@oobe-protocol-labs/sap-mcp-server 0.9.0 → 0.9.2

package/.env.example

@@ -74,6 +74,32 @@ SAP_HTTP_PORT=8787
 SAP_HTTP_HOST=127.0.0.1
 # SAP_HTTP_CORS_ORIGINS=https://app.example.com,https://admin.example.com
 
+# =============================================================================
+# Hosted Remote Scaling & Backpressure
+# =============================================================================
+# Redis should be enabled for clustered/PM2 multi-process hosted deployments.
+# It shares rate limits and payment usage ledger streams across workers.
+# SAP_MCP_USE_REDIS=true
+# SAP_MCP_REDIS_URL=redis://127.0.0.1:6379
+
+# Stateful Streamable HTTP sessions. Idle sessions are closed automatically so
+# crawlers and abandoned agent sessions cannot exhaust memory.
+SAP_MCP_REMOTE_MAX_STATEFUL_SESSIONS=2000
+SAP_MCP_REMOTE_SESSION_IDLE_TTL_MS=600000
+SAP_MCP_REMOTE_SESSION_ABSOLUTE_TTL_MS=3600000
+SAP_MCP_REMOTE_SESSION_CLEANUP_INTERVAL_MS=30000
+
+# Global in-process backpressure for active MCP requests/streams.
+# Raise this with enough RAM/CPU and a reverse proxy connection budget.
+SAP_MCP_REMOTE_MAX_IN_FLIGHT_REQUESTS=1024
+
+# Node HTTP tuning for reverse-proxied Streamable HTTP.
+SAP_MCP_REMOTE_REQUEST_TIMEOUT_MS=300000
+SAP_MCP_REMOTE_HEADERS_TIMEOUT_MS=65000
+SAP_MCP_REMOTE_KEEP_ALIVE_TIMEOUT_MS=75000
+# 0 means unlimited requests per socket.
+SAP_MCP_REMOTE_MAX_REQUESTS_PER_SOCKET=0
+
 # =============================================================================
 # Remote MCP Access Control
 # =============================================================================
@@ -131,6 +157,10 @@ SAP_MCP_X402_MAX_TIMEOUT_SECONDS=120
 # SAP_MCP_X402_FACILITATOR_AUTH_TOKEN=
 # Optional browser/manual checkout link included in 402 JSON responses.
 # SAP_MCP_PAY_SH_CHECKOUT_URL=https://pay.sh/checkout/YOUR_CHECKOUT_ID
+# Optional strict hosted marketplace mode. Keeps MCP handshake/discovery,
+# base profile, skills bootstrap, and local payment bridge helper tools free,
+# but charges basic balance and operational reads.
+SAP_MCP_MONETIZATION_STRICT_TOOLS=false
 
 # OOBE self-hosted x402 facilitator.
 # The facilitator signer is a dedicated fee-payer keypair used only to complete

package/CHANGELOG.md

@@ -2,9 +2,50 @@
 
 All notable changes to this project are documented in this file.
 
-## [Unreleased]
+## 0.9.2 - 2026-07-17
 
-No unreleased changes yet.
+### Added
+
+- Added the free `sap_agent_start` tool and matching `sap-agent-start` prompt so
+  users can tell an agent "Start SAP MCP" instead of pasting a long operations
+  prompt. The bootstrap points agents to `sap_skills_bundle`,
+  `sap_payments_readiness`, and `sap_payments_call_paid_tool` while preserving
+  hosted accountless/non-custodial behavior.
+
+### Fixed
+
+- Tightened SAP MCP agent bootstrap behavior so simple connection checks stay
+  concise instead of dumping the full tool catalog or protocol category list.
+- Added AgentKit SPL token input alias normalization for common wallet-owner
+  fields, reducing schema-discovery retries in agent runtimes.
+
+## 0.9.1 - 2026-07-16
+
+Hotfix for hosted SAP MCP users whose agent runtime connected to the remote
+`sap` server but could not start the local non-custodial `sap_payments` bridge
+from an `npx`/`npm exec` install.
+
+### Fixed
+
+- Fixed `sap-mcp-server` startup when launched by Hermes, Codex, Claude,
+  OpenClaw, or another MCP runtime through `npx` outside the repository. The
+  CLI bootstrap now adds both package-local and npm/npx parent `node_modules`
+  paths before loading the server, so SAP SDK assets such as
+  `@oobe-protocol-labs/synapse-sap-sdk/idl/synapse_agent_sap.json` resolve
+  correctly.
+- Made the runtime module resolver find the actual package root from any
+  compiled `dist/*` entrypoint instead of assuming a fixed folder depth.
+- Updated generated runtime config examples and wizard tests to pin the local
+  `sap_payments` bridge to `@oobe-protocol-labs/sap-mcp-server@0.9.1`.
+
+### Verification
+
+- `pnpm run lint`
+- `pnpm run typecheck`
+- `pnpm test -- --run src/runtime/module-resolution.test.ts src/payments/pricing.test.ts src/payments/monetization-gate.test.ts src/remote/server.test.ts`
+- `pnpm run build`
+- Real packaged install smoke test from a temporary directory using the generated
+  npm tarball and `SAP_MCP_PAYMENTS_BRIDGE_ONLY=true`.
 
 ## 0.9.0 - 2026-07-16
 

package/README.md

@@ -60,6 +60,17 @@ Create or select a profile:
 npx sap-mcp-config wizard
 ```
 
+After connecting hosted SAP MCP in an agent runtime, start the agent context
+with one short message:
+
+```text
+Start SAP MCP.
+```
+
+The agent should call the free `sap_agent_start` tool or `sap-agent-start`
+prompt, load `sap_skills_bundle`, and use the local `sap_payments` bridge for
+paid/write hosted calls.
+
 Inspect the active profile:
 
 ```bash
@@ -117,7 +128,7 @@ For paid/write hosted tools, add the local non-custodial payment bridge as well:
 ```toml
 [mcp_servers.sap_payments]
 command = "npx"
-args = ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.0", "sap-mcp-server"]
+args = ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.2", "sap-mcp-server"]
 startup_timeout_sec = 300
 tool_timeout_sec = 300
 
@@ -135,7 +146,7 @@ Codex supports Streamable HTTP MCP servers with URL-based entries in `config.tom
 ```toml
 [mcp_servers.sap]
 command = "npx"
-args = ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.0", "sap-mcp-server"]
+args = ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.2", "sap-mcp-server"]
 
 [mcp_servers.sap.env]
 SAP_MCP_ALLOW_ENV_CONFIG_OVERRIDE = "false"
@@ -180,6 +191,12 @@ DELETE  /mcp
 
 `GET /docs` serves the public documentation site for install, start, configuration, hosted remote MCP, x402/pay.sh payments, and MCP client setup.
 
+Marketplace listings such as Smithery can use [`smithery.config.schema.json`](smithery.config.schema.json)
+to explain the hosted setup path. The schema intentionally asks for no
+secrets: SAP MCP hosted reads work remotely, while paid/write calls use the
+wizard-managed local `sap_payments` bridge, local profile policy, and
+user-controlled signer.
+
 See [05. Remote VPS Deployment](docs/05_REMOTE_VPS_DEPLOYMENT.md) and [07. Endpoints And Clients](docs/07_ENDPOINTS_AND_CLIENTS.md).
 
 ## 6. Monetization

package/USER_DOCS/00_START_HERE.md

@@ -188,3 +188,4 @@ npm exec --yes --package @oobe-protocol-labs/sap-mcp-server -- sap-mcp-config au
 | `04_CLIENT_CONFIGS.md` | Claude, Hermes, Codex, OpenClaw config examples |
 | `05_SKILLS_AND_TOOLS.md` | Skills, tool selection, and security behavior |
 | `06_DESKTOP_GUI_WIZARD.md` | Desktop GUI wizard install, hosted setup, local payment bridge, and runtime behavior |
+| `07_SMITHERY_AND_MARKETPLACES.md` | Smithery setup schema, marketplace usage, native x402 clients, and local bridge guidance |

package/USER_DOCS/01_HOSTED_REMOTE_MCP.md

@@ -108,7 +108,21 @@ npm exec --yes --package @oobe-protocol-labs/sap-mcp-server -- sap-mcp-config sh
 npm exec --yes --package @oobe-protocol-labs/sap-mcp-server -- sap-mcp-config profile-info
 ```
 
-## 4. Test Hosted MCP Manually
+## 4. First Agent Message
+
+After the hosted `sap` server and local `sap_payments` bridge are configured,
+restart the agent runtime and say:
+
+```text
+Start SAP MCP.
+```
+
+The agent should call `sap_agent_start`, load `sap_skills_bundle`, inspect
+hosted profile state, and use `sap_payments_readiness` before paid/write calls.
+This is the normal path for non-technical users. They should not need to paste a
+long prompt or manually explain x402.
+
+## 5. Test Hosted MCP Manually
 
 Initialize:
 
@@ -130,7 +144,7 @@ curl -iN https://mcp.sap.oobeprotocol.ai/mcp \
   -d '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}'
 ```
 
-## 5. Free Tool Smoke Test
+## 6. Free Tool Smoke Test
 
 ```bash
 curl -iN https://mcp.sap.oobeprotocol.ai/mcp \
@@ -143,7 +157,7 @@ curl -iN https://mcp.sap.oobeprotocol.ai/mcp \
 
 The RPC URL in returned metadata must be redacted if it contains query secrets.
 
-## 6. Paid Tool Smoke Test
+## 7. Paid Tool Smoke Test
 
 ```bash
 curl -iN https://mcp.sap.oobeprotocol.ai/mcp \

package/USER_DOCS/04_CLIENT_CONFIGS.md

@@ -45,7 +45,7 @@ url = "https://mcp.sap.oobeprotocol.ai/mcp"
 
 [mcp_servers.sap_payments]
 command = "npx.cmd"
-args = ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.0", "sap-mcp-server"]
+args = ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.2", "sap-mcp-server"]
 startup_timeout_sec = 300
 tool_timeout_sec = 300
 
@@ -65,7 +65,7 @@ the complete local stdio SAP MCP process instead of using the hosted endpoint, u
 ```toml
 [mcp_servers.sap]
 command = "npx.cmd"
-args = ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.0", "sap-mcp-server"]
+args = ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.2", "sap-mcp-server"]
 
 [mcp_servers.sap.env]
 SAP_MCP_ALLOW_ENV_CONFIG_OVERRIDE = "false"
@@ -194,7 +194,7 @@ For Claude Code, use the official MCP CLI pattern:
 
 ```bash
 claude mcp add --transport http sap https://mcp.sap.oobeprotocol.ai/mcp
-claude mcp add --transport stdio sap_payments -- npx --yes --package @oobe-protocol-labs/sap-mcp-server@0.9.0 sap-mcp-server
+claude mcp add --transport stdio sap_payments -- npx --yes --package @oobe-protocol-labs/sap-mcp-server@0.9.2 sap-mcp-server
 ```
 
 Set `SAP_MCP_PAYMENTS_BRIDGE_ONLY=true` and `SAP_ALLOWED_TOOLS=all` in the

package/USER_DOCS/05_SKILLS_AND_TOOLS.md

@@ -1,6 +1,30 @@
 # Skills And Tool Usage
 
-## 1. Install Skills
+## 1. Start SAP MCP
+
+Users should not need to paste a long operations prompt. After connecting the
+hosted `sap` MCP server, say this to the agent:
+
+```text
+Start SAP MCP.
+```
+
+The agent should then:
+
+1. call `sap_agent_start`;
+2. call `sap_skills_bundle` with `includeContents: true`;
+3. use exact tool names from `tools/list`;
+4. call `sap_payments_readiness` if the local `sap_payments` bridge is visible;
+5. use `sap_payments_call_paid_tool` for paid hosted tools that return x402 payment requirements.
+
+If `sap_payments` is missing, run the wizard repair flow and restart the agent
+runtime:
+
+```bash
+npm exec --yes --package @oobe-protocol-labs/sap-mcp-server -- sap-mcp-config wizard
+```
+
+## 2. Install Skills
 
 List bundled skills:
 
@@ -34,7 +58,7 @@ Install bundled skills into a local agent skill directory:
 }
 ```
 
-## 2. Tool Selection
+## 3. Tool Selection
 
 Use profile and context first:
 
@@ -63,7 +87,7 @@ Use transactions:
 - `sap_sign_transaction`
 - `sap_submit_signed_transaction`
 
-## 3. Agent Safety
+## 4. Agent Safety
 
 Agents must not:
 

package/USER_DOCS/06_DESKTOP_GUI_WIZARD.md

@@ -106,7 +106,7 @@ url = "https://mcp.sap.oobeprotocol.ai/mcp"
 
 [mcp_servers.sap_payments]
 command = "npx"
-args = ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.0", "sap-mcp-server"]
+args = ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.2", "sap-mcp-server"]
 startup_timeout_sec = 300
 tool_timeout_sec = 300
 
@@ -138,7 +138,7 @@ Claude Desktop uses a root `mcpServers` JSON object:
     },
     "sap_payments": {
       "command": "npx",
-      "args": ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.0", "sap-mcp-server"],
+      "args": ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.2", "sap-mcp-server"],
       "env": {
         "SAP_MCP_ALLOW_ENV_CONFIG_OVERRIDE": "false",
         "SAP_MCP_PAYMENTS_BRIDGE_ONLY": "true",
@@ -170,7 +170,7 @@ Hermes global `mcp.json` uses flat server entries:
   },
   "sap_payments": {
     "command": "npx",
-    "args": ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.0", "sap-mcp-server"],
+    "args": ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.2", "sap-mcp-server"],
     "env": {
       "SAP_MCP_ALLOW_ENV_CONFIG_OVERRIDE": "false",
       "SAP_MCP_PAYMENTS_BRIDGE_ONLY": "true",
@@ -193,7 +193,7 @@ mcp_servers:
     args:
       - --yes
       - --package
-      - @oobe-protocol-labs/sap-mcp-server@0.9.0
+      - @oobe-protocol-labs/sap-mcp-server@0.9.2
       - sap-mcp-server
     env:
       SAP_MCP_ALLOW_ENV_CONFIG_OVERRIDE: "false"
@@ -215,7 +215,7 @@ OpenClaw MCP JSON uses the same root `mcpServers` structure as generic MCP clien
     },
     "sap_payments": {
       "command": "npx",
-      "args": ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.0", "sap-mcp-server"],
+      "args": ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.2", "sap-mcp-server"],
       "env": {
         "SAP_MCP_ALLOW_ENV_CONFIG_OVERRIDE": "false",
         "SAP_MCP_PAYMENTS_BRIDGE_ONLY": "true",

package/USER_DOCS/07_SMITHERY_AND_MARKETPLACES.md

@@ -0,0 +1,163 @@
+# Smithery And MCP Marketplaces
+
+## 1. What Smithery Connects To
+
+Smithery connects to the hosted SAP MCP endpoint:
+
+```txt
+https://mcp.sap.oobeprotocol.ai/mcp
+```
+
+The hosted endpoint is non-custodial. It can expose tools, prompts, resources,
+metadata, free discovery calls, and x402 payment challenges, but it does not
+store or load user keypairs.
+
+Marketplace metadata:
+
+```txt
+https://mcp.sap.oobeprotocol.ai/server.json
+https://mcp.sap.oobeprotocol.ai/.well-known/mcp/server-card.json
+https://mcp.sap.oobeprotocol.ai/smithery.config.schema.json
+https://mcp.sap.oobeprotocol.ai/.well-known/x402
+https://mcp.sap.oobeprotocol.ai/pay/provider.yml
+```
+
+## 2. Recommended Smithery Mode
+
+Use Smithery first for free discovery and tool inspection:
+
+- `initialize`
+- `tools/list`
+- `prompts/list`
+- `resources/list`
+- `sap_profile_current`
+- `sap_skills_list`
+- `sap_get_network_overview`
+- `sap_payments_readiness` when the local bridge is also installed
+
+Paid/write calls return an x402 challenge. That is expected behavior, not an
+authentication error.
+
+## 3. Paid Tool Options
+
+There are three supported paths for paid hosted SAP MCP tools.
+
+| Path | Use When | What Pays |
+| --- | --- | --- |
+| Free discovery | The user is browsing tools, docs, metadata, or base context. | Nothing. |
+| Native x402 client | The agent runtime or marketplace can parse `PAYMENT-REQUIRED`, sign locally, and retry with `PAYMENT-SIGNATURE` or `X-PAYMENT`. | The runtime's x402 wallet or payer. |
+| Local `sap_payments` bridge | The runtime can call local MCP tools but does not replay x402 itself. | The user's local SAP MCP profile or external signer. |
+
+The hosted server never signs for the user.
+
+## 4. Smithery Config Schema
+
+SAP MCP publishes a Smithery-friendly JSON schema:
+
+```txt
+https://mcp.sap.oobeprotocol.ai/smithery.config.schema.json
+```
+
+The schema is intentionally optional because free discovery works immediately.
+It asks the user or runtime to declare the intended usage mode:
+
+- `free-discovery`
+- `x402-native-client`
+- `local-sap-payments-bridge`
+
+When publishing or refreshing SAP MCP on Smithery, pass the same schema file:
+
+```bash
+npx --yes smithery mcp publish https://mcp.sap.oobeprotocol.ai/mcp \
+  -n oobe-protocol/sap-mcp \
+  --config-schema smithery.config.schema.json
+```
+
+## 5. Local Bridge Setup
+
+For most users who want paid/write tools, run the wizard locally:
+
+```bash
+npm exec --yes --package @oobe-protocol-labs/sap-mcp-server -- sap-mcp-config wizard
+```
+
+Choose the recommended full hosted setup. The wizard configures:
+
+- hosted `sap` remote MCP;
+- local `sap_payments` MCP bridge;
+- active SAP MCP profile;
+- local wallet or external signer boundary;
+- policy limits for paid/write operations.
+
+After restarting the agent runtime, ask the agent to run:
+
+```txt
+sap_payments_readiness
+sap_payments_profile_current
+```
+
+Then paid hosted calls should be routed through:
+
+```txt
+sap_payments_call_paid_tool
+```
+
+## 6. Native x402 Client Flow
+
+If the user already has an x402-capable client, the flow is:
+
+1. Call the hosted paid tool normally.
+2. Receive `HTTP 402` with `PAYMENT-REQUIRED`.
+3. Parse the first accepted requirement from `accepts[0]`.
+4. Build and sign a fresh payment payload from that exact requirement.
+5. Retry the exact same MCP method and params in the same MCP session.
+6. Send the proof as `PAYMENT-SIGNATURE` or `X-PAYMENT`.
+7. Read `PAYMENT-RESPONSE` or `X-PAYMENT-RESPONSE` as the receipt.
+
+The JSON-RPC `id` may change during retry, but the method and params must stay
+the same. SAP MCP binds payment to the canonical tool request, not to a private
+server-side session wallet.
+
+## 7. Why Calls Can Exceed Paid Volume
+
+Marketplace traffic often contains many unpaid probes:
+
+- capability scanning;
+- `tools/list`;
+- agents trying paid tools without an x402 payer;
+- retries that stop after receiving the challenge;
+- read-only marketplace analytics.
+
+Those requests count as calls or payment challenges, but they do not count as
+settled volume. Settled volume only increases when a valid x402 proof is
+verified and settled through the OOBE facilitator.
+
+## 8. Strict Marketplace Monetization
+
+OOBE hosted deployments can run strict tool monetization:
+
+```bash
+SAP_MCP_MONETIZATION_STRICT_TOOLS=true
+```
+
+In strict mode, MCP handshake and discovery still work, but every operational
+tool call outside base profile, skill bootstrap, and local `sap_payments` bridge
+helpers requires x402 payment. This is the correct mode when public marketplace
+traffic should not receive free balance, token-account, or operational reads.
+
+Strict mode does not make Smithery or any marketplace pay automatically. It only
+ensures that unpaid operational calls are challenged consistently. The caller
+still needs a native x402 payer, a custom x402 CLI/proxy, or the local
+`sap_payments` bridge.
+
+## 9. Agent Instructions
+
+Agents should summarize SAP MCP marketplace state like this:
+
+> SAP MCP hosted tools are connected. Free discovery works directly. Paid or
+> write tools require either a native x402-capable client or the local
+> `sap_payments` bridge created by the SAP MCP wizard. OOBE never receives
+> user keypair bytes.
+
+Avoid saying the hosted server "has no signer" as if the user is blocked. The
+correct trust model is: remote tools, local signatures.

package/assets/logos/openclaw.svg

@@ -0,0 +1,22 @@
+<svg viewBox="0 0 120 120" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <defs>
+    <linearGradient id="lobster-gradient" x1="0%" y1="0%" x2="100%" y2="100%">
+      <stop offset="0%" stop-color="#ff4d4d"/>
+      <stop offset="100%" stop-color="#991b1b"/>
+    </linearGradient>
+  </defs>
+  <!-- Body -->
+  <path d="M60 10 C30 10 15 35 15 55 C15 75 30 95 45 100 L45 110 L55 110 L55 100 C55 100 60 102 65 100 L65 110 L75 110 L75 100 C90 95 105 75 105 55 C105 35 90 10 60 10Z" fill="url(#lobster-gradient)"/>
+  <!-- Left Claw -->
+  <path d="M20 45 C5 40 0 50 5 60 C10 70 20 65 25 55 C28 48 25 45 20 45Z" fill="url(#lobster-gradient)"/>
+  <!-- Right Claw -->
+  <path d="M100 45 C115 40 120 50 115 60 C110 70 100 65 95 55 C92 48 95 45 100 45Z" fill="url(#lobster-gradient)"/>
+  <!-- Antenna -->
+  <path d="M45 15 Q35 5 30 8" stroke="#ff4d4d" stroke-width="3" stroke-linecap="round"/>
+  <path d="M75 15 Q85 5 90 8" stroke="#ff4d4d" stroke-width="3" stroke-linecap="round"/>
+  <!-- Eyes -->
+  <circle cx="45" cy="35" r="6" fill="#050810"/>
+  <circle cx="75" cy="35" r="6" fill="#050810"/>
+  <circle cx="46" cy="34" r="2.5" fill="#00e5cc"/>
+  <circle cx="76" cy="34" r="2.5" fill="#00e5cc"/>
+</svg>

package/config.schema.json

@@ -307,6 +307,11 @@
           "format": "uri",
           "description": "Optional pay.sh checkout URL included in 402 response bodies."
         },
+        "strictTools": {
+          "type": "boolean",
+          "default": false,
+          "description": "When true, hosted monetization charges every non-essential tool call. MCP handshake/discovery, base profile, skills bootstrap, and local payment bridge helper tools remain free."
+        },
         "prices": {
           "type": "object",
           "additionalProperties": false,

package/dist/config/env.d.ts

@@ -55,6 +55,7 @@ export declare const envSchema: z.ZodObject<{
     SAP_MCP_X402_FACILITATOR_AUTH_TOKEN: z.ZodOptional<z.ZodString>;
     SAP_MCP_X402_MAX_TIMEOUT_SECONDS: z.ZodDefault<z.ZodNumber>;
     SAP_MCP_PAY_SH_CHECKOUT_URL: z.ZodOptional<z.ZodString>;
+    SAP_MCP_MONETIZATION_STRICT_TOOLS: z.ZodDefault<z.ZodEffects<z.ZodBoolean, boolean, unknown>>;
     SAP_MCP_PRICE_READ_PREMIUM_USD: z.ZodDefault<z.ZodNumber>;
     SAP_MCP_PRICE_BUILDER_USD: z.ZodDefault<z.ZodNumber>;
     SAP_MCP_PRICE_VALUE_FIXED_USD: z.ZodDefault<z.ZodNumber>;
@@ -88,6 +89,7 @@ export declare const envSchema: z.ZodObject<{
     SAP_MCP_MONETIZATION_ENABLED: boolean;
     SAP_MCP_MONETIZATION_PROVIDER: "x402" | "pay-sh";
     SAP_MCP_X402_MAX_TIMEOUT_SECONDS: number;
+    SAP_MCP_MONETIZATION_STRICT_TOOLS: boolean;
     SAP_MCP_PRICE_READ_PREMIUM_USD: number;
     SAP_MCP_PRICE_BUILDER_USD: number;
     SAP_MCP_PRICE_VALUE_FIXED_USD: number;
@@ -153,6 +155,7 @@ export declare const envSchema: z.ZodObject<{
     SAP_MCP_X402_FACILITATOR_AUTH_TOKEN?: string | undefined;
     SAP_MCP_X402_MAX_TIMEOUT_SECONDS?: number | undefined;
     SAP_MCP_PAY_SH_CHECKOUT_URL?: string | undefined;
+    SAP_MCP_MONETIZATION_STRICT_TOOLS?: unknown;
     SAP_MCP_PRICE_READ_PREMIUM_USD?: number | undefined;
     SAP_MCP_PRICE_BUILDER_USD?: number | undefined;
     SAP_MCP_PRICE_VALUE_FIXED_USD?: number | undefined;
@@ -234,6 +237,7 @@ export interface SapMcpMonetizationConfig {
     facilitatorAuthToken?: string;
     maxTimeoutSeconds: number;
     payShCheckoutUrl?: string;
+    strictTools: boolean;
     prices: {
         readPremiumUsd: number;
         builderUsd: number;

package/dist/config/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/config/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA0DxB;;GAEG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwEpB,CAAC;AAEH;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAMrD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,WAAW,GAAG,WAAW,GAAG,WAAW,CAAC;IACpD,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,OAAO,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,uBAAuB,EAAE,MAAM,CAAC;IAChC,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,uBAAuB,EAAE,MAAM,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAC/B,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAC9C,SAAS,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,KAAK,CAAC,EAAE;QACN,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,MAAM,CAAC,EAAE;QACP,IAAI,EAAE,YAAY,GAAG,YAAY,GAAG,QAAQ,CAAC;QAC7C,QAAQ,EAAE,OAAO,CAAC;QAClB,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,YAAY,EAAE,wBAAwB,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,MAAM,UAAU,GAClB,UAAU,GACV,mBAAmB,GACnB,iBAAiB,GACjB,mBAAmB,GACnB,YAAY,CAAC;AAEjB;;;GAGG;AACH,MAAM,MAAM,0BAA0B,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE3D;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,0BAA0B,CAAC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE;QACN,cAAc,EAAE,MAAM,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,MAAM,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAmCD;;;;;;GAMG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED;;GAEG;AACH,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAMD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,YAAY,CAqC5D;AAsWD;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,IAAI,CAQ9D;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,YAAY,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CA+BhG"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/config/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA0DxB;;GAEG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyEpB,CAAC;AAEH;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAMrD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,WAAW,GAAG,WAAW,GAAG,WAAW,CAAC;IACpD,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,OAAO,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,uBAAuB,EAAE,MAAM,CAAC;IAChC,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,uBAAuB,EAAE,MAAM,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAC/B,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAC9C,SAAS,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,KAAK,CAAC,EAAE;QACN,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,MAAM,CAAC,EAAE;QACP,IAAI,EAAE,YAAY,GAAG,YAAY,GAAG,QAAQ,CAAC;QAC7C,QAAQ,EAAE,OAAO,CAAC;QAClB,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,YAAY,EAAE,wBAAwB,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,MAAM,UAAU,GAClB,UAAU,GACV,mBAAmB,GACnB,iBAAiB,GACjB,mBAAmB,GACnB,YAAY,CAAC;AAEjB;;;GAGG;AACH,MAAM,MAAM,0BAA0B,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE3D;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,0BAA0B,CAAC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,OAAO,CAAC;IACrB,MAAM,EAAE;QACN,cAAc,EAAE,MAAM,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,MAAM,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAmCD;;;;;;GAMG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED;;GAEG;AACH,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAMD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,YAAY,CAqC5D;AAwWD;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,IAAI,CAQ9D;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,YAAY,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CA+BhG"}

package/dist/config/env.js

@@ -112,6 +112,7 @@ export const envSchema = z.object({
     SAP_MCP_X402_FACILITATOR_AUTH_TOKEN: z.string().optional(),
     SAP_MCP_X402_MAX_TIMEOUT_SECONDS: z.coerce.number().positive().default(120),
     SAP_MCP_PAY_SH_CHECKOUT_URL: z.string().url().optional(),
+    SAP_MCP_MONETIZATION_STRICT_TOOLS: booleanEnvSchema.default(false),
     SAP_MCP_PRICE_READ_PREMIUM_USD: z.coerce.number().positive().default(0.008),
     SAP_MCP_PRICE_BUILDER_USD: z.coerce.number().positive().default(0.05),
     SAP_MCP_PRICE_VALUE_FIXED_USD: z.coerce.number().nonnegative().default(0.2),
@@ -518,6 +519,8 @@ function transformToRuntimeConfig(env, fileConfig = {}) {
             facilitatorAuthToken: env.SAP_MCP_X402_FACILITATOR_AUTH_TOKEN,
             maxTimeoutSeconds: env.SAP_MCP_X402_MAX_TIMEOUT_SECONDS,
             payShCheckoutUrl: env.SAP_MCP_PAY_SH_CHECKOUT_URL,
+            strictTools: asOptionalBoolean(monetizationConfig.strictTools)
+                ?? env.SAP_MCP_MONETIZATION_STRICT_TOOLS,
             prices: {
                 readPremiumUsd: asOptionalNumber(monetizationPrices.readPremiumUsd) ?? env.SAP_MCP_PRICE_READ_PREMIUM_USD,
                 builderUsd: asOptionalNumber(monetizationPrices.builderUsd) ?? env.SAP_MCP_PRICE_BUILDER_USD,