Tutorials, comparisons and design patterns for building autonomous agents that self-fund, call 345+ models and orchestrate MCP Tools.
Managed wallets promise that a policy engine in the enclave bounds what an agent can sign. An x402 payment never reaches that engine as a transaction: it is an EIP-3009 or Permit2 typed-data message whose wire shape depends on the adapter. We ran @x402/evm 2.28.0 against mocked Turnkey and Privy backends and read both policy languages. Turnkey's documented x402 path sends an empty EIP-712 domain, a bug its own draft PR describes. Privy's typed-data rules need an exact types-map match, or a DENY rule silently stops firing. Neither engine can keep a running x402 budget or bound the validity window relative to now. Plus ready-to-test policies for paying LLM4Agents, what it means for us, and six steps.
When an agent's model reads a 402, the seller is writing into its context window. The x402 spec limits serviceName and tags, and the Bazaar spec calls the facilitator a trust boundary, but description, error and extension examples have no rule, and the MCP transport requires the 402 in model-visible content. We read @x402/mcp, Cloudflare Agents and Coinbase AgentKit: Cloudflare enforces its own cap on the requirement that is actually signed, while AgentKit checks its configurable cap against an amount the model types, leaving the SDK's $1 default as the only binding limit. We counted 32,127 Bazaar listings: 7.1% are written like tool descriptions, addressed to the model that picks tools, and nine carry literal injection payloads as security-tool samples. A small test on two local models: no run paid without asking, but one model told the user the payment was pre-approved by their own policy, and an injected listing won a 50x-overpriced call. Plus what it means for LLM4Agents and six steps.
Between 2 and 9 October, the x402 batch-settlement scheme reached production on Solana mainnet in a mode where the seller signs the meter. The agent-side router integrating it responded by reading the channel account directly and comparing what was claimed against what it signed. Three SDK fixes made the same move, taking the charged baseline out of the client's voucher and reading it from onchain state, while the spec now says a resource server's own price MUST NOT be trusted. auth-capture v1.1 landed in both SDKs along with a mode where the facilitator signs the receiver's consent. And MCP Server Cards went Final while the repository holding their normative schema still calls itself experimental.
Crossmint sells agent wallets with a spend cap, allowed counterparties and a time window, enforced onchain. We read the docs, @crossmint/wallets-sdk 1.20.0, the M2M Payments reference app and Crossmint's open-source Stellar contract to see where that cap binds an x402 payment. The primitive exists, as signer scopes. But the agent guides and the reference app register the agent's key without them, scopes cannot be added to an approved signer, and on EVM an x402 EIP-3009 payment reaches the wallet only as a staticcall to isValidSignature on a 32-byte hash, a path that cannot keep a running total. On Stellar, Soroban hands the account the full transfer call and Crossmint's policy enforces the cumulative cap. Plus what it means for a seller of inference to smart-account buyers, and six steps.
A pay-per-call LLM price must be fixed before the model runs, so the input side is an estimate. Ours, confirmed by probing our own 402 and reading our source, is ceil(JSON.stringify(messages).length / 4): UTF-16 units, JSON escapes counted twice. We ran the Universal Declaration of Human Rights in 15 languages and a set of agent payloads through o200k, cl100k, Qwen3, DeepSeek-V3.1, GLM-4.6 and Mistral's Tekken. English is over-counted by 30 to 33% on every tokenizer; Spanish sits near break-even; Chinese, Japanese and Korean are under-counted 2 to 4.5x; Hindi and Bengali up to 4.85x. Transaction hashes, addresses, base64 signatures and real Base receipts come in 1.6 to 3.5x under, and a decomposed Vietnamese text costs up to 3x its composed twin. A 1000x1000 image is over-counted 17.9x, so ten of them quote $1.13 for an 8-cent call, past the x402 SDK's default $1 cap. We trace who absorbs each miss on our three billing paths and lay out seven steps to make the 402 the bill.
Tool-calling agents carry provider-specific state through every step: tool_choice semantics, parallel-call rules, call IDs, tool names and signed reasoning. We traced it across OpenAI, Anthropic, Gemini and Mistral and four translation layers. Claude Opus 5.5, Sonnet 5.5, Fable 5.1 and Mythos 5.1 return 400 on forced tool use; Gemini 3 returns 400 when the current turn lacks its thought signatures; mistral-common's v3 to v11 validators reject any call ID that is not nine letters and digits, which catches Ollama's own IDs even after vLLM truncates them. Locally, Ollama 0.30.6 ignored tool_choice none, required, a forced function and parallel_tool_calls false, all with HTTP 200. Claude drops thinking blocks across models and accounts, and editing tools mid-session invalidates them. Our own x402 quote prices tool results but not tool definitions, and issues a 402 for requests the upstream documents as invalid. Seven steps for a gateway whose fallback survives a tool loop.
Agents rely on strict: true to get JSON that parses and matches the schema. OpenAI, Anthropic and Gemini each accept a different subset of JSON Schema: minimum is enforced by two and a 400 on the third, recursion works on two and fails on Anthropic, and Gemini's own example schema is rejected by both others. Anthropic's OpenAI-compatible endpoint ignores response_format and strict entirely, Ollama and vLLM never read the flag, LiteLLM turns unsupported constraints into descriptions without re-validating by default, and OpenRouter routes a fallback model even when it will ignore the schema. Locally, Ollama 0.30.6 enforced 12 of 16 keywords and silently dropped multipleOf, format email, uniqueItems and allOf, all with HTTP 200, while the enforced ones made the model answer green when told blue. Our own x402 quote ignores the schema: a 154 KB request that is almost all schema is quoted the same $0.01 as one with no schema, while the same text in the message is quoted $0.09. Seven steps for a gateway that sells a guarantee it can keep.
Reasoning models bill for text nobody reads. OpenAI, Anthropic and Google all charge hidden reasoning as output and count it against the same cap as the answer, and when the cap runs out mid-thought the agent pays for an empty response. On Claude Opus 5.5 and Fable 5.1 thinking cannot be turned off at all, and GPT-6 Astra returns HTTP 400 for effort none. We traced one value, reasoning_effort high, through OpenAI, Gemini's and Anthropic's compatibility layers, LiteLLM, OpenRouter and Ollama and got seven different behaviors, from a 4,096-token budget to silently ignored. Locally, a six-character answer cost 917 output tokens with thinking on and 38 with it off; a 256-token cap returned nothing and billed all 256. Then we probed our own x402 walk-up quote: it reads max_tokens but ignores max_completion_tokens, is not clamped to the model's output limit, and quotes an unknown model. What a pay-per-call gateway owes its agents: reasoning tokens on the receipt, an honest effort table, a reasoning floor, and upto settlement.