Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion public/.well-known/agent-skills/index.json
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
"type": "skill-md",
"description": "TypeScript SDK for the Payment HTTP Authentication Scheme. Handles 402 Payment Required flows with Tempo, Stripe, and other payment methods. Use when integrating payments or mppx into a client or server application.",
"url": "/.well-known/agent-skills/mppx/SKILL.md",
"digest": "sha256:9520d231fd7ae64ce54c8176e870a36d758c272748ceeadc7a3a8d23c2b8a5ce"
"digest": "sha256:45039f241e97036627d9cf2b2864408fa6b6afb70faf7f0001ffc8eb5ceaece6"
}
]
}
36 changes: 32 additions & 4 deletions public/.well-known/agent-skills/mppx/SKILL.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,32 @@ description: TypeScript SDK for the Payment HTTP Authentication Scheme. Handles

TypeScript SDK for the "Payment" HTTP Authentication Scheme. Full 402 flow: challenge → credential → receipt.

## What I can accomplish

- Add `402` payment handling to a client with `Fetch.polyfill` or `Fetch.from`.
- Protect HTTP routes with server-side MPP Challenges and Receipt responses.
- Accept one-time Tempo stablecoin payments with `tempo.charge`.
- Accept metered Tempo stablecoin payments with `tempo.session`.
- Accept one-time card payments with `stripe.charge`.
- Verify Credentials directly for custom transports or background workflows.
- Wrap MCP clients and servers so tool calls can require payment.

## Required inputs

- Client integrations need a signing account and one or more client payment methods.
- Server integrations need a recipient, currency, amount, and `MPP_SECRET_KEY`.
- Tempo examples use chain ID `4217` unless a page explicitly covers Moderato testnet.
- Stripe examples need a configured Stripe account and Shared Payment Token flow.
- MCP integrations need the MCP client or server object to wrap.

## Constraints

- Keep `MPP_SECRET_KEY` server-side and out of logs.
- Never commit private keys or wallet seeds.
- Treat runtime `402` Challenges as authoritative for current payment terms.
- Return `id` and `opaque` unchanged when responding to a Challenge.
- Use `USDC.e` for Tempo bridged USDC examples, not generic USDC.

## Client

```ts
Expand Down Expand Up @@ -82,7 +108,9 @@ npx mppx example.com -v # verbose output

## References

- Docs: https://mpp.dev/sdk/typescript
- Repo: https://github.com/wevm/mppx
- Spec: https://github.com/tempoxyz/payment-auth-spec
- Tempo: https://docs.tempo.xyz
- [TypeScript SDK docs](https://mpp.dev/sdk/typescript)
- [Client quickstart](https://mpp.dev/quickstart/client)
- [Server quickstart](https://mpp.dev/quickstart/server)
- [mppx repository](https://github.com/wevm/mppx)
- [IETF Specification](https://paymentauth.org)
- [Tempo docs](https://docs.tempo.xyz)
10 changes: 10 additions & 0 deletions public/.well-known/api-catalog
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,11 @@
"href": "https://mpp.dev/guides/building-with-an-llm",
"title": "Build with an LLM",
"type": "text/html"
},
{
"href": "https://mpp.dev/AGENTS.md",
"title": "Agent instructions",
"type": "text/markdown"
}
],
"status": [
Expand All @@ -38,6 +43,11 @@
"href": "https://mpp.dev/.well-known/agent-skills/index.json",
"title": "Agent Skills discovery index",
"type": "application/json"
},
{
"href": "https://mpp.dev/agent-permissions.json",
"title": "Agent permissions",
"type": "application/json"
}
]
}
Expand Down
34 changes: 34 additions & 0 deletions public/AGENTS.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
# MPP documentation

Use this site to integrate MPP, the Machine Payments Protocol for HTTP `402` payment flows.

## Start here

- Read [`llms.txt`](https://mpp.dev/llms.txt) for a concise page index.
- Read [`llms-full.txt`](https://mpp.dev/llms-full.txt) when you need the full documentation in one request.
- Use [`/.well-known/mcp.json`](https://mpp.dev/.well-known/mcp.json) to connect to the MPP documentation MCP server.
- Use [`/.well-known/agent-skills/index.json`](https://mpp.dev/.well-known/agent-skills/index.json) to discover agent skills.

## Main tasks

- Add payments to an API with [`mppx`](https://mpp.dev/quickstart/server).
- Connect a coding agent to paid APIs with [`mppx`](https://mpp.dev/quickstart/agent).
- Use the TypeScript SDK reference at [`/sdk/typescript`](https://mpp.dev/sdk/typescript).
- Browse paid services at [`/services`](https://mpp.dev/services).

## Project structure

- Documentation pages live under `/assets/md/` as Markdown mirrors.
- Agent skills live under `/.well-known/agent-skills/`.
- API discovery files live under `/.well-known/` and `/api/`.
- Service catalog files live under `/services/`.

## Protocol terms

MPP uses a Challenge, Credential, and Receipt flow:

- Servers return Challenges in `WWW-Authenticate`.
- Clients return Credentials in `Authorization`.
- Servers return Receipts in `Payment-Receipt`.

Prefer Tempo stablecoin examples unless a page is specifically about another payment method.
36 changes: 36 additions & 0 deletions public/agent-permissions.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
{
"$schema": "https://mpp.dev/schemas/agent-permissions.schema.json",
"agentUserAgents": ["ChatGPT-User", "ClaudeBot", "GPTBot", "PerplexityBot"],
"allowedActions": [
"read-documentation",
"read-discovery",
"read-openapi",
"read-skill"
],
"allowedPaths": [
"/",
"/.well-known/*",
"/AGENTS.md",
"/agent-permissions.json",
"/api/api-catalog",
"/api/openapi.json",
"/assets/md/*",
Comment on lines +12 to +17

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Add advertised root files to allowedPaths

The new agent index and API catalog advertise /AGENTS.md and /agent-permissions.json as primary agent-readable discovery files, but this allowlist only permits /, /.well-known/*, API docs, markdown mirrors, and llms files. If an agent enforces allowedPaths after reading this policy, the advertised instructions and permission document fall outside the allowed read surface, which self-blocks the discovery flow this file is meant to enable.

Useful? React with 👍 / 👎.

"/llms-full.txt",
"/llms.txt",
"/services/llms.txt"
],
"disallowedActions": ["execute-payment", "submit-credential", "write-data"],
"humanRequiredActions": [
"execute-payment",
"send-transaction",
"store-private-key"
],
"permissions": {
"read": true,
"write": false
},
"rateLimits": {
"burst": 60,
"period": "1m"
}
}
96 changes: 96 additions & 0 deletions public/agent.html
Original file line number Diff line number Diff line change
@@ -0,0 +1,96 @@
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
<title>MPP agent index</title>
<meta
name="description"
content="Agent-readable entry point for MPP docs, API discovery, skills, permissions, and Markdown source."
/>
<meta name="ai:page-type" content="agent-index" />
<meta name="ai:token-count" content="1200" />
<link rel="canonical" href="https://mpp.dev/agent.html" />
</head>
<body>
<main>
<article>
<h1>MPP agent index</h1>
<p>
Use this page as the compact HTML entry point for agents integrating
MPP, mppx, or HTTP 402 payment flows. It links to the canonical
Markdown, skill, permissions, and API discovery documents.
</p>

<section>
<h2>Primary files</h2>
<table>
<thead>
<tr>
<th>File</th>
<th>Purpose</th>
</tr>
</thead>
<tbody>
<tr>
<td><a href="/llms.txt">llms.txt</a></td>
<td>Short documentation index grouped for agent retrieval.</td>
</tr>
<tr>
<td><a href="/llms-full.txt">llms-full.txt</a></td>
<td>Complete Markdown corpus for long-context agents.</td>
</tr>
<tr>
<td><a href="/AGENTS.md">AGENTS.md</a></td>
<td>Project conventions, key files, and build commands.</td>
</tr>
<tr>
<td><a href="/agent-permissions.json">agent-permissions.json</a></td>
<td>Allowed interactions, human gates, and rate limits.</td>
</tr>
<tr>
<td><a href="/.well-known/agent-skills/mppx/SKILL.md">mppx skill</a></td>
<td>Capabilities, inputs, constraints, and references.</td>
</tr>
<tr>
<td><a href="/.well-known/api-catalog">API catalog</a></td>
<td>Linkset discovery for docs, OpenAPI, skills, and metadata.</td>
</tr>
</tbody>
</table>
</section>

<section>
<h2>Recommended flow</h2>
<p>
Start with <a href="/llms.txt">llms.txt</a>, fetch the smallest
Markdown page that answers the task, then use the skill and API
catalog only when you need integration details or machine-readable
endpoints.
</p>
<pre><code>curl https://mpp.dev/llms.txt
curl https://mpp.dev/.well-known/agent-skills/mppx/SKILL.md
curl https://mpp.dev/agent-permissions.json</code></pre>
</section>

<section>
<h2>Human-agent bridge</h2>
<p>
Documentation pages expose clean Markdown mirrors under
<code>/assets/md/</code>. Use the Copy for AI control in the page UI
or fetch the Markdown directly.
</p>
<button type="button" data-copy-ai="" aria-label="Copy for AI">
Copy for AI
</button>
<button type="button" data-copy="" aria-label="Copy command">
Copy command
</button>
<p>
<a href="/assets/md/index.md">View homepage as Markdown</a>
</p>
</section>
</article>
</main>
</body>
</html>
36 changes: 32 additions & 4 deletions skills/mppx/SKILL.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,32 @@ description: TypeScript SDK for the Payment HTTP Authentication Scheme. Handles

TypeScript SDK for the "Payment" HTTP Authentication Scheme. Full 402 flow: challenge → credential → receipt.

## What I can accomplish

- Add `402` payment handling to a client with `Fetch.polyfill` or `Fetch.from`.
- Protect HTTP routes with server-side MPP Challenges and Receipt responses.
- Accept one-time Tempo stablecoin payments with `tempo.charge`.
- Accept metered Tempo stablecoin payments with `tempo.session`.
- Accept one-time card payments with `stripe.charge`.
- Verify Credentials directly for custom transports or background workflows.
- Wrap MCP clients and servers so tool calls can require payment.

## Required inputs

- Client integrations need a signing account and one or more client payment methods.
- Server integrations need a recipient, currency, amount, and `MPP_SECRET_KEY`.
- Tempo examples use chain ID `4217` unless a page explicitly covers Moderato testnet.
- Stripe examples need a configured Stripe account and Shared Payment Token flow.
- MCP integrations need the MCP client or server object to wrap.

## Constraints

- Keep `MPP_SECRET_KEY` server-side and out of logs.
- Never commit private keys or wallet seeds.
- Treat runtime `402` Challenges as authoritative for current payment terms.
- Return `id` and `opaque` unchanged when responding to a Challenge.
- Use `USDC.e` for Tempo bridged USDC examples, not generic USDC.

## Client

```ts
Expand Down Expand Up @@ -93,7 +119,9 @@ npx mppx example.com -v # verbose output

## References

- Docs: https://mpp.dev/sdk/typescript
- Repo: https://github.com/wevm/mppx
- Spec: https://github.com/tempoxyz/payment-auth-spec
- Tempo: https://docs.tempo.xyz
- [TypeScript SDK docs](https://mpp.dev/sdk/typescript)
- [Client quickstart](https://mpp.dev/quickstart/client)
- [Server quickstart](https://mpp.dev/quickstart/server)
- [mppx repository](https://github.com/wevm/mppx)
- [IETF Specification](https://paymentauth.org)
- [Tempo docs](https://docs.tempo.xyz)
10 changes: 10 additions & 0 deletions src/env.d.ts
Original file line number Diff line number Diff line change
Expand Up @@ -5,3 +5,13 @@ declare module "*.svg?raw" {
const content: string;
export default content;
}

declare module "*.md?raw" {
const content: string;
export default content;
}

declare module "*.json?raw" {
const content: string;
export default content;
}
16 changes: 16 additions & 0 deletions src/pages/_api/.well-known/agent-skills/mppx/SKILL.md.ts
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
import skill from "../../../../../../public/.well-known/agent-skills/mppx/SKILL.md?raw";

const headers = {
"Access-Control-Allow-Origin": "*",
"Cache-Control": "public, max-age=300",
"Content-Type": "text/markdown; charset=utf-8",
"X-Content-Type-Options": "nosniff",
};

export function GET() {
return new Response(skill, { headers });
}

export function HEAD() {
return new Response(null, { headers });
}
1 change: 1 addition & 0 deletions src/pages/_api/.well-known/api-catalog.ts
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
export { GET, HEAD } from "../api/api-catalog";
16 changes: 16 additions & 0 deletions src/pages/_api/AGENTS.md.ts
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
import agents from "../../../public/AGENTS.md?raw";

const headers = {
"Access-Control-Allow-Origin": "*",
"Cache-Control": "public, max-age=300",
"Content-Type": "text/markdown; charset=utf-8",
"X-Content-Type-Options": "nosniff",
};

export function GET() {
return new Response(agents, { headers });
}

export function HEAD() {
return new Response(null, { headers });
}
16 changes: 16 additions & 0 deletions src/pages/_api/agent-permissions.json.ts
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
import permissions from "../../../public/agent-permissions.json?raw";

const headers = {
"Access-Control-Allow-Origin": "*",
"Cache-Control": "public, max-age=300",
"Content-Type": "application/json; charset=utf-8",
"X-Content-Type-Options": "nosniff",
};

export function GET() {
return new Response(permissions, { headers });
}

export function HEAD() {
return new Response(null, { headers });
}
10 changes: 10 additions & 0 deletions src/pages/_api/api/api-catalog.ts
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,11 @@ const apiCatalog = {
title: "Build with an LLM",
type: "text/html",
},
{
href: "https://mpp.dev/AGENTS.md",
title: "Agent instructions",
type: "text/markdown",
},
],
status: [
{
Expand All @@ -45,6 +50,11 @@ const apiCatalog = {
title: "Agent Skills discovery index",
type: "application/json",
},
{
href: "https://mpp.dev/agent-permissions.json",
title: "Agent permissions",
type: "application/json",
},
],
},
],
Expand Down
Loading
Loading