Dexter-DAO/dexter-x402-sdk holds a health index of 55 out of 100, placing it in the Moderate band. It scores highest on Vitality (87/100) and lowest on Community & Adoption (36/100). It was last updated 5 days ago. A single contributor accounts for most of its recent work.
55
overall / 100
Moderate
Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.
55
Excellent85-100Exemplary; meets essentially all checked criteria
Good70-84Healthy; minor gaps
Moderate50-69Acceptable with notable gaps; review recommended
At risk30-49Significant weaknesses; adoption warrants caution
Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
Direct dependencies free of known advisories — no direct dependency carries a known advisory
8.4/25
Indirect dependencies free of known advisories — 2 affected: bigint-buffer 1.1.5 (high 7.5), uuid 8.3.2 (high 7.5)
29.1/40
No advisories left outstanding — 2 advisory-carrying package(s) unaddressed past 90 days; oldest published 477 days ago
Inputs used
source
osv
advisories
2
affected_packages
2
assessed_packages
98
unassessed_packages
0
affected_by_severity
high 2
direct_affected_packages
0
Matched the npm:@dexterai/x402@5.4.2 runtime dependency closure — what installing the published package pulls in — 98 packages. Reachability is not analyzed.
How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
More detail
Star and fork history 0 ★ / 4 ⇿
0Stars
4Forks
2Releases
When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.
Major 2Minor 0Patch 0
OpenSSF Scorecard 3.7 / 10
3.7aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).Scorecard v5.5.0 · 2026-07-25 17:02 UTC
The resolved dependency set could not be collected for this report: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
Dependency advisories 2
Installing npm:@dexterai/x402@5.4.2 pulls in 98 packages, direct and transitive: 2 carry known advisories, of which 0 are direct dependencies.
Package
Version
Relation
Severity
Advisories
Fixed in
bigint-buffer
1.1.5
indirect
high
1
—
uuid
8.3.2
indirect
high
1
13.0.1
An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.
Raw JSON report machine-readable
{
"data": {
"repo": {
"topics": [
"evm",
"payments",
"sdk",
"solana",
"x402",
"agents",
"tabs",
"usdc"
],
"is_fork": false,
"size_kb": 1799,
"has_wiki": false,
"homepage": "https://dexter.cash/sdk",
"languages": {
"JavaScript": 78640,
"TypeScript": 1109060
},
"pushed_at": "2026-07-19T18:04:51Z",
"created_at": "2025-12-21T21:34:40Z",
"owner_type": "Organization",
"updated_at": "2026-07-19T18:05:02Z",
"description": "Give your agent a spending limit it can't exceed. Non-custodial tabs on Solana, plus one-shot x402 across the major EVM chains. Buyer + seller SDKs.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "main",
"license_spdx_raw": "MIT",
"primary_language": "TypeScript",
"significant_languages": [
"TypeScript"
]
},
"owner": {
"blog": "https://dexter.cash",
"name": "Dexter AI",
"type": "Organization",
"login": "Dexter-DAO",
"company": null,
"location": "Solana",
"followers": 4,
"avatar_url": "https://avatars.githubusercontent.com/u/251671417?v=4",
"created_at": "2025-12-27T01:56:55Z",
"is_verified": null,
"public_repos": 13,
"account_age_days": 210
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v5.3.1",
"kind": "patch",
"published_at": "2026-07-07T01:59:31Z"
},
{
"tag": "v5.3.0",
"kind": "minor",
"published_at": "2026-07-05T21:25:10Z"
},
{
"tag": "v4.0.0",
"kind": "major",
"published_at": "2026-06-17T21:22:18Z"
},
{
"tag": "v3.18.1",
"kind": "patch",
"published_at": "2026-06-17T20:11:06Z"
},
{
"tag": "v3.0.0",
"kind": "major",
"published_at": "2026-04-15T19:51:48Z"
},
{
"tag": "v2.0.0",
"kind": "major",
"published_at": "2026-03-16T03:09:39Z"
}
],
"recent_commits": [
{
"oid": "b5e1358b3c10e8d4c64c73a73566c54fd4ddc07a",
"body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(tab): export armTabOpen (mandate ceremony arms drain protection)",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-19T18:04:33Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "fdefa7a02ffc3ad0947577ca4c2164bcde85ed3e",
"body": null,
"is_bot": false,
"headline": "5.4.1",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-19T17:56:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "265adef06b2d7b2ad24af7049741a6b4115cf969",
"body": "…tions\n\ngenerateSessionKeypair/makeSessionKey/signVoucher/scopeCapAtomic/\nparseAtomic/deriveChannelId now exported from @dexterai/x402/tab — the\nHark mandate rail (service-held session keys signing per-delivery\nincrements) needs the building blocks without the Tab class.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01W2EGLFXfCRdhR6yx529rdb",
"is_bot": false,
"headline": "feat(tab): export session-key primitives for delegated-signer integra…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-19T17:56:14Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "f38651eb80256249576fc9c679c26906acdefde8",
"body": "…egistry\n\nThree new networks: eip155:480 (world, USDC), eip155:143 (monad, USDC),\neip155:4663 (robinhood, Paxos USDG — the chain has no native Circle USDC).\nNew EIP712_DOMAINS map mirrors the facilitator registry so exact payments\nsign the correct domain even when requirements.extra is absent — on t\n[…]\ncUrl\nconsolidated onto EVM_RPC_URLS, isEvmNetwork covers all bare names.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_017S6E1DY6Uk4UEQsip1MXH1",
"is_bot": false,
"headline": "feat: v5.4.0 — Robinhood Chain, Monad, World Chain + EIP712_DOMAINS r…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-19T07:38:57Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "38e5c16b6b730678ce1f9af23d91647ce56d90a5",
"body": null,
"is_bot": false,
"headline": "5.3.4",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-18T12:05:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0786e71190125e51dd5af97075629b2d77cab2c7",
"body": "JSON frames containing their own \\n escapes (streamed thinking text) were\ncorrupted: meter.send escaped only real newlines while the client unescape\nconverted the JSON's literal backslash-n into real newlines, breaking parse.\nEscape backslashes first; decode with a single-pass true inverse.\n\nFound live during the metered-inference mainnet gauntlet (2026-07-18).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_015iG3xtiDmNUrpwBg427Lsa",
"is_bot": false,
"headline": "fix(tab): SSE escape round-trip — backslashes escape before newlines",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-18T12:05:57Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "0b686939532455e30ae17fbaf96b2eff6ffe957c",
"body": null,
"is_bot": false,
"headline": "5.3.3",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-18T11:43:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1f8f81667961bea27494957fc835e4d7b2b8cd2e",
"body": "…zero new deps\n\nStructural RedisLikeClient (ioredis satisfies it): SET NX PX lease atomic\nacross processes, token-guarded Lua release, shared entry serialization\n(now exported) so out-of-process ledgers can't drift from FileChannelLedger.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_015iG3xtiDmNUrpwBg427Lsa",
"is_bot": false,
"headline": "feat(tab/seller): RedisChannelLedger — multi-process durable ledger, …",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-18T11:43:51Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "c41ab645c7ed89da7dcdbdee0306dbf6f5670d5f",
"body": null,
"is_bot": false,
"headline": "5.3.2",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-18T11:39:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "088d81dbad023656520f50810fec46afd83b254a",
"body": "… session cache\n\nAfter a process restart the SessionCache started every channel at\nlastCumulativeAtomic '0', so the first voucher on a long-lived tab computed\nincrement = full lifetime cumulative — tripping maxPerVoucherAtomic with a\nfalse cumulative_exceeds_cap 402 — and monotonicity ran against 0 \n[…]\nes.\n\nFound by the metered-inference spec adversarial panel (2026-07-18).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_015iG3xtiDmNUrpwBg427Lsa",
"is_bot": false,
"headline": "fix(tab/seller): reseed voucher baseline from durable ledger on fresh…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-18T11:39:32Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "46b28b5dd8dfafd86ffc9bc190bbc7cfabd0ed97",
"body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01FteCDwNEhMYCr4FtT78fBG",
"is_bot": false,
"headline": "chore(deps): @dexterai/vault ^0.37.0 dev",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-18T10:36:13Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "f16a874173fa22fdb29021a0995a3b5a7386a8fe",
"body": "…r range >=0.34.0 unchanged)\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01FteCDwNEhMYCr4FtT78fBG",
"is_bot": false,
"headline": "chore(deps): @dexterai/vault ^0.36.0 dev — role-9 discriminators (pee…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-18T08:59:40Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "6a3fcbc517d9eeb374b8b40d60ac15ff40da4b8f",
"body": null,
"is_bot": false,
"headline": "Merge branch 'r21-metered-inference'",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-08T02:20:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "29a42bda3bb3285b95767dd9a09da81845d054a7",
"body": "…free sends on charge failure\n\nReview finding (HIGH): deliver() ran before meter.charge(1), so a failing\ncharge (cap/expiry/non-monotonic) still delivered the page — unlimited free\nsends. Reordered to the money order for a paid side-effect: open the meter,\ncharge(1) (fails closed, deliver never reac\n[…]\n\nfaults post-charge. tsc --noEmit clean; unpaid 402 dual-rail unchanged.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01FBsz6CL3DmhYdz9vUDx2FB",
"is_bot": false,
"headline": "fix(examples): push-per-send tab rail charges BEFORE delivering — no …",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-08T02:03:53Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "29fe09f827186167ab69bf6c7dac2fd2212cdadc",
"body": "…buyer no longer drops multi-line chunks\n\nThe 5.3.1 SSE meter transforms payloads asymmetrically: meter.send()\nescapes only RAW newlines (a no-op for JSON.stringify output), while the\nbuyer-side tab.stream() unwrapper rewrites every LITERAL backslash-n back\ninto a raw newline. Any JSON frame whose t\n[…]\nguard is the clamp; the overshoot is kept since the meter\ncannot refund.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01FBsz6CL3DmhYdz9vUDx2FB",
"is_bot": false,
"headline": "fix(examples): metered-inference — newline-proof b64 SSE frames; tab …",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-08T01:56:21Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "de0740259656252cef739a33b5363280007df1c5",
"body": "…r a tab\n\nExample server #2 (R21): REAL LLM inference behind tabOrExactMiddleware.\nPOST /v1/complete meters per OUTPUT token served — 10 USDC microunits\n($0.00001) per token on the tab rail via openSse, $0.01 flat sticker on\nthe exact rail (the prepaid experience the tab replaces). Metering is\nunder\n[…]\nthe balance\ngate (need $0.0100, have $0.0000) with an ephemeral keypair.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01FBsz6CL3DmhYdz9vUDx2FB",
"is_bot": false,
"headline": "feat(examples): metered-inference — pay per output token, capped, ove…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-08T01:27:55Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d6c912729c14d4cf249c55a5aa384987fe9ea6aa",
"body": "…ind the dual-rail tab paywall\n\nExample seller #1 (R21). POST /send {channel, to, message} behind ONE\ntabOrExactMiddleware at $0.01/send: agents open a hard-capped tab and\npage as they go; one-shot buyers pay exact. Price decided per request in\nthe handler as integer USDC microunits (sticker vs bill\n[…]\nolveTabTerms resolve it, unfunded payAndFetch stops at\nthe balance gate.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01FBsz6CL3DmhYdz9vUDx2FB",
"is_bot": false,
"headline": "feat(examples): push-per-send — agent pages a human at $0.01/send beh…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-08T01:27:10Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "15678fe6e898977da07a94c02d0488efdd533479",
"body": null,
"is_bot": false,
"headline": "5.3.1",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-07T01:57:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a670dbad1f5d572c0bba8a61243290a64ca11db0",
"body": "…cknowledgement)\n\nReview MINOR-1: payUrlWithTab called openTab without onLiveSession and its\noptions type had no passthrough — that call site could never acknowledge a\nlive-session replace (a live same-seller session always threw\nLiveSessionExistsError with no way through). Optional 'error' | 'replace'\nnow forwards verbatim to openTab; test proves the option reaches the\nadapter's authorizeSession through openTab.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(tab): payUrlWithTab gains the onLiveSession passthrough (K-T4e a…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-07T01:55:48Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "1a4e3977960b4166db83841e9df493fdf5efdd2c",
"body": "…rolls-out, no live-guarantee claim\n\nReview IMPORTANT-2: the K-T3 docs asserted the facilitator 'now GUARANTEES\nthe protection cadence server-side' — the K-T2 engine is built but not\ndeployed, so for the publish window the claim is false and a seller who\nloosens lockCadence on its strength loses mid\n[…]\nng\nnow anchors on the refusing facilitator's own gate (a refusal is evidence\nthat facilitator's engine owns the span), not a blanket guarantee.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(seller): sequencing-honest cadence-engine framing — defer-as-it-…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-07T01:53:20Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "bb503c3ddeb553adb328616e306a8ff9556880cd",
"body": "…-session fixture\n\nReview IMPORTANT-1: with both at '1000000' a maxAmount<->maxRevolvingCapacity\ntransposition in the adapter's register-builder call serialized to identical\nbytes and passed byte-compare on BOTH legs (bare + compose). Fixture now\n1000000 vs 900000; mutation-verified — swapping the args on the bare leg\nfails all 3 not-live cases, swapping on the compose leg fails the atomic\ncompose byte-compare.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test(tab): differentiate maxAmount vs revolvingCapacity in K-T4e live…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-07T01:51:25Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "9cb78988042954f5a526f713c3ec0b21ecc37f95",
"body": "…penTab + K-T3 advisory cadence & gate-refused watermark\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_011eEBpshD2YPvJNR8VEJm5i",
"is_bot": false,
"headline": "docs(changelog): 5.3.1-candidate entries — K-T4e live-session-aware o…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-07T01:14:12Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "6936d59799408a53ac03d228d8cd789b16499041",
"body": "…_cadence gate-refused watermark (cadence spec §5, A12)\n\nThe facilitator now guarantees the protection cadence server-side (its\nengine fires locks at the on-chain penny knob for every seller), so the\nSDK's lockCadence demotes to an advisory lock-more-aggressively dial —\nstated on TabMiddlewareOption\n[…]\nthrough the real\nmiddleware); suite 434 -> 443, typecheck + build clean.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_011eEBpshD2YPvJNR8VEJm5i",
"is_bot": false,
"headline": "feat(tab/seller): K-T3 — lockCadence demotes to advisory + below_lock…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-07T01:12:58Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "ed5e6a83a67da7f9a9beb16c9f5775f739f1dfc4",
"body": "…ssion\n\nThe session PDA is per (vault, counterparty): re-opening a tab against a\nseller with a LIVE session collides with it, and the K-T1 program guard\n(SessionAlreadyActive) rejects the bare register that used to silently\noverwrite it — stranding the old session's unsettled tail. authorizeSession\n\n[…]\nare against the REAL vault\nbuilders with deterministic P-256 ceremonies.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_011eEBpshD2YPvJNR8VEJm5i",
"is_bot": false,
"headline": "feat(tab): K-T4e — authorizeSession goes atomic over a live target se…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-07T01:05:43Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a531d1d17ba2c5b7ce172fba5efeb37c5db41540",
"body": "…predecessor\n\nAdditive for every symbol this SDK imports (instructions/session/signers/\ntypes/messages/precompile/constants/grant/reader verified by d.ts diff):\n- BuildRegisterSessionKeyArgs gains OPTIONAL weldedNodePda (V7 credit gate;\n omitted == pre-V7 behavior, which this SDK keeps)\n- session m\n[…]\never imported\nTypecheck + full suite (418) green with ZERO source edits.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_011eEBpshD2YPvJNR8VEJm5i",
"is_bot": false,
"headline": "chore(deps): @dexterai/vault ^0.20.0 -> ^0.34.0 (dev + peer) — K-T4e …",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-07T00:52:04Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "3b44fce93b24c34a867871f0018157c35e57130a",
"body": "…idempotent tag-publish workflow (no red run when maintainer published first)\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_012fQexmQDAWRRymx4VVayLA",
"is_bot": false,
"headline": "chore(release-hygiene): files allowlist assets/*.svg (stray-proof) + …",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-05T21:25:08Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "ea70b0cd0b37c636dd1887d414d494f85a51da6a",
"body": "…crystallize logging, frontier baseline seeding, buyer covered-settle tolerance\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_012fQexmQDAWRRymx4VVayLA",
"is_bot": false,
"headline": "chore(release): 5.3.0 — lockCadence on the dual seller wrapper, loud …",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-05T21:18:15Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "7149c8a60a46f42c5505bfe25255925ae5e6b4b6",
"body": "…unts; guard null 409 body (C2-T3 fix pass)\n\nFix 1 (Important, spec §4 review adoption 2026-07-05): the 200\ncovered_by_frontier path no longer trusts the marker alone — it re-derives\nattemptedCumulative > onChainSpent AND attemptedCumulative <= frontier from\nthe 200 body's camelCase fields via the s\n[…]\n\nSuite 418/418 (base 414 + 4), typecheck + build clean. No version bump.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_012fQexmQDAWRRymx4VVayLA",
"is_bot": false,
"headline": "fix(tab/buyer): verify 200 covered_by_frontier coverage from body amo…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-05T21:14:30Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "f69207a645a5ae3b7aa83b1222b3f48411a782cc",
"body": "…oke proceeds (C-2 §4)\n\nOnce seller-side crystallization re-arms, a buyer's final settle can land fully\ncovered by locks. postSettle now treats two shapes as success-no-op (settleTx:''),\nso close() proceeds to the session revoke instead of throwing before it:\n\n 1. HTTP 200 { settled:false, reason:'\n[…]\nnClose omitted stays ARMED on close via the per-field default (?? true).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_012fQexmQDAWRRymx4VVayLA",
"is_bot": false,
"headline": "fix(tab/buyer): tolerate covered-by-frontier settles in close() — rev…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-05T21:04:22Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2e1b3fc658a5e5513834d37414364994d40f07ec",
"body": "The dual-rail seller wrapper (the RECOMMENDED entry point, what tab-demo\nmounts) constructed the tab rail via tabMiddleware but never exposed or\nforwarded lockCadence — so every dual-rail seller was armed-by-default\n(threshold $0.10, onClose true) with no off switch. An attempted disarm on\na dual mo\n[…]\neen; typecheck + build clean; the\nforward is present in emitted dist JS.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_012fQexmQDAWRRymx4VVayLA",
"is_bot": false,
"headline": "feat(tab/seller): forward lockCadence through tabOrExactMiddleware",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-05T20:47:55Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2c81f651112a870d26dcbb36422b34b621c4f590",
"body": "…seeding\n\nTwo seller-protection fixes surfaced by the tab-lane launch-gate test\n(production crystallization was silently dead — version drift on the\nconsumer, but the SDK's own silence made it invisible):\n\n1. No-silent-fallbacks: every crystallize attempt outcome now logs.\n Failures console.error \n[…]\n.\n\nRequires a release (5.3.0) before dexter-api adopts the ^5.2.0 range.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01MpS2PGzdsmhxNjo9tjkPrq",
"is_bot": false,
"headline": "feat(tab/seller): loud crystallize logging + chain-frontier baseline …",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-05T18:31:39Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "103b133cbc7f9cb240cc7285e8e0a9aee9f89458",
"body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01MpS2PGzdsmhxNjo9tjkPrq",
"is_bot": false,
"headline": "chore: keep stray pricing doc out of the tarball",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-05T17:18:30Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "c5f9e8f23cd1f0fc847cd690f2f4b789179bf400",
"body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01MpS2PGzdsmhxNjo9tjkPrq",
"is_bot": false,
"headline": "chore: untrack stray asset swept by add -A (stays on disk)",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-05T17:17:40Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "dfcb5aab97d7d2fb7b584464e87dc5e8a74bb5da",
"body": "…ession key)\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01MpS2PGzdsmhxNjo9tjkPrq",
"is_bot": false,
"headline": "chore(release): 5.2.0 — tabFromGrant (buyer-side tab from a granted s…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-05T17:16:52Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "716d0ec371103c902780e85dafac87c346202dd7",
"body": "…eview items)\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01MpS2PGzdsmhxNjo9tjkPrq",
"is_bot": false,
"headline": "docs(tab): TOCTOU serialization warning + spent odometer semantics (r…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-05T17:15:00Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "cd3daf832bd7511bd08789db22c80b900a8ca4de",
"body": "…chain-frontier resume, fail-closed arming\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01MpS2PGzdsmhxNjo9tjkPrq",
"is_bot": false,
"headline": "feat(tab): tabFromGrant — buyer-side tab from a granted session key, …",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-07-05T16:58:36Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "c339bce08ec400c1cb27ca666dcd3dde001a4435",
"body": "…it-only vaults\n\nThe Solana adapter no longer derives the vault USDC ATA itself. authorizeSession\nnow calls @dexterai/vault's resolveVaultUsdcAta (the single derive-and-probe\nsource of truth) and passes PublicKey|null to buildAdapterRegisterInstruction —\nnull for a credit-only vault with no ATA. Bum\n[…]\nplicated deriveSwigWalletAddress/getAssociatedTokenAddressSync. v5.1.0.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01SfUTzaR1N3BBFtchZeLph7",
"is_bot": false,
"headline": "feat(tab): route register through resolveVaultUsdcAta — supports cred…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-22T02:28:42Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "027de9630262a155ccc7f9e4acc5c08c0d039f87",
"body": "No code change since 5.0.0; republish to surface the rewritten README and the\nnew REFERENCE.md on the npm package page.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01SfUTzaR1N3BBFtchZeLph7",
"is_bot": false,
"headline": "chore(release): 5.0.1 — docs-only (pitch README + REFERENCE.md to npm)",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-20T16:42:06Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "ec1a125ebe0f399d6802012cd4f83b466a418355",
"body": "The README was ~354 lines, ~12 code blocks, and a large API-reference tail —\ndocumentation stuffed into the thing people read to decide whether they care.\nRewritten as a pitch (170 lines): the problem, the tab, ONE hero snippet, the\ntrust story elevated as the centerpiece, tabs as the star with one-\n[…]\nis\nlost — just off the front page. All exports verified against source.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01SfUTzaR1N3BBFtchZeLph7",
"is_bot": false,
"headline": "docs: rewrite README as a pitch, relocate the manual to REFERENCE.md",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-20T16:40:38Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4e720901c2f6e4adb65efa2799cd1b294da2a2c8",
"body": "…dexterai/vault a peer dep (5.0.0)\n\nBREAKING CHANGE: the Solana tab adapter now consumes vault 0.19's canonical\n`signOperation(operationMessage)` signer contract instead of `sign(challenge)`,\nand `@dexterai/vault` moves from a bundled dependency to a peerDependency\n(>=0.19). This kills the vault-ver\n[…]\n: 5.0.0 migration note, peer-dep install, kill stale TODO + test count.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01SfUTzaR1N3BBFtchZeLph7",
"is_bot": false,
"headline": "feat(tab)!: unify passkey signer on vault 0.19 signOperation + make @…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-20T16:32:17Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a02eb520f2a1ff03ab79dbb989a54f4e09b12243",
"body": "… shim\n\nThe Solana tab adapter now imports PasskeySignerWithPublicKey from\n@dexterai/vault/signers (publicKey + sign(challenge)) instead of defining its\nown signOperation interface. Both signing paths conform:\n - browser: vault's DexterApiBrowserPasskeySigner drops in directly\n - node: passkeyS\n[…]\natures validate.\n\nBump @dexterai/vault -> ^0.13.0; bump 4.0.0 -> 4.1.0.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01SfUTzaR1N3BBFtchZeLph7",
"is_bot": false,
"headline": "feat(tab): consume vault's canonical PasskeySigner — unify, no bridge…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-20T04:19:12Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "78d9cabee7c9abebba195c749c202d9e6c73005a",
"body": "BREAKING CHANGE: the v1-era public exports are removed, completing the 3.9.0\ndeprecation. The payment engine is unchanged; payAndFetch (client) and\nx402Middleware (server) cover everything the removed helpers did.\n\nRemoved exports:\n- client: createX402Client, wrapFetch (+ X402Client/X402ClientConfig\n[…]\ndFetch).\n\nGates: tsc --noEmit clean; 359/359 vitest pass; build clean; public .d.ts barrels\nconfirmed free of all removed symbols.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(v4)!: remove deprecated v1-era exports — x402 v4.0.0",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T21:19:53Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "f2e730ab742872e28c40c1a9a095516026a52cfa",
"body": "…tart\n\nDrop the \"At scale\" load-balancer ledger caveat + the redundant pre-audit\nre-mention from the seller section — front-loading defensive caveats in an\nintegration quickstart is noise. The multi-instance lease constraint already\nlives in the seller code comments; pre-audit is stated once in the trust section.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(seller): cut the premature multi-instance caveat from the quicks…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T19:30:21Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "95db3414998b22ee2263997f3c4d58145aba076e",
"body": "…e SELLER.md\n\nKeep one home for the seller path (the README seller section, now complete:\nthe lock-aware guarantee, the copy-paste middleware, await meter.end(), the\nmulti-instance ledger caveat, pre-audit). Removes the separate SELLER.md added\nin 89358e7 — README + the site llms are the two surfaces, not a third file.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(seller): fold seller integration into the README; drop standalon…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T19:29:17Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "89358e7424973ed29d8c7b40a69016236d2e2c13",
"body": "… README link\n\nSelf-contained \"get paid by agents\" path for partners (and their coding agents):\nfront-door @dexterai/x402, lock-aware guarantee, one copy-paste seller, honest\npre-audit + multi-instance-ledger caveats. Linked from the README seller section.\nMirrored at dexter.cash/sdk/seller/llms.txt.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(seller): SELLER.md — focused AI-first seller integration guide +…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T19:25:09Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "c0ddc527719a8c588be8fa2c2f8d1fc8526a7747",
"body": "Ships the terms.ts protection 'freeze' → 'lock' fix to npm consumers so\nresolveTabTerms reports the shipped tab protection. Docs-and-descriptor\nonly; no runtime/protocol change.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore(release): @dexterai/x402 3.18.1 — lock-mode settlement descriptor",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T18:33:32Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "9d70a7104c0d13fc418f22a519804a8a088db62e",
"body": "The facilitator's /tab/open default flipped freeze→lock in Step-4, so every\nx402 buyer tab (armTabOpen sends no mode) is now lock-protected. The README\nand the resolveTabTerms settlement descriptor still advertised 'freeze' —\nboth predate the Step-4 work and were never updated.\n\n- README: \"freeze-pr\n[…]\n'lock'.\n\nThis is a public type change; reaches consumers on the next @dexterai/x402\npublish (gated). tsc clean, terms suite green.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs+fix(tab): lock is the shipped tab protection, not freeze (Step-4)",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T18:30:44Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "3d2bbc7e1e50e92b10bdb297036cbd8bb739e013",
"body": null,
"is_bot": false,
"headline": "chore(release): x402 seller crystallization cadence (Step-4)",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T18:05:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bd193f1966d9e8af7b54fa7e0c10b594b12885bf",
"body": null,
"is_bot": false,
"headline": "merge: Step-4 seller crystallization cadence (POST /tab/lock)",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T18:05:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f6e9b9801ca301888d50ac0f88ecfa2ffd9062cb",
"body": "…ath final-voucher + truthful watermark, fetch timeout (Step-4)\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(tab/seller): crystallize — canonical facilitator default, close-p…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T16:41:38Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "59e2b014c981298864a13d2fb2a7b1a863f6bfb3",
"body": "…tep-4)\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(tab/seller): keyless crystallization cadence → POST /tab/lock (S…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T16:30:28Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "571b5e52843f3f08134896535cfd1a0328c485b8",
"body": "DESIGN-tab-streaming / reference_dexter_facilitator_url / DESIGN-timeout-double-charge\nare no longer published; keep the inline rationale, drop the dead pointers. Phase\nlabels left untouched pending the numbering consolidation.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore(comments): drop references to docs pulled from the public repo",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T06:35:17Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "bcfd99297ee47d0c4aeafa8c7e09a67f892d737d",
"body": "…aar comment\n\nKeep the engineering rationale; remove the pointer to a private competitive-intel\ndoc (it never shipped in this repo, but the public comment named it).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore(comment): drop competitive-intel doc breadcrumb from public baz…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T06:31:58Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "22af39b9fc60ea9dfa9020b16d601665cca6990f",
"body": "…dings); keep README only\n\nLocal copies retained; history purge in the pre-reveal scrub. Code comments that\nreference pulled design docs are cosmetic (swept separately).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore(repo): unpublish internal/working docs (whole docs/ + stray fin…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T06:29:29Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "3a08284d5a2e81b8ecb43db6430b19966e76b5d4",
"body": "…(gitignore + untrack)\n\nThese are internal agent-workflow plans/specs/research, not public SDK docs.\nLocal copies retained on disk; history purge folded into the pre-reveal scrub.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore(repo): stop publishing internal docs/superpowers/ working docs …",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T06:25:15Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "c12dde6dc66431fa264d5f5ad2b8c7434f8bbe56",
"body": "…hardcoded Helius key\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(security): cleanup-test-vault resolves write RPC from env, not a …",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T06:15:27Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "a583832c69f1d3ae18f1d7b368a163b52c62b448",
"body": "…ross writes; release on response lifecycle not the meter\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(seller): make the channel lease actually work — preserve lease ac…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T06:07:15Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "04db49c2e06619c381ba9b75b3ea74c80e3ddee8",
"body": "…only entry\n\nFileChannelLedger.tryAcquireLease on a fresh channel (the first request, before\nthe voucher is persisted) created a lease-only entry with a null lastVoucher;\nserialize() null-dereffed -> every first request on a durable/file-backed seller\nthrew. InMemory default never serializes, so the suite missed it. lastVoucher is\nnow SignedVoucher|null end-to-end with a durable-path regression test.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(seller): nullable lastVoucher so durable ledger can hold a lease-…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T05:58:16Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "f734d13488e514e21e597529016d437d56317023",
"body": "…dger\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(seller): document multi-instance lease requirement for ChannelLe…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T05:53:32Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "5e715e211ba8671c7def2c6f64841fa97303c43d",
"body": "…concurrent-same-channel rug)\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(seller): durable channel lease — one live stream per tab (closes …",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T05:52:57Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "4d22420edbcb11976be1ce56286966d71297e2b0",
"body": "…annel metering, rug fix)\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(plan): Task 8 — durable channel lease (reject concurrent same-ch…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T05:48:33Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "a18154835c9ea44ff49fd65747d56dce2dd75568",
"body": "…ate meter on cap-reject; guard close-persist\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(seller): additive per-channel-locked delivered accounting; termin…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T05:40:08Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "d6f0439f0aff3028a5495b7fad1433ba17e40bc5",
"body": null,
"is_bot": false,
"headline": "docs(seller): await meter.end() in README tab example (now-async API)",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T05:28:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "032638bd5efeab37cccf4d09b0cfef54d7463257",
"body": "…ix openSse example",
"is_bot": false,
"headline": "feat(seller): export ChannelLedger surface; deprecate VoucherStore; f…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T05:27:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "022050d3ec668bc013788a1a4d001693b0e3de62",
"body": "…eline + persist)",
"is_bot": false,
"headline": "feat(seller): wire ChannelLedger through tabMiddleware (delivered bas…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T05:26:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "77aa1128bd2273127578572e89b9a113b5aa4930",
"body": null,
"is_bot": false,
"headline": "feat(seller): SellerTabImpl delivered baseline + recordDelivered closure",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T05:25:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "835ce87cfc16ea5f89da184ba1e9958b3c2423ed",
"body": "…eak) + two-request-reuse test",
"is_bot": false,
"headline": "fix(seller): meter budget = signed − delivered (close channel-reuse l…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T05:24:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bd0782dd539ec6b82d6ca5d94ca5192543469d98",
"body": "…ith resumeTab)",
"is_bot": false,
"headline": "feat(seller): FileChannelLedger — durable per-channel state (shared w…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T05:23:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "13ead0b2e54e5ad60d070c52237574362307747f",
"body": "… delivered hooks",
"is_bot": false,
"headline": "feat(seller): ChannelLedger types + InMemoryChannelLedger + SellerTab…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T05:23:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e6df0a086f48ca7eb333d3badd6fa5155ead88a5",
"body": "…-coupled to async end())\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(plan): fold README await meter.end() parity into Task 6 (version…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T05:20:06Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "e78eecc42b264196943194fd0bbd22a64e4012ee",
"body": "…n res 'close', not just end()\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(plan): close buyer-disconnect grief window — persist delivered o…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T05:15:21Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "8b5b5f29cee0a38054d9a8e48e9538e0871d7e4e",
"body": "…n B)\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(plan): seller ChannelLedger meter-fix implementation plan (optio…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T05:10:19Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "346d31cef55c4d2e011599173d86be7cb6efe813",
"body": "…nest)\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: README rewrite — Tabs-first front door (cap-first, pre-audit ho…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T04:33:13Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "e7615e2068cfb9c85bb685707c5b294fda7c3e25",
"body": "…rant, software passkey\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "test(2b): proof-of-firstuse harness — counterfactual vault activate→g…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-17T03:31:25Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "60cfcc97fac92b306c2deafbf19508bce4a07519",
"body": "…nvite preflight, tolerant seller delta, arm-increase assertion, preflight hardening\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(proof-of-connect): review fixes — isSessionLive full-state arg, i…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-12T21:51:30Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "f2718686f99723128060bf947fe2df6f79158a19",
"body": "… granted agent pays the live route)\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test(tab): proof-of-connect — 3c e2e harness (deep link → human tap →…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-12T21:23:38Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "9bc98c802e7af71e7a23cffd38e66f2bf2ba5530",
"body": "…dedness claim)\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: CUSTODY.md — the custody dial (root placement vs the agent-boun…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-12T21:13:50Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "cb96dcab0b50a42f19eb95fdb949d1536347fcd6",
"body": "…loy, default Step-4)\n\nimpl+cos converged: not standalone, not 'someday' — bundles into the next\nvault program deploy. Tracked.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(LIVENESS): destination-pin fix scheduled (rides next program dep…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-12T04:30:28Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "7336b5e3f261da411944c64bc8d21434dfed4636",
"body": "…ed (facilitator-enforced)\n\nRead upstream swig program_exec_authenticate (rev c2e8eb4): validates only\nprogram id + settle_tab data prefix + config/wallet at accounts[0..1]; does\nNOT inspect the sibling SignV2 transfer's destination/amount. settle_tab_voucher\ndoesn't take the destination ATA, so the\n[…]\ned voucher; vault withdrawal unaffected. Fix tracked: settle_tab_voucher\ntakes the destination ATA as a constrained account == counterparty ATA.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(LIVENESS): audit RESOLVED — settle destination is NOT chain-pinn…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-12T04:16:48Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "5872b43df8080ee8547977d8c79431f2cd66f6d4",
"body": "…t 'cannot redirect'\n\ncos's challenge checked out: settle_tab_voucher gates the OPPORTUNITY\n(ProgramExec role + buyer-signed one-shot voucher, program-enforced) but\nthe sibling SignV2 transfer's destination/amount pinning rests on upstream\nSwig ProgramExec validation depth (role action = All). Audit scope now\nprecise; doc states the split honestly.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(LIVENESS): claim exactly what's verified — 'cannot initiate', no…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-12T04:11:52Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "95b102b4c8602e9f4f1a41ca292367b17dc08916",
"body": "…seller dependency stated plainly\n\nPer cos review thread: written against current known behavior; the\nseller-self-submit authority question is noted as unverified for a\nfuture audit, not held as a blocker.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: LIVENESS.md — custody vs liveness, keeper-free buyer recovery, …",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-12T04:07:57Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "bcd3bcbb9527badc59397ba5f9781e30c5473a9b",
"body": "…v (proxy is read-only)\n\nrpc.dexter.cash rejects sendTransaction (method_not_allowed) — correct\nfor a public proxy, fatal for proofs. SOLANA_RPC_URL env wins; fallback\nreads SOLANA_RPC_ENDPOINT from the local dexter-api env. Key stays out\nof the repo either way.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(scripts): proofs resolve a WRITE-capable RPC from the operator en…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-12T03:30:32Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "710e61d0eefe554e1a8cae6dbbde0cedc22fa5f0",
"body": "… the public repo\n\nThe Dexter RPC subdomain proxies Helius with the key held server-side;\nSOLANA_RPC_URL env overrides. (Key remains in git history — rotation\nstill recommended.)\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(scripts): proof scripts use rpc.dexter.cash proxy — no API key in…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-12T03:28:05Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "38be807f898cd8b33b401562baa50aec5fc8114f",
"body": "…b, zero seller knowledge\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test(scripts): proof-of-stranger — pay a LIVE public Dexter URL by ta…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-12T02:43:48Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "01f9ca44415e7062a7b324c437fdcee4087c6022",
"body": "…(fill(7) was swept)\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(scripts): proof-of-loop seller from the private keypair file too …",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-12T02:26:53Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "fae89f2b77fd29c43b6ac60651192a27884b6a2d",
"body": "… weak seed\n\nfromSeed(fill(N)) is a derivable key: proof-of-loop's fill(7) seller was\nswept by a bot within the hour of the 3a proof (USDC gone, ATA closed by\n31N4j7my…). Fixed-but-private keypair keeps the replace-in-place session\nsemantics without settling value to a sweepable address.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(scripts): proof-of-dual seller from a private keypair file, not a…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-12T02:26:31Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "102fca70e4e0dabce76187a35b221c4e13b8d559",
"body": "… freeze)\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(scripts): proof-of-dual closes the tab on a failed leg (frees the…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-12T02:21:00Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "779e8e8f634f058a6a2243dde565ef749ce7abd2",
"body": "…-rail seller\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test(scripts): proof-of-dual — resolve + exact + tab legs vs one dual…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-12T02:15:14Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "1765174d14a22878daa2f7c99b3567adcde5caf0",
"body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(tab): export resolveTabTerms + tabOrExactMiddleware; 3.17.0",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-12T02:09:08Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "1566942a2637abf5e3ef006eea355a1be4ca75a4",
"body": "…ath + precedence tests\n\nQuality-review fixes: getPaymentAccept failure is the same transient\ncondition as the challenge path (503 challenge_unavailable, not 500); the\nexact rail's SUCCESS path (req.x402 + PAYMENT-RESPONSE + next) and settle-\nfailure 402 are now pinned; voucher-wins header precedence pinned.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(tab/seller): dual exact rail — 503 on facilitator-down, success-p…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-12T02:06:27Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "029d48c7f78476b3639d35e96655a636153d2cfe",
"body": "…act)\n\nExact rail verifies/settles with EXPLICIT requirements (our amount), never\nthe header-derived fallback — underpayment pin in dual.test.ts.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(tab/seller): tabOrExactMiddleware — one 402, two rails (tab + ex…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-12T01:56:56Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "79e60cb5c68e07147c5d1669b6b3cef9750f35e4",
"body": "…e human figure\n\nQuality-review fix: perRequest.human renders with USDC's 6 decimals; a\nnon-USDC tab asset would be wrong by orders of magnitude in a consent UI.\nUSDC-only guard + pinning test; atomic stays authoritative.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(tab): resolveTabTerms refuses non-USDC offers — never misprice th…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-12T01:52:22Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "d90f416a2697bed81f330637bd93c276b5d24e06",
"body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(tab): resolveTabTerms — pre-flight tab terms for a URL, no payment",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-12T01:45:10Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "9763fc75c2143290c8bda1aee0d58c74e0251f1a",
"body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: 3.16.0 — pay-a-URL (Step 3a)",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-12T00:26:27Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "d8783436dedbd4cf68cafa3a1f34dccd40a8117d",
"body": "…ler removed (Step 3a ship gate)\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(proof): buyer discovers the seller from the wire — hardcoded sel…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-12T00:26:01Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "972e678924f3ac684184a8d4361e812e9c279dd8",
"body": "…ot 'coming'\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(tab): export pay-a-URL surface + README — tab section is LIVE, n…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-12T00:24:41Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "3f01b8053badbd893b98d828d415b296a05c08da",
"body": "… failure-returns-tab contract\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(tab): document double-probe cost + exhausted-tab legibility; pin…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-12T00:23:16Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "53fc67d90f26b95c595a4df799e56d6a4d764893",
"body": "…nowledge\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(tab): payUrlWithTab — pay a URL through a tab with zero seller k…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-12T00:20:00Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "ce9546831527b12e21a9df0d9a57958ea20cc13c",
"body": "…IP-2 in interop test\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(tab/seller): facilitator-down answers 503+Retry-After; pin raw CA…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-12T00:16:04Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "7941bb1c17fb0d0387c93b4cafefd700c652d822",
"body": "… for strangers\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(tab/seller): tabChallengeMiddleware — standard 402 tab challenge…",
"author_name": "Branch Manager",
"author_login": "BranchManager69",
"committed_at": "2026-06-12T00:10:18Z",
"body_truncated": false,
"is_coding_agent": true
}
],
"releases_count": 6,
"commits_last_year": 354,
"latest_release_at": "2026-07-07T01:59:31Z",
"latest_release_tag": "v5.3.1",
"releases_from_tags": false,
"days_since_last_push": 5,
"active_weeks_last_year": 20,
"days_since_latest_release": 18,
"mean_days_between_releases": 22.6
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 37,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "@dexterai/x402",
"exists": true,
"license": "MIT",
"keywords": [
"x402",
"solana",
"base",
"evm",
"ethereum",
"polygon",
"arbitrum",
"optimism",
"avalanche",
"bsc",
"worldchain",
"monad",
"robinhood-chain",
"skale",
"payments",
"dexter",
"web3",
"crypto",
"stripe",
"machine-payments",
"agent-payments",
"opendexter",
"marketplace",
"ai-agents",
"monetize",
"api-payments"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@dexterai/x402",
"is_deprecated": false,
"latest_version": "5.4.2",
"repository_url": "https://github.com/Dexter-DAO/dexter-x402-sdk",
"versions_count": 97,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 2823,
"first_published_at": "2025-12-27T02:46:34.665000Z",
"latest_published_at": "2026-07-19T18:04:49.812000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 5
}
]
},
"popularity": {
"forks": 4,
"stars": 3,
"watchers": 0,
"fork_history": {
"days": [
{
"date": "2026-01-07",
"count": 1
},
{
"date": "2026-02-15",
"count": 1
},
{
"date": "2026-04-07",
"count": 1
},
{
"date": "2026-05-20",
"count": 1
}
],
"complete": true,
"collected": 4,
"total_forks": 4
},
"star_history": null,
"open_issues_and_prs": 16
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [
"examples"
],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [
"examples/live-chain/demo-app/tsconfig.json",
"examples/live-chain/relay/tsconfig.json",
"examples/metered-inference/tsconfig.json",
"examples/push-per-send/tsconfig.json",
"tsconfig.json"
],
"toolchain_manifests": [],
"largest_source_bytes": 34665,
"source_files_sampled": 167,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"package.json"
],
"advisories": {
"error": null,
"scope": "published_package",
"source": "osv",
"findings": [
{
"name": "bigint-buffer",
"direct": false,
"version": "1.1.5",
"severity": "high",
"ecosystem": "npm",
"cvss_score": 7.5,
"advisory_ids": [
"GHSA-3gc7-fjrx-p6mg"
],
"fixed_version": null,
"advisory_count": 1,
"oldest_advisory_days": 477
},
{
"name": "uuid",
"direct": false,
"version": "8.3.2",
"severity": "high",
"ecosystem": "npm",
"cvss_score": 7.5,
"advisory_ids": [
"GHSA-w5hq-g745-h8pq"
],
"fixed_version": "13.0.1",
"advisory_count": 1,
"oldest_advisory_days": 93
}
],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {
"high": 2
},
"advisory_count": 2,
"affected_count": 2,
"assessed_count": 98,
"malicious_count": 0,
"assessed_package": "npm:@dexterai/x402@5.4.2",
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"npm"
],
"dependencies": [
{
"name": "@dexterai/x402-ads-types",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^0.2.0"
},
{
"name": "@dexterai/x402-core",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^1.4.0"
},
{
"name": "@noble/curves",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^1.9.7"
},
{
"name": "@noble/hashes",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^1.8.0"
},
{
"name": "@solana/spl-token",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^0.4.9"
},
{
"name": "@solana/web3.js",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^1.98.0"
},
{
"name": "@x402/core",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "2.12.0"
},
{
"name": "@x402/evm",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "2.12.0"
},
{
"name": "@x402/extensions",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "2.12.0"
},
{
"name": "tweetnacl",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^1.0.3"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 1,
"merged_prs": 0,
"open_issues": 15,
"closed_ratio": 0.667,
"closed_issues": 30,
"closed_unmerged_prs": 1
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "BranchManager69",
"commits": 354,
"avatar_url": "https://avatars.githubusercontent.com/u/121578862?v=4"
}
],
"contributors_sampled": 1,
"top_contributor_share": 1
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"ci.yml",
"publish.yml"
],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"package-lock.json"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": null,
"reason": "no pull request found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/30 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 3,
"reason": "project has 1 contributing companies or organizations -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 3,
"reason": "dependency not pinned by hash detected -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "no SAST tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 0,
"reason": "22 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "b5e1358b3c10e8d4c64c73a73566c54fd4ddc07a",
"ran_at": "2026-07-25T17:02:49Z",
"aggregate_score": 3.7,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-19T18:06:02Z",
"oldest_open_prs": [
{
"number": 45,
"created_at": "2026-05-20T08:23:37Z",
"last_comment_at": "2026-05-20T10:09:51Z",
"last_comment_author": "peterxing"
}
],
"last_merged_pr_at": null,
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 8,
"created_at": "2026-03-10T07:21:52Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 18,
"created_at": "2026-03-15T03:51:29Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 31,
"created_at": "2026-03-15T03:55:33Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 32,
"created_at": "2026-03-15T03:55:51Z",
"last_comment_at": "2026-04-06T00:45:33Z",
"last_comment_author": "BranchManager69"
},
{
"number": 34,
"created_at": "2026-03-15T03:56:26Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 36,
"created_at": "2026-03-15T03:57:10Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 38,
"created_at": "2026-04-10T01:02:34Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 39,
"created_at": "2026-04-10T01:02:41Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 40,
"created_at": "2026-04-10T01:02:45Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 41,
"created_at": "2026-04-10T01:02:48Z",
"last_comment_at": "2026-05-20T08:24:18Z",
"last_comment_author": "peterxing"
},
{
"number": 42,
"created_at": "2026-04-11T17:08:11Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 43,
"created_at": "2026-05-04T13:47:14Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 44,
"created_at": "2026-05-10T21:47:15Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 47,
"created_at": "2026-06-08T16:27:22Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 48,
"created_at": "2026-06-18T21:18:12Z",
"last_comment_at": null,
"last_comment_author": null
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/Dexter-DAO/dexter-x402-sdk",
"host": "github.com",
"name": "dexter-x402-sdk",
"owner": "Dexter-DAO"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 55,
"inputs": {
"security": 44,
"vitality": 87,
"community": 36,
"governance": 43,
"engineering": 62
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "excellent",
"name": "Vitality",
"value": 87,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "good",
"name": "Development activity",
"note": null,
"notes": [],
"value": 78,
"inputs": {
"commits_last_year": 354,
"human_commit_share": 1,
"days_since_last_push": 5,
"active_weeks_last_year": 20
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 5 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 5
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "20/52 weeks with commits",
"points": 13.8,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 20
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "354 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 354
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"releases_count": 6,
"latest_release_tag": "v5.3.1",
"releases_from_tags": false,
"days_since_latest_release": 18,
"mean_days_between_releases": 22.6
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "6 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 6
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 18 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 18
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~22.6 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 22.6
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 5,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 5 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 5
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 36,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 9,
"inputs": {
"forks": 4,
"stars": 3,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "3 stars",
"points": 4.9,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 3
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "4 forks",
"points": 4,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 4
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "moderate",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 58,
"inputs": {
"packages": [
"@dexterai/x402"
],
"dependents": null,
"ecosystems": "npm",
"total_downloads": null,
"monthly_downloads": 2823
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "2,823 downloads/month across npm",
"points": 46,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 2823,
"ecosystems": "npm"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "at_risk",
"name": "Sustainability & Governance",
"value": 43,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 13,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 1,
"top_contributor_share": 1
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0,
"status": "missed",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "1 contributors",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 1
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 3,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "at_risk",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 31,
"inputs": {
"merged_prs": 0,
"open_issues": 15,
"closed_issues": 30,
"issue_closed_ratio": 0.667,
"closed_unmerged_prs": 1
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "67% of issues closed",
"points": 31.2,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 67
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "0/1 decided PRs merged",
"points": 0,
"status": "missed",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 0,
"decided": 1
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "at_risk",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 44,
"inputs": {
"followers": 4,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "Dexter-DAO",
"public_repos": 13,
"account_age_days": 210
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "4 followers of Dexter-DAO",
"points": 5,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 4,
"login": "Dexter-DAO"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "13 public repos, account ~0 yr old",
"points": 9.5,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 13
}
},
{
"code": "account_age_years",
"params": {
"years": 0
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"@dexterai/x402"
],
"ecosystems": "npm",
"any_deprecated": false,
"min_days_since_publish": 5
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on npm",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "npm"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 5 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 5
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "97 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 97
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 62,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_ci_tests"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 60,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "2 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 2
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 65,
"inputs": {
"topics": [
"evm",
"payments",
"sdk",
"solana",
"x402",
"agents",
"tabs",
"usdc"
],
"has_wiki": false,
"homepage": "https://dexter.cash/sdk",
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://dexter.cash/sdk",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "8 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 8
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "at_risk",
"name": "Security",
"value": 44,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): CI-Tests, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"ci_tests",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 37,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 16,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 2,
"scorecard_aggregate": 3.7
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 3",
"points": 1.5,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "no SAST tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "22 existing vulnerabilities detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "good",
"name": "Dependency advisories",
"note": "Matched the npm:@dexterai/x402@5.4.2 runtime dependency closure — what installing the published package pulls in — 98 packages. Reachability is not analyzed.",
"notes": [
{
"code": "advisories_scope_published",
"params": {
"package": "npm:@dexterai/x402@5.4.2",
"assessed": 98
}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 72,
"inputs": {
"source": "osv",
"advisories": 2,
"affected_packages": 2,
"assessed_packages": 98,
"unassessed_packages": 0,
"affected_by_severity": "high 2",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "2 affected: bigint-buffer 1.1.5 (high 7.5), uuid 8.3.2 (high 7.5)",
"points": 8.4,
"status": "partial",
"details": [
{
"code": "advisories_affected",
"params": {
"count": 2,
"packages": "bigint-buffer 1.1.5 (high 7.5), uuid 8.3.2 (high 7.5)"
}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "2 advisory-carrying package(s) unaddressed past 90 days; oldest published 477 days ago",
"points": 29.1,
"status": "partial",
"details": [
{
"code": "advisories_stale",
"params": {
"days": 90,
"count": 2,
"oldest": 477
}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 98,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 2
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 55,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.94,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "94 of 100 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 94,
"sampled": 100
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 56,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"package-lock.json"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [
"examples/live-chain/demo-app/tsconfig.json",
"examples/live-chain/relay/tsconfig.json",
"examples/metered-inference/tsconfig.json",
"examples/push-per-send/tsconfig.json",
"tsconfig.json"
],
"agent_commit_share": 0.85,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "examples/live-chain/demo-app/tsconfig.json, examples/live-chain/relay/tsconfig.json, examples/metered-inference/tsconfig.json, examples/push-per-send/tsconfig.json, tsconfig.json",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "examples/live-chain/demo-app/tsconfig.json, examples/live-chain/relay/tsconfig.json, examples/metered-inference/tsconfig.json, examples/push-per-send/tsconfig.json, tsconfig.json"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "85 of the last 100 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 85,
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 3",
"points": 3,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "TypeScript",
"largest_source_bytes": 34665,
"source_files_sampled": 167,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "TypeScript (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "TypeScript"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/167 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 167,
"oversized": 0
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "at_risk",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"example_dirs": [
"examples"
],
"has_mcp_signal": false,
"api_schema_files": []
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": "examples",
"points": 40,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "examples"
}
}
],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
],
"report_type": "repository",
"generated_at": "2026-07-25T17:02:55.153174Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/d/Dexter-DAO/dexter-x402-sdk.svg",
"full_name": "Dexter-DAO/dexter-x402-sdk",
"license_state": "standard",
"license_spdx": "MIT"
}
Related records
Inspected repositories sharing catalogue tags or ecosystems with Dexter-DAO/dexter-x402-sdk. Read them side by side →
Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.27.0 — full methodology · metrics wiki.
