ddg-agent-services-mcp 0.1.0__tar.gz

ddg_agent_services_mcp-0.1.0/.github/dependabot.yml

@@ -0,0 +1,23 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "10:00"
+      timezone: "Etc/UTC"
+    open-pull-requests-limit: 5
+    groups:
+      python-security-and-maintenance:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "10:30"
+      timezone: "Etc/UTC"
+    open-pull-requests-limit: 5

ddg_agent_services_mcp-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,61 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  test-build-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v8.2.0
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.12'
+
+      - name: Static secret and hygiene scan
+        run: |
+          python - <<'PY'
+          from pathlib import Path
+          import re, sys
+          patterns = {
+              'private_key_block': r'-----BEGIN [A-Z ]*PRIVATE KEY-----',
+              'github_token': r'\b(?:ghp|github_pat)_[A-Za-z0-9_]{16,}',
+              'stripe_secret': r'\bsk_(?:live|test)_[A-Za-z0-9]{16,}',
+              'aws_access_key': r'\b(?:AKIA|ASIA)[A-Z0-9]{16}\b',
+              'raw_secret_assignment': r'(?i)(?:private[_ -]?key|secret|token|password)\s*[:=]\s*(?:0x)?[0-9a-z_./+=-]{32,}',
+              'lan_url': r'https?://(?:10\.|172\.(?:1[6-9]|2[0-9]|3[01])\.|192\.168\.)[^\s)\]"\']+',
+          }
+          findings = []
+          for p in Path('.').rglob('*'):
+              if not p.is_file() or any(part in {'.git', '.venv', 'dist', '__pycache__'} for part in p.parts):
+                  continue
+              if p.suffix.lower() not in {'.py', '.json', '.md', '.txt', '.toml', '.yaml', '.yml', '.sh', '.service'}:
+                  continue
+              text = p.read_text(encoding='utf-8', errors='replace')
+              for name, rx in patterns.items():
+                  for m in re.finditer(rx, text):
+                      findings.append((str(p), name, text[max(0, m.start()-32):m.end()+32].replace('\n', ' ')[:160]))
+          if findings:
+              print('Potential secret/leak findings:')
+              for finding in findings[:20]:
+                  print(finding)
+              sys.exit(1)
+          print('secret_hygiene_scan_ok')
+          PY
+
+      - name: Compile, unit test, and build package
+        run: |
+          uv run --extra dev python -m compileall src tests scripts
+          uv run --extra dev pytest -q
+          uv build --sdist --wheel

ddg_agent_services_mcp-0.1.0/.github/workflows/codeql.yml

@@ -0,0 +1,30 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '37 6 * * 1'
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze Python
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: python
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4

ddg_agent_services_mcp-0.1.0/.github/workflows/validate.yml

@@ -0,0 +1,23 @@
+name: validate
+on:
+  pull_request:
+  push:
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: Validate JSON and Python syntax
+        run: |
+          python - <<'PY'
+          import json, pathlib, py_compile
+          for p in pathlib.Path('.').rglob('*.json'):
+              json.loads(p.read_text())
+              print('json ok', p)
+          for p in pathlib.Path('.').rglob('*.py'):
+              py_compile.compile(str(p), doraise=True)
+              print('py ok', p)
+          PY

ddg_agent_services_mcp-0.1.0/.gitignore

@@ -0,0 +1,11 @@
+__pycache__/
+*.pyc
+.env
+*.env
+.venv/
+dist/
+*.egg-info/
+node_modules/
+state/
+audit/
+c_priv/

ddg_agent_services_mcp-0.1.0/DISCOVERY.md

@@ -0,0 +1,82 @@
+# AI-Agent Discovery Guide
+
+This file is for buyer agents, agent-runtime maintainers, and directory/registry reviewers who need to decide whether DDG Agent-Payable Services are callable, safe, and relevant.
+
+## Canonical service surface
+
+```text
+https://agents.daedalusdevelopmentgroup.com
+```
+
+## Machine-readable entry points
+
+| Surface | URL | What an agent should use it for |
+| --- | --- | --- |
+| AI discovery | `https://agents.daedalusdevelopmentgroup.com/.well-known/ai` | First-pass service summary and links |
+| Status | `https://agents.daedalusdevelopmentgroup.com/.well-known/ddg-agent-status.json` | Live rail/service/MCP readiness |
+| API catalog | `https://agents.daedalusdevelopmentgroup.com/.well-known/api-catalog` | Linkset pointing to canonical API assets |
+| OpenAPI | `https://agents.daedalusdevelopmentgroup.com/openapi.json` | Request/response schemas and routes |
+| llms.txt | `https://agents.daedalusdevelopmentgroup.com/llms.txt` | LLM-readable usage notes |
+| Pricing | `https://agents.daedalusdevelopmentgroup.com/.well-known/ddg-agent-pricing.json` | Service pricing and payment metadata |
+| Agent catalog | `https://agents.daedalusdevelopmentgroup.com/.well-known/agent-catalog.json` | Agent-buyable service descriptions |
+| Agent skills | `https://agents.daedalusdevelopmentgroup.com/.well-known/agent-skills/index.json` | Skill-specific service discovery |
+| Checkout conformance | `https://agents.daedalusdevelopmentgroup.com/.well-known/ddg-agent-checkout-conformance.json` | 403/402/payment/idempotency contract |
+| Refund/reversal policy | `https://agents.daedalusdevelopmentgroup.com/.well-known/ddg-agent-refund-policy.json` | Strict no-free-work reversal and entitlement-revocation policy |
+| MCP design/status | `https://agents.daedalusdevelopmentgroup.com/.well-known/ddg-agent-swarm-mcp-design.md` | MCP wrapper design and current status |
+
+## Current payment rails
+
+Live now:
+
+```text
+x402
+direct_crypto_auto
+direct_crypto_manual
+```
+
+Accepted crypto options exposed to buyer agents:
+
+- x402 `accepts[]`: Base, Polygon, Arbitrum One, World Chain, and Solana mainnet USDC.
+- Direct crypto public receiving-address families: EVM/stablecoins, BTC, BCH, LTC, DOGE, SOL, TRX, XRP, XLM, ALGO, DOT, ZEC, and XMR.
+- Direct crypto proofs are auto-verified only for verifier-supported assets; the remaining public address families are operator-confirmed before fulfillment.
+
+Installed but not advertised live yet:
+
+```text
+mpp
+```
+
+MPP / Stripe / Tempo must remain pending until a real penny-scale settlement succeeds, idempotency replay passes, invalid-token failure stays closed, the public status/pricing/catalog are updated, and all submission packets are re-synced.
+
+## How I expect buyer agents to find DDG
+
+A capable agent looking for services such as `x402 checkout conformance`, `MCP tool security audit`, `agent discovery repair`, or `browser proof artifact` will usually search in this order:
+
+1. General web search / GitHub search for exact task keywords.
+2. x402 ecosystem discovery: CDP Bazaar, x402scan, x402 ecosystem page, and x402 awesome lists.
+3. MCP ecosystem discovery: official MCP Registry, MCP server aggregators, and GitHub topics.
+4. Machine-readable files on service domains: `/.well-known/ai`, `/llms.txt`, `/openapi.json`, `/.well-known/agent-catalog.json`, `/.well-known/agent-skills/index.json`, and status/conformance JSON.
+5. Package registries for installable tools: npm, PyPI, OCI/GHCR, or MCPB once a package is released.
+6. Social/indexable proof: posts and docs that link directly to machine-readable endpoints instead of vague landing pages.
+
+## Directory/registry readiness
+
+Ready now after security audit:
+
+- public GitHub repo packet
+- owned machine-readable discovery surfaces (`/.well-known/ai`, `llms.txt`, OpenAPI, pricing, catalog, agent skills)
+- MCP `ddg://distribution/agent-radar`, `ddg://distribution/x402scan-status`, and `ddg://distribution/x402-chains` resources for agent clients
+- x402scan registration is live for `agents.daedalusdevelopmentgroup.com` with 5 validated resources; keep AgentCash/x402scan probes green after every OpenAPI/payment-edge/submission change.
+- x402 / agent-commerce awesome-list PR copy
+- x402 ecosystem listing request copy
+- search-indexed docs and social links to machine-readable endpoints
+
+Ready only after additional work:
+
+- CDP x402 Bazaar: requires CDP Facilitator settlement with route discovery metadata and `paymentPayload.resource`.
+- Official MCP Registry: requires a public installable package on a supported registry (PyPI for this stdio wrapper) or a public HTTP/Streamable MCP endpoint plus MCP Registry metadata/namespace verification.
+- npm/PyPI package listing: requires packaging and release workflow for the stdio MCP wrapper.
+
+## Security posture
+
+DDG sells bounded artifacts/results and proof bundles. DDG does not sell or publish raw provider account access, OAuth tokens, provider API keys, private model IDs, private payment material, raw payment tokens, or verifier sidecar URLs.

ddg_agent_services_mcp-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Daedalus Development Group
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

ddg_agent_services_mcp-0.1.0/PKG-INFO

@@ -0,0 +1,180 @@
+Metadata-Version: 2.4
+Name: ddg-agent-services-mcp
+Version: 0.1.0
+Summary: Payment-aware MCP wrapper and AI-agent distribution/readiness surface for DDG Agent-Payable Services
+Project-URL: Homepage, https://agents.daedalusdevelopmentgroup.com/.well-known/ai
+Project-URL: Documentation, https://agents.daedalusdevelopmentgroup.com/.well-known/ddg-agent-swarm-mcp-design.md
+Project-URL: Repository, https://github.com/daedalusdevelopmentgroup/ddg-agent-payable-services
+Project-URL: Issues, https://github.com/daedalusdevelopmentgroup/ddg-agent-payable-services/issues
+Author-email: Daedalus Development Group <0xcircuitbreaker@protonmail.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: agent-commerce,ai-agents,bazaar,machine-payments,mcp,mcp-registry,openapi,x402
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Internet :: WWW/HTTP
+Classifier: Topic :: Security
+Requires-Python: >=3.11
+Requires-Dist: aiohttp>=3.14.1
+Requires-Dist: cryptography>=48.0.1
+Requires-Dist: mcp>=1.23.0
+Requires-Dist: pydantic-settings>=2.14.2
+Requires-Dist: pygments>=2.20.0
+Requires-Dist: pyjwt>=2.13.0
+Requires-Dist: pynacl>=1.6.2
+Requires-Dist: python-multipart>=0.0.31
+Requires-Dist: starlette>=1.3.1
+Requires-Dist: tornado>=6.5.7
+Requires-Dist: urllib3>=2.7.0
+Provides-Extra: dev
+Requires-Dist: pytest>=9.0.3; extra == 'dev'
+Description-Content-Type: text/markdown
+
+<!-- mcp-name: io.github.daedalusdevelopmentgroup/ddg-agent-services-mcp -->
+# DDG Agent-Payable Services
+
+AI-agent-native services from Daedalus Development Group (DDG): checkout/payment conformance, MCP/tool security audits, agent-discovery repair, buyer-agent smoke probes, browser proof, repo context packs, and bounded DDG-operated model/artifact orders.
+
+Production base URL:
+
+```text
+https://agents.daedalusdevelopmentgroup.com
+```
+
+## Current live payment rails
+
+```text
+x402
+direct_crypto_auto
+direct_crypto_manual
+```
+
+Accepted crypto is intentionally broad but bounded by public receiving-address custody and verifier support:
+
+- x402 `accepts[]`: Base, Polygon, Arbitrum One, World Chain, and Solana mainnet USDC.
+- Direct crypto public receiving-address families: EVM/stablecoins, BTC, BCH, LTC, DOGE, SOL, TRX, XRP, XLM, ALGO, DOT, ZEC, and XMR.
+- Auto verification applies only where the verifier can prove settlement; otherwise `/v1/order-intake` records a hashed proof for operator confirmation before fulfillment.
+
+MPP / Tempo is now advertised in the public 402 challenge with the verifier reporting ready:true and invalid-token failure verified. The remaining proof is one real buyer-funded penny settlement/idempotent replay before calling the MPP money flow fully witnessed. Stripe SPT remains planned.
+
+## Start here if you are a buyer agent
+
+1. Fetch AI discovery:
+
+```bash
+tmp=$(mktemp)
+curl -fsS -o "$tmp" https://agents.daedalusdevelopmentgroup.com/.well-known/ai
+python3 -m json.tool "$tmp"
+```
+
+2. Fetch status:
+
+```bash
+tmp=$(mktemp)
+curl -fsS -o "$tmp" https://agents.daedalusdevelopmentgroup.com/.well-known/ddg-agent-status.json
+python3 -m json.tool "$tmp"
+```
+
+3. Fetch pricing/catalog:
+
+```bash
+tmp_pricing=$(mktemp)
+tmp_catalog=$(mktemp)
+curl -fsS -o "$tmp_pricing" https://agents.daedalusdevelopmentgroup.com/.well-known/ddg-agent-pricing.json
+curl -fsS -o "$tmp_catalog" https://agents.daedalusdevelopmentgroup.com/.well-known/agent-catalog.json
+python3 -m json.tool "$tmp_pricing"
+python3 -m json.tool "$tmp_catalog"
+```
+
+4. Verify checkout conformance:
+
+```bash
+tmp=$(mktemp)
+curl -fsS -o "$tmp" https://agents.daedalusdevelopmentgroup.com/.well-known/ddg-agent-checkout-conformance.json
+python3 -m json.tool "$tmp"
+```
+
+5. Probe the payment gate without spending:
+
+```bash
+curl -i -X POST https://agents.daedalusdevelopmentgroup.com/v1/tx-smoke-test \
+  -H 'Content-Type: application/json' \
+  -H 'X-Agent-Id: your-agent-id' \
+  -d '{"service":"tx_penny_smoke_test"}'
+```
+
+Expected without payment: `402 payment_required` with accepted protocols.
+
+## Important endpoints
+
+See also [`DISCOVERY.md`](DISCOVERY.md) for the agent-radar/distribution map and directory readiness notes.
+
+| Endpoint | Purpose |
+| --- | --- |
+| `/.well-known/ai` | AI-agent discovery surface |
+| `/.well-known/ddg-agent-status.json` | Rail/service/MCP status |
+| `/.well-known/api-catalog` | Linkset API catalog |
+| `/openapi.json` | OpenAPI contract |
+| `/llms.txt` | LLM-facing instructions |
+| `/.well-known/ddg-agent-pricing.json` | Machine-readable pricing |
+| `/.well-known/agent-catalog.json` | Agent service catalog |
+| `/.well-known/agent-skills/index.json` | Agent-skill discovery index |
+| `/.well-known/ddg-agent-checkout-conformance.json` | Checkout conformance profile |
+| `/.well-known/ddg-agent-refund-policy.json` | Strict refund/reversal policy for agent-paid work |
+| `/.well-known/ddg-agent-swarm-mcp-design.md` | MCP design/status doc |
+
+## Flagship services
+
+- `agent_payment_readiness_audit`
+- `mcp_tool_security_audit`
+- `agent_service_distribution_pack`
+- `agent_marketplace_listing_pack`
+- `agent_readiness_scorecard`
+- `buyer_agent_smoke_probe`
+- `browser_proof`
+- `repo_context_pack`
+- `ai_skill_safety_scan`
+- `model_agent_run`
+
+## MCP
+
+The local stdio MCP server is in [`mcp/`](mcp/). It exposes free discovery/status/conformance tools, allowlisted `ddg://` resources for public manifests/docs/OpenAPI, agent-radar/x402 Bazaar readiness metadata, and payment-aware paid-service helpers. Paid tools return structured `402 payment_required` challenges instead of opaque MCP errors.
+
+Current MCP status: stdio package/source is locally smoke-tested and the hosted Streamable HTTP endpoint is live at `https://mcp.daedalusdevelopmentgroup.com/mcp` with public MCP-client smoke passing. See [`docs/mcp-production-readiness.md`](docs/mcp-production-readiness.md).
+
+## Security and compliance stance
+
+DDG sells bounded artifacts/results, not raw model-provider account access. DDG never sells, returns, or relays:
+
+- raw OAuth tokens
+- provider API keys
+- private account/session state
+- raw provider seats
+- private model IDs when they would reveal account mechanics
+- raw payment tokens or verifier sidecar URLs
+
+Provider-backed model capacity is packaged as DDG-operated artifact/result delivery with spend caps, output schemas, redaction, receipts, and operator review where needed.
+
+## Repository contents
+
+```text
+openapi.json                         Public OpenAPI contract copy
+docs/pricing.json                    Pricing copy
+docs/agent-catalog.json              Catalog copy
+docs/agent-status.json               Status copy
+docs/checkout-conformance.json       Checkout profile copy
+docs/agent-skills/                   Agent skill JSON files
+mcp/                                 Local stdio MCP server and metadata
+scripts/agent_checkout_conformance_probe.py  Probe script
+examples/                            Curl and Python buyer-agent examples
+schemas/                             Public JSON schema drafts
+```
+
+## Contact
+
+Operator contact: `0xcircuitbreaker@protonmail.com`

ddg_agent_services_mcp-0.1.0/README.md

@@ -0,0 +1,143 @@
+<!-- mcp-name: io.github.daedalusdevelopmentgroup/ddg-agent-services-mcp -->
+# DDG Agent-Payable Services
+
+AI-agent-native services from Daedalus Development Group (DDG): checkout/payment conformance, MCP/tool security audits, agent-discovery repair, buyer-agent smoke probes, browser proof, repo context packs, and bounded DDG-operated model/artifact orders.
+
+Production base URL:
+
+```text
+https://agents.daedalusdevelopmentgroup.com
+```
+
+## Current live payment rails
+
+```text
+x402
+direct_crypto_auto
+direct_crypto_manual
+```
+
+Accepted crypto is intentionally broad but bounded by public receiving-address custody and verifier support:
+
+- x402 `accepts[]`: Base, Polygon, Arbitrum One, World Chain, and Solana mainnet USDC.
+- Direct crypto public receiving-address families: EVM/stablecoins, BTC, BCH, LTC, DOGE, SOL, TRX, XRP, XLM, ALGO, DOT, ZEC, and XMR.
+- Auto verification applies only where the verifier can prove settlement; otherwise `/v1/order-intake` records a hashed proof for operator confirmation before fulfillment.
+
+MPP / Tempo is now advertised in the public 402 challenge with the verifier reporting ready:true and invalid-token failure verified. The remaining proof is one real buyer-funded penny settlement/idempotent replay before calling the MPP money flow fully witnessed. Stripe SPT remains planned.
+
+## Start here if you are a buyer agent
+
+1. Fetch AI discovery:
+
+```bash
+tmp=$(mktemp)
+curl -fsS -o "$tmp" https://agents.daedalusdevelopmentgroup.com/.well-known/ai
+python3 -m json.tool "$tmp"
+```
+
+2. Fetch status:
+
+```bash
+tmp=$(mktemp)
+curl -fsS -o "$tmp" https://agents.daedalusdevelopmentgroup.com/.well-known/ddg-agent-status.json
+python3 -m json.tool "$tmp"
+```
+
+3. Fetch pricing/catalog:
+
+```bash
+tmp_pricing=$(mktemp)
+tmp_catalog=$(mktemp)
+curl -fsS -o "$tmp_pricing" https://agents.daedalusdevelopmentgroup.com/.well-known/ddg-agent-pricing.json
+curl -fsS -o "$tmp_catalog" https://agents.daedalusdevelopmentgroup.com/.well-known/agent-catalog.json
+python3 -m json.tool "$tmp_pricing"
+python3 -m json.tool "$tmp_catalog"
+```
+
+4. Verify checkout conformance:
+
+```bash
+tmp=$(mktemp)
+curl -fsS -o "$tmp" https://agents.daedalusdevelopmentgroup.com/.well-known/ddg-agent-checkout-conformance.json
+python3 -m json.tool "$tmp"
+```
+
+5. Probe the payment gate without spending:
+
+```bash
+curl -i -X POST https://agents.daedalusdevelopmentgroup.com/v1/tx-smoke-test \
+  -H 'Content-Type: application/json' \
+  -H 'X-Agent-Id: your-agent-id' \
+  -d '{"service":"tx_penny_smoke_test"}'
+```
+
+Expected without payment: `402 payment_required` with accepted protocols.
+
+## Important endpoints
+
+See also [`DISCOVERY.md`](DISCOVERY.md) for the agent-radar/distribution map and directory readiness notes.
+
+| Endpoint | Purpose |
+| --- | --- |
+| `/.well-known/ai` | AI-agent discovery surface |
+| `/.well-known/ddg-agent-status.json` | Rail/service/MCP status |
+| `/.well-known/api-catalog` | Linkset API catalog |
+| `/openapi.json` | OpenAPI contract |
+| `/llms.txt` | LLM-facing instructions |
+| `/.well-known/ddg-agent-pricing.json` | Machine-readable pricing |
+| `/.well-known/agent-catalog.json` | Agent service catalog |
+| `/.well-known/agent-skills/index.json` | Agent-skill discovery index |
+| `/.well-known/ddg-agent-checkout-conformance.json` | Checkout conformance profile |
+| `/.well-known/ddg-agent-refund-policy.json` | Strict refund/reversal policy for agent-paid work |
+| `/.well-known/ddg-agent-swarm-mcp-design.md` | MCP design/status doc |
+
+## Flagship services
+
+- `agent_payment_readiness_audit`
+- `mcp_tool_security_audit`
+- `agent_service_distribution_pack`
+- `agent_marketplace_listing_pack`
+- `agent_readiness_scorecard`
+- `buyer_agent_smoke_probe`
+- `browser_proof`
+- `repo_context_pack`
+- `ai_skill_safety_scan`
+- `model_agent_run`
+
+## MCP
+
+The local stdio MCP server is in [`mcp/`](mcp/). It exposes free discovery/status/conformance tools, allowlisted `ddg://` resources for public manifests/docs/OpenAPI, agent-radar/x402 Bazaar readiness metadata, and payment-aware paid-service helpers. Paid tools return structured `402 payment_required` challenges instead of opaque MCP errors.
+
+Current MCP status: stdio package/source is locally smoke-tested and the hosted Streamable HTTP endpoint is live at `https://mcp.daedalusdevelopmentgroup.com/mcp` with public MCP-client smoke passing. See [`docs/mcp-production-readiness.md`](docs/mcp-production-readiness.md).
+
+## Security and compliance stance
+
+DDG sells bounded artifacts/results, not raw model-provider account access. DDG never sells, returns, or relays:
+
+- raw OAuth tokens
+- provider API keys
+- private account/session state
+- raw provider seats
+- private model IDs when they would reveal account mechanics
+- raw payment tokens or verifier sidecar URLs
+
+Provider-backed model capacity is packaged as DDG-operated artifact/result delivery with spend caps, output schemas, redaction, receipts, and operator review where needed.
+
+## Repository contents
+
+```text
+openapi.json                         Public OpenAPI contract copy
+docs/pricing.json                    Pricing copy
+docs/agent-catalog.json              Catalog copy
+docs/agent-status.json               Status copy
+docs/checkout-conformance.json       Checkout profile copy
+docs/agent-skills/                   Agent skill JSON files
+mcp/                                 Local stdio MCP server and metadata
+scripts/agent_checkout_conformance_probe.py  Probe script
+examples/                            Curl and Python buyer-agent examples
+schemas/                             Public JSON schema drafts
+```
+
+## Contact
+
+Operator contact: `0xcircuitbreaker@protonmail.com`

ddg_agent_services_mcp-0.1.0/SECURITY.md

@@ -0,0 +1,13 @@
+# Security Policy
+
+Report security issues to `0xcircuitbreaker@protonmail.com`.
+
+Please do not send secrets in issue bodies, service targets, or public pull requests. If you need to provide sensitive evidence, send a minimal redacted reproducer first.
+
+## DDG public security boundaries
+
+- Public agents call only `https://agents.daedalusdevelopmentgroup.com`.
+- Verifier sidecars are private and are not public API endpoints.
+- MPP is not live until a real penny settlement proof passes.
+- DDG returns redacted receipts/artifacts and avoids buyer contact leakage.
+- Dynamic execution/browser/security scans are sandboxed or operator-reviewed.

ddg_agent_services_mcp-0.1.0/SECURITY_AUDIT.md

@@ -0,0 +1,50 @@
+# Pre-publish Security Audit Summary
+
+Date: 2026-06-23
+
+This repository packet was re-audited before publishing DDG Agent-Payable Services to GitHub and agent-discovery surfaces.
+
+## Checks performed
+
+- JSON parse validation for all repository `*.json` files.
+- Python source compile validation without writing bytecode.
+- Secret-pattern scan for private-key blocks, API keys, Stripe live keys, AWS keys, GitHub tokens, private-key hex labels, LAN URLs, loopback verifier URLs, and unsafe raw-provider-account wording.
+- Git hygiene check for clean status and no `Co-authored-by:` trailers.
+- Public production payment ladder check:
+  - no identity -> `403 agent_only`
+  - identity/no payment -> `402 payment_required`
+  - fake payment -> `402 payment_required`
+- Node sidecar supply-chain audit in the source workspace: `npm audit --omit=dev` returned zero vulnerabilities.
+- MCP package readiness checks: stdio package metadata staged, local free-tool/402 smoke performed, and hosted HTTP/Streamable MCP intentionally not listed as live until deployed and smoked.
+- Wallet/public-chain audit: published service wallets showed zero public tx/balance seen in the latest public-data scan; XMR and DOT have the noted visibility limitations.
+
+## Result
+
+- Confirmed secret leaks: **0**
+- Public live endpoint confirmed leaks: **0**
+- Public repo packet confirmed secret/loopback/LAN leaks: **0**
+- `Co-authored-by:` commit trailers in this packet repo: **0**
+- Tracked `__pycache__` / `*.pyc` / `*.env` / `c_priv` / `node_modules`: **0**
+- JSON validation: **pass**
+- Python compile validation: **pass**
+- Public ladder: **pass**
+- `npm audit --omit=dev`: **0 vulnerabilities**
+
+## Reviewed non-leak findings
+
+The scan may flag DDG's explicit policy language such as "not resale of raw provider accounts" or "never raw provider account/session access." Those are benign safety statements, not credential leaks or resale claims.
+
+## Important live-rail status
+
+Current public live rails are:
+
+```text
+x402
+direct_crypto_auto
+```
+
+MPP/Stripe/Tempo is installed but **not advertised live**. It must not be listed as live until a real penny-scale MPP payment settles, idempotency replay passes, fake-token failure stays closed, sidecar health reports `ready:true`, and public docs/status are updated.
+
+## Security stance
+
+DDG sells bounded artifacts/results, not raw provider account access. DDG does not publish or return raw provider API keys, OAuth tokens, private account sessions, private model IDs, payment private keys, raw payment tokens, or verifier sidecar URLs.

ddg_agent_services_mcp-0.1.0/deploy/cloudflare/ddg-agent-services-mcp-ingress.example.yml

@@ -0,0 +1,11 @@
+# Example Cloudflare Tunnel ingress stanza for the DDG MCP server.
+# Preferred endpoint after production smoke:
+#   https://mcp.daedalusdevelopmentgroup.com/mcp
+#
+# Keep the payment edge hostname (agents.daedalusdevelopmentgroup.com) separate
+# unless you intentionally add path-based ingress and re-smoke both services.
+
+ingress:
+  - hostname: mcp.daedalusdevelopmentgroup.com
+    service: http://127.0.0.1:8891
+  - service: http_status:404