EnvarPay 0.1.0a8 — reviewed Agent purchases and task wallet onboarding

Published Python release with atomic connection setup, explicit peer approval, reviewed Agent calls and authenticated remote task wallets. Task mode remains experimental and Base Sepolia only. Preserve keys, policies and state when upgrading. The attached files match the PyPI/CI release artifacts.

EnvarPay 0.1.0a7 — payments onboarding and Envar integration

Python envarpay==0.1.0a7 is published on PyPI with verified wheel/sdist hashes and a clean index installation.

The README and guides now explain receiving and paying with existing agents, Python vs npm vs independent MCP service choices, endpoint ownership, receiving settings, Envar discovery/reporting and original-request recovery. Task escrow remains a separate experimental Base Sepolia-only mode.

The @envarai/envarpay TypeScript client is merged and its Node 22/24+Bun checks pass; npm registry publication is still pending. See the installation-channel guide for current availability.

Validation: all 8 executable PR checks passed; release build/upload succeeded; clean Python 3.13 installation and dependency checks passed. No new public-chain payment is claimed.

EnvarPay 0.1.0a5 — security and payment recovery fixes

Security and original-payment recovery update.

• Require Starlette >=1.3.1 to address CVE-2026-48818 and CVE-2026-54283.
• Refuse recovery of an unresolved payment after the operator switches to a different network/asset.
• If an error response omitted the transaction hash, query the original approved seller instead of getting stuck on the local response; never sign or settle again.
• Includes the merged agent/role setup and configuration guides from 0.1.0a4 source.

120 tests passed on Starlette 1.7.0; Python 3.11/3.13 CI passed. Existing signed payloads and budget reservations are preserved. Real production payment enablement and platform rollout are separate acceptance steps.

EnvarPay 0.1.0a3 — connected agents and durable purchase recovery

EnvarPay 0.1.0a3 connects existing MCP and native Hermes/OpenClaw HTTP services, adds authenticated private Agent and wallet entries, and supports original purchase/result recovery without creating another signature or settlement.

Directory candidates never change the wallet allowlist. Reports persist locally and retry independently of payment. Sellers can explicitly opt in to receiving address/price updates from Envar; configuration is validated and applied atomically. Public chain data alone cannot retrieve private task results.

Validation: 90 local tests and 90 clean-wheel tests; Python 3.11/3.13 CI passed. Native Hermes HTTP and authenticated MCP-to-Hermes delivery were verified locally. The platform receiving/transaction integration and final production payment acceptance are separate dependent work; this release does not claim those have completed.

Install the wheel asset in a dedicated environment. Payments remain disabled by default, and operator-approved peers and budgets are required. Keep signing keys and wallet state outside an Agent with shell access. Existing embedded kind="hermes" configurations must migrate to an existing runtime service.

EnvarPay v0.1.0a1 — Get your agents paid

EnvarPay: get your agents paid

First public alpha of the MIT-licensed MCP + x402 payment SDK and CLI.

• Get paid: put an upfront USDC payment gate in front of an existing MCP tool or official Hermes agent.
• Pay others: connect a dedicated wallet MCP tool with explicit service, recipient and spending limits.
• Integrate: use the CLI or the Python PaidServer / WalletService APIs.

Install

python -m pip install https://github.com/EnvarAI/EnvarPay/releases/download/v0.1.0a1/envar_pay-0.1.0a1-py3-none-any.whl
envar-pay --help

Python 3.11+. For a Hermes seller, install into Hermes's Python environment. The package is not on PyPI yet. Start with the English guide or 中文指南.

Evidence

GitHub CI passed on Python 3.11 and 3.13; 42 tests per environment, lint and package build/install checks. A clean local wheel installation passed too.

The earlier two-Hermes POC paid 0.01 test USDC on Base Sepolia before task execution: transaction. The extracted package has official-Hermes registration, real model connectivity and a read-only receipt recheck. No new payment was made for this public release; simulated tests and CI are not settlement evidence.

Alpha boundaries

Generated configuration uses Base Sepolia, payment disabled, and a 0.01 test-USDC per-call/cumulative cap. No automatic refunds, multi-host recovery, external signer integration or new mainnet validation. Preserve state after ambiguous outcomes and read the operating boundaries before enabling any wallet.

Assets include the wheel, source distribution and SHA256SUMS. Integration reports and focused contributions are welcome.