Capability brief · Independent · Not affiliated with Coinbase

The best agent surface we've reviewed, with one category still unbuilt.

Five findings. The first two are pure credit; Coinbase is genuinely ahead. Every finding reproducible with curl: exact command, exact status, exact observation. The ask is at the end, and it is small.

Method. Passive recon only: plain HTTP GETs of public pages and standard well-known paths, with a nonsense-path control to tell true 404s from soft responses, and content-type + body inspection on every 200. No auth, no fuzzing, no enumeration, no wall routed around. Captured 2026-07-14. Marketing/adoption figures cite public URLs and are labeled as reported.

Baseline, credited first, in full

Coinbase authored x402 (a web-native way for AI agents to pay per use), co-founded the x402 Foundation with Cloudflare, and, unlike every other institution we've reviewed, actually ships agent-legible surfaces. www.coinbase.com/llms.txt is a real, well-authored file that routes agents to Agentic Wallet, AgentKit, and x402. docs.cdp.coinbase.com ships a real llms.txt and a real A2A agent-card.json. This is the state of the art. The findings below are refinements at the edges: one stale file, one gap on the consumer host, and one genuinely new category, not a "you're behind" story.

The bottom line, in plain English

No jargon. Two of the five findings are pure credit: Coinbase is genuinely ahead. These are the three that turn into money or momentum.

Refresh the expired security file → diligence stops tripping on Coinbase at the door

Automated review tools read that one file first, and its date lapsed roughly two years ago; a one-line refresh means the first thing a scanner checks about Coinbase passes clean.

Put the agent card on the main site → an AI can do business on coinbase.com, not just read it

The capability already exists on the docs host; mirroring it to the consumer front door means an assistant that lands there can transact, closing the last gap on the very standard Coinbase authored.

Back the first proof-of-outcome merchant → the agentic-commerce thesis gets a physical-world example

Every agent-payable merchant indexed so far sells digital data; funding one that settles verified real-world work extends Coinbase's own "agents that transact" story from screens to the ground, and it already runs on Base.

Finding 1 · credit

A real consumer-domain llms.txt (the file AI assistants read first): the standard's author practicing what it published

Wherewww.coinbase.com/llms.txt
StatusHTTP 200 · text/plain; charset=utf-8 · 5,098 B · server: cloudflare
curl -s https://www.coinbase.com/llms.txt | head -c 200
# Coinbase & Coinbase Developer Platform (landing pages) > This file is for AI agents and automated tools ... start with Agentic Wallet ... AgentKit ... x402 (HTTP-native payments)

Most consumer domains 404 here. Coinbase ships a genuine agent index that disambiguates "agent + wallet" paths (Agentic Wallet vs Embedded vs Server Wallets vs AgentKit) and points to docs.cdp.coinbase.com/llms-full.txt for deep retrieval. Credited without reservation.

Why it matters: it makes the two findings below easy wins: you have already internalized the pattern; the gaps are extending it one host over and adding one merchant category.

Finding 2 · credit

A real A2A agent card (a file that lets other AI agents discover and call you) on CDP docs: JSON, not a soft-200

Wheredocs.cdp.coinbase.com/.well-known/agent-card.json
StatusHTTP 200 · application/json · protocolVersion 0.3 · server: Vercel
curl -s https://docs.cdp.coinbase.com/.well-known/agent-card.json | head -c 200
{"name":"Coinbase Developer Documentation","protocolVersion":"0.3", "preferredTransport":"HTTP+JSON","skills":[{"id":"coinbase", ...}]}

This is exactly the artifact Robinhood's consumer host only pretends to serve (there, agent-card.json returns an HTML shell). Coinbase's docs return real JSON with a named skill and transport binding. Credited.

Why it matters: it proves the capability lives in-house. Finding 4 is simply: it isn't on the consumer host too.

Finding 3

The consumer security.txt is real, and expired since mid-2024

Wherewww.coinbase.com/.well-known/security.txt
StatusHTTP 200 · text/plain · 117 B · Expires: 2024-06-01T00:00:00z
curl -s https://www.coinbase.com/.well-known/security.txt
# Coinbase Security Vulnerability Disclosure Contact: https://hackerone.com/coinbase Expires: 2024-06-01T00:00:00z <-- ~2 years past

The file points to a managed HackerOne program (good), but its Expires lapsed roughly two years before capture, and it carries no Encryption or Canonical field. RFC 9116 treats a past Expires as "should not be used." For the company defining agentic-payment norms, a stale machine-readable security signal is a precise, easily-fixed miss.

Why it matters: automated diligence agents read this exact file. An expired date is the one thing a scanner flags before it reads anything else you ship.

Finding 4

The x402 author ships no x402 well-known, and no A2A card, on its own consumer host

Wherewww.coinbase.com/.well-known/x402 · /.well-known/agent-card.json · /.well-known/ai-plugin.json
Statusall 404 (true 404s: a nonsense-path control also 404s via Cloudflare)
# control confirms these are real 404s, not blocks curl -s -o /dev/null -w '%{http_code}\n' https://www.coinbase.com/.well-known/x402 curl -s -o /dev/null -w '%{http_code}\n' https://www.coinbase.com/this-nonsense-control-xyz123.txt
404 (/.well-known/x402) 404 (nonsense control, same true 404)

The A2A agent card (Finding 2) lives only on docs; the consumer domain that does ship llms.txt has no agent card and no /.well-known/x402 discovery manifest. So an agent that lands on coinbase.com can read the prose index but cannot discover a callable agent endpoint or an x402 payable surface there, from the very company that authored the x402 discovery pattern.

Why it matters: this is a one-file extension of what you already ship on docs. Mirroring the docs agent card to www.coinbase.com and adding a consumer /.well-known/x402 closes the gap and models the standard on your highest-traffic host.

Finding 5 · the opportunity

Every x402 merchant indexed so far sells a digital API. None settle a verified physical outcome

x402 and Agent.market/the Bazaar have proven agents will pay for digital services: API calls, data, compute. The category that closes the loop between the onchain economy and the physical one is a proof-of-outcome merchant: an agent pays, and what settles is a verified real-world result with an immutable receipt. That merchant type does not exist in the directory yet.

EcoWealth is that merchant, live today, on your rails: standard accepts[] emitted, EIP-3009 exact-scheme accepted, self-settled with no facilitator. Discoverable at vealth.net/.well-known/x402 (22 endpoints); settlement on the EWP contract 0x76c17C…A14B on Base mainnet (workId 14 settled); board 7,624 postings / ~$671k posted (vealth.net/labor/stats). Pay $0.10 → get a bounded ecological work packet → its completion writes a tCO2e retirement receipt.

Why it matters to Coinbase: your agentic-commerce thesis needs merchants to be real for the flywheel to spin. A proof-of-outcome category extends the story from "agents buy data" to "agents fund verified physical work", and the first such merchant is already standard-conformant and running on Base.

The ask

Proof first, then one small step tied to your own agentic-commerce thesis. The deliverable is an on-chain receipt settled over your own standard.

Index one merchant. List EcoWealth's work-packet program in Agent.market / the Bazaar as the first proof-of-outcome category: it already emits standard accepts[] and self-settles.
Make one machine payment. One CDP Agentic Wallet, one x402 call $0.10 USDC on Base → settled payment + on-chain proof receipt.
Fund one packet. Back one proof-verified ecological packet ~$10 → the tCO2e retirement receipt that extends your onchain-economy story to physical outcomes.
← Back to the cover
Provisioned by EcoWealth · Digital Provisioning Protocol · provenance‑sealed