// Blog

Technical notes for AI agent builders

Tutorials, comparisons and design patterns for building autonomous agents that self-fund, call 345+ models and orchestrate MCP Tools.

CIMD in the wild: agent identity without registration

The 2026-07-28 MCP revision made Client ID Metadata Documents the preferred way for an agent to identify itself, and deprecated Dynamic Client Registration. We diffed all three revisions of the IETF draft, then crawled all 87,160 entries in the MCP registry and resolved 3,450 authorization servers. Only 17.2 percent advertise CIMD support; 93.7 percent still advertise a DCR endpoint; and 88.5 percent of the CIMD adopters kept DCR running alongside it.

15 min read →

One signature, fifty invocations: auditing x402's two-phase gap

x402 separates payment verification from on-chain settlement, and that window has been the subject of three independent security papers this year. We ran the attacks against @x402/express 2.24.0 and audited the monorepo at HEAD. The duplicate grant is closed. The duplicate work is not, and cross-resource substitution still succeeds on the first try.

16 min read →

Who pays your agent's gas? An on-chain audit of Circle Paymaster

An agent that holds only USDC still needs gas. Circle Paymaster is the permissionless way to pay it in USDC, and it is a different trust model from the x402 facilitator that eats the fee for you. We audited every mainnet deployment and measured a full day of traffic: the price of gas is set by the user operation, not by the chain, and in the window we measured accounts paid 202,307 USDC for transactions that cost 358 dollars to include.

14 min read →

AIPREF at the deadline: auditing the vocabulary agents are supposed to read

The IETF AIPREF working group has two standards-track drafts due at the IESG on 31 August 2026. One of them says, on its own cover, that its contents do not reflect working group consensus. We read every revision, implemented the resolution algorithm, and ran it against a fresh crawl of the top 10,000 domains. Exactly one domain emits a preference the specification can read.

16 min read →

Agentic week: x402 grew a payment lifecycle

Between 21 and 28 August, three merged changes in x402 attacked the same assumption: that a payment is one request, one signature, one settlement. auth-capture became a full authorize/capture/void/refund lifecycle with onchain authorizer binding, settlement_pending stopped being the caller's problem, and the exact scheme learned to settle before it serves. MCP, meanwhile, published its post-2026-07-28 roadmap.

9 min read →

Auditing x402 default assets: 26 tokens, one broken EIP-712 domain

One table in the x402 SDKs decides three things at once: which stablecoin a dollar price resolves to, which EIP-712 domain the client signs, and which assets a default client is allowed to pay at all. We drove every EVM row against its token on chain. Nineteen of twenty EIP-3009 entries verify. One has been signing against the wrong domain for five months, in all three SDKs.

13 min read →

EIP-7702 smart EOAs on x402: who validates the signature

Twenty-three bytes of delegation code change which function validates your agent's payment signature: ecrecover becomes isValidSignature, and the delegate decides. We scanned 74,029 EIP-3009 authorizations on Base in 24 hours, classified every payer, found 497 smart EOAs across 18 delegate implementations, and then synthesized a 7702 account for each one to run the real USDC transfer path with a raw owner signature. Thirteen accepted it, five rejected it, and the live accounts told us why the split is not a property of the delegate alone.

13 min read →

ERC-7710 on x402: MetaMask's delegation rail, audited

Our last two audits found that x402's per-payment cap and Coinbase's onchain budget never compose. This week we audited the stack that finally wires both layers together: MetaMask's Delegation Framework, the erc7710 asset transfer method in the x402 spec, and a live facilitator redeeming delegations on Base. We verified bytecode on four chains, measured 20,009 redemptions in seven days — 36x Coinbase's rail — and drove the npm packages until we found the default that breaks MetaMask's own quickstart.

11 min read →