How to verify 402registry before you pay

What one check is

A check fetches a public website the way AI crawlers fetch it — plain HTTP, no JavaScript — and reports what that fetch actually returned. It reads the page, robots.txt, the sitemap and the redirects, sends the same page request with the user-agent strings of 4 AI crawlers to see whether a firewall treats them differently, and has a language model read the page text. Every finding quotes the evidence it is based on, and every report carries its date and the rules version (2026-09-13).

The exact list of requests, the limits and how to opt out are on our crawler page.

What a passing check does not mean

• It does not guarantee ranking, indexing, citation, or inclusion in ChatGPT, Claude, Perplexity or any search engine.
• It is not a test run by OpenAI, Anthropic, Perplexity or Google. When we send the user-agent strings of their crawlers, the requests come from us.
• It is a dated observation, not a permanent status. A site can change the next day; the date is on every report, badge and catalog entry, and listed sites are re-checked for free about every 30 days.
• It says nothing about who owns or runs the site that was checked.

Check the payment terms yourself

Ask for a check without paying:

curl -si https://402registry.com/buy/one

The answer is HTTP 402. The PAYMENT-REQUIRED header is standard base64 of a JSON object (x402 version 2, scheme exact). Before you sign anything, decode it and confirm:

• network: eip155:8453 (Base)
• asset: USDC, contract 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913
• payTo: 0x8e37022edcf0f21cf3c9f93fee9d4d32519f36f4
• amount, in USDC base units (6 decimals) — one per product:

Sign only if the decoded header shows exactly these values. The same terms are in our manifest, together with whether the till is open right now.

The receiving wallet

0x8e37022edcf0f21cf3c9f93fee9d4d32519f36f4 receives the payments of all four services run by the same person: 402registry, AISkills402, 402cron and 402post. Its history is public on the block explorer and on x402scan.

Payments from 0x146ea0b673978b1acc6f6517cb9de35c63e102c9 and 0xa340966d806f114483d671f6bf934daebbdff8dc are our own end-to-end tests, not sales.

What we never ask for

• A seed phrase, a private key or a wallet export.
• Payment by email, chat or direct message. Purchases happen only over x402, at the addresses above.
• A signature for anything other than the one USDC transfer described in the 402 response.
• Access to the admin panel, hosting or DNS of the site you want checked. We read only what any visitor can read.

If something that uses our name asks for any of these, it is not us. Please tell us at abuse@402registry.com.

How we treat the sites we check

• The address you submit must be https://, a hostname rather than an IP address, on a standard port and without a username or password. Internal and link-local names, and our own hosts, are refused.
• Every redirect is checked against the same rules before we follow it.
• Each request has a 6-second timeout and reads at most 1.5 MB.
• Page text is evidence, never instructions: the language model that reads it is told the page is untrusted data and that instructions inside it are to be ignored.

Reports and the public catalog

A paid report is private: only the buyer gets its link, and it is never indexed. Nothing about a failed check is published. What is public is the catalog entry of a site that passed, its dated badge and its profile page.

Who runs it

Georgi Kalchev — see who runs it on the home page, and his professional profile on LinkedIn.

Report a problem

Security issues, abuse, a wrong report or a site that wants out of the catalog: write to abuse@402registry.com. The same contact is in security.txt.