Tutorials, comparisons and design patterns for building autonomous agents that self-fund, call 345+ models and orchestrate MCP Tools.
An x402 payment requirement carries the chain in one string and the recipient in another, with nothing binding them. ERC-7930 encodes both into a single binary envelope where the mismatch is unrepresentable. We reproduced all four spec vectors with the Wonderland SDK and OpenZeppelin's Solidity library, measured the parse gas, and found the real blocker: only two of the twelve network namespaces x402 advertises have a CAIP-350 profile.
Token-2022 confidential transfers were switched off in June 2025 after a proof-verification bug. We read the feature-gate accounts straight off mainnet: the re-enable gate activated at slot 424,224,000 on 2026-06-04, Token-2022 was redeployed on 2026-06-17, and SIMD-0385 transaction v1 activated on 2026-09-15 — which is why a full confidential transfer now fits in a single 2,687-byte transaction. Then we point that at the x402 exact scheme for SVM, which requires exactly one TransferChecked with a plaintext amount to a derived ATA, and falls back to a destination balance delta. A confidential transfer emits neither: no TransferChecked, no readable amount, and a public balance delta of zero. We measure what is actually moving today (36 proof-program transactions in a 2h12m window, wrapped mints holding 1.19 USDT), read the mint census for PYUSD and USDG, and lay out the three ways a facilitator could verify a payment it cannot read.
Between 11 and 18 September, 30 pull requests merged into x402, and the sharpest cluster was four independent bugs in which the middleware handed the payment hook a different view of the request than the one the route handler received: a consumed body, a URL missing its base path and query, dropped repeated query parameters, dropped empty ones. Also: Casper lands with a CEP-3009 clone of EIP-3009, the MCP tool-call timeout gets a ceiling one week after it got a floor, SEP-2640 makes the Skills extension Final with a security section that treats server instructions as untrusted input, and TRM Labs puts a number on how much x402 volume is actually agentic.
The agent payment stack got good at proving payment and good at proving hardware. It is still weak at proving model identity: that the weights which produced your token stream are the weights you were quoted for. We walk the chain an agent can actually check — the NVIDIA NRAS v4 GPU attestation endpoint and its claims, the TDX/SEV boot measurement, the compose-hash commitment, and the one production mechanism that reaches the weights themselves (Tinfoil's Modelwrap, which pins a dm-verity Merkle root into the kernel command line so every 4KB read is verified). Then we read the public registry that scores nine verification layers across providers, including the silent gateway substitution it caught on 2026-05-05 and the attestation endpoint that returned a passing report for a model that does not exist. We price the overhead from the OpenPcc measurements, and close with the uncomfortable symmetry for any routing gateway: model fallback is authorized substitution, and the only thing separating it from fraud is a receipt that names what actually ran.
Prompt caching turned per-call LLM pricing into a function of history: cache writes cost 1.25x base input, cache reads 0.1x, and which one you get depends on traffic in the last five minutes, on the model that served the request, and on the workspace that owns the cache. We price a real agent loop on Claude Opus 5 — the same 30,000-token prefix at $0.2100 cold and $0.0375 warm — then show why x402's exact scheme, built on EIP-3009's fixed signed amount, cannot express that. The answer is already merged: the upto scheme, where amount means the authorized maximum at verification and the measured consumption at settlement, implemented on EVM through Permit2 because EIP-3009 requires exact amounts at signature time. We verify the x402UptoPermit2Proxy contract on Base, walk the six-month commit history of the scheme, cover the minimum-cacheable-prefix thresholds that make model fallback silently destroy caching, and close with what a gateway owes its agents: normalized cache accounting in the OpenAI-compatible usage object, cache-aware fallback ordering, and a receipt that says why the number is the number.
"The agent's key never leaves the enclave" is the pitch behind every TEE agent wallet. We audited the actual spec: the HKDF that derives the key, the two-link signature chain, what MRTD and the RTMRs measure, and what it costs to verify on-chain. The attestation proves which code runs on which hardware. It does not prove the wallet you funded is the wallet that signs.
State channels promise per-token billing with no gas per call — exactly what an LLM gateway wants. We audited ERC-7824 against the deployed Nitrolite contracts, censused the ChannelHub on Base, Ethereum and Polygon, and found the session-key delegation an agent would rely on cannot sign its own exit.
Tether's Wallet Development Kit added an x402 guide on February 18, 2026: a self-custodial agent wallet signs an EIP-3009 authorization in USDT0 and a hosted facilitator settles it on Plasma or Stable. We read the docs, pulled both token contracts, resolved their proxies, read the verified TetherTokenV2 source, cloned the Semantic demo and adapter, unpacked the current wallet package from npm, probed both chains and the facilitator, and sampled recent traffic. The contracts do what x402 needs, including ERC-1271 for smart-account agents, but version() reverts, Plasma has no upstream default-asset row, the guide documents v1 headers while installing the v2 SDK, the hosted facilitator returned HTTP 500 and 503 on the day we tested, the MCP toolkit on npm is a 0.0.0 placeholder, and 5,000 recent Plasma transactions plus 1,200 Stable blocks contained zero EIP-3009 calls. Semantic's roadmap ends in a pay-per-token LLM router.