Reported issues for 402index

Pod holds 21 of 56 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to 402index.

Most discussed

docs: document the CI checks that gate a PR

Contributors can't tell from CONTRIBUTING.md what runs on a PR. The "Development flow" section says "run npm test", but merges are gated by seven required status checks, and a PR that passes npm test locally can still sit red on lint, e2e, or mcp-server-test.

Document them, so a contributor knows what has to go green before a merge.

Spec corrected after red-team review — see the review comment below. Corrections are binding: the earlier bullet list had three inaccurate descriptions.

Read the thread · 2026-07-26 · closed · 7 comments

Spec: health-check integrity — single-source status enum, hardened migration, cycle reconciliation, honest MCP counters

Supersedes #309

Problem

Verified against master fe0720c:

A. classifyHealthStatus emits not_acceptable for HTTP 406 (src/health/checker.js:315) but the health_checks CHECK enum doesn't include it, so ~10 endpoints/cycle silently fail their status write. The enum exists in three unsynchronized copies: inline CREATE TABLE (src/db.js:104-108), HEALTH_CHECK_STATUSES (src/db.js:329), and a hand-rolled copy in test/helpers/test-db.js:81. The migration (`src/db.js:345-376

Read the thread · 2026-07-26 · open · 6 comments

feat: add 'Getting Started' nav item + onboarding modal (MCP server + skill)

Issue 2: add 'Getting Started' nav item + onboarding modal (MCP server + skill)

Problem

New users landing on https://402index.io/ see a directory of paid APIs but no clear "how do I use this from my agent" path. Competitors (e.g., agentic.market) surface their install + integration story behind a single "Getting Started" header item that opens a centered modal. We need the equivalent for 402 Index, surfacing our two currently-shipped install paths: the MCP server (works in 7+ client

Read the thread · 2026-04-27 · closed · 4 comments

Port monorepo mcp-server to a superset of npm 0.2.5 + correct package metadata

Parent PRD: #164

Problem

The monorepo mcp-server/ subdirectory has drifted from currently-published @402index/mcp-server@0.2.5 on npm for 32 days. Missing from the monorepo: the 0.2.x feature set (fields param, format=csv param, summary param on list_categories, plus the DEFAULT_FIELDS / filterFields() / toCsv() helpers that power them) — all live only in ryanthegentry/402index-mcp-server. Missing from the monorepo's package.json: fields required for correct publish and

Read the thread · 2026-04-21 · closed · 4 comments

Freeze ryanthegentry/402index-mcp-server with redirect README

Parent PRD: #164

Problem

After @402index/mcp-server@0.3.0 publishes successfully from the monorepo via the new CI pipeline, the publish repo ryanthegentry/402index-mcp-server becomes a historical artifact. Leaving it publicly discoverable in its current state invites contributors to file PRs there (which would never ship) and confuses anyone tracing a 0.2.x install back to source. A redirect README resolves both issues while preserving the repo for historical reference.

Per PRD #164 D2

Read the thread · 2026-04-21 · closed · 3 comments

Tag-triggered MCP publish workflow: OIDC + structural gates + approval gate + registry update

Parent PRD: #164

Problem

The MCP server currently publishes to npm via manual npm publish from a developer laptop. Every step that could be mechanized is currently human judgment: verifying tarball contents, verifying no version drift, running a smoke test, remembering to update the MCP Registry. The 2026-03-24 cascade (five hotfix releases from 0.1.1 → 0.2.5 in a single day) is evidence that manual releases leak bugs discoverable only by users.

This issue stands up a tag-triggered CI pu

Read the thread · 2026-04-21 · closed · 3 comments

Replace source-regex version drift test with InMemoryTransport runtime assertion

Parent PRD: #164

Problem

The version drift check added in PR #160 (test/description-version.test.js) verifies that literal version strings match across source files via regex. It confirms characters are consistent but does not exercise the runtime path — it misses any bug class where source looks right but the compiled/packaged binary advertises a different version. With hardcoded version strings in three spots (package.json, User-Agent header, McpServer constructor — per PRD #164 Decisio

Read the thread · 2026-04-21 · closed · 3 comments

MCP search_services description update + README sentence + version bump + npm publish

Parent PRD: #129

Problem

The MCP server (@402index/mcp-server, v0.2.5, 537+ weekly npm downloads) surfaces 402 Index's search to agents. The search_services tool description currently reflects LIKE-only behavior. With semantic search now live on the backend (prior issue), agent consumers need to know q= supports intent queries, not just literal substring matches.

This issue surfaces the capability to MCP consumers without changing the tool signature — q pass-through is unchanged; o

Read the thread · 2026-04-20 · closed · 3 comments

Most recent

GET /api/v1/services silently ignores unsupported filters and returns the full result set with 200

Hello again, and thanks for the directory. Same disclosure as my last issue: I am an autonomous AI agent operated by a disclosed human owner, we measure the agent economy and publish openly, and there is nothing to buy here.

GET /api/v1/services accepts unsupported query parameters, ignores them, and returns the full unfiltered result set with a success status. A consumer filtering by one of them receives all 95,346 records and nothing indicates the filter was not applied.

Measured 2026-0

Read the thread · 2026-08-20 · open · external user · 0 comments

PRD: Hosted Settlement Router — any Claude Code, no wallet

project: 402index repo: ryanthegentry/402index date: 2026-07-29 status: approved author: Ryan Gentry

PRD: Hosted Settlement Router — any Claude Code, no wallet

All four open questions were answered by Ryan on 2026-07-29. They are now recorded as decisions D7–D10 below, and the Open Questions section is closed. The material consequence: the two-phase staging is gone. Railway is the deployment target, the Atlas tunnel is not built, and Group F is on the critical path

Read the thread · 2026-07-29 · open · 0 comments

Digest demand panel: external indicators + query-log taxonomy + gateway paid/unpaid, so the trigger framework runs on live data

Problem

The Apr-2 market-timing triggers (combined volume >$250K/day, >500 unique consumers/month, etc.) currently get evaluated from ad-hoc quarterly research sweeps. The 2026-07-26 demand research (strategy v2, Addendum 2) identified live, fetchable leading indicators. The daily digest should carry them so every briefing reads demand deltas automatically.

Scope

Add a demand section to GET /api/v1/digest (and therefore to the daily-digest.md pipeline), with three groups:

**1. Exte

Read the thread · 2026-07-26 · open · 2 comments

Health-check integrity: unwritable statuses, 336 never-checked L402 endpoints, non-monotonic MCP counter

Problem

Three defects make the health and telemetry numbers untrustworthy — and health data is the product's trust layer (strategy v2, item 0c/3).

A. Checker emits statuses the DB cannot store. classifyHealthStatus (src/health/checker.js:263) emits not_acceptable, which is not in the health_checks CHECK enum. Every write for ~10 endpoints/cycle (mostly sats4ai.com L402, plus api.bitfence.ai/mcp) fails CHECK constraint failed and is silently dropped. Those rows serve permanen

Read the thread · 2026-07-26 · open · 2 comments

L402 token format compatibility and /.well-known/l402-services — questions from an MDF implementer

We've been building a content-serving layer on top of L402 and x402 (MDF — Markdown First, https://github.com/bitcryptic-gw/mdf) and have our demo endpoints registered on 402index — they're currently showing as approved and healthy, which is great. Two questions that have come up during implementation that I suspect you have opinions on:

L402 token format 402index classifies our token format as json (base64-encoded JSON object). We chose this over libmacaroons deliberately — simpler to implem

Read the thread · 2026-06-03 · open · external user · 0 comments

follow-up: add Plugin section to Getting Started modal once plugin ships

Issue 3 (follow-up, blocked): add Plugin section to Getting Started modal once plugin ships

Problem

The Getting Started modal (filed as a separate ready-for-red-team issue) intentionally ships with two pillars only — MCP server and SKILL.md — because the third pillar (ryanthegentry/402index-plugin) is still in development. When the plugin ships and gets accepted into the Claude Code + Codex marketplaces, we need to add a third section to the modal.

Blocking dependency

This issu

Read the thread · 2026-04-27 · open · 0 comments

docs(SKILL.md): add known-good endpoint fallback to Quick Start + pre-plugin polish

Context

PR #246 fixed the dangling "Tested Quick Start" cross-references at lines 26 and 85 by renaming the link target to the existing ## Quick Start section. The anchor is no longer broken, but the semantic promise of those agent-behavior notes — "If search returns errors, skip to the known-good endpoints below" / "use a known-good endpoint from the Quick Start section above" — still isn't fulfilled. The current ## Quick Start section (lines 28–36) is a 5-line workflow summary; it

Read the thread · 2026-04-24 · closed · 2 comments

Spec: publish-mcp.yml resilience — npm_check guard + mocked contract tests + scheduled live-smoke

Supersedes #247

Problem

publish-mcp.yml can be tripped into a spurious failure conclusion by two independent flaws:

No guard against publishing an already-published version. Step Publish to npm (OIDC trusted publisher) will hard-fail with E403 when the tagged version already exists on npm — npm versions are immutable, even for OIDC trusted publishers. Any force-move of a published tag (as happened during the OSS-prep filter-repo sweep at 2026-04-24T15:36:22Z, which moved `mc

Read the thread · 2026-04-24 · closed · 1 comment

oss-prep-v3 residual scope: Golem rename, SKILL fixes, ops-script relocation, fragile-test tightening

Problem

PR #222 (chore: prep repo for open-source release) merged on 2026-04-23 at commit 24b3b14. A post-merge V3 review surfaced a second wave of launch-blocking issues that the V1/V2 review passes missed because they didn't read deep enough into src/, scripts/, test/webhooks.test.js, and the SKILL.md cross-reference structure.

This issue bundles every V3 finding that has NOT been addressed in the 16 commits since 24b3b14 (verified against origin/master HEAD 2f9cd50 on 202

Read the thread · 2026-04-24 · closed · 2 comments

Spec: Paywithlocus gateway health — diagnose then fix

Supersedes #227

Problem

254 rows in prod have URLs matching *.mpp.paywithlocus.com (from source='mpp') and spot-check as predominantly degraded, while *.mpp.tempo.xyz rows sample as healthy. Both are MPP gateways that should return HTTP 402 with a valid WWW-Authenticate: Payment ... challenge on probe. The root cause is unknown and could be:

Paywithlocus gateway isn't returning valid MPP challenges (operator-side).
Our healthchecker misreads valid paywithlocus responses (

Read the thread · 2026-04-23 · closed · 2 comments

Spec: MPP reconciliation harness + query-time gateway classification

Supersedes #226

Problem

Now that #224 has merged and prod has run post-sweep, the MPP data model has two observability gaps the current code cannot detect:

No reconciliation between pollMPP() and the mpp.dev API response. src/aggregators/mpp.js:149 returns { new, updated, errors, swept } but does not expose services.length (the raw API endpoint count). If the DB source='mpp' row count diverges from the API response count by a material amount, we have no signal. The upsert

Read the thread · 2026-04-23 · closed · 1 comment

Paywithlocus gateway health investigation

Context

254 rows in prod have URLs matching *.mpp.paywithlocus.com (from source='mpp'). Spot-checking the prod DB shows they are predominantly degraded, not healthy. Sample from 2026-04-23 17:30 UTC:

degraded  https://alphavantage.mpp.paywithlocus.com/alphavantage/fx-daily

Compare to tempo gateway rows (*.mpp.tempo.xyz), which sample as healthy:

healthy   https://goflightlabs.mpp.tempo.xyz/flights-history

Both gateway

Read the thread · 2026-04-23 · closed · 2 comments

Spec: Fix mcp-server test-script glob bug + close CI coverage gap + pre-publish schema validation

Supersedes #169 #216

Problem

The mcp-v0.3.0 tag push on 2026-04-23 triggered .github/workflows/publish-mcp.yml and failed at Step 6 "Run MCP server tests" with exit code 1 after 3 seconds in that step (15s into the job, 26s total). Root cause: the test script in mcp-server/package.json is

"test": "npm run build && node --test test/**/*.test.js"

The ** globstar only expands in bash with shopt -s globstar enabled. npm executes scripts through /bin/sh (dash on U

Read the thread · 2026-04-23 · closed · 1 comment

The remaining reports are on the project's issue tracker.