Repository navigation
Weekly dependency audit: one issue while a high or critical finding is open - #61
Merged
Merged
Conversation
mpp-pay from x402-doctor (#139): the agent sends USDC.e on Tempo with the MPP memo and answers with the transaction hash, checked on a Tempo RPC; the 402 then carries an evm and a tempo challenge and /openapi.json lists both offers. Off until MPP_TEMPO_RECIPIENT is set. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TsD5haPKxeWjYmErHzvU48
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TsD5haPKxeWjYmErHzvU48
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TsD5haPKxeWjYmErHzvU48
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TsD5haPKxeWjYmErHzvU48
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TsD5haPKxeWjYmErHzvU48
A 402 with a payment that was refused now logs network (from the x402 payment header, or the MPP credential's method: evm = base, tempo = Tempo), so the usage log can show which network traffic comes from. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TsD5haPKxeWjYmErHzvU48
…ithub.com/Fizzl13/SmartContractExplainer into claude/x402-agents-solana-payments-nceg9b
On mainnet the paid routes also accept the same dollar price in RLUSD on the XRP Ledger, to XRPL_PAY_TO (default Frits's account with the RLUSD trust line; XRPL_PAY_TO=off turns it off), verified and submitted by an in-process facilitator from @x402/xrpl, as in the other Fizzl services. The usage log counts RLUSD in dollars. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TsD5haPKxeWjYmErHzvU48
…ithub.com/Fizzl13/SmartContractExplainer into claude/x402-agents-solana-payments-nceg9b
Agents built on t54's x402-xrpl / Xrpl.X402 SDK (most of the XRPL AI Hub)
sign with the x402 SourceTag 804681468, bind the invoice in Memos and send
{ signedTxBlob, invoiceId }. @x402/xrpl refuses Memos, so those payments now
go to t54's hosted facilitator, which verified and settled such a payment
on testnet; standard @x402/xrpl payments stay in-process (also re-tested on
testnet with the SourceTag in the requirements). Every XRPL accept now
carries extra.sourceTag. XRPL_T54_URL=off keeps everything local.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TsD5haPKxeWjYmErHzvU48
…lana-payments-nceg9b
Google crawled the homepage but has not indexed it yet; these give it a clear signal which URL to index. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TsD5haPKxeWjYmErHzvU48
…ithub.com/Fizzl13/SmartContractExplainer into claude/x402-agents-solana-payments-nceg9b
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TsD5haPKxeWjYmErHzvU48
…ithub.com/Fizzl13/SmartContractExplainer into claude/x402-agents-solana-payments-nceg9b
A refused MPP credential is logged as payment_failed with protocol mpp; it now also carries reason (the problem detail sent back, max 160 characters), so a client that can't pay us shows what went wrong. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TsD5haPKxeWjYmErHzvU48
…ithub.com/Fizzl13/SmartContractExplainer into claude/x402-agents-solana-payments-nceg9b
With ALGORAND_PAY_TO set (an Algorand account with the USDC opt-in), both paid routes also offer the same dollar price in USDC (ASA 31566704) on Algorand mainnet, settled by GoPlausible's public facilitator, which pays the Algorand fee. It sits before the URL facilitator and offers only Algorand, so PayAI never claims it. Off without the variable or with "off". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TsD5haPKxeWjYmErHzvU48
GoPlausible's x402 catalog reads the x402-merchant extension (name, website, logo, categories) when it settles a payment and shows it on the merchant, one per pay-to address. Both paid routes now carry it, the same on every fizzl.eu service. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TsD5haPKxeWjYmErHzvU48
check_wallet_approvals and explain_approval declare an outputSchema (verdict, explanation) and answer with structuredContent next to the same "VERDICT: explanation" text (which the usage log reads); feedback does too. Extra fields are allowed, so new ones never break a call. MCP directories such as Smithery score output schemas. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TsD5haPKxeWjYmErHzvU48
The XRPL AI Hub (xrpl-ai.org) ingests /.well-known/x402 and lists each
resource by its name and description; without them it shows the long
402 text. The manifest moves to well-known.js, with resources as
{ url, method, name, description } objects (the endpoints list stays)
and a description that names the payment options.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TsD5haPKxeWjYmErHzvU48
HSTS (one year), nosniff, a Referrer-Policy and X-Frame-Options, and no x-powered-by header. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TsD5haPKxeWjYmErHzvU48
Dependabot alerts are off here, so a new advisory like this week's MCP SDK one went unnoticed. Every Monday npm audit now checks PlainText's production dependencies. A high or critical finding the server can reach opens one issue labelled dependency-audit (GitHub emails the owner) or adds the new list to the open one, and the next clean run closes it. Checked against the lockfile from before the MCP SDK update: it reports exactly that advisory, and nothing on the current lockfile. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TsD5haPKxeWjYmErHzvU48
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependabot alerts are off on this repo, so a new advisory like this week's MCP SDK one (GHSA-6qxp-vccf-f47h) only showed up by chance. This adds a weekly check.
.github/workflows/audit.yml: every Monday at 05:17 UTC,npm audit --omit=dev --package-lock-onlyon PlainText's production dependencies..github/scripts/audit-check.mjs: keeps the high and critical findings a production install can reach, walking the lockfile from the root the way Node resolves packages.dependency-audit(GitHub emails the owner) or adds the new list to the open one. The next clean run closes it.Tested
🤖 Generated with Claude Code
https://claude.ai/code/session_01TsD5haPKxeWjYmErHzvU48
Generated by Claude Code