Pulsefeed X402 MCP Server

Two questions an agent must answer before it acts, and neither is answered by a scanner that only looks at the present.

1. Is this x402 endpoint safe to pay? Liveness, a 0-100 trust score, scam flags (receiver swapped, catalog price differs from the challenge price, honeypot receiver, testnet listed as production), a pay/avoid verdict and on-chain proof links on Base. The 402 challenge itself is validated against the x402 protocol schema, so a malformed challenge is never reported as payable.

2. Did this MCP server or npm package change after people adopted it? An install script added in a later version, ownership swapped, repository removed, package unpublished, build provenance lost. Static scanners cannot answer this: a rug pull is clean at review time by construction. Answering it requires yesterday's snapshot to exist, which is why the series starts on 2026-07-30 and cannot be reconstructed after the fact.

PulseFeed re-audits the whole MCP registry every night, diffs it against the previous day, and re-probes the x402 endpoint population daily. Eleven tools, all free, no key, no account. Pass your own dependency list to mcp_drift_check and get back only what moved.

Corrections are public. We once published that 76% of x402 endpoints were dead; that measured our own parser, not the market, and the figure was corrected twice more. Every correction lives at pulsefeed.dev/correction. Retracted events are never deleted: the record is append-only, a retraction is an appended line, and the original stays available on request.