Two spend-safety fixes from the gap audit (#4814):
- Client.Do refused a 402 only on the budget check, but parsed
maxAmountRequired with a swallowed error, so a non-decimal, overflowing
or negative amount became 0 and passed the cap trivially while Payer.Pay
still signed against the string. Now reject any amount that is not a
positive integer before signing.
- Require settled only when the facilitator implemented Settler; a
verify-only facilitator served the resource while no funds moved. Add
Config.RequireSettlement to fail closed in that case.
Tests cover invalid/negative/overflow amounts and the verify-only
fail-closed path.
Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL
Co-authored-by: Claude <noreply@anthropic.com>
* feat(mcp): advertise x402 payment requirements in the tool catalog
/mcp/tools now includes each priced tool's payment requirements (amount,
network, asset, payTo) when payments are enabled, so an agent can see the
cost before calling and choose by price — a shoppable catalog, the
foundation for a tool marketplace. Free tools carry no payment block; the
shared Tool struct is copied when pricing so it isn't mutated. Tests cover
priced/free tools and payments-disabled. Documented in the payments guide.
* feat(x402): consumer client with a spend budget (pay-and-retry)
Add x402.Client, the consumer counterpart to Middleware: it settles 402
challenges automatically via a pluggable Payer, up to a spend Budget. A
call that would exceed the budget is refused before any payment is made,
and spend accumulates across calls — the spend cap that keeps an
autonomous, paying caller in bounds. Tests cover pay-within-budget,
refuse-over-budget, budget accumulation, and free endpoints, end to end
against the server Middleware with a mock facilitator and payer. Guide
documents the consumer side; agent-level AgentMaxSpend is the next step.
* chore: gofmt gateway/mcp/benchmark_test.go (trailing newline)
---------
Co-authored-by: Claude <noreply@anthropic.com>
Asim Aslam