@oobe-protocol-labs/sap-mcp-server 0.9.2 → 0.9.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oobe-protocol-labs/sap-mcp-server",
-  "version": "0.9.2",
+  "version": "0.9.4",
   "mcpName": "ai.oobeprotocol.sap.mcp/sap-mcp",
   "description": "Official MCP gateway for OOBE Protocol SAP — AI agents can interact with SAP identity, registry, reputation, tools, memory, payments, settlement, and proof-of-execution on Solana",
   "type": "module",

package/server.json

@@ -3,7 +3,7 @@
   "name": "ai.oobeprotocol.sap.mcp/sap-mcp",
   "title": "SAP MCP Server | OOBE Protocol",
   "description": "Solana-native MCP gateway for SAP tools, DeFi, SNS identity, x402/pay.sh, and agent operations.",
-  "version": "0.9.2",
+  "version": "0.9.4",
   "websiteUrl": "https://mcp.sap.oobeprotocol.ai/",
   "repository": {
     "url": "https://github.com/OOBE-PROTOCOL/sap-mcp",
@@ -29,7 +29,7 @@
     {
       "registryType": "npm",
       "identifier": "@oobe-protocol-labs/sap-mcp-server",
-      "version": "0.9.2",
+      "version": "0.9.4",
       "transport": {
         "type": "stdio"
       },
@@ -45,7 +45,7 @@
         },
         {
           "type": "positional",
-          "value": "@oobe-protocol-labs/sap-mcp-server@0.9.2"
+          "value": "@oobe-protocol-labs/sap-mcp-server@0.9.4"
         },
         {
           "type": "positional",

package/skills/sap-mcp/SKILL.md

@@ -155,6 +155,12 @@ and arguments, `confirm: true`, and `maxAttempts: 5` so a fresh payment payload
 is created. Use `sap_x402_paid_call` only when a runtime still exposes the
 legacy alias.
 
+When a hosted paid/write builder returns `transactionBase64`, `transaction`, or
+another unsigned Solana transaction payload, finalize it locally with
+`sap_payments_finalize_transaction`. Do not call hosted `sap_sign_transaction`
+for a user-owned signer, do not create `.js`/`.mjs` signing scripts, and do not
+read keypair JSON.
+
 When summarizing a hosted connection, use language like:
 "server is non-custodial; user signatures come from the local SAP profile or
 external signer." Avoid saying "signer not configured", "read-only only",

package/skills/sap-payments-x402/SKILL.md

@@ -9,6 +9,7 @@ workflows, and hosted SAP MCP x402/pay.sh monetization.
 - `sap_x402_get_balance`
 - `sap_payments_profile_current`
 - `sap_payments_call_paid_tool`
+- `sap_payments_finalize_transaction`
 - `sap_payments_prepare_challenge`
 - `sap_payments_sign_challenge`
 - `sap_payments_verify_receipt`
@@ -81,6 +82,12 @@ SAP MCP `sap_payments` bridge is already configured. The legacy
 `sap_x402_paid_call` alias is acceptable only when a runtime has not refreshed
 to the new tool name.
 
+If the hosted paid tool returns `transactionBase64`, `transaction`, or an
+unsigned transaction object, call `sap_payments_finalize_transaction` with
+`confirm: true`. Set `submit: false` for preview/sign only, or `submit: true`
+after the user approves execution. Never create temporary signing scripts, read
+keypair JSON, or call hosted `sap_sign_transaction` for user-owned signatures.
+
 Use low-level helpers only for custom clients:
 
 - `sap_payments_prepare_challenge` returns the parsed hosted x402 challenge