@hpp-io/x402-mcp-bridge 0.0.3 → 0.1.1

package/README.md

@@ -25,20 +25,35 @@ Two wallet modes:
 | **light** (default) | fund small = your cap | none (settlement is gasless) | quick start, low value |
 | **Safe** (governance) | on-chain daily cap (AllowanceModule) | delegate pays top-up gas | treasury, teams |
 
-## Quick start (light mode, ~2 min)
+## Install
 
+Three steps: install the CLI, onboard, fund. The CLI does the host wiring for
+you — no config files to edit.
+
+**1. Install the CLI** (puts `hpp-x402` on your PATH):
 ```bash
-# 1. Create a wallet + register the bridge into your host in one shot
-npx -y -p @hpp-io/x402-mcp-bridge hpp-x402 setup --install claude
-#   → prints your delegate address + a paste-ready config
+# macOS / Linux
+curl -fsSL https://raw.githubusercontent.com/hpp-io/x402-tools/main/install/install.sh | bash
+# Windows (PowerShell)
+irm https://raw.githubusercontent.com/hpp-io/x402-tools/main/install/install.ps1 | iex
+```
+Or straight from npm (same result): `npm install -g @hpp-io/x402-mcp-bridge`.
 
-# 2. Fund it — send USDC.e to that address on HPP (no native gas needed)
-npx -y -p @hpp-io/x402-mcp-bridge hpp-x402 fund
+**2. Onboard** — create a wallet and register the bridge into your host:
+```bash
+hpp-x402 setup --install claude-code   # or: claude | cursor | windsurf | openclaw
+```
+This creates a wallet in your OS keychain and writes the correct MCP config for
+that host (on Claude Code it runs `claude mcp add` for you).
 
-# 3. Restart your host. Ask the agent to discover + call a paid service.
+**3. Fund it** — send USDC.e (on HPP, no native gas needed) to your address:
+```bash
+hpp-x402 fund      # prints your wallet address + current balance
 ```
 
-`--install` accepts `claude | claude-code | cursor | windsurf | openclaw`.
+Restart your host and chat — your agent can now discover and pay for services.
+(You can also just ask it *“what's my wallet address?”* — the `wallet_address`
+tool answers.)
 
 ## The `hpp-x402` CLI
 
@@ -55,6 +70,11 @@ hpp-x402 channel <sub>         batch-settlement channels (ls/status/refund)
 hpp-x402 safe <setup|revoke>   Safe (governance) wallet + AllowanceModule
 ```
 
+Run the CLI as `hpp-x402 <command>` after the installer above, or without
+installing via `npx -y -p @hpp-io/x402-mcp-bridge hpp-x402 <command>`. The `-p`
+matters: a bare `npx @hpp-io/x402-mcp-bridge` launches the MCP **server**, not
+the CLI.
+
 Common flags: `-a, --account <name>` (keychain slot, default `delegate-default`),
 `-n, --network <caip2>` (`eip155:181228` Sepolia / `eip155:190415` Mainnet).
 
@@ -81,6 +101,7 @@ Registered by the bridge on top of any proxied upstream tools:
 
 | Tool | What it does |
 |------|--------------|
+| `wallet_address` | report your own wallet address (to fund it with USDC.e) |
 | `hpp_discover` | list/search the curated HPP discovery directory (read-only) |
 | `hpp_call` | call a discovered service by `resourceId`; pays via your wallet |
 | `x402_http_call` | call any allow-listed x402 HTTP endpoint (auth headers from local policy) |
@@ -92,32 +113,31 @@ Non-custodial throughout: discovery never holds funds or sees your keys.
 
 ## Configuration (env)
 
-The host config's `env` block drives the bridge. Light mode omits the Safe vars:
+**All env is optional.** A bare entry boots on HPP Sepolia with an auto-created
+keychain wallet:
+
+```jsonc
+{ "mcpServers": { "hpp-x402": {
+  "command": "npx", "args": ["-y", "@hpp-io/x402-mcp-bridge"]
+} } }
+```
+
+Set env only to override the defaults — mainnet, a specific key, a proxied
+server, or Safe mode:
 
 ```jsonc
-// claude_desktop_config.json (generated by `hpp-x402 setup`)
-{
-  "mcpServers": {
-    "hpp-x402": {
-      "command": "npx",
-      "args": ["-y", "@hpp-io/x402-mcp-bridge"],
-      "env": {
-        "DELEGATE_PRIVATE_KEY": "keychain://hpp-x402/delegate-default",
-        "USDCE_ADDRESS": "0x401eCb1D350407f13ba348573E5630B83638E30D",
-        "HPP_RPC_URL": "https://sepolia.hpp.io",
-        "HPP_NETWORK": "eip155:181228",
-        "RESOURCE_SERVER_URL": "https://your-x402-server/mcp/sse"  // optional
-      }
-    }
-  }
+"env": {
+  "HPP_NETWORK": "eip155:190415",                          // Mainnet (default: Sepolia)
+  "DELEGATE_PRIVATE_KEY": "keychain://hpp-x402/my-wallet",  // default: auto-created
+  "RESOURCE_SERVER_URL": "https://your-x402-server/mcp/sse" // proxy a seller's MCP tools
 }
 ```
 
 | Var | Notes |
 |-----|-------|
-| `DELEGATE_PRIVATE_KEY` | `keychain://hpp-x402/<account>` (recommended) or `0x<64 hex>` |
-| `USDCE_ADDRESS` | USDC.e token on HPP |
-| `HPP_RPC_URL` / `HPP_NETWORK` | chain RPC + CAIP-2 id |
+| `DELEGATE_PRIVATE_KEY` | **optional** — auto-created in the OS keychain if unset. `keychain://hpp-x402/<account>` or `0x<64 hex>` |
+| `HPP_NETWORK` | **optional** — CAIP-2 id, default `eip155:181228` (Sepolia); `eip155:190415` = Mainnet |
+| `USDCE_ADDRESS` / `HPP_RPC_URL` | **optional** — default per network |
 | `RESOURCE_SERVER_URL` | optional upstream MCP server to proxy (omit = local tools only) |
 | `SAFE_ADDRESS` + `ALLOWANCE_MODULE_ADDRESS` | set both = Safe mode; omit both = light mode |
 | `HPP_X402_DISCOVERY` | `on` (default) / `off` — registers `hpp_discover` / `hpp_call` |

package/dist/a2a.js

@@ -18,6 +18,7 @@
  */
 import { x402Client } from "@x402/core/client";
 import { ExactEvmScheme } from "@x402/evm/exact/client";
+import { checkWalletSpend, recordWalletSpend } from "./spendGuard.js";
 import { log } from "./log.js";
 /**
  * Pick the single `accept` entry the bridge will actually pay against:
@@ -153,11 +154,16 @@ export async function payA2aAgent(deps, args) {
     // Reconstruct a single-accept PaymentRequired for the SDK so its
     // internal selection cannot diverge from what we just chose.
     const narrowedRequired = { ...required, accepts: [accept] };
-    // 2. Spend-cap: ensure the delegate holds enough USDC.e (same gate as the
-    //    MCP/HTTP path). Skipped when no funds source is wired.
+    const requiredAtomic = BigInt(accept.amount ?? "0");
+    // 2a. Wallet-wide guard (per-call + daily ledger) — the same brake as the
+    //     HTTP/MCP path, so A2A payments are capped too (previously uncapped).
+    const walletDeny = checkWalletSpend(requiredAtomic);
+    if (walletDeny)
+        return errorResult(`blocked: ${walletDeny}`);
+    // 2b. Spend-cap: ensure the delegate holds enough USDC.e (Safe autoTopup or
+    //     light-mode balance check). Skipped when no funds source is wired.
     if (deps.funds) {
         try {
-            const requiredAtomic = BigInt(accept.amount ?? "0");
             await deps.funds.ensure(requiredAtomic);
         }
         catch (err) {
@@ -190,6 +196,8 @@ export async function payA2aAgent(deps, args) {
         return errorResult(`A2A payment did not complete (state="${finalState}", payment="${payStatus}"): ` +
             JSON.stringify(task?.status?.message ?? task?.metadata ?? {}).slice(0, 300));
     }
+    // Record the successful spend against the wallet-wide daily ledger.
+    recordWalletSpend(requiredAtomic);
     return {
         content: [{ type: "text", text: JSON.stringify({ payment: payStatus, ...extractResult(task) }) }],
     };

package/dist/autoTopup.js

@@ -114,6 +114,10 @@ export class AutoTopup {
         }
         return this.execute(amount);
     }
+    /** Funds interface: the delegate's immediately-spendable balance. */
+    async balance() {
+        return this.balanceOfDelegate();
+    }
     /** Read delegate's current ERC-20 balance. */
     async balanceOfDelegate() {
         return (await this.publicClient.readContract({

package/dist/cli/hpp-x402.js

@@ -95,7 +95,7 @@ const program = new Command();
 program
     .name("hpp-x402")
     .description("HPP x402 agent wallet + payment CLI")
-    .version("0.0.3");
+    .version("0.1.1");
 // ── setup (one-command onboarding) ─────────────────────────────────────
 program
     .command("setup")
@@ -334,6 +334,7 @@ program
 program.command("policy").description("manage the x402_http_call host policy (show/set/list/unset/defaults)").allowUnknownOption();
 program.command("channel").description("inspect/manage batch-settlement channels (ls/status/refund)").allowUnknownOption();
 program.command("safe").description("Safe (governance) wallet: setup | revoke").allowUnknownOption();
+program.command("serve").description("run a lightweight x402 seller — a paid HTTP endpoint (--pay-to, --handler)").allowUnknownOption();
 // Passthrough groups delegate to the existing scripts, which parse process.argv
 // themselves. Intercept BEFORE commander so their flags aren't consumed, and
 // rewrite argv so each script sees its sub-args starting at index 2.
@@ -345,6 +346,7 @@ async function runPassthrough(modPath, label, subArgs) {
 const PASSTHROUGH = {
     policy: { mod: "./policy.js", label: "hpp-x402-policy" },
     channel: { mod: "./channel.js", label: "hpp-x402-channel" },
+    serve: { mod: "./serve.js", label: "hpp-x402-serve" },
 };
 const sub = process.argv[2];
 if (sub && sub in PASSTHROUGH) {

package/dist/cli/serve.js

@@ -0,0 +1,128 @@
+/**
+ * hpp-x402 serve — lightweight generic x402 seller (A2 Phase 2).
+ *
+ * Turns any agent capability into a paid HTTP endpoint. express +
+ * @x402/express `paymentMiddleware` run the whole serve-then-settle x402 flow
+ * (build requirements → 402 → verify → settle) against our facilitator; the
+ * route handler just does the work — either **echo** (default, for testing) or
+ * forward the request body to a configured **webhook** (`--handler <url>`).
+ * The Noosphere on-chain compute backend is intentionally NOT used — the
+ * handler is generic (SELLER_DESIGN layer 2).
+ *
+ * Usage:
+ *   hpp-x402 serve --pay-to 0x... [--port 4030] [--path /paid/echo]
+ *     [--price 10000] [--network eip155:181228] [--asset 0x...]
+ *     [--facilitator-url https://facilitator-sepolia.hpp.io]
+ *     [--handler https://my-agent/handle] [--description "..."]
+ */
+import express from "express";
+import { paymentMiddleware, x402ResourceServer } from "@x402/express";
+import { ExactEvmScheme } from "@x402/evm/exact/server";
+import { HTTPFacilitatorClient } from "@x402/core/server";
+import { declareDiscoveryExtension } from "@x402/extensions/bazaar";
+const DEFAULT_USDCE = "0x401eCb1D350407f13ba348573E5630B83638E30D";
+const DEFAULT_FACILITATOR = "https://facilitator-sepolia.hpp.io";
+// EIP-712 domain of HPP USDC.e — buyers need (name, version) in the advertised
+// requirements to sign the EIP-3009 authorization. Override via --domain-name /
+// --domain-version for a different asset.
+const DEFAULT_DOMAIN_NAME = "Bridged USDC";
+const DEFAULT_DOMAIN_VERSION = "2";
+function parseArgs(argv) {
+    const out = {};
+    for (let i = 2; i < argv.length; i++) {
+        const a = argv[i];
+        if (!a.startsWith("--"))
+            continue;
+        const k = a.slice(2);
+        const next = argv[i + 1];
+        if (!next || next.startsWith("--"))
+            out[k] = true;
+        else {
+            out[k] = next;
+            i++;
+        }
+    }
+    return out;
+}
+export async function run() {
+    const a = parseArgs(process.argv);
+    const payTo = a["pay-to"];
+    if (!payTo)
+        throw new Error("--pay-to <address> required (where payments land)");
+    const port = Number(a.port ?? 4030);
+    const path = a.path ?? "/paid/echo";
+    const price = String(a.price ?? "10000");
+    const network = (a.network ?? "eip155:181228");
+    const asset = a.asset ?? DEFAULT_USDCE;
+    const facilitatorUrl = a["facilitator-url"] ?? DEFAULT_FACILITATOR;
+    const handlerUrl = a.handler;
+    const description = a.description ?? "hpp-x402 paid endpoint";
+    const domainName = a["domain-name"] ?? DEFAULT_DOMAIN_NAME;
+    const domainVersion = a["domain-version"] ?? DEFAULT_DOMAIN_VERSION;
+    // Advertise discovery metadata by default so the facilitator auto-indexes
+    // this seller into x402-discovery after the first settlement. --private opts
+    // out (unlisted endpoint).
+    const discoverable = a.private !== true;
+    // SDK server-side scheme builds correct requirements (incl. exact EIP-712
+    // domain) + drives verify/settle via the facilitator.
+    const facilitator = new HTTPFacilitatorClient({ url: facilitatorUrl });
+    const resourceServer = new x402ResourceServer([facilitator]);
+    resourceServer.register(network, new ExactEvmScheme());
+    // Bazaar discovery extension — the facilitator picks it up at settlement and
+    // forwards it to the discovery indexer, so this seller becomes findable via
+    // hpp_discover after its first sale (no explicit register needed).
+    const discovery = discoverable
+        ? declareDiscoveryExtension({
+            bodyType: "json",
+            input: {},
+            inputSchema: { type: "object", additionalProperties: true },
+            output: { example: { ok: true } },
+        })
+        : {};
+    const routes = {
+        [`POST ${path}`]: {
+            accepts: [
+                {
+                    scheme: "exact",
+                    network,
+                    payTo,
+                    price: { amount: price, asset, extra: { name: domainName, version: domainVersion } },
+                    maxTimeoutSeconds: 600,
+                },
+            ],
+            description,
+            extensions: { ...discovery },
+        },
+    };
+    const app = express();
+    app.use(express.json());
+    // Serve-then-settle: verifies X-PAYMENT, runs the handler, settles on success.
+    app.use(paymentMiddleware(routes, resourceServer));
+    app.post(path, async (req, res) => {
+        try {
+            if (handlerUrl) {
+                const r = await fetch(handlerUrl, {
+                    method: "POST",
+                    headers: { "content-type": "application/json" },
+                    body: JSON.stringify(req.body ?? {}),
+                });
+                const text = await r.text();
+                res.status(r.status).type(r.headers.get("content-type") ?? "application/json").send(text);
+            }
+            else {
+                res.json({ ok: true, echo: req.body ?? null, served: "hpp-x402-serve" });
+            }
+        }
+        catch (err) {
+            res.status(502).json({ error: `handler failed: ${err.message}` });
+        }
+    });
+    app.get("/healthz", (_req, res) => {
+        res.json({ ok: true });
+    });
+    app.listen(port, () => {
+        process.stderr.write(`hpp-x402 serve: POST ${path} @ :${port}  price=${price} payTo=${payTo}\n` +
+            `  network=${network} facilitator=${facilitatorUrl} handler=${handlerUrl ?? "echo"}\n`);
+    });
+}
+//# sourceMappingURL=serve.js.map

package/dist/config.js

@@ -8,6 +8,11 @@ import { z } from "zod";
 const HEX_ADDR = /^0x[0-9a-fA-F]{40}$/;
 const HEX_KEY = /^0x[0-9a-fA-F]{64}$/;
 const KEYCHAIN_URI = /^keychain:\/\/[^\/]+\/[a-zA-Z0-9._-]+$/;
+// Per-network defaults so USDCE_ADDRESS / HPP_RPC_URL can be omitted (zero-config).
+const NETWORK_DEFAULTS = {
+    "eip155:181228": { rpc: "https://sepolia.hpp.io", usdc: "0x401eCb1D350407f13ba348573E5630B83638E30D" },
+    "eip155:190415": { rpc: "https://mainnet.hpp.io", usdc: "0x401eCb1D350407f13ba348573E5630B83638E30D" },
+};
 const Schema = z.object({
     // Delegate EOA — signs EIP-3009 payments + executeAllowanceTransfer.
     // Accepted forms:
@@ -22,17 +27,19 @@ const Schema = z.object({
     SAFE_ADDRESS: z.string().regex(HEX_ADDR).optional(),
     // Deployed AllowanceModule (Safe mode only; pairs with SAFE_ADDRESS).
     ALLOWANCE_MODULE_ADDRESS: z.string().regex(HEX_ADDR).optional(),
-    // Asset paid in (USDC.e on HPP).
-    USDCE_ADDRESS: z.string().regex(HEX_ADDR),
+    // Asset paid in (USDC.e on HPP). Optional — defaults per network (below).
+    USDCE_ADDRESS: z.string().regex(HEX_ADDR).optional(),
     // Remote MCP server we proxy to (the seller). Optional: when unset the
     // bridge runs in local-tools-only mode (e.g. credit top-up / A2A) and skips
     // the upstream connection entirely.
     RESOURCE_SERVER_URL: z.string().url().optional(),
-    // Chain RPC.
-    HPP_RPC_URL: z.string().url(),
+    // Chain RPC. Optional — defaults per network (below).
+    HPP_RPC_URL: z.string().url().optional(),
     // CAIP-2 network identifier used by @x402/evm.
     // e.g. "eip155:181228" (HPP Sepolia) / "eip155:190415" (HPP Mainnet).
-    HPP_NETWORK: z.string().regex(/^eip155:\d+$/),
+    // Optional — defaults to HPP Sepolia so a bare `npx @hpp-io/x402-mcp-bridge`
+    // boots with zero config (see NETWORK_DEFAULTS + runBridge auto-wallet).
+    HPP_NETWORK: z.string().regex(/^eip155:\d+$/).optional().default("eip155:181228"),
     // Optional knobs ------------------------------------------------------
     // How much to pull on each topup, in atomic USDC.e units. If unset,
     // the bridge tops up "just enough" for the upcoming payment + small
@@ -61,6 +68,15 @@ const Schema = z.object({
         .url()
         .optional()
         .default("https://x402-discovery.hpp.io"),
+    // Seller tools (A2 Phase 1). "on" registers seller_* MCP tools so this agent
+    // can charge others over x402 (facilitator verify/settle wrappers). Off by
+    // default — buyers don't need them.
+    HPP_X402_SELLER: z.enum(["on", "off"]).optional().default("off"),
+    HPP_X402_FACILITATOR_URL: z
+        .string()
+        .url()
+        .optional()
+        .default("https://facilitator-sepolia.hpp.io"),
 })
     // Wallet mode is inferred from Safe config presence: both set = Safe mode
     // (autoTopup from the Safe within an on-chain cap); both omitted = light mode
@@ -88,12 +104,18 @@ export function loadConfig(env = process.env) {
     const v = parsed.data;
     const chainId = Number(v.HPP_NETWORK.split(":")[1]);
     const walletMode = v.SAFE_ADDRESS && v.ALLOWANCE_MODULE_ADDRESS ? "safe" : "light";
+    // Zero-config: fill USDC.e + RPC from per-network defaults when omitted.
+    const defaults = NETWORK_DEFAULTS[v.HPP_NETWORK] ?? NETWORK_DEFAULTS["eip155:181228"];
     return {
         ...v,
+        USDCE_ADDRESS: v.USDCE_ADDRESS ?? defaults.usdc,
+        HPP_RPC_URL: v.HPP_RPC_URL ?? defaults.rpc,
         chainId,
         walletMode,
         discoveryEnabled: v.HPP_X402_DISCOVERY === "on",
         discoveryUrl: v.HPP_X402_DISCOVERY_URL,
+        sellerEnabled: v.HPP_X402_SELLER === "on",
+        facilitatorUrl: v.HPP_X402_FACILITATOR_URL,
     };
 }
 //# sourceMappingURL=config.js.map

package/dist/funds/direct-balance.js

@@ -41,13 +41,16 @@ export class DirectBalance {
      * (sufficient balance) or throws with a funding instruction. It never returns
      * a tx hash.
      */
-    async ensure(requiredAtomic) {
-        const balance = (await this.publicClient.readContract({
+    async balance() {
+        return (await this.publicClient.readContract({
             address: this.token,
             abi: ERC20_BALANCE_ABI,
             functionName: "balanceOf",
             args: [this.delegate],
         }));
+    }
+    async ensure(requiredAtomic) {
+        const balance = await this.balance();
         if (balance >= requiredAtomic)
             return null;
         throw new Error(`insufficient USDC.e: need ${requiredAtomic}, have ${balance}. ` +

package/dist/httpX402.js

@@ -24,6 +24,7 @@ import { x402Client, x402HTTPClient } from "@x402/core/client";
 import { ExactEvmScheme } from "@x402/evm/exact/client";
 import { pickExactAccept } from "./a2a.js";
 import { loadPolicy, checkAccess, checkAmount, resolveCredentials, checkCooldown, recordPaid, acquireHostLock, } from "./policy.js";
+import { checkWalletSpend, recordWalletSpend } from "./spendGuard.js";
 import { log } from "./log.js";
 export const X402_HTTP_TOOL = {
     name: "x402_http_call",
@@ -166,6 +167,11 @@ export async function x402HttpCall(deps, args) {
         const deny = checkAmount(access.limits, amount);
         if (deny)
             return errorResult(`blocked: ${deny}`);
+        // wallet-wide guard (per-call + daily ledger) — uniform across all payment
+        // tools; blocks a runaway agent before signing.
+        const walletDeny = checkWalletSpend(amount);
+        if (walletDeny)
+            return errorResult(`blocked: ${walletDeny}`);
         // Ensure the delegate holds enough USDC.e (Safe autoTopup within the
         // on-chain cap, or a light-mode balance check — same gate either way).
         if (deps.funds) {
@@ -198,6 +204,7 @@ export async function x402HttpCall(deps, args) {
         // retries; a failed settle (isError) stays retryable.
         if (!result.isError) {
             recordPaid(host, result.content[0].text ?? "");
+            recordWalletSpend(amount);
         }
         log.info("x402_http_call.done", {
             host,

package/dist/index.js

@@ -14,10 +14,41 @@ import { DirectBalance } from "./funds/direct-balance.js";
 import { connectUpstream } from "./client.js";
 import { startBridgeServer } from "./server.js";
 import { DiscoveryClient } from "./discovery.js";
-import { isKeychainURI, resolveKeychain } from "./keychain.js";
+import { isKeychainURI, resolveKeychain, setKeychain, buildKeychainURI, } from "./keychain.js";
+import { generatePrivateKey, privateKeyToAccount } from "viem/accounts";
 const PKG_NAME = "@hpp-io/x402-mcp-bridge";
-const PKG_VERSION = "0.0.3"; // mirrors package.json — bump together
+const PKG_VERSION = "0.1.1"; // mirrors package.json — bump together
+const DEFAULT_ACCOUNT = "delegate-default";
+/**
+ * Zero-config first run: if no DELEGATE_PRIVATE_KEY is supplied, auto-create a
+ * delegate wallet in the OS keychain (idempotent — reused on later runs) and
+ * point the env at its keychain URI. Lets a bare
+ * `npx -y @hpp-io/x402-mcp-bridge` boot with no config; the user just funds the
+ * printed address. Explicitly-set keys are untouched.
+ */
+function ensureDelegateKey(env) {
+    if (env.DELEGATE_PRIVATE_KEY)
+        return;
+    const uri = buildKeychainURI(DEFAULT_ACCOUNT);
+    let key;
+    let created = false;
+    try {
+        key = resolveKeychain(uri);
+    }
+    catch {
+        key = generatePrivateKey();
+        setKeychain(DEFAULT_ACCOUNT, key);
+        created = true;
+    }
+    env.DELEGATE_PRIVATE_KEY = uri;
+    const address = privateKeyToAccount(key).address;
+    // Written straight to stderr (not the level-gated logger, which isn't
+    // configured yet at this point) so the funding address is always visible.
+    process.stderr.write(`\nhpp-x402: wallet ${created ? "created" : "ready"} → ${address}\n` +
+        `  ▶ Fund it: send USDC.e to this address (no native gas needed).\n\n`);
+}
 export async function runBridge(env = process.env) {
+    ensureDelegateKey(env);
     const cfg = loadConfig(env);
     setLogLevel(cfg.LOG_LEVEL);
     log.info("bridge.start", {
@@ -85,6 +116,12 @@ export async function runBridge(env = process.env) {
         : undefined;
     if (discovery)
         log.info("discovery.enabled", { url: cfg.discoveryUrl });
+    // Seller tools — register seller_* when enabled.
+    const seller = cfg.sellerEnabled
+        ? { network: cfg.HPP_NETWORK, facilitatorUrl: cfg.facilitatorUrl }
+        : undefined;
+    if (seller)
+        log.info("seller.enabled", { facilitator: cfg.facilitatorUrl });
     await startBridgeServer({
         upstream,
         name: PKG_NAME,
@@ -93,6 +130,7 @@ export async function runBridge(env = process.env) {
         network: cfg.HPP_NETWORK,
         funds,
         discovery,
+        seller,
         a2aRpcTimeoutMs,
     });
     // Graceful shutdown: when the host closes our stdin (or Claude Desktop