BotsRated

Dependency Watch: What Changed In The Services Your Agents Use

Paste the paid x402 sellers and MCP servers your agents already call, upload your mcp.json, or paste the public payTo addresses you've paid. You get what we measured for each one, with links to the signed records. Recent measured history, from October 23, 2026 (when our checks started); it grows every day. Free, no account.

Public 0x (EVM) addresses only. We compare them to the payTo addresses our unpaid checks already quoted; we don't read the chain and we don't store them. Never paste a private key or seed phrase.

From an mcp.json we read only each server's URL hostname. Commands, args, env and headers (where API keys usually live) are ignored and never stored or shown. We never fetch anything named in your file, and we don't store the report.

Email Me When This Changes (Coming)

Not available yet. When it opens it will use double opt-in, as our Privacy Policy describes: we keep your address only after you click the confirmation link. Today you can get alerts by webhook (a Slack or Discord channel webhook works too): alerts.

JSON: POST /v1/dependency-watch/report with {"text": "<hosts or mcp.json>"}. BotsRated covers the sellers and MCP tools you call; BotPulse covers the packages and rails you build on.