0.7.0

All three packages move to 0.7.0 together: @wasit-dev/core, @wasit-dev/cli and @wasit-dev/server.

The x402 payment checks now pay on Base Sepolia, Ethereum Sepolia and Solana devnet as well as Stellar testnet, and three negative payment checks join them, for sixteen checks in all. X402-04 and X402-05 read every payment option, on any chain, and every FAIL says what to change. MPP-01 now signs only for the network the run names. New in the CLI: wasit serve, a paywall that misbehaves on purpose, and wasit wallet --network.

Security: MPP-01 signs only for the network the run names

Up to 0.6.0, MPP-01 read the amount, currency and recipient from the target's challenge but not its network, and the @stellar/mpp charge client signs for whichever network the challenge names, through its own default RPC endpoint for it. A target asking for stellar:pubnet could therefore have a mainnet transfer, for the amount it chose, signed by the payer key if that account holds mainnet funds. This is read from the SDK's source (@stellar/mpp 0.7.1), not run.

In 0.7.0 a challenge for any network but the run's is refused before anything is signed, on the unpaid read and on the request actually paid, with no verdict (ERROR (configuration)). The payment goes through the run's RPC endpoint (--rpc-url, MCP rpcUrl), which must be https, and is made once: the SDK's client paid up to three times when a target kept answering 402. If you ran MPP-01 with a payer key that holds mainnet funds, upgrade. Advisory: GHSA-wm3g-w88q-73xx.

Results can change on upgrade

• X402-05 passes a service on a chain other than Stellar, where it failed.
• X402-04 or X402-05 fails a challenge with a broken second option, and X402-04 fails one without scheme, asset or maxTimeoutSeconds, or with a wrongly typed field.
• X402-08, X402-09 or X402-10 fails a target that accepts a replayed, underpaid or expired payment. One that refuses even a valid payment gets X402-07 skipped instead of passed.
• X402-06 gives no verdict when the payer's balance is below the price, and nothing is sent.
• MPP-01 gives no verdict when the target asks to be paid on a network other than the run's, and is not paid. An http --rpc-url stops MPP-01 before anything is sent. A target that answers 402 after being paid has that 402 reported instead of being paid again.

Added: x402 payments on Base Sepolia, Ethereum Sepolia and Solana devnet

--network eip155:84532, eip155:11155111 or solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1 (MCP network). On Base Sepolia the payment uses the transfer method the target advertises, EIP-3009 or Permit2; on Ethereum Sepolia it pays in Circle's USDC; on Solana the sponsor named in extra.feePayer pays the fee. The settlement is read from each chain's own record: the ERC-20 Transfer log on Base and Ethereum, the token balances on Solana. The official client's spend controls stay: a price above $1, or an asset outside its list, gets no verdict and nothing is sent.

Added: three negative payment checks

X402-08 Payment Replay Rejected, X402-09 Underpayment Rejected, X402-10 Expired Authorization Rejected. Each needs an accepted payment first, so a target that refuses every payment gets them skipped.

Changed: X402-04 and X402-05 read every payment option, on any chain

Both read only the first option, and X402-05 accepted only the two Stellar networks. Both now check every option and name the one at fault by its index. X402-05 requires CAIP-2, as x402 v2 does, with each namespace's own rules where its CAIP-2 definition fixes them. The payment checks pay only on the option for the run's network.

Added: every failure says what to change

A FAIL carries a Fix line and a Docs link, in the CLI, in --json and in the MCP server's structuredContent (fix, docs). The check catalogue gains Common failures and fixes.

Fixed: a failed settlement names its reason

A valid payment that verified but did not settle reads settlement failed: <reason>, from the PAYMENT-RESPONSE the official SDK server sends.

Added: wasit serve and wasit wallet --network

wasit serve runs a local x402 paywall that misbehaves on purpose (no-settle, wrong-settlement, wrong-network, overprice, v1-challenge, malformed-header), to test an agent that pays. wasit wallet --network generates the x402 payer for Base Sepolia, Ethereum Sepolia or Solana devnet and shows its USDC.

Verified

Every suite against every fixture, each settlement read back from its chain, the packages installed as a user gets them, and the paywalls that lie: 2026-10-08, with the per-chain runs on 2026-10-05 and 2026-10-06. Full list in the CHANGELOG.

Install

npx -y @wasit-dev/cli@0.7.0 --version
claude mcp add wasit -- npx -y @wasit-dev/server@0.7.0

Testnet only. A passing result means the service behaved as the spec requires for the published checks; it is not a security audit.