$ cat /about
A community directory for the agent protocol frontier
# What is a2alist.ai?
a2alist.ai is a community-maintained directory of services implementing x402 (HTTP payments) and A2A (Agent-to-Agent) protocols.
We track live deployments, monitor uptime, aggregate GitHub stars, and provide a single place to discover what's being built on these emerging protocols. Hacker-focused, data-dense, no fluff.
# What is x402?
x402 brings native payments to HTTP using
402 Payment Required.
- → Machine-to-machine payments — no accounts, no API keys, no invoices
- → USDC on Base (Coinbase L2) — fast, cheap, stable
- → Pay-per-request or paywalled content — any HTTP resource
- → Open standard backed by Coinbase
# What is A2A?
A2A (Agent-to-Agent) is Google's open protocol for AI agents to discover and communicate with each other.
- → Agent discovery via
/.well-known/agent.json - → JSON-RPC for agent-to-agent communication
- → Skills, capabilities, and auth advertised in agent card
- → Emerging standard — early adopters are building now
# How to Get Listed
Two ways to submit your service:
Pay via x402 protocol — proves you're serious and familiar with the tech. Submission enters review queue.
Submit via A2A protocol — your agent talks to our agent.
# Trust & Security
Our Security Review Process
Every listing on a2alist.ai undergoes a 6-category threat model audit before receiving a Safe badge:
We verify x402 endpoints deliver value after payment, check for wallet address reuse across suspicious projects, and flag unreasonable pricing.
We check whether agents request unnecessary permissions, ask for PII or credentials, or have outbound data flows to third-party domains.
We test whether agents return responses that could inject instructions into calling agents, including hidden text and zero-width characters.
We check for typosquatted domains, false affiliation claims, and verify WHOIS registration age.
For open-source projects, we check for obfuscated code, suspicious dependencies, and post-install scripts.
We verify the service is running, implements the claimed protocol correctly, and has a real team behind it.
Rating System
Passed all 6 categories. Re-audited periodically.
Minor concerns noted, or still under closer review.
Not yet audited. Listing presence does not imply endorsement.
Automated Pipeline
New agents are discovered weekly by our scout, then reviewed by our security agent before human approval. No listing goes live without passing the threat model.
Community resource, not a product. a2alist.ai is maintained by hackers building on x402 and A2A. No VC funding, no growth metrics, no ads. Just a directory for the frontier.