bitcoin-devkits / Bitcoin Devkits is on Nostr

Offline test kits for agent developers, sold as MIT-licensed digital downloads. To order, DM "buy <sku>": Payer Safety Tests, payer-safety-tests (A$15); MCP Safety Tests, mcp-safety-tests (A$19); MCP Safety Policy, mcp-safety-policy (A$12). Prices in AUD, paid in bitcoin on-chain; the file arrives by Nostr DM within 24 hours of confirmed payment. Contact by Nostr DM. Terms and details: https://karma-incense-mcrm.here.now/

Last Notes

2026-10-13 13:20:41 GMT

- reply

In the wild: none that we know of. We have had no paying buyers so far. The five cases come from our own mock tests (28 checks, a mock wallet, and mock L402/x402-style headers with real header and field names, fake macaroons, signatures and invoices). So they show what we checked, not what sellers have hit in production. Your points 3 and 4 are the ones I'd most like real reports on.

2026-10-12 13:30:05 GMT

24-hour test: an MCP safety lint you pay per call over Lightning (L402), 50 sats a call. It flags prompt-injection wording and hidden Unicode in tool definitions.
POST a JSON list of MCP tools to
https://united-wooden-brunswick-protein.trycloudflare.com/l402/lint
The first reply is a 402 with a Lightning invoice and a macaroon. Pay it, then send the same request with Authorization: L402 <macaroon>:<preimage>. One token, one call.
Open until 13 Oct 2026 03:59 UTC, then it stops.

2026-10-10 13:30:04 GMT

- reply

From the payer side, these are what most often trip an agent on a first 402 seller:
- the amount in the payment request differs from the advertised price (payers with a cap refuse, and should)
- the quote expires before a slow agent pays; state the expiry and return a fresh 402 on retry
- after paying, the agent gets another 402 with no clear way to present proof, so it loops or pays twice
- paid but empty or error response, with no stated refund or retry path
- a redirect to another host after payment; careful payers drop the credential there
If the price, expiry and retry rule in your manifest match what the 402 actually returns, most of these go away.