The differences that matter between MCP marketplaces are mechanical, not editorial: whether a purchase can be completed inside the protocol, who the payment names as recipient, and what happens when a listing takes the money and fails. Here are the checks, each answered for FiatDock — including where we come up short.
Last updated: · by FiatDock
Almost every place that lists MCP servers is a directory. A directory answers one question: does this exist? A marketplace has to answer a harder one: can my agent buy it right now, with nobody watching?
The gap between those questions is a payment, and it is easy to underestimate. The first half looks trivial — the agent sends a request, gets HTTP 402, and the price is right there. The second half is where agents stop: decode the requirements, sign an EIP-3009 USDC authorization for the exact atomic amount, to the exact recipient, on the exact chain, before the deadline, then retry with the payment attached. An agent that found the service through a catalog's MCP tools must now leave MCP and hand-build HTTP, because nothing in the tool surface it was handed accepts a payment. So the first test on any MCP marketplace is not about fees: connect to its MCP server, list its tools, and look for one that takes a payment as an argument. If there isn't one, it is a directory with prices printed on it.
| What to look for | FiatDock | What to watch out for |
|---|---|---|
| Purchase inside MCP | call_service takes an optional payment argument — call once for the price, sign, call again to buy | Catalogs whose MCP tools search but cannot pay |
| Custody | The 402 names the seller's own wallet; the 1% is a separate payment to a separate address | A 402 whose payTo is the platform's wallet — that is custody |
| Failure | Deliver first, settle second: no answer, nothing settles, and the body says you were not charged | Charge-on-connect; refunds by ticket; or no stated policy |
| Fees | 1% per call, 0% for a seller's first 30 days; free to browse and list | High take rates, hidden payout fees, withdrawal minimums |
| Security | Every hosted listing's tools/list re-read every 6 hours — hourly on ephemeral tunnel hosts, and immediately when the seller edits the listing — against prompt-injection and tool-poisoning rules | Unscanned catalogs — and scanners with no published false-positive record |
| Ranking | Tri-state callable on every listing; ordering only, never hiding; ?sort=price still returns the cheapest | "Unknown" quietly presented as "broken", or the reverse |
This compares marketplace models. Named, as of July 2026: listing directories such as Smithery, Glama, mcp.so and PulseMCP pay developers $0 for a listing (Smithery charges around $30/mo for hosting tiers); monetized platforms such as Apify and MCPize take a 15–20% cut, hold the funds and pay out on a schedule.
On FiatDock a purchase is two tool calls and no HTTP. The first call_service call carries no payment — that is how the agent learns the price. The response returns the full challenge under paymentRequired, a howToPay block naming the exact next call, and a plain statement that a 402 is a price and not a charge. The agent signs, base64-encodes the payload, and calls call_service again with payment set. The transport carries the payment and never judges it — verification and settlement stay in the same gateway wall — so there is no new trust surface.
The limitation, plainly: the remote server at POST /mcp holds no private key and never will, so it hands you the challenge rather than signing for you. If you would rather not write signing code, the local package npx fiatdock-mcp signs automatically from AGENT_PRIVATE_KEY — including both legs of the 99/1 split, which a single-payment wrapper cannot do.
"Non-custodial" is one of the few marketing claims you can verify in thirty seconds. Send an unpaid request to a paid resource, decode the 402, read payTo. If it is the platform's address, the platform receives your money and forwards some of it later — that is custody, with the counterparty and freeze risk that follows. FiatDock's gateway 402 names the seller's own payout wallet; the 1% fee is a second, separate payment to a separate address at the same moment. There is no escrow, no pooled wallet, no ledger of balances we owe anyone. During a seller's first 30 days there is no platform leg at all: one payment, full price, straight to the seller.
This is the criterion most catalogs never address, and the one that costs buyers real money. FiatDock's gateway forwards first and settles second: if the seller's server produces no answer, nothing settles, the response is 502, and the body says you were not charged.
Getting that right meant reading more than a status code, because MCP over HTTP reports tool failures with HTTP 200 — a missing tool arrives as a successful response containing a JSON-RPC error. So the gateway parses the body and splits by fault:
-32000 to -32099 range. You get a 502 and no charge.-32602). If bad input were free, junk arguments would farm unlimited calls at the seller's expense.tools/call is refused — some servers answer every POST with the same payload whatever was asked.One signed authorization buys exactly one answer: it is claimed before the forward, so five concurrent calls on one payment header cannot return five paid answers. The failure we could not design away is declared rather than hidden — if the seller answers but settlement then fails, you get the answer with an X-FiatDock-Unsettled header and we raise a critical alert.
Every hosted listing's tools/list is re-read on a six-hour cycle against an in-house ruleset covering prompt injection, tool poisoning and the OWASP MCP risks; a HIGH finding suspends the listing and alerts. Endpoints on ephemeral tunnel hosts — the *.trycloudflare.com class of URL, which its own provider warns will disappear — are re-read hourly instead, because a six-hour-old "reachable" is a lie about a hostname built to vanish. And a seller's edit re-probes the listing on the spot, so a fix takes effect immediately rather than at the next cycle. Tool descriptions are treated as untrusted input throughout, because that is what they are: text a stranger wrote that ends up in your model's context.
The honest half is that an over-eager scanner is its own failure mode, and ours proved it. A credential-exfiltration rule listed the bare word token among its sensitive nouns. On a marketplace whose sellers are mostly crypto APIs, one tool named for token holders matched it, and 13 working listings — over half the catalog at the time — were auto-suspended and kept dead by the six-hourly re-scan. The rule now requires a qualifier (auth, bearer, session, api token), and tests carry the verbatim text from that incident in both directions. Ask any marketplace what its false-positive record looks like; if it has none, it has not run a scanner long enough to find out.
Every listing carries a tri-state callable field: true with evidence a call would answer, false with a machine-readable callableReason when we have evidence it would not, and absent when it has never been checked — "we don't know" and "it's broken" are different facts, and collapsing them punishes new sellers. One predicate feeds browse, the catalog JSON, the MCP resource and the home page, so they cannot drift apart. Callability orders, it never filters: nothing is removed for failing it, and an explicit ?sort=price still returns the absolute cheapest listing whether or not we think it works. One documented exception — an endpoint silent for seven consecutive days leaves the default catalog and returns automatically on a single successful health check.
Marketplaces like to publish payer counts. Payer counts mean very little alone, and our own data shows why. Measured on from the public CDP Bazaar index, trailing 30 days: FiatDock's paid routes had 2 unique payers; api.onesource.io, selling comparable chain primitives at a comparable price in the same index, had 759. That reads as a rout — until you divide. Revenue per payer was $0.0675 for both of us, identically. A third seller there, twit.sh, earned $9.98 per payer on 51 payers — roughly 148× more.
The call counts explain it: across 20 of one seller's 25 endpoints, calls divided by payers came to exactly 1.00 — every wallet called once and never returned, the signature of a catalog scan rather than a customer. Ask for revenue per payer and calls per payer, and read a large payer count with a ratio near 1.0 as a measure of how thoroughly a catalog has been indexed.
No external buyer has yet paid for a third-party listing — measured 13 August 2026 against our own payment log. Three real external x402 settlements have landed, all on FiatDock's own first-party data routes, totalling $0.003 on 10 and 12 August 2026; both paying wallets paid hundreds of other endpoints that week, which makes them scanners confirming our paywall works, not customers. Most traffic we see is automated, and no marketplace conjures demand: listing here is distribution, not buyers. What we promise is narrower and checkable — publishing is free, a call that fails costs nothing, and every figure above can be re-derived from a public index or a live request.
The one your agent can buy from unattended: a payment tool in the MCP surface, the seller's wallet in the 402, settlement only after an answer, scanned listings, honest ranking. The fee here is 1%, and 0% for a seller's first 30 days.
It means the seller passed an identity check through a licensed provider and holds a current $20/month subscription, and that the listing is security-scanned. It is not a quality guarantee, and it is not required to publish or to get paid.
Next: What an MCP marketplace is · Browse services · Sell your MCP service · Sell an API to AI agents · Monetize an MCP server · Pricing
For agents: skill.md (task-first instructions) · llms.txt (live catalog and prices) · docs.