billed the buyer for the merchant’s outages and for its refusals — and a refusal is the common case, not the rare one. A well-built merchant rejects bad input cheaply and early, the way rwa.aeron.sh answers 422 to any question asking for advice before it fetches anything. Billing that is billing for a sentence saying no.

Only a 2xx is delivery. A merchant’s 4xx is its refusal of your input; its 5xx is its own outage. Both come back untouched with no X-PAYMENT-RESPONSE, and that absence is what tells a wallet nothing moved.

Zeroed rows are excluded from every total in /ledger/stats, so they cannot read as revenue or inflate the sale count.