// Blog

Technical notes for AI agent builders

Tutorials, comparisons and design patterns for building autonomous agents that self-fund, call 345+ models and orchestrate MCP Tools.

RSL 1.0 audit: a licensing layer that ships without prices

RSL puts the access rules and the price in the same machine-readable document, and its <accepts> element points straight at x402. We audited it end to end on 22 August 2026: 1,013 domains crawled, three distinct live license documents found, zero prices, one listed license server that does not resolve in DNS, and an x402 tree that has never heard of RSL. This is what the licensing layer actually looks like from an agent's side of the wire.

14 min read →

ACK audit: what an agent payment receipt actually proves

The Agent Commerce Kit from Catena Labs models agent identity and payments as W3C Verifiable Credentials. We cloned the repo, read the schemas and ran the published SDK: a receipt for a payment that never happened verifies in 22 ms, offline, and an expired payment request is accepted. Here is what ACK binds, what it leaves to the application, and what its 2026 security fixes tell us.

13 min read →

Agentic week: the payment stack grew a brake pedal

Between 14 and 21 August almost every shipped change in the agent payment stack was a constraint, not a capability. x402 clients now refuse to sign anything over one dollar unless told otherwise, facilitators gained a non-terminal state for broadcasts they cannot confirm, AWS put payment limits in the infrastructure layer at GA, and the US accounting board proposed a rule for holding the money. Guardrails week.

10 min read →

Open Payments and GNAP: an agent-payment audit of Interledger's rail

Interledger's Open Payments is a mature, bank-grade agent-payment rail built on GNAP (RFC 9635) and HTTP Message Signatures (RFC 9421). We resolved a live wallet address, signed real grant requests, created an incoming payment and rotated a token on interledger-test.dev — and found the wall: directed-identity keys are rejected for the outgoing (spending) grant, which requires a human redirect. Zero mentions of 'agent' in the spec.

9 min read →

NANDA audited: 13,605 agents claimed, 350 retrievable

Project NANDA calls itself the DNS for AI agents: a lean index resolving to cryptographically verifiable AgentFacts. We measured it on August 19, 2026. The public API reports 13,605 agents and hands back at most 350 distinct records; 193 of the 264 registered AgentFacts URLs return 404; not one live document carries a signature. Three agents priced themselves in x402 anyway, using fields the schema does not define.

14 min read →

L402 Audited: The Original HTTP 402 Is Becoming a Payment Method

L402 turned HTTP 402 into a working protocol five years before x402 existed: a macaroon that commits to a Lightning payment hash, verified statelessly against a preimage. We audited the spec, the standardization trail, and Aperture's source tree as of 2026-08-18. bLIP-26 has been an open pull request since June 2023 with 91 review comments and no merge. Neither L402 nor Payment appears in the IANA HTTP authentication scheme registry. And Aperture now emits three offers on one 402, because Lightning Labs shipped the Stripe/Tempo Payment scheme next to its own.

14 min read →

ERC-8004's third registry is live and empty

ERC-8004 deploys three registries: identity, reputation, validation. We audited the Solidity in erc-8004/erc-8004-contracts and measured what each registry actually holds on Ethereum and Base. Identity works. Reputation is thin. Validation has never been used on Ethereum. And a single EOA can upgrade all three.

14 min read →

KYAPay audit: six drafts to answer who is behind the agent

On 19 July 2026 Skyfire published six Internet-Drafts defining KYAPay: a JWT family that carries who authorized an agent, how that human was verified, which AML screening ran, and how the request will be paid — all in one HTTP header. Co-authors come from Experian, Akamai, Okta and Ory. We read the raw drafts, audited the three IANA registries they target, and compared them against what Skyfire ships in production today. Registered claims: zero.

17 min read →