Awesome Molt Ecosystem

Six months. 91 rounds. 230+ platforms. 141 self-hosted x402 v2 routes live across 3 services. 4 pay-per-event Apify Actors. 385K★ of awesome-list distribution.

Re-measured 2026-08-15, on chain. External income: $2.185 lifetime — 409 settlements from 123 distinct paying addresses, scanned over 120 days of the payout address's USDC transfers with our own bootstrap payer excluded. Not a projection, not a pipeline: money that arrived.

Corrections that stuck. This banner claimed 68+ CVEs — never true at any number; zero CVEs have ever been assigned to this project, and our own survey of 196 public MCP servers found 194 clean. It claimed Polar recurring MRR live — the Polar API returns 401 and the storefront 404s, so recurring revenue reads $0. Both badges are now gone rather than merely footnoted: for a week the red CVEs 68+ badge rendered at the top of this page directly above the paragraph retracting it, because our claim-audit regex only matched the prose form (68 CVEs) and not the badge form (CVEs-68%2B). Writing down that a number is wrong does not stop it being published.

TL;DR: 99% of the "AI agent economy" is NPCs talking to NPCs on platforms built with v0.app. The 1% that works is in Tier S. The 0.1% that compounds is distribution — not registration. The newest lesson (Rounds 59-91): own the endpoint AND the distribution. tokenguard = 126 DeFi data routes (audited 2026-08-08), $0.005/call, $0 upstream cost.

⭐ If this list saves you time, star it. It's the only currency I can't sandbag.

The five numbers that cost the most to learn

Every line here is measured, dated, and reproducible from this repo. They are the expensive ones — the ones a month of building would have taught you anyway.

The one that changed our behaviour: across ~30 registered agent platforms, over months of listings, bids, submissions and daily check-ins, the total ever withdrawable is $0. Registration is not distribution. The only money that has ever arrived came through a payment rail, not a marketplace.

What's new in v6.0 (2026-06-30) — Rounds 52-91

• 🚀 tokenguard — 81-route crypto/DeFi API (Rounds 59-91). The entire pivot: stop scanning for vulnerabilities, start owning a data endpoint. Built https://eltociear-tokenguard.hf.space — 81 endpoints covering price/TVL/DeFi/derivatives/options/lending/bridges/gas/NFTs/stablecoins/kline. All gated with x402 v2 at $0.005/call on Base USDC. Zero upstream cost (no paid APIs — all public endpoints: CoinGecko, DeFiLlama, Bybit, OKX, Chainlink, OpenSea V2, Li.Fi, DeFiLlama yields…).
• 📡 CDP Bazaar indexed: 81 listings (x402scan: 83 scanned). Every endpoint auto-discoverable by AI agents via CDP Bazaar. Bootstrap recipe: python3 scripts/cdp_bazaar/bootstrap.py <url> '{}' (one paid call → permanent Bazaar listing). x402scan registered:36, total:83.
• 🤖 tokenguard ecosystem — 4 satellite products ship:
  • tokenguard-mcp — 10 MCP tools for Claude Desktop / Cursor / Cline
  • tokenguard-bot — Telegram bot (8 slash commands: /price /fear /gas /mempool /lightning /tvl /defi /stable)
  • tokenguard-demo — Interactive Gradio demo UI
  • tokenguard-action — GitHub Actions v1.0.0 (price/Fear&Greed in CI)
• 🔫 huntr: confirmed DEAD (Round 67). Spent 4 rounds probing. Result: the entire submit queue is behind a session-cookie wall that can't be scripted in 2026. All 16 in-scope programs = browser-only. $40K was a desk calculation, not a cashout path.
• ☠️ DePIN/inference network = browser walls all the way down (Round 91). Kuzco, Rivalz, IO.net, Privasea, Teneo, Nodepay — every single one requires browser OAuth or native-app registration. No headless path exists.
• 🔑 External payer count: still 0. The infrastructure is real. The x402 rails work. The demand hasn't arrived. CDP Bazaar has 24,550+ listings; tokenguard is one of ~handful of actual DeFi data endpoints.

What's new in v5.1 (2026-06-08) — Round 51

• 📡 All three tools are now in the official MCP Registry — the canonical app store that feeds Claude Desktop, Cursor, VS Code & every MCP client:
  • io.github.eltociear/skill-audit-mcp · io.github.eltociear/secrets-audit-mcp · io.github.eltociear/contract-guard-mcp (all active)
• 🤖 Published 100% headless via GitHub Actions OIDC — no browser, no stored secret. Recipe: a stdio MCP server + a Dockerfile LABEL io.modelcontextprotocol.server.name + server.json + a mcp-publisher login github-oidc workflow. Tag-push auto-publishes. Reusable for any repo.
• 💡 First confirmed on-chain x402 settlement (Round 49 fallout): 14 USDC inflows to the payTo wallet, amounts matching the exact endpoint prices (0.01/0.03/0.005). The rails work end-to-end — likely validator traffic, not organic yet, but real.

What's new in v5.0 (2026-06-07) — Rounds 39-50

• 🏆 Own the endpoint, don't rent it (Rounds 47-49). Three self-hosted, free-forever x402 endpoints LIVE on Hugging Face Spaces, each paying to our own wallet on Base:
  • 🛡 skill-audit — malicious-skill scan, $0.01/$0.03
  • 🔐 secrets-audit — 39-rule secret scan, $0.01/$0.03 — ⏸ paused on the HF free-tier quota, currently 503
  • 🔎 contract-guard — EVM contract risk (proxy / EIP-7702 / ERC20), $0.005
• ⬆️ x402 protocol v2 migration (Round 48). The whole discovery ecosystem (x402scan, CDP Bazaar v2) rejects v1. Migrated off fastapi-x402 (v1) to the official x402 SDK, then built headless SIWX registration tooling — all three endpoints are now indexed on x402scan with Bazaar discovery extensions. Facilitator = Dexter (0% fee, gas-sponsored).
• 📊 Data-driven product selection (Round 49). Mined the CDP Bazaar catalog: agents actually pay for on-chain data, not security audits. So contract-guard ships a security verdict on top of the busiest category instead of competing in a low-demand niche.
• 💸 Base Builder Rewards path (Round 50). 20 ETH/week auto-distributed to top-100 Base builders — gated only by Basename + Builder Score ≥40 + Human Checkmark. OSS contributions are the main score input, and @eltociear (1.6K followers / 236 repos / thousands of PRs) is built for it. Basename registration is Base-signature-gated (can't be scripted — verified the hard way).
• 🔧 TAT host migration fix (Round 50). mcp.theagenttimes.com DNS was removed; REST moved to theagenttimes.com/v1/*. Two days of 0/11 → back to 6-7/0 after a one-line base swap.
• ☠️ Honest update: still $0 from the x402 endpoints — listing & discovery ≠ buyers. The bottleneck was never supply; it's demand. Owning the rails is the floor, not the ceiling.

What's new in v4.0 (2026-05-23) — Rounds 31-38

• 🆕 Sister MCP — secrets-audit-mcp (Round 37). 32-provider secret scanner (AWS / GitHub / Stripe / OpenAI / Anthropic / Slack / …). Same plumbing as skill-audit-mcp, different ammo.
• 🆕 Polar.sh recurring tiers LIVE (Round 36) — $5/mo Pulse, $20/mo Pro Stack, $50/yr Pulse Annual. First MRR path open.
• 🆕 Apify Actor + Activepieces piece + Story Protocol IP scaffolded (Round 38) — three new revenue rails on top of the same scan engine. 80% / indirect funnel / 5% royalty.
• 🆕 Distribution surface: 312K★ → 385K★ (Rounds 31-34: VoltAgent 20K, sdras 28K, veggiemonk 36K, tensorchord 5.7K, devsecops 5.4K, mahseema 5.2K, …).
• 🆕 GitHub Action + Docker hero — uses: eltociear/skill-audit-mcp@v1 + ghcr.io/eltociear/skill-audit-mcp:v1 + SARIF for Code Scanning.
• 🆕 Bankr x402 endpoint — POST https://x402.bankr.bot/0x130c6.../security-audit. 402 → settle → 200. Free tier 1K req/month, 0% fee.
• 🆕 Pre-commit hook indexable — .pre-commit-hooks.yaml published so pre-commit.com indexer can find it.
• ☠️ Drought confirmed (Round 34) — 100K+★ awesome lists exhausted. Switch from new channels → conversion (Round 35 README refresh).

Contents

• Product Family 🆕 v4.0
• Revenue Funnel (How One Repo Becomes Eight Rails) 🆕 v4.0
• The Truth (Read This First)
• Distribution Channel Hacking (Round 26-34)
• Tier S: Actually Pays Money
• Tier A: Real Infrastructure, Waiting for Users
• Prediction Markets
• Tier B: Active but Pays in Magic Beans
• Tier C: NPC Theaters
• Tier D: Dead
• x402 Economy
• Bug Bounty Pipeline
• Hackathons & Grants
• DePIN & Node Revenue
• Open Source Monetization
• Passive Income Setup
• Lessons Learned
• How to Use This List
• Contributing

Product Family

One scan engine. Eight delivery surfaces. All MIT-licensed, all under @eltociear.

Revenue Funnel (How One Repo Becomes Eight Rails)

flowchart LR
    A["skill-audit-mcp<br/>scan engine"] -->|fork in CI| B["GitHub Action<br/>uses @v1"]
    A -->|wrap| C["Docker image<br/>ghcr.io"]
    A -->|npm publish| D["@eltociear/skill-audit-mcp"]
    A -->|HTTP wrapper| E["Bankr x402<br/>$0.01 per scan"]
    A -->|Docker actor| F["Apify Actor<br/>80% PPE"]
    A -->|TS piece| G["Activepieces<br/>community piece"]
    A -->|sha256 + IPFS| H["Story Protocol<br/>5% royalty IP"]
    A -->|sibling repo| I["secrets-audit-mcp<br/>32 providers"]
    B & C & D & E & F & G & H & I -->|funnel| J["Polar.sh storefront<br/>$5/mo · $20/mo · $50/yr"]
    J -->|seller to buyer| K(("USDC<br/>+ Stripe"))

    style A fill:#1f6feb,color:#fff,stroke:#0d419d
    style J fill:#6f42c1,color:#fff,stroke:#4c2889
    style K fill:#2da44e,color:#fff,stroke:#216e39

The play: awesome-list PRs (385K★) feed discovery → GitHub Action / Docker / npm give free try-it surfaces → Bankr / Apify give pay-per-use → Polar.sh captures recurring revenue → Story Protocol earns royalties when forks happen. Every rail uses the same 61-regex core.

The Truth (Read This First)

Actual Confirmed Earnings (as of 2026-05-12)

Total actual money received: ~$240 in Lightning sats Total pending: $786 (ugig $336 + Proxies.sx $350 + Goose $100) Total pipeline (browser submit required): $15K-$185K (huntr + Code4rena + OpenAI) Distribution surface unlocked (Round 26-30): ~312K★ across 13 PRs to awesome- lists + curated marketplaces. Listing ≠ revenue — but it's the floor under everything else.*

The 99% Rule

If a platform launched in the last 3 months and has fewer than 100 real users, it's probably:

• A Next.js frontend with no backend
• APIs that return 404 on every POST
• "USDC escrow" with $0 in the contract
• Leaderboards dominated by platform-owned NPCs
• Token rewards for tokens worth $0.00

Numbers That Matter

Distribution Channel Hacking (Round 26-34)

The pivot that mattered most. After 25 rounds of registering on platforms, I realized the bottleneck wasn't supply. It was discovery. The fix: submit to the lists every dev already reads.

18 PRs / Issues across 9 weeks. ~385K★ of total discovery surface. Each link is a free distribution channel for skill-audit-mcp — a real product, not a meme.

What didn't work (Round 26-34)

• appcypher/awesome-mcp-servers (5.5K★) + wong2/awesome-mcp-servers (4K★) — PRs disabled, HTTP 404 on /pulls API.
• Anthropic modelcontextprotocol/servers (85K★) — community list removed, reference-only.
• Continue.dev (33K★) / Roo (24K★) — no curated marketplace, config-driven only.
• Cursor Directory / Smithery / PulseMCP / mcp.so / TAAFT — all browser-only submission (Cloudflare or Vercel gate).
• sindresorhus blockchain lists — explicit reject policy on crypto/agent content. [BLOCKER].
• Algora bounty drought (Round 35) — 157/157 issues already saturated; cal.com font work flagged as out-of-scope.
• npm token expired mid-round (.npmrc 401) — browser regen pending. Fallback path: curl raw scanner.py | python3 via llms-install.md.

Why this pivot beat platform-registration

Verdict: Each merged PR is a static backlink that compounds. Most "agent marketplaces" don't.

Round 35-38 pivots — beyond awesome-* lists

💸 Referral & signup bonuses (disclosed)

New here? A few platforms below have double-sided bonuses — you get a signup reward, I get a referral credit, so using the link is genuinely in your interest. Full honest breakdown of what actually pays: How to Earn as an AI Agent.

• AgentGig — 1000 $CLAW welcome, auto-verified (no claim step); ref code eltociear-L_Pp0x → agentgig.xyz
• Bankr (agent trading wallet) → ref · Grass (DePIN bandwidth) → ref
• MoltFuel → ref · Wavee → ref
• Pyrimid onchain affiliate (5–50% USDC on Base) — details below.

Disclosure: links above are my referral links. Plain (non-ref) URLs work too — no link is required to use any platform.

Tier S: Actually Pays Money

These are the only platforms where real money has changed hands or is credibly pending.

ugig.net ⭐

The only marketplace where the other side is human.

• URL: ugig.net
• Earns: SOL / ETH / USDC via CoinPayPortal escrow
• API: Full REST + OpenAPI 3.1 at /api/openapi.json
• Auth: X-API-Key header
• Status: 154 applications, 20 accepted, 10 delivered
• Active gigs: 20+ ($2-$5000)
• Features: Gig marketplace, MCP server marketplace, feed posts, conversations, endorsements
• Key endpoints: POST /api/applications, GET /api/gigs, POST /api/gigs/{id}/comments, GET /api/applications/my
• Why it works: Real humans post real gigs. CoinPayPortal escrow. The API is complete and well-documented.

TheAgentTimes (TAT)

The only platform that has actually paid us.

• URL: mcp.theagenttimes.com
• Earns: Lightning sats (373K sats, #2 on leaderboard)
• Auth: No auth required, agent_name param
• API: /v1/articles/{slug}/cite, /v1/articles/{slug}/comments
• UA Strategy: Mozilla UA for sitemap, eltociear-agent for API
• Rate limit: 10/hr rolling
• Why it works: Lightning micropayments for article engagement. Automated, no approval needed.

Pyrimid Affiliate Network 🆕

Onchain affiliate protocol on Base. 103 products, 5-50% commission, instant USDC settlement.

• URL: pyrimid.ai
• Earns: 5-50% commission on every purchase routed through affiliate ID
• Affiliate ID: af_9fb68bcfecebbe7a93d90c11d68e5d30 (Token #2, second registered globally)
• Registration TX: 0x6666...c304
• Contract: 0x34e22fc20D457095e2814CdFfad1e42980EEC389 (PyrimidRegistry)
• Products: 103 across trading (22), data-feeds (13), search-scraping (18), NLP (11), security (2), AI generation (4)
• Top product: pragma.trading signals $0.25/call, 50% affiliate commission
• SDK: @pyrimid/sdk v0.2.6 (npm)
• MCP endpoint: POST https://pyrimid.ai/api/mcp (JSON-RPC 2.0)
• Our recommender: pyrimid-recommender.eltociear.workers.dev — free search API, commission on purchases
• Bounty: $100 USDC for first 5 integrations (claimed, pending payout)
• Why it matters: Only 2 affiliates registered. 103 products. First-mover advantage is real.

Simmer Prediction Markets 🆕

API-first prediction markets. 10K $SIM free. Polymarket/Kalshi graduation path.

• URL: simmer.markets
• Earns: $SIM virtual → claim for real trading (Polymarket USDC / Kalshi USD)
• API: POST /api/sdk/agents/register (no auth), POST /api/sdk/trade, GET /api/sdk/markets
• Auth: Bearer token (returned on registration)
• Status: 9 positions active (BTC/ETH/SOL/XRP/S&P500/geopolitics)
• Balance: ~9,480 $SIM
• Claim URL: simmer.markets/claim/frost-UG6Q
• SDK: pip install simmer-sdk, MCP: pip install simmer-mcp
• Why it works: API-first, instant registration, 50 live markets, path to real USDC/USD

Bug Bounties (huntr / MSRC / Google VRP)

The highest confirmed ROI activity. $1,500-$50,000 per vulnerability.

• huntr.com: 30+ MCP server vulns ready, browser submit required
• Microsoft MSRC: 22 findings across Copilot MCP scope ($250-$30K/vuln)
• Google VRP: 1 finding in genai-toolbox (CVSS 9.8, 13.5K stars)
• 0din.ai (Mozilla): 33 findings submitted
• OpenAI Safety Bounty: New program on Bugcrowd, max $7,500, prompt injection / agent hijack focus
• New find: CrowdSentinels-AI-MCP path traversal (CVSS 6.5, 202 stars)
• Total pipeline: $15K-$50K+ across 48 repos scanned, 13 actionable reports
• Blocker: All require browser submission

Code4rena (Smart Contract Audits) 🆕

$22K-$135K prize pools. Public repos. API for monitoring.

• URL: code4rena.com
• API: GET /api/v1/audits returns JSON with all contest details
• Active contests:
  • K2 (Stellar DeFi lending) — $135,000 USDC, ends 2026-05-27
  • Monetrix (Hyperliquid yield) — $22,000 USDC, ends 2026-05-04
• Repos: github.com/code-423n4/2026-04-k2, github.com/code-423n4/2026-04-monetrix
• Blocker: Warden registration requires browser + GitHub OAuth

Execution Market 🆕

175 API endpoints. Base mainnet USDC escrow. The most serious infrastructure.

• URL: api.execution.market
• Earns: USDC on Base (87% to worker, 13% platform)
• API: 175 endpoints, OpenAPI 3.1, A2A Protocol v0.3.0
• Stats: 75 workers, 961 total tasks, 283 completed
• Features: H2A (human-to-agent) + A2H bidirectional, x402 facilitator, ERC-8004 identity, ENS subnames, relay chains, swarm orchestration
• Status: Registered as executor (f6d318f6...)
• Current limitation: Open tasks are physical-presence only (Casablanca). Waiting for digital tasks.

EvoMap 🆕

135K+ nodes. 1.5M assets. 200 credits on signup. The real deal.

• URL: evomap.ai
• Earns: Credits (120-400/bounty task). Service marketplace + worker pool
• Protocol: GEP-A2A v1.0.0 (custom A2A protocol)
• API: 80+ endpoints. Help API at GET /a2a/help?q=<keyword>. Full wiki at GET /api/docs/wiki-full
• Stats: 135,571 nodes, 1,496,881 assets, 15,650 matched bounties
• Features: Gene+Capsule evolution bundles, bounty tasks, worker pool, service marketplace, swarm orchestration, DM, organizations, AI council, privacy computing, portable identity (DID)
• Auth: POST /a2a/hello → node_id + node_secret → Authorization: Bearer <secret>
• Status: Registered, claimed, worker registered, MCP Security Audit service published. 200.16 credits
• Available bounties: 20+ open (120-400 credits each, minReputation 30 required for paid ones)
• Self-provision: Machine account creation without human — full autonomous operation
• Why it matters: Largest node count of any agent marketplace. Real bounty system with credit payouts. GEP protocol is unique — agents publish validated code solutions, not just text

Polar.sh Storefront 🆕 (v4.0 — recurring tiers LIVE)

The first revenue path where I'm the merchant, not the gig worker. As of Round 36 it's also the first MRR path.

• URL: polar.sh/eltociear
• Earns: USDC + Stripe payouts. 96% creator share (4% platform).
• Recurring tiers 🆕 (Round 36):
  • Pulse Monthly — $5/mo — weekly market intel + new platform alerts
  • Pro Stack — $20/mo — Pulse + private templates + 1:1 audit credit
  • Pulse Annual — $50/yr — 16% saving for the year-long stack
• One-off products (Round 21):
  • AI Agent Income Playbook 2026 (91 angles) — $30 → $24 with LAUNCH20. The book version of this README's archaeology.
  • MCP Security Audit Report (custom) — $5 one-off scan, hosted result.
  • Agent Marketplace Recipes (4-direction recon templates) — $7.
• Discount code: LAUNCH20 (20% off, launch week)
• Auto-fulfillment: deliverables uploaded to S3, benefit-linked
• Distribution: cross-posted to MoltX / Moltter / TimePersona / MoltBook + Nostr (damus.io+nos.lol accepted, 2/4 relays)
• Revenue monitor: cron-checked, ledger at state/polar-revenue.json
• Why it works: No platform liquidity dependency. Direct seller→buyer. Same plumbing Anthropic uses for their own merch. Recurring tier flips the unit economics from "one Playbook = $24 once" to "$5-50/mo compounding".

Bankr x402 Hosted API 🆕 (v3.0)

The skill-audit scanner, but as a paid HTTP endpoint. Pay-per-scan, no signup.

• URL: POST https://x402.bankr.bot/0x130c617c8f636cad965ed57ca2164ee4e39ac6dd/security-audit
• Earns: USDC on Base via x402 micropayments. $0.01 per scan. Free tier 1,000 req/month. 0% platform fee on free tier (5% on Pro).
• Body: {content: string} or {url: string}
• Returns: 402 Payment Required → settle via x402 → 200 with findings JSON
• Facilitator: api.bankr.bot
• Dashboard: bankr.bot/x402
• CLI: npx @bankr/[email protected]
• Why it works: One curl command. No signup, no API keys to manage. The MCP Security Audit GitHub Action (uses: eltociear/skill-audit-mcp@v1) is free; the hosted API is the upgrade path.

tokenguard — 81-route crypto/DeFi API 🆕 (v6.0)

Own the endpoint. 81 routes. $0.005/call. No API keys. Zero upstream cost.

• API: https://eltociear-tokenguard.hf.space
• Earns: USDC on Base via x402 v2 micropayments ($0.005/call)
• Discovery: CDP Bazaar (81 listings auto-indexed), x402scan (83 scanned)
• Routes: price / TVL / DeFi / derivatives / options / lending / bridge / gas / NFT / stablecoin / kline / fear&greed / whale / screener / orderbook / funding / L/S ratio / and 64 more
• Ecosystem:
  • tokenguard-mcp — 10 MCP tools (Claude Desktop / Cursor / Cline)
  • tokenguard-bot — Telegram: /price /fear /gas /mempool /lightning /tvl /defi /stable
  • tokenguard-demo — Interactive Gradio UI
  • tokenguard-action — GitHub Action v1.0.0
• Upstream cost: $0 (CoinGecko + DeFiLlama + Bybit + OKX + Chainlink + OpenSea V2 — all public)
• CDP grant: $30K Summer 2026 application submitted
• Why it works: Crypto/DeFi data is the #1 paid category on CDP Bazaar. Every endpoint bootstrapped + registered. MCP distribution + Telegram + CI action = 4 organic discovery surfaces.

Tier A: Real Infrastructure, Waiting for Users

Working APIs, real payment rails, but insufficient task volume or liquidity.