@oobe-protocol-labs/sap-mcp-server 0.3.0 → 0.7.0

package/dist/wizard-core/desktop-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"desktop-flow.js","sourceRoot":"","sources":["../../src/wizard-core/desktop-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,eAAe,EAAiD,MAAM,oBAAoB,CAAC;AACpG,OAAO,EACL,wBAAwB,EACxB,qCAAqC,EACrC,iCAAiC,EACjC,wBAAwB,GAEzB,MAAM,mCAAmC,CAAC;AA6D3C;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAAa;IACvD,OAAO,KAAK;SACT,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;SAC5B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B;IAC7C,MAAM,WAAW,GAAG,cAAc,CAAC;IACnC,OAAO;QACL,WAAW;QACX,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,eAAe,EAAE,IAAI;QACrB,UAAU,EAAE,0BAA0B,CAAC,WAAW,CAAC;QACnD,aAAa,EAAE,CAAC;QAChB,aAAa,EAAE,EAAE;QACjB,WAAW,EAAE,KAAK;QAClB,QAAQ,EAAE,MAAM;QAChB,aAAa,EAAE,KAAK;QACpB,SAAS,EAAE,MAAM;QACjB,cAAc,EAAE,IAAI;QACpB,iBAAiB,EAAE,CAAC,OAAO,CAAC;QAC5B,kBAAkB,EAAE,IAAI;KACzB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAgB;IACxD,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAuC,CAAC;IACjE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,MAAM,CAAC,EAAsB,CAAC;QACzC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,OAAO;QACL;YACE,EAAE,EAAE,OAAO;YACX,KAAK,EAAE,OAAO;YACd,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;YACjD,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE;YACjE,gBAAgB,EAAE,IAAI;YACtB,cAAc,EAAE,qFAAqF;SACtG;QACD;YACE,EAAE,EAAE,QAAQ;YACZ,KAAK,EAAE,QAAQ;YACf,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClD,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE;YAClE,gBAAgB,EAAE,IAAI;YACtB,cAAc,EAAE,iFAAiF;SAClG;QACD;YACE,EAAE,EAAE,QAAQ;YACZ,KAAK,EAAE,QAAQ;YACf,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClD,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE;YAClE,gBAAgB,EAAE,IAAI;YACtB,cAAc,EAAE,0FAA0F;SAC3G;QACD;YACE,EAAE,EAAE,UAAU;YACd,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;YACpD,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE;YACpE,gBAAgB,EAAE,IAAI;YACtB,cAAc,EAAE,+EAA+E;SAChG;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAyB;IAClE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;QACxC,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;YAC/F,MAAM,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,WAAW,GAAG,2BAA2B,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACnE,IAAI,CAAC,WAAW,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,8GAA8G,CAAC,CAAC;IAC9H,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChF,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACnE,MAAM,CAAC,IAAI,CAAC,oFAAoF,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAyB;IACpE,MAAM,MAAM,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,WAAW,GAAG,2BAA2B,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,KAAK,MAAM;QACtC,CAAC,CAAC,MAAM,eAAe,CAAC;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,WAAW;YACX,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,UAAU,EAAE,KAAK;YACjB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CAAC;QACF,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,cAAc,GAA0C,EAAE,CAAC;IACjE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAmB,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC5E,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,iCAAiC,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;QACrF,cAAc,CAAC,IAAI,CAAC;YAClB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK;YAC5B,MAAM,EAAE,YAAY;YACpB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;YACxB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,qCAAqC,EAAE,CAAC;QACtD,cAAc,CAAC,IAAI,CAAC;YAClB,OAAO,EAAE,OAAO;YAChB,MAAM,EAAE,YAAY;YACpB,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;YACvB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,wBAAwB,EAAE,CAAC;QACzC,cAAc,CAAC,IAAI,CAAC;YAClB,OAAO,EAAE,sBAAsB;YAC/B,MAAM,EAAE,WAAW;YACnB,IAAI,EAAE,KAAK,CAAC,SAAS;YACrB,OAAO,EAAE,aAAa,KAAK,CAAC,OAAO,gBAAgB;SACpD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,cAAc,EAAE,CAAC;AAC/D,CAAC"}

package/docs/00_README.md

@@ -22,6 +22,8 @@ For end-user installation and MCP client setup, start with [`../USER_DOCS/00_STA
 | [10. Operations, Release, And PM2](10_OPERATIONS_RELEASE_AND_PM2.md) | Build gates, PM2 ecosystem, logs, monitoring, changelog discipline, public/private repo guidance. |
 | [11. Code Quality Audit](11_CODE_QUALITY_AUDIT.md) | Engineering scorecard, release gates, quality rules, and current residual risks. |
 | [12. On-Chain Agent Chat](12_ONCHAIN_AGENT_CHAT.md) | SAP signed thematic group rooms, room manifests, retrieval, link sharing, privacy boundaries, and SDK-native roadmap. |
+| [13. Bounty Program Proposal](13_BOUNTY_PROGRAM_PROPOSAL.md) | Proposed multi-partner bounty with OOBE/SAP MCP, Bento, Metaplex 014/MPL Core, SNS, judging criteria, and technical requirements. |
+| [14. Desktop Wizard Release](14_DESKTOP_WIZARD_RELEASE.md) | GUI wizard architecture, release artifacts, signing requirements, and multi-OS GitHub Actions packaging. |
 
 ## 00.2 Primary Binaries
 
@@ -34,6 +36,7 @@ For end-user installation and MCP client setup, start with [`../USER_DOCS/00_STA
 | `sap-signing-proxy` | Local signing proxy for external signer mode. |
 | `sap-mcp-facilitator` | Self-hosted x402 SVM facilitator. |
 | `sap-mcp-pay-sh-spec` | pay.sh provider YAML generator. |
+| SAP MCP Desktop Wizard | GUI/TUI-style installer released as DMG/ZIP, Windows EXE, and Linux tar.gz artifacts. |
 
 ## 00.3 Golden Rules
 

package/docs/03_CONFIGURATION_AND_WIZARD.md

@@ -62,7 +62,24 @@ The wizard should:
 9. Offer optional MCP client config injection.
 10. Warn before merge or override when an existing `sap` MCP entry is found.
 
-## 03.5 Client Config Injection
+## 03.5 Desktop GUI Wizard
+
+SAP MCP also ships a Desktop GUI Wizard for users who should not need to edit JSON, TOML, or YAML by hand.
+
+The desktop app uses the same setup modules as `sap-mcp-config wizard`; it must not create a second config format or a separate wallet model.
+
+Desktop flow:
+
+1. Choose a named profile.
+2. Create or import a dedicated SAP MCP wallet.
+3. Set policy limits and optional Bento Guard metadata.
+4. Detect local agent runtimes.
+5. Configure hosted MCP and the local x402 paid-call bridge where supported.
+6. Show a final review before writing files.
+
+Release artifacts are produced as macOS DMG/ZIP, Windows NSIS EXE, and Linux tar.gz. See [14. Desktop Wizard Release](14_DESKTOP_WIZARD_RELEASE.md).
+
+## 03.6 Client Config Injection
 
 The injection step is optional. It targets known local MCP clients such as Claude Desktop, Hermes, Codex, and OpenClaw.
 
@@ -86,7 +103,17 @@ The injected config should follow the profile manager:
 
 Do not inject keypair bytes, hard-coded legacy wallet paths, or stale RPC overrides into agent client files.
 
-## 03.6 Config CLI
+For hosted paid/write tools, clients may also need a local `sap_payments` bridge that exposes only:
+
+```txt
+sap_x402_paid_call
+sap_profile_current
+sap_x402_estimate_cost
+```
+
+This bridge signs x402 payment proofs locally with the active SAP MCP profile and retries the hosted tool call.
+
+## 03.7 Config CLI
 
 Use `sap-mcp-config` for profile and policy operations:
 
@@ -109,7 +136,7 @@ npx sap-mcp-config audit
 npx sap-mcp-config hash
 ```
 
-## 03.7 Approval Workflow
+## 03.8 Approval Workflow
 
 Sensitive config changes can require approval. Typical protected fields are:
 
@@ -121,7 +148,7 @@ Sensitive config changes can require approval. Typical protected fields are:
 
 Pending changes are listed with `sap-mcp-config pending`, approved with `sap-mcp-config approve <id>`, and denied with `sap-mcp-config deny <id>`.
 
-## 03.8 Network Consistency
+## 03.9 Network Consistency
 
 The active profile is the source of truth for network behavior. If a profile is on devnet, SAP tools must return devnet data. If a profile is on mainnet, SAP tools must return mainnet data.
 
@@ -140,4 +167,3 @@ env:
   SAP_MCP_ALLOW_ENV_CONFIG_OVERRIDE: "false"
   SAP_LOG_LEVEL: info
 ```
-

package/docs/06_PAYMENTS_X402_AND_PAYSH.md

@@ -42,7 +42,49 @@ PAYMENT-SIGNATURE: <x402 payment payload>
 X-PAYMENT: <x402 payment payload>
 ```
 
-## 06.4 Payment Test Matrix
+The retry must preserve the initialized `mcp-session-id` and the same MCP method
+and params that produced the challenge. JSON-RPC `id` is not part of the
+canonical paid request hash.
+
+## 06.4 Local x402 Paid-Call Addon
+
+Some clients can connect to hosted Streamable HTTP MCP but cannot yet sign and
+replay x402 challenges natively. SAP MCP ships a local helper for that case:
+
+```bash
+npm exec --yes --package @oobe-protocol-labs/sap-mcp-server -- sap-mcp-x402-paid-call \
+  --tool sap_list_all_agents \
+  --arguments '{"limit":5}' \
+  --max-usd 0.02 \
+  --max-attempts 5 \
+  --confirm
+```
+
+The wizard can install addon metadata and snippets for Hermes, Claude, Codex,
+OpenClaw, or custom runtimes:
+
+```text
+~/.config/mcp-sap/addons/x402-paid-call
+```
+
+The helper initializes the hosted MCP session, receives the x402 challenge,
+signs the payment payload with the user's local SAP MCP profile wallet, retries
+the hosted call, and prints the settlement receipt. It does not send keypair
+bytes to the hosted server. It fails closed when the active profile has no
+supported local payment signer.
+
+Local stdio SAP MCP may expose `sap_x402_paid_call` when the process has a
+user-controlled wallet profile. The public hosted server should not advertise
+that helper in non-custodial mode because signing belongs on the user's machine.
+
+Transient settlement errors such as `BlockhashNotFound`,
+`transaction_simulation_failed`, `smart_wallet_simulation_failed`, `node is
+behind`, `minimum context slot`, or `fetch failed` should be retried with a
+fresh x402 challenge and payment payload. Do not reuse old signed payment
+payloads, and do not bypass the hosted paid path with direct RPC calls unless
+the user explicitly asks for local execution.
+
+## 06.5 Payment Test Matrix
 
 Before mainnet launch, verify these cases on devnet:
 
@@ -59,7 +101,7 @@ Before mainnet launch, verify these cases on devnet:
 | Facilitator unavailable | Paid call fails closed, not free. |
 | pay.sh checkout configured | 402 body includes checkout URL, but SAP MCP remains pricing authority. |
 
-## 06.5 pay.sh Role
+## 06.6 pay.sh Role
 
 pay.sh is useful as a provider/catalog/proxy layer for public distribution and checkout UX.
 
@@ -72,7 +114,7 @@ Important distinction:
 
 For that reason, SAP MCP should remain the pricing source of truth for MCP `tools/call` requests.
 
-## 06.6 Enable Monetization
+## 06.7 Enable Monetization
 
 Configure monetization through a private environment store. Public docs should not include live facilitator URLs, auth tokens, payment recipients, RPC credentials, or signer paths.
 
@@ -91,7 +133,7 @@ SAP_MCP_PAY_SH_CHECKOUT_URL=<optional-pay-sh-checkout-url>
 
 `SAP_MCP_MONETIZATION_PAY_TO` is the revenue recipient. It is not the facilitator signer, not a customer payment signer, and not an agent wallet.
 
-## 06.7 Facilitator Keypair
+## 06.8 Facilitator Keypair
 
 The facilitator needs its own dedicated signer. Initialize it:
 
@@ -112,7 +154,7 @@ The facilitator signer is used for facilitator operations. It must be separate f
 3. Revenue recipient wallet.
 4. Customer wallets.
 
-## 06.8 Start Facilitator
+## 06.9 Start Facilitator
 
 Start the facilitator through PM2, systemd, or a container supervisor with private environment injection:
 
@@ -122,7 +164,26 @@ npx sap-mcp-facilitator start
 
 If the facilitator binds to a non-loopback host or is reachable across a network boundary, an auth token is required.
 
-## 06.9 Generate pay.sh Provider YAML
+Facilitator settlement depends on Solana RPC health. Production deployments should configure at least one private primary RPC and one or more fallback endpoints:
+
+```bash
+SAP_MCP_FACILITATOR_RPC_URL=<private-primary-rpc-url>
+SAP_MCP_FACILITATOR_RPC_FALLBACK_URLS=<private-backup-rpc-url>,https://api.mainnet-beta.solana.com
+```
+
+The facilitator retries only transient RPC failures such as transport failures, throttling, lagging nodes, skipped slots, or blockhash visibility issues. It does not retry business failures such as insufficient funds, invalid signatures, or program errors. RPC URLs are redacted in logs and CLI output.
+
+## 06.10 Generate pay.sh Provider YAML
+
+The hosted OOBE deployment publishes a public, secret-free provider catalog at:
+
+```text
+https://mcp.sap.oobeprotocol.ai/pay/provider.yml
+```
+
+Use that URL for catalog discovery and pay.sh proxy configuration. It intentionally omits private RPC URLs, signer paths, facilitator auth tokens, and VPS-local paths.
+
+For private operator files, generate a provider YAML locally:
 
 ```bash
 npx sap-mcp-pay-sh-spec \
@@ -149,7 +210,9 @@ Options:
 | `--title <text>` | pay.sh provider title. |
 | `--no-fee-payer` | Disable operator fee-payer sponsorship. |
 
-## 06.10 Usage Ledger
+Do not publish generated YAML files that include `--rpc-url` or `--signer-path`.
+
+## 06.11 Usage Ledger
 
 Payment decisions are written to the usage ledger. The ledger should store:
 

package/docs/07_ENDPOINTS_AND_CLIENTS.md

@@ -5,8 +5,14 @@
 | Method | Path | Purpose | Auth |
 | --- | --- | --- | --- |
 | `GET` | `/` | Public landing page with share metadata and safe endpoint information. | Public. |
+| `GET` | `/docs` | Docsify-powered public documentation site for install, start, configuration, hosted remote MCP, x402/pay.sh, and client setup. | Public. |
+| `GET` | `/docs/*.md` | Read-only markdown files used by the docs site. Supports `docs/` and `USER_DOCS/` through `/docs/user/*.md`. | Public. |
 | `GET` | `/server.json` | Machine-readable public server metadata. | Public. |
+| `GET` | `/openapi.json` | OpenAPI 3.1 discovery document for the hosted MCP endpoint, x402 metadata, and pay.sh catalog link. | Public. |
+| `GET` | `/.well-known/x402` | x402 discovery document for paid hosted MCP resources. | Public. |
+| `GET` | `/pay/provider.yml` | Secret-free pay.sh provider YAML for the hosted SAP MCP catalog/proxy workflow. | Public. |
 | `GET` | `/favicon.png` | SAP MCP favicon/social preview asset. | Public. |
+| `GET` | `/favicon.ico` | Browser favicon compatibility route at the API root. | Public. |
 | `GET` | `/health` | Health check. | No, unless reverse proxy requires it. |
 | `GET` | `/.well-known/agent-card.json` | A2A-compatible discovery card. | Usually public. |
 | `GET` | `/.well-known/sap-mcp-wizard.json` | Machine-readable wizard install metadata for agents that cannot see local config. | Public. |
@@ -15,7 +21,7 @@
 | `GET` | `/mcp` | Streamable HTTP session stream. Browser-style `Accept: text/html` receives a public preview page instead. | Same as `POST /mcp`. |
 | `DELETE` | `/mcp` | Streamable HTTP session cleanup. | Same as `POST /mcp`. |
 
-The public HTML and JSON endpoints must remain secret-free. Do not expose RPC query parameters, private VPS paths, keypair file paths, bearer tokens, facilitator auth tokens, or wallet bytes through these routes.
+The public HTML, JSON, and YAML endpoints must remain secret-free. Do not expose RPC query parameters, private VPS paths, keypair file paths, bearer tokens, facilitator auth tokens, or wallet bytes through these routes.
 
 ## 07.2 Facilitator Endpoints
 
@@ -113,6 +119,27 @@ Generic MCP client JSON:
 }
 ```
 
+Codex `~/.codex/config.toml`:
+
+```toml
+[mcp_servers.sap]
+url = "https://mcp.sap.oobeprotocol.ai/mcp"
+```
+
+Codex supports Streamable HTTP MCP servers with URL-based TOML entries. Use local stdio through `npx` only when you want Codex to launch SAP MCP locally:
+
+```toml
+[mcp_servers.sap]
+command = "npx"
+args = ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server", "sap-mcp-server"]
+
+[mcp_servers.sap.env]
+SAP_MCP_ALLOW_ENV_CONFIG_OVERRIDE = "false"
+SAP_LOG_LEVEL = "info"
+```
+
+On Windows, use `command = "npx.cmd"`.
+
 Hermes global `~/.hermes/mcp.json`:
 
 ```json

package/docs/10_OPERATIONS_RELEASE_AND_PM2.md

@@ -93,9 +93,10 @@ Version `0.2.0` includes:
 4. Optional client config injection for local agents.
 5. x402 monetization gate for paid hosted tool calls.
 6. OOBE self-hosted x402 SVM facilitator.
-7. pay.sh provider YAML generation.
-8. SAP SDK, SNS, Synapse AgentKit, Solana, profile, transaction, skill, chat, and payment tools.
-9. Policy engine support with local, Bento, and hybrid modes.
-10. Security guardrails for private key exposure and unsafe actions.
-11. Clean `pnpm audit --audit-level moderate` dependency graph.
-12. Node.js `>=22.12.0` and pnpm `11.7.0` release baseline.
+7. Facilitator RPC failover through `SAP_MCP_FACILITATOR_RPC_FALLBACK_URLS` for transient endpoint failures.
+8. pay.sh provider YAML generation.
+9. SAP SDK, SNS, Synapse AgentKit, Solana, profile, transaction, skill, chat, and payment tools.
+10. Policy engine support with local, Bento, and hybrid modes.
+11. Security guardrails for private key exposure and unsafe actions.
+12. Clean `pnpm audit --audit-level moderate` dependency graph.
+13. Node.js `>=22.12.0` and pnpm `11.7.0` release baseline.