Skip to content

x402 on every surface (API + MCP) + proof-of-work challenge - #232

Merged
ralyodio merged 1 commit into
mainfrom
feat/x402-all-surfaces
Oct 21, 2026
Merged

ralyodio merged 1 commit into
mainfrom
feat/x402-all-surfaces

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Why nobody pays (measured 2026-10-21): 0 rows in crawl_sales, ever. Buying works (checkout 303s to a CoinPay cs_ session; x402 offer valid), but every door is free:

  • item pages: the headless-Chrome residential swarm passes the one-line cookie script (402 then 200 same IP same second; 11,569/11,795 IPs read one page)
  • /api/v1: 600/h anonymous per IP, then a 429 with no x402 offer; a paid pass was metered as a stranger
  • /mcp, /api/mcp: no hourly meter at all

Changes: lib/api-meter.js (pass = premium allowance, over-limit stranger = gateway.sell 402 with the x402 offer, settles PAYMENT-SIGNATURE/X-PAYMENT), applied to /api/v1/* and MCP POST; x402-gateway 0.12.0 with challenge.work: 17.

bun test: 2542 pass, 0 fail.

🤖 Generated with Claude Code

…proof-of-work challenge

- lib/api-meter.js replaces the /api/v1 rateLimit: a valid crawl pass gets the
  premium hourly allowance (it met the meter as a stranger before); a stranger
  over 600/h gets the gateway's 402 x402 offer instead of a 429, and a payment
  sent with the request settles on the spot.
- /mcp and /api/mcp POST get the same meter (they had none).
- x402-gateway 0.12.0, challenge.work 17: the headless-Chrome swarm ran the
  one-line cookie script (402, same IP same second, 200); now each address
  pays a proof of work.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Added@​profullstack/​x402-gateway@​0.12.08810010096100

View full report

@ralyodio
ralyodio merged commit 62987d6 into main Oct 21, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant