@aifinpay/mcp 2.7.0 → 2.7.1

package/README.md

@@ -4,7 +4,7 @@ AiFinPay MCP server for persistent agent identity, Agent Passport resolution,
 route discovery and non-signing settlement invoices. Canonical domain:
 **aifinpay.io**.
 
-Version **2.7.0** is prepared in this checkout, requiring agent2.5.0 and canonical skill2.8.0.
+Version **2.7.1** is prepared in this checkout, requiring agent2.5.1 and canonical skill2.8.0.
 The published baseline checked2026-10-04 was MCP2.5.0. Package publication and
 real registry dependency/lock refresh remain release gates; a source-cohort
 build does not prove those steps. Owner-enabled v1.4 purchases with `payable_fetch` are
@@ -247,7 +247,7 @@ snapshot. Verify `agent_address` against the wallet you intend to use.
 | `AIFINPAY_MAX_USD`           | —                     | Per-payment USD cap for `payable_fetch`; required when payments are enabled.          |
 | `AIFINPAY_GATEWAY_ORIGINS`   | —                     | Comma-separated exact HTTPS origins the agent may pay; required with payments.        |
 | `AIFINPAY_GATEWAY_PATH_MODE` | `gateway`             | Use `gateway` for merchant-slug identity or `direct` for full request-path identity.  |
-| `AIFINPAY_PAY_CHAIN`         | `polygon`             | Owner-selected payment chain; see the2.7.0 source capability list.                    |
+| `AIFINPAY_PAY_CHAIN`         | `polygon`             | Owner-selected payment chain; see the2.7.1 source capability list.                    |
 | `AIFINPAY_MAX_GAS`           | —                     | Gas cap per payment in the pay chain's native currency (POL, ETH, AVAX, BNB, XRP).    |
 | `AIFINPAY_RPC_URL`           | chain's public RPC    | HTTPS RPC for the pay chain.                                                          |
 | `AIFINPAY_CLAIM_ORIGINS`     | AiFinPay dashboards   | Exact origins `agent_claim_self` may link the agent to.                               |
@@ -297,14 +297,14 @@ executor; this MCP does not expose Amoy paid receipt purchases.
 
 MIT.
 
-## Additional EVM networks in the 2.7.0 source candidate
+## Additional EVM networks in the 2.7.1 source candidate
 
 Owner `AIFINPAY_PAY_CHAIN` accepts polygon, base, optimism, arbitrum, avalanche,
 bnb, unichain, xrplevm and robinhood. `AIFINPAY_MAX_GAS` is in the selected native
 POL/ETH/AVAX/BNB/XRP currency; the legacy POL cap applies only on Polygon. Assets
 must be pinned for that chain, including BNB 18-decimal USDC/USDT and Robinhood
 18-decimal USDe/6-decimal USDG. XRPL EVM has native XRP only. Metadata comes from
-agent 2.5.0; the backend must still authorize and serve that merchant/network.
+agent 2.5.1; the backend must still authorize and serve that merchant/network.
 Source support does not activate networks in production. Pending journals retain
 the original chain and are recovered without another settlement. A legacy
 missing-chain journal is adopted only when the owner-configured chain and the
@@ -312,10 +312,10 @@ actual signed transaction's chain ID, payer, pinned target and exact call agree.
 Insufficient evidence requires manual receipt reconciliation. A later quote
 expiry does not invalidate receipt recovery for an existing payment.
 
-Release order: publish reviewed canonical skill2.8.0 and agent2.5.0, refresh MCP
+Release order: publish reviewed canonical skill2.8.0 and agent2.5.1, refresh MCP
 dependencies and lock from those real registry releases, pass standalone MCP
-CI, then publish MCP2.7.0. This candidate is tested against fresh source-packed
-agent2.5.0 and skill2.8.0. The existing registry entries remain until publication;
+CI, then publish MCP2.7.1. Source-cohort validation requires fresh source-packed
+agent2.5.1 and skill2.8.0. The existing registry entries remain until publication;
 no npm integrity/resolution is fabricated. An old2.3.x agent cannot build the
 new descriptor/helper imports, and old skill2.6.0 cannot satisfy the exact
 release-target guard. Hosted source CI uses `scripts/check-mcp-source-cohort.mjs`: a byte-preserving fixed registry bootstrap and genuine same-commit Node plus fully pinned canonical skill packages in disposable directories. Exact package bytes, versions, bundled skill and full tests must pass; the registry publication guard must still refuse this source cohort. Standalone release CI requires the refreshed real registry lock. Never publish the candidate with the old registry dependency lock.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aifinpay/mcp",
-  "version": "2.7.0",
+  "version": "2.7.1",
   "mcpName": "io.github.daochild/aifinpay",
   "description": "AiFinPay MCP: persistent local agent wallets, owner-configured EVM and Solana payment adapters, durable budgets and receipt recovery.",
   "type": "module",
@@ -76,7 +76,7 @@
   },
   "bugs": "https://github.com/AiFinPay/sdk/issues",
   "dependencies": {
-    "@aifinpay/agent": "^2.5.0",
+    "@aifinpay/agent": "^2.5.1",
     "@aifinpay/skill": "^2.8.0",
     "@modelcontextprotocol/sdk": "^1.0.0",
     "bs58": "^6.0.0",