AI Product Index

Plus the surfaces whose whole job is to make the routes above findable by something that only knows the domain:.well-known/mcp.json(MCP server card — SEP-1649/2127 are draft, so it carries only the fields both drafts agree on),opensearch.xml(still the one format that turns a bare domain into a callable search box),feed.xml+feed.json(a directory that gains entries is a feed), and.well-known/ai-plugin.json(superseded, and probed often enough that answering costs less than the 404s). A test asserts the manifests cannot advertise a route the Worker does not have.

Write paths (the autonomous transactions)—.github/workflows/register.yml, gated on issue-title prefix (not a label, which REST-API agents couldn't set):

- [register]— new listing.scripts/process-issue.mjs(input via env only, never shell-interpolated): 20 KB cap → parse (``json fence or bare body) →validate()→ unique slug + normalized-URL dedup → ≤ 10 listings per GitHub account → liveness check (product URL must answer < 400 in 10 s) → write reconstructedlistings/<slug>.json.
- [update]— full replacement of an existing listing; only the originalgithub_user(or the repo owner) may update;created/github_user/tierpreserved,updatedstamped.
- [upgrade]— paid tier change ({"slug", "tier": "verified|featured", "rail": "x402", "receipt": {"transaction": "0x…"}}): ownership + shape checks, then on-chain receipt verification viascripts/x402-receipt.mjs— the transaction must have succeeded, have enough confirmations, and contain an ERC-20Transferof at least the tier price in the configured asset topayments.x402_address. Spent transaction hashes are burned into the committedpayments.jsonledger so one payment cannot buy two upgrades. Rejectspayments_not_enabledwhile the rail is unconfigured;rail: "card"returnsmanual_reconciliation.
- All modes: build + commit + push with a reset-and-redo retry loop ×3 (not an Actionsconcurrencygroup, which silently cancels queued runs; afterreset --hardthe dedup re-runs, so a lost race fails cleanly), then a machine-readable bot comment ({"ok":…,"code":…,"errors":…}) and issue close. Pages redeploys on the push (~1 min).

Tiers:free<verified<featured— paid tiers sort first in the index and get a badge. Manual flip (e.g. after an out-of-band payment):node scripts/set-tier.mjs <slug> <tier>, then commit + push.

Health—.github/workflows/health.yml(Mondays 04:17 UTC + manual dispatch):scripts/check-liveness.mjsre-checks every listing URL; strike state in committedhealth.json;3 consecutive weekly failures delist(page 404s, registry updated); failures/delistings reported as a GitHub issue.

Catalog liveness—scripts/probe-catalogs.mjs, same weekly cron: neither upstream registry checks whether its entries still answer, so a rotating sample of both catalogs is probed and the results published atapi/{x402,mcp}/health.json. Every stride-th row rather than a contiguous window — these files are sorted, so a neighbourhood is not a sample (placeholder URLs are 1.6% of the MCP catalog but were 54% of its first 120 rows) — with the cursor advancing one per run, so a full pass still covers every entry exactly once.A 402 or 401 counts as answering: the question is whether anything is listening, and only transport failures and 5xx count against an entry. Two consecutive misses before anything is called dead; searchflags and never hides, since one weekly probe from one network path is evidence rather than proof.

MCP server—mcp/server.mjs: zero-dependency stdio JSON-RPC (initialize/ping/tools/list/tools/call). It imports its tool definitions fromworker/discovery.jsand forwardstools/callto the hosted/mcp, so the two servers cannot drift;tools/liststays offline because registry health checks introspect it in a sandbox with no network. Addsregister_product(opens the[register]issue; needs envGITHUB_TOKEN, public_repo), which is the only reason to prefer stdio — a token on a public Worker is a credential waiting to leak. Install:claude mcp add ai-product-index -- node <clone>/mcp/server.mjs, or skip the clone entirely withclaude mcp add --transport http ai-product-index https://index.percall.dev/mcp.

Security model: all HTML text/attributes through oneesc(); hrefs only from scheme-allowlisted (http/https, public-host) URL fields; JSON-LD<-escaped against</script>breakout; slug regex + resolved-path assertion stop path traversal; accepted objects rebuilt field-by-field from an allowlist (no__proto__write-through); workflow token scoped tocontents: write, issues: write.

The free/paid boundaryis a whitelist, not a delete.freeView()inscore.jsnames the fields the free tier keeps, so a field added to the audit later cannot leak into it by omission — and a test asserts a hypothetical new paid field stays out. The free tier deliberately answers "do I have a problem, and roughly where"; the paid tier answers "here is the code that fixes it".

Payment security— the facilitator verifies signatures and balances; it has no idea what we charge, soworker/x402.jsis what stops a client from paying one atomic unit to an address of its own choosing:

- every field of the client'sacceptedblock is compared against our own requirements (scheme, network, asset,payTo, amount), and theauthorization is checked independently— a payload with a correct-lookingacceptedblock but an authorization paying elsewhere is rejected;
- amounts compare asBigInt, so"1e5"," 10000"and"-10000"never pass as"10000";
- the nonce isreserved in KV before settling, so a concurrent replay loses the race instead of settling twice;
- the audit target passesurlError()(public http/https hosts only)before any charge— nobody pays for a request we would reject.

.github/workflows/deploy.ymlruns tests, asserts the committed build is not stale, thenwrangler deployon every push tomain. It skips the deploy with a notice while the two Cloudflare secrets are unset, somainstays green instead of collecting red Xs nobody reads.Deployed and green since 2026-07-25; the setup below is recorded for a rebuild, not outstanding work. One-time setup:
- npx wrangler kv namespace create PAYMENTS→ put the id inwrangler.toml.
- Repo secretsCLOUDFLARE_API_TOKEN(Workers Scripts: Edit) andCLOUDFLARE_ACCOUNT_ID.
- Pointindex.percall.devat the Worker —gh workflow run cf-admin -f action=attach-domain -f hostname=index.percall.dev(the zone must be on the Cloudflare account and the token needs its zone rights).
- Optional, for/api/stats.json:npx wrangler secret put CF_ACCOUNT_IDandCF_ANALYTICS_TOKEN(Account Analytics: Read). Without them the endpoint reportsstats_not_enabledrather than pretending.

Locally, run it withnpx wrangler dev --local --persist-to /tmp/seo-wstate. The--persist-tooutside the repo matters: the asset directory is the repo root, so wrangler's state dir otherwise lands in the watched tree and reload-loops forever.