Add x402 Bazaar plugin (read-only onchain data & AI reports, x402)

[sukrutkrdg]

Adds x402 Bazaar — a read-only external-mcp plugin exposing 40+ Base data/AI
services (token risk, wallet intelligence, OFAC sanctions, prices, NFTs, AI
token/wallet reports) via the x402-bazaar-mcp server. Paid per call in USDC
over x402; no transactions (Submission: none). Complements Base MCP actions
with the intelligence layer agents need first.

MCP: https://www.npmjs.com/package/x402-bazaar-mcp

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 1 Sum 2

[sukrutkrdg]

Friendly bump 🙏 Happy to make any changes that'd help this land x402 Bazaar is a read-only external-mcp data/intelligence plugin (token risk, wallet intel, OFAC, AI reports) for Base agents.

Live at 402.com.tr, MCP on the official registry. Thanks for maintaining this

[sukrutkrdg]

B20 is now live on mainnet — and as of this launch, x402 Bazaar's b20_safety reads the B20 token precompiles directly (supplyCap, isPaused, policyId(TRANSFER_SENDER/RECEIVER_POLICY), multiplier) to flag freeze and burnBlocked-seize risk into a single hold/caution/avoid verdict. Per the IB20 spec, burnBlocked can only hit a holder that isn't authorized under TRANSFER_SENDER_POLICY, so the seize surface maps cleanly to whether a sender policy is set — no role enumeration needed.

Believe this is the first B20-aware safety check on Base. It's read-only (returns data, never transacts) and complements Base MCP's action side. Happy to adjust the plugin doc to any review notes. Thanks for taking a look!

[sukrutkrdg]

Quick correction to my note above: B20 mainnet activation slipped a few hours (a GitHub issue) and is expected shortly — saying it was "now live" was premature, apologies. The b20_safety code is wired and ready (reads supplyCap/isPaused/policyId/multiplier from the token precompiles); I'll confirm live precompile reads the moment activation lands.

[sukrutkrdg]

Confirmed live ✅ — tested b20_safety against a real B20 stablecoin (NADT, 0xb20000000000000000000186a08e781c38059eec) on mainnet. It reads the token precompiles and returns isB20: true, variant: stablecoin, symbol: NADT, and a risk verdict (no sender/receiver policy → not freezable/seizable, not paused, supply-capped → hold). The earlier RPC flakiness is fixed (sequential reads + retry instead of parallel calls that tripped the public RPC rate limit). Working end-to-end — believe it's the first B20-aware safety check on Base. Happy to adjust the plugin doc to any review notes.