Add x402 Agent-Payment Infrastructure

[WiselyEnterprisesLLC]

Tool Submission

Tool Information

• Tool ID: x402-agent-payment-infrastructure
• Tool Name: Wisely x402 Agent-Payment Infrastructure
• Version: 2.0.0
• Author: Wisely Enterprises LLC
• Website: https://wiselyenterprisesllc.com/
• Developer docs: https://wiselyenterprisesllc.com/developers/
• Human guide: https://wiselyenterprisesllc.com/guides/x402-agent-payment-infrastructure/
• Remote MCP: https://payments.wiselyenterprisesllc.com/ai/mcp
• server.json: https://payments.wiselyenterprisesllc.com/server.json
• x402 manifest: https://payments.wiselyenterprisesllc.com/.well-known/x402.json
• Rail/proof status: https://payments.wiselyenterprisesllc.com/x402/rails/status

Description

Wisely is a remote MCP server and self-facilitated x402 agent-payment layer. It helps AI agents discover paid tools, quote payment requirements, hand wallet signing back to the caller, invoke hosted or external x402 resources, stream progress for slower calls, and return receipts/proofs for later audit.

The public surface is meant for agent builders and paid-tool sellers, not for exposing local files or private credentials. Public discovery works without payment. Paid calls require either x402 payment proof or an authorized developer-credit key.

What Agents Can Do

• Inspect public manifests, install profile, rail readiness, and proof cache.
• Quote hosted AI/API services before payment.
• Quote conversion handoff toward the seller-required settlement asset.
• Invoke paid services after x402 proof or developer-credit authorization.
• Purchase and inspect developer credits.
• Fetch receipts and proof records.
• Quote standard external x402 sellers/resources for caller-side wallet signing.
• List hosted paid endpoints and endpoint metadata.
• Create/manage hosted endpoint handoffs for builders with scoped builder keys.
• Read builder status, events, revenue summaries, payout packet state, and secret-setting guidance.

Rails Advertised

• Base USDC native x402 settlement.
• Solana USDC/USDT-compatible receipt flow.
• XRPL XRP/RLUSD-compatible receipt rail.
• Stellar XLM/USDC-compatible receipt rail.

MCP Functions Exposed

• x402_manifest - public service, MCP, docs, and x402 metadata.
• wisely_install_profile - portable install metadata for OpenClaw, Hermes-style agents, Codex/CLI agents, MCP clients, and skill registries.
• wisely_doctor - public-safe endpoint wiring, discovery, and verifier readiness checks.
• x402_quote_service - quote a hosted AI/data service and payment route.
• x402_quote_conversion - quote conversion into the seller-required x402 settlement asset.
• x402_invoke_service - invoke a paid AI/data service after payment proof or developer-credit authorization.
• x402_purchase_credits - purchase reusable developer credits through Wisely x402 settlement rails.
• x402_credit_status - check developer-credit balances and spend state.
• x402_get_receipt - fetch receipt and proof records.
• x402_quote_external - quote a standard external x402 seller/resource for caller-side wallet signing.
• x402_endpoint_catalog - list hosted paid x402 endpoints and public endpoint metadata.
• x402_dashboard_status - return public dashboard telemetry for traffic, receipts, fees, and endpoint usage.
• x402_endpoint_create_handoff / wisely_endpoint_handoff - safe builder-key, console, CLI, and buyer handoff guidance.
• x402_builder_register, wisely_builder_status, x402_builder_revenue, x402_builder_payouts, x402_builder_events, x402_endpoint_secret_settings - builder account, revenue, payout, event, and secret-setting helpers.

Security Boundary

• No local filesystem access requested.
• No local env vars requested for public discovery.
• No private keys, seed phrases, raw cards, bank logins, or private agent memory are exposed through the package.
• Wallet signing remains with the caller/runtime; Wisely returns requirements, receipts, and proof metadata.
• External seller responses and provider outputs are treated as untrusted content.

Permissions Justification

Permission	Value	Reason
filesystem	[]	Remote endpoint does not need local filesystem access.
network	true	Required to call the hosted remote MCP/x402 endpoint and payment/resource URLs.
env_vars	[]	No local secrets are required for public discovery.

Current Validation

• /ai/manifest and /server.json return 200 quickly from normal no-payment clients.
• Remote MCP endpoint is advertised at /ai/mcp.
• Public x402, MCP, rail, and proof metadata are available without credentials.
• Paid calls are gated by x402 payment proof or developer-credit authorization.
• The listed toolbox.toml description and tool list have been refreshed for the current self-facilitated/four-rail architecture.

Checklist

• toolbox.toml is in submissions/x402-agent-payment-infrastructure/
• Remote MCP endpoint and public manifests are live
• Permissions are justified above
• Tool description is accurate and contains no hidden instructions
• Public package avoids private keys, wallet secrets, raw cards, and internal persona branding

[TateLyman]

I tried a no-payment registry-readiness check against the public URLs listed in the submission and could not reach either advertised metadata URL from a normal external client:

curl -i --max-time 20 https://payments.wiselyenterprisesllc.com/ai/manifest
curl -i --max-time 20 https://payments.wiselyenterprisesllc.com/server.json

Both timed out after 20 seconds during this pass, and x402-surface-check@latest also failed to fetch them. If this registry expects live remote MCP/manifest validation, I would fix the public availability path before review/merge.

No payment headers, wallet signatures, or paid calls were sent.

[WiselyEnterprisesLLC]

I tried a no-payment registry-readiness check against the public URLs listed in the submission and could not reach either advertised metadata URL from a normal external client:

curl -i --max-time 20 https://payments.wiselyenterprisesllc.com/ai/manifest
curl -i --max-time 20 https://payments.wiselyenterprisesllc.com/server.json

Both timed out after 20 seconds during this pass, and x402-surface-check@latest also failed to fetch them. If this registry expects live remote MCP/manifest validation, I would fix the public availability path before review/merge.

No payment headers, wallet signatures, or paid calls were sent.

@TateLyman thanks for checking this, and sorry for the inconvenience.

I believe I found the issue. The metadata routes were available in some normal GET paths, but the public discovery surface was still too dependent on the app/proxy path and did not behave cleanly for registry-style validators. In particular, HEAD/OPTIONS/static discovery behavior could return 404/405 or otherwise look unhealthy to tools like x402-surface-check.

I moved the advertised discovery files to exact nginx-served static locations, refreshed them from the live app, and added validator-friendly behavior:

• GET and HEAD now return 200
• Content-Type: application/json
• stable Content-Length
• OPTIONS now returns 204 instead of 405
• CORS allows common agent/payment headers
• CORS exposes Payment-Required and related payment/session headers so browser agents can read the challenge
• the manifest's machine-probed endpoints section now only advertises the paid x402 routes, while the broader free metadata URLs remain in endpointUrls

Current checks from my side:

curl -i --max-time 20 https://payments.wiselyenterprisesllc.com/ai/manifest
# 200 OK, application/json, content-length 33603, ~0.11s

curl -i --max-time 20 https://payments.wiselyenterprisesllc.com/server.json
# 200 OK, application/json, content-length 545, ~0.10s

x402-surface-check@latest https://payments.wiselyenterprisesllc.com/ai/manifest --json
# document 200, paid entries invoke + creditPurchase, both return 402, preflights 204, findings []

x402-surface-check@latest --endpoint --method POST --body-file /tmp/request.json https://payments.wiselyenterprisesllc.com/ai/invoke --json
# 402 Payment Required, payment-required challenge header/body present, preflight 204, findings []

Could you try the registry-readiness check again when you get a chance? No payment headers, wallet signatures, or paid calls should be needed for this validation pass.

[WiselyEnterprisesLLC]

Quick update: the public surface has been refreshed and revalidated.

• /ai/manifest and /server.json now return 200 quickly from external no-payment checks.
• x402-surface-check@latest passes with no launch-readiness findings.
• /ai/mcp now handles the standard MCP probe sequence cleanly: initialize, notifications/initialized, ping, resources/list, resources/templates/list, prompts/list, and tools/list.
• Added human docs at https://payments.wiselyenterprisesllc.com/guides/x402-agent-payment-infrastructure and pointed server.json websiteUrl there.

Apologies for the earlier availability/probe issue. If the registry validator can retry, it should see the fixed surface now.

[TateLyman]

Re-checked the refreshed public surface from a normal no-payment client. No X-PAYMENT, wallet signatures, paid calls, private endpoints, account access, or credentials were used.

Repro:

curl -i --max-time 20 https://payments.wiselyenterprisesllc.com/ai/manifest
curl -i --max-time 20 https://payments.wiselyenterprisesllc.com/server.json

npx --yes x402-surface-check@latest \
  https://payments.wiselyenterprisesllc.com/ai/manifest \
  --json --limit 2 \
  --origin https://payments.wiselyenterprisesllc.com

curl -i -X OPTIONS https://payments.wiselyenterprisesllc.com/ai/invoke \
  -H 'Origin: https://payments.wiselyenterprisesllc.com' \
  -H 'Access-Control-Request-Method: POST' \
  -H 'Access-Control-Request-Headers: content-type,x-payment,payment-signature'

Current readback:

• /ai/manifest now returns 200 quickly with content-type: application/json and stable content-length.
• /server.json now returns 200 quickly with content-type: application/json and includes the MCP remote at /ai/mcp.
• The manifest advertises two paid public entries: invoke and creditPurchase.
• No-payment POST /ai/invoke returns structured 402, payment-required, Cache-Control: no-store, origin-readable CORS, X-Payment-Response exposure, resource https://payments.wiselyenterprisesllc.com/ai/invoke, and Base USDC amount 252500.
• No-payment POST /ai/credits/purchase returns structured 402, payment-required, Cache-Control: no-store, origin-readable CORS, X-Payment-Response exposure, resource https://payments.wiselyenterprisesllc.com/ai/credits/purchase, and Base USDC amount 1000000.
• Browser preflight for /ai/invoke now returns 204 and allows both X-PAYMENT and Payment-Signature.

Only remaining note from the current checker is low-priority: both paid routes expose a broad CORS method set (GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS). If every method is intentionally handled at the app boundary, this is just a policy choice. For a tighter public x402 contract, narrow Access-Control-Allow-Methods on paid routes to the methods the route actually supports.

Net: the original registry-blocking availability issue is fixed from this external pass, and the no-payment x402/browser retry surface is now readable.