Follow puts Tool SDK on your private watchlist; its changes then lead “Since you were last here” when you come back. Following needs an account; browsing never does.
“Active” by the activity rule: 2 meaningful events in the last 30 days, the newest 2026-10-06.
SourceRepositories, changelogs and feeds HEY reads for this project, and the ship events recorded from them.ReadRecordsv0.31.1v0.31.0v0.30.1+2 moreWhat HEY derivedHEY’s activity rule reads the counted events as “Active”.Not concludedIt says what HEY can read of the building, not how good the project is, who is behind it, or what its token will do. Quiet or unknown is not "abandoned".
Verified Builder.
The quality gate found verified building evidence from the project's own sources.
Source1 registered source, 0 of them context only.ReadRecordsv0.31.1v0.31.0v0.30.1+3 moreWhat HEY derivedThe quality gate’s stored decision: “Verified Builder”.Not concludedA verified builder is one whose shipping HEY confirmed from public evidence. It does not say who runs the project — that is the ownership claim, a separate check.
Market figures are context only and never change activity status. Methodology
Why it matters: One of a run of ships in the 30 days to it: building continued, not a one-off.
What's Changed · Docs: close a stray code fence in the predicate gating guide that turned the delegated access section into a code block. · List bankr among the --wallet-provider values in the bundled skill and the Vercel template. Community Contributions · Predicate gating…Show allShow less
What's Changed
Docs: close a stray code fence in the predicate gating guide that turned the delegated access section into a code block.
List bankr among the --wallet-provider values in the bundled skill and the Vercel template. Community Contributions
Bars: meaningful, source-backed ships per week (count). Weeks run Monday to Sunday, UTC, labelled by their Monday. Commits are aggregated, a code week counted once. Hatched: 3 weeks before HEY began reading this project’s sources — not yet read, not zero.
Questions HEY can answer about Tool SDK — as of 2026-10-19
Is Tool SDK still being built?
DerivedActive: 2 meaningful events in 30 days; latest ship 13 days ago.Evidence →
What did Tool SDK ship last?
Factv0.31.1 — GitHub release, 13 days ago.Evidence →
What does HEY not know about Tool SDK?
Unknown3 gaps: Official docs (no source), API description (no source), Official site changes (no source). No official website on record.Details →
Build timeline
v0.31.0
GitHub release · Source verified
What's Changed · Bind free predicateGate EIP-3009 authorizations to the endpoint URL, tool ID and operator, and make eip3009AuthenticatedFetch verify that audience before signing. Add an optional shared replayGuard to enforce single-use identity authorizations. · Point the…Show allShow less
What's Changed
Bind free predicateGate EIP-3009 authorizations to the endpoint URL, tool ID and operator, and make eip3009AuthenticatedFetch verify that audience before signing. Add an optional shared replayGuard to enforce single-use identity authorizations.
Point the Robinhood Chain explorer apiUrl at the Etherscan v2 API (chainid=4663) instead of Blockscout, which returns a Cloudflare 403 to scripted clients.
Correct the WalletStateAttestationPredicate entry in skill/references/known-predicates.md: the reference implementation's hasAccess takes the issuer's…
What's Changed · Point the Robinhood Chain block explorer at robin.etherscan.io. Full Changelog: https://github.com/ProjectOpenSea/opensea-devtools/compare/tool-sdk-v0.30.0...tool-sdk-v0.30.1Show allShow less
What's Changed
Point the Robinhood Chain block explorer at robin.etherscan.io. Full Changelog: https://github.com/ProjectOpenSea/opensea-devtools/compare/tool-sdk-v0.30.0...tool-sdk-v0.30.1
What's Changed Picks up @opensea/wallet-adapters@1.0.0 and re-exports its Solana surface. PrivySvmAdapter, SvmWalletAdapter, SvmTransactionRequest and WalletSelector are now available from the package root, alongside the existing WalletAdapter exports. createWalletFromEnv({…Show allShow less
What's Changed Picks up @opensea/wallet-adapters@1.0.0 and re-exports its Solana surface. PrivySvmAdapter, SvmWalletAdapter, SvmTransactionRequest and WalletSelector are now available from the package root, alongside the existing WalletAdapter exports. createWalletFromEnv({ chainType: "svm" }) selects a Solana wallet, and with no argument it still returns the EVM one, so existing callers are unchanged. Two flows that are EVM-only in substance now reject a Solana wallet with a message naming the reason rather than failing later on a missing method: x402 settlement, which is…
What's changed Breaking. A paid tool whose settlement fails now returns 502 without the output, instead of 200 with the result. createToolHandler gains settlement, defaulting to "required". Set settlement: "best-effort" to restore the previous behavior, which only suits callers…Show allShow less
What's changed Breaking. A paid tool whose settlement fails now returns 502 without the output, instead of 200 with the result. createToolHandler gains settlement, defaulting to "required". Set settlement: "best-effort" to restore the previous behavior, which only suits callers who reconcile failed settlements out of band. This is a minor version because the package is pre-1.0, not because the change is small. Also in this release:
replayGuard on the hosted x402 gates and paidPredicateGate, an optional single-use claim over each authorization's (payer, nonce) pair. Off…
What's Changed · Normalize x402 registry references to the public usage-reporting source tokens. Full Changelog: https://github.com/ProjectOpenSea/opensea-devtools/compare/tool-sdk-v0.28.4...tool-sdk-v0.28.5Show allShow less
What's Changed
Normalize x402 registry references to the public usage-reporting source tokens. Full Changelog: https://github.com/ProjectOpenSea/opensea-devtools/compare/tool-sdk-v0.28.4...tool-sdk-v0.28.5
What's Changed · Reject negative and malformed x402 payment amounts. A negative maxAmountRequired previously slipped under the signed-BigInt maxAmount cap check and, when signed, wrapped into a huge positive uint256 EIP-3009 authorization, bypassing the caller's spending limit.…Show allShow less
What's Changed
Reject negative and malformed x402 payment amounts. A negative maxAmountRequired previously slipped under the signed-BigInt maxAmount cap check and, when signed, wrapped into a huge positive uint256 EIP-3009 authorization, bypassing the caller's spending limit. Amounts are now validated as canonical non-negative integers in validatePaymentRequirements (unconditionally, even without a cap) and again in the EIP-3009 signer as defense-in-depth for direct signX402Payment callers. (#530)
Updated dependency @opensea/wallet-adapters to 0.3.3 (EIP-712 encoding…
What's Changed · fix(tool-sdk): scope predicate gate reads to the configured chain (#520): predicateGate/paidPredicateGate no longer force reads to the Base RPC when rpcUrl is unset, so a non-Base registry chain is actually queried. The x402 identity/payment chain…Show allShow less
What's Changed
fix(tool-sdk): scope predicate gate reads to the configured chain (#520): predicateGate/paidPredicateGate no longer force reads to the Base RPC when rpcUrl is unset, so a non-Base registry chain is actually queried. The x402 identity/payment chain (Base/Base-Sepolia) is decoupled from the registry chain so non-Base gating no longer fails closed. Includes regression tests for a non-Base registry with Base identity/payment. Full Changelog: https://github.com/ProjectOpenSea/opensea-devtools/compare/tool-sdk-v0.28.2...tool-sdk-v0.28.3
What's Changed Security and hardening patch release. Security · paidAuthenticatedFetch per-invocation maxAmount cap (#508): at most one nonzero x402 authorization is signed per call, and cumulative authorized value can never exceed maxAmount. Closes a double-challenge bypass…Show allShow less
What's Changed Security and hardening patch release. Security
paidAuthenticatedFetch per-invocation maxAmount cap (#508): at most one nonzero x402 authorization is signed per call, and cumulative authorized value can never exceed maxAmount. Closes a double-challenge bypass where a malicious tool could obtain two independently-settleable authorizations, each under the cap.
verifyXPaymentAuth hardening (#509): the free predicateGate rejects non-zero-value X-Payment authorizations, validBefore is capped to 1h, the resolved chainId is pinned to the gate's chain…
What's Changed Security · eip3009AuthenticatedFetch now validates the 402 challenge's asset and network before signing: the network must be supported and the asset must be the canonical USDC contract for that network. This closes a signature-phishing surface where a zero-value…Show allShow less
What's Changed Security
eip3009AuthenticatedFetch now validates the 402 challenge's asset and network before signing: the network must be supported and the asset must be the canonical USDC contract for that network. This closes a signature-phishing surface where a zero-value challenge could name an arbitrary verifying contract / EIP-712 domain and still get signed (#507).
eip3009AuthenticatedFetch enforces the documented zero-value guarantee: it only signs X-Payment authorizations with value: 0, and returns non-zero (or unparseable-amount) 402 challenges as-is instead…
What's Changed · Add Robinhood Chain (4663) support: --network robinhood on all CLI commands (custom viem chain definition until viem ships one) and 4663 added to every canonical Deployment.chains array in chains.ts. · Fix x402 CAIP-2 network handling asymmetry: server-side…Show allShow less
What's Changed
Add Robinhood Chain (4663) support: --network robinhood on all CLI commands (custom viem chain definition until viem ships one) and 4663 added to every canonical Deployment.chains array in chains.ts.
Fix x402 CAIP-2 network handling asymmetry: server-side predicate gates now accept CAIP-2 (eip155:8453) and numeric (8453) network identifiers in the X-Payment payload, and the client normalizes the v1 payload network to the canonical short name.
Fix x402 usage reporting when the facilitator returns a CAIP-2/numeric network: settle() resolves the…
What's Changed · feat: add Monad (chain 143) support. The --network flag now accepts monad in addition to base, mainnet, shape, and abstract. Monad is defined locally (mirroring viem's definition) because the pinned viem version predates Monad mainnet. 143 is added to every…Show allShow less
What's Changed
feat: add Monad (chain 143) support. The --network flag now accepts monad in addition to base, mainnet, shape, and abstract. Monad is defined locally (mirroring viem's definition) because the pinned viem version predates Monad mainnet. 143 is added to every Deployment.chains array in chains.ts, and the deployed-address docs are updated: the canonical v0.2 addresses are identical on Monad (verified via CREATE2 dry-run). (#477) Full Changelog: https://github.com/ProjectOpenSea/opensea-devtools/compare/tool-sdk-v0.26.1...tool-sdk-v0.27.0
What's Changed · Fix createBankrAccount reading the wrong shape from Bankr's /wallet/me. The endpoint returns { wallets: [{ chain, address }, ...] } (no top-level address), so the account was created with an undefined address. Now resolves the EVM entry from wallets[]. (#473)…Show allShow less
What's Changed
Fix createBankrAccount reading the wrong shape from Bankr's /wallet/me. The endpoint returns { wallets: [{ chain, address }, ...] } (no top-level address), so the account was created with an undefined address. Now resolves the EVM entry from wallets[]. (#473)
Picks up the @opensea/wallet-adapters@0.3.2 dependency bump (BigInt EIP-712 signing fix). Full Changelog: https://github.com/ProjectOpenSea/opensea-devtools/compare/tool-sdk-v0.26.0...tool-sdk-v0.26.1
What's Changed Minor Changes · BREAKING: Unify predicateGate to use the standard 402 + X-Payment (EIP-3009) auth flow only (#471). · PredicateGateConfig.operatorAddress is now required (was optional) · Authorization: EIP-3009 header is no longer accepted: use the X-Payment…Show allShow less
What's Changed Minor Changes
BREAKING: Unify predicateGate to use the standard 402 + X-Payment (EIP-3009) auth flow only (#471).
PredicateGateConfig.operatorAddress is now required (was optional)
Authorization: EIP-3009 header is no longer accepted: use the X-Payment header via the 402 challenge flow
Authorization: SIWE . header is no longer accepted (was already deprecated)
CLI dry-run-predicate-gate now requires --operator-address and asserts a 402 response Fixes
Use the Bankr /wallet/me endpoint instead of /wallet/info…
What's Changed · feat: The register command now validates that the manifest URL and declared endpoint share the same origin before sending the onchain transaction. Previously only verify and deploy checked this, so a developer could burn gas registering a tool the indexer would…Show allShow less
What's Changed
feat: The register command now validates that the manifest URL and declared endpoint share the same origin before sending the onchain transaction. Previously only verify and deploy checked this, so a developer could burn gas registering a tool the indexer would immediately reject. All three commands (register, verify, deploy) now show a consistent, actionable error message that explicitly calls out subdomains as different origins and explains how to fix it. (#465) Full Changelog…
What's Changed · Add support for the upto x402 payment scheme, which allows variable pricing (charge up to amountPerCall, with the actual charge potentially less). createX402Client now registers both ExactEip3009Scheme and UptoEip3009Scheme internally, letting @x402/core route…Show allShow less
What's Changed
Add support for the upto x402 payment scheme, which allows variable pricing (charge up to amountPerCall, with the actual charge potentially less). createX402Client now registers both ExactEip3009Scheme and UptoEip3009Scheme internally, letting @x402/core route to the correct scheme based on the challenge's scheme field. The pay CLI, paidFetch, and paidAuthenticatedFetch route to the appropriate scheme automatically, so callers no longer need to know which scheme to instantiate. (#459) Full Changelog…
What's Changed · --tool-ref and the usage reporters now support non-address registries such as x402:bazaar and x402:bankr for tools that are not registered onchain (#455). toolRegistryAddress is widened to string, and toolOnchainId is kept as a string to preserve precision for…Show allShow less
What's Changed
--tool-ref and the usage reporters now support non-address registries such as x402:bazaar and x402:bankr for tools that are not registered onchain (#455). toolRegistryAddress is widened to string, and toolOnchainId is kept as a string to preserve precision for IDs exceeding Number.MAX_SAFE_INTEGER.
--tool-ref now uses a comma delimiter (chainId,registryAddress,onchainId) instead of a colon, so a registry identifier that itself contains a colon stays unambiguous (#457). Example: 8453,x402:bazaar,8679018179619845322. Full Changelog…
What's Changed · Caller-side usage reporting can now identify a tool by its ERC-8257 composite key instead of only its endpoint URL. reportCallerX402Usage accepts optional toolChainId, toolRegistryAddress, and toolOnchainId, and the pay CLI gains a --tool-ref…Show allShow less
What's Changed
Caller-side usage reporting can now identify a tool by its ERC-8257 composite key instead of only its endpoint URL. reportCallerX402Usage accepts optional toolChainId, toolRegistryAddress, and toolOnchainId, and the pay CLI gains a --tool-ref <chainId:registryAddress:onchainId> flag (e.g. --tool-ref 8453:0x265b...2cf1:65). When supplied, these are sent in place of tool_endpoint, matching the server-side reporter's payload. This fixes the 400 Multiple tools registered for endpoint error when reporting usage for a tool whose endpoint maps to more than one…
What's Changed · Migrate paidFetch, paidAuthenticatedFetch, and the pay CLI to the @x402/core client infrastructure (x402Client, x402HTTPClient, SchemeNetworkClient) for payment payload creation and header encoding. Adds an ExactEip3009Scheme adapter wrapping tool-sdk's existing…Show allShow less
What's Changed
Migrate paidFetch, paidAuthenticatedFetch, and the pay CLI to the @x402/core client infrastructure (x402Client, x402HTTPClient, SchemeNetworkClient) for payment payload creation and header encoding. Adds an ExactEip3009Scheme adapter wrapping tool-sdk's existing EIP-3009 signing into the standard x402 scheme interface. No public API changes. (#447) This also resolves a payment-blocking bug in the previous home-rolled encoder: btoa(JSON.stringify(...)) threw InvalidCharacterError whenever a server's 402 challenge echoed a non-Latin1 character (e.g. an…
What's Changed · Usage report fires via platform waitUntil (createToolHandler): the fire-and-forget usage report now runs as keep-alive-after-response work instead of being awaited inline. This removes reporting latency from every successful call and closes a billing edge — x402…Show allShow less
What's Changed
Usage report fires via platform waitUntil (createToolHandler): the fire-and-forget usage report now runs as keep-alive-after-response work instead of being awaited inline. This removes reporting latency from every successful call and closes a billing edge — x402 settlement runs before the report, so awaiting it meant a function freeze in that window could charge a paid caller without returning a result. Auto-detected on Vercel (no @vercel/functions dependency), wired on Cloudflare via toCloudflareHandler (its fetch gains an optional ctx arg), overridable…
