@quackai/q402-mcp 0.8.33 → 0.8.35

package/README.md

@@ -27,8 +27,27 @@ Quote → route → (optional) settle stablecoin payments across 10 EVM chains,
 | **OpenAI Codex CLI** | `codex mcp add q402 -- npx -y @quackai/q402-mcp` (Windows fallback: see below) |
 | **Cursor** | Add to `~/.cursor/mcp.json`: `{ "mcpServers": { "q402": { "command": "npx", "args": ["-y", "@quackai/q402-mcp"] } } }` |
 | **Cline** | Cline → Settings → MCP Servers → Edit JSON. Same shape as Cursor. |
+| **GitHub Copilot (VS Code)** | Add to `.vscode/mcp.json` — root key is `servers`, **not** `mcpServers`: `{ "servers": { "q402": { "command": "npx", "args": ["-y", "@quackai/q402-mcp"] } } }`. Reload VS Code, then enable q402 in the Copilot Chat tools picker. |
+| **Hermes Agent (Nous Research)** | YAML, not JSON. Add under `mcp_servers` in `~/.hermes/config.yaml` (see below), then run `/reload-mcp`. |
 | **Any other stdio MCP client** | Point it at `npx -y @quackai/q402-mcp`. No client-specific code. |
 
+<details>
+<summary>Hermes Agent — YAML config (<code>~/.hermes/config.yaml</code>)</summary>
+
+Hermes reads MCP servers from `~/.hermes/config.yaml` under `mcp_servers` (YAML, not JSON):
+
+```yaml
+mcp_servers:
+  q402:
+    command: "npx"
+    args: ["-y", "@quackai/q402-mcp"]
+    enabled: true
+```
+
+After editing, run `/reload-mcp` in Hermes to load the tools. Or use the CLI: `hermes mcp add q402 --command npx --args -y @quackai/q402-mcp`.
+
+</details>
+
 > Claude **Code** (the CLI, `claude` binary) and Claude **Desktop** (the macOS / Windows app) are different products. The `claude mcp add` command only exists in the CLI; the Desktop app needs the JSON config above.
 
 Secrets are NOT in this config. The server reads them from `~/.q402/mcp.env` (same pattern as AWS / Stripe / gh CLIs).

package/dist/index.js

@@ -211,7 +211,7 @@ var isValidPrivateKey = (s) => typeof s === "string" && PRIVATE_KEY_RE.test(s);
 // package.json
 var package_default = {
   name: "@quackai/q402-mcp",
-  version: "0.8.33",
+  version: "0.8.35",
   description: "MCP server for Q402 \u2014 gasless USDC/USDT/RLUSD payments on 10 EVM chains + Chainlink CCIP USDC bridge on the eth/avax/arbitrum triangle, callable from Claude (Desktop / Code), OpenAI Codex CLI, and any other Model Context Protocol client.",
   mcpName: "io.github.bitgett/q402-mcp",
   keywords: [
@@ -222,7 +222,11 @@ var package_default = {
     "claude-code",
     "codex",
     "openai-codex",
+    "cursor",
     "cline",
+    "copilot",
+    "github-copilot",
+    "hermes",
     "q402",
     "x402",
     "stablecoin",
@@ -1424,6 +1428,10 @@ var PAY_TOOL = {
         const: true,
         description: "MUST be true and only set after the user has confirmed this exact payment in chat. When hookParams is set, confirm what it does to the money too: the split RECIPIENTS and shares (funds go there, not `to`) and any oracle condition gating settlement \u2014 not just the top-level recipient + amount."
       },
+      consentToken: {
+        type: "string",
+        description: "Two-phase consent. Omit on the FIRST call to get a needs_confirmation preview plus a consentToken (no funds move); re-call with the SAME args plus this token to execute. Re-derived from the payment params, so a previewed payment cannot be swapped for a different one. confirm:true alone does NOT send."
+      },
       hookParams: {
         type: "object",
         description: "Q402 Hook params (server-managed Agent Wallet only). recipientAgentId (ReputationGate), condition (ConditionalOracle price/time gate), or splits (MultiPayeeSplit fan-out, bps sum 10000).",
@@ -1960,6 +1968,10 @@ TWO-PHASE CONSENT: confirm:true alone does NOT send. Call this tool first WITHOU
         type: "boolean",
         const: true,
         description: "MUST be true and only set after the user has confirmed the entire batch in chat."
+      },
+      consentToken: {
+        type: "string",
+        description: "Two-phase consent. Omit on the FIRST call to get a needs_confirmation preview of every recipient + amount plus a consentToken (no funds move); re-call with the SAME args plus this token to execute. Re-derived from the batch, so the previewed batch cannot be swapped. confirm:true alone does NOT send."
       }
     },
     required: ["chain", "token", "recipients", "confirm"],
@@ -4984,10 +4996,16 @@ async function runRequestPay(input) {
     to: req.recipient.toLowerCase(),
     amount: req.amount,
     token: req.token,
-    chain: req.chain
+    chain: req.chain,
+    // Bind the funding source too — the user is consenting to pay from THIS
+    // wallet, so swapping walletId after the preview must void consent. Mirrors
+    // q402_pay's consentIntent. Empty string = the server-default Agent Wallet
+    // (resolved at settle time); pinning a specific wallet re-triggers consent.
+    wid: (input.walletId ?? "").toLowerCase()
   };
   const consent = checkConsent(consentIntent, input.consentToken);
   if (!consent.ok) {
+    const fromNote = input.walletId ? ` from wallet ${input.walletId}` : "";
     return {
       ok: false,
       status: "needs_consent",
@@ -4998,7 +5016,7 @@ async function runRequestPay(input) {
       message: "Relay this preview to the user and get an explicit yes, then re-call with the same requestId plus consentToken. No funds moved.",
       needsConsent: {
         status: "needs_confirmation",
-        preview: `Pay ${req.amount} ${req.token} to ${req.recipient} on ${req.chain} (request ${req.id}).`,
+        preview: `Pay ${req.amount} ${req.token} to ${req.recipient} on ${req.chain}${fromNote} (request ${req.id}).`,
         consentToken: consent.expected
       }
     };
@@ -5069,6 +5087,10 @@ var REQUEST_PAY_TOOL = {
       walletId: {
         type: "string",
         description: "Optional. Agent Wallet address to pay from. Defaults to the configured / server-default wallet."
+      },
+      consentToken: {
+        type: "string",
+        description: "Two-phase consent. Omit on the FIRST call to get a needs_confirmation preview plus a consentToken (no funds move); re-call with the SAME requestId plus this token to execute. Re-derived from the request terms + funding wallet, so a previewed payment cannot be swapped for a different one."
       }
     },
     required: ["requestId", "confirm"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quackai/q402-mcp",
-  "version": "0.8.33",
+  "version": "0.8.35",
   "description": "MCP server for Q402 — gasless USDC/USDT/RLUSD payments on 10 EVM chains + Chainlink CCIP USDC bridge on the eth/avax/arbitrum triangle, callable from Claude (Desktop / Code), OpenAI Codex CLI, and any other Model Context Protocol client.",
   "mcpName": "io.github.bitgett/q402-mcp",
   "keywords": [
@@ -11,7 +11,11 @@
     "claude-code",
     "codex",
     "openai-codex",
+    "cursor",
     "cline",
+    "copilot",
+    "github-copilot",
+    "hermes",
     "q402",
     "x402",
     "stablecoin",