A primary-source review of MPP, Payment Auth, Tempo and HTTP 402 for the week ending October 18, 2026.
Last week was catalog curation — two additions, ten delistings, a fee clarification underneath. This week doesn’t even clear that bar: the primary record shows no new MPP integration, payment term, or protocol capability. What it shows instead is documentation catching up to code, one catalog entry still waiting on proof it actually processes a payment, and a cluster of CI fixes that matter more to the people maintaining these repositories than to anyone paying through them.
SDK docs catch up to mppx 0.13.4
mpp PR #1065 syncs the TypeScript SDK documentation with mppx 0.13.4, with the implementing commit clarifying settlement hooks, error handling, and payment behavior. This is the same genre of change prior briefs have flagged before: documentation making an existing release legible rather than adding to what the SDK can do. The value is real but it’s maintenance value — fewer integrators left guessing at settlement-hook semantics from source code alone.
A new catalog listing, with the payment leg still unverified
mpp PR #1064 lists AIsa’s MPP data APIs — web search, financials, weather, and more — as a fixed-price service. The service is live at api.aisa.one and accepts MPP challenges, but nothing in the primary record confirms an end-to-end payment has gone through yet. That’s the same gap every catalog addition carries: being reachable and documented isn’t the same as being paid. Worth testing next is the actual Credential → execution → Receipt flow against the live endpoint, to see whether AIsa processes a payment the way the listing claims.
CI pins, a cooldown fix, and two discovery-path corrections
The rest of the week’s activity sits entirely in repository hygiene. Multiple repositories pinned GitHub Actions references to commit 947d9a3c, via mpp PR #1080 and mpp-specs PR #378, with matching commits landing the pin across both repos. mpp-specs PR #379 and mpp PR #1084 then extended the GitHub Actions cooldown from seven to eight days, via a commit addressing a Dependabot tag-date rounding issue that was triggering runs early.
Separately, mpp PR #1066, with its commit, fixed proxy discovery documentation — replacing outdated routes with /openapi.json and /llms.txt — and mpp PR #1076, with its commit, moved skill publication to generate canonical files under /.well-known/agent-skills/, removing stale hand-copied copies so skill digests match their source.
None of this changes what an agent can do against MPP. It changes whether the pipelines that ship MPP’s code stay reproducible, whether Dependabot’s automated runs land when they’re supposed to, and whether a developer following the proxy-discovery docs or fetching a skill file gets what’s actually current. Worth verifying next: that /openapi.json and /llms.txt return the data the updated docs claim, and that the new /.well-known/agent-skills/ index carries correct digests now that the stale copies are gone.
Spec artifacts, refreshed on schedule
The usual auto-published spec builds — one release and another, giving HTML, TXT, XML, and PDF renderings of the IETF Payment Auth specification — came out of commits bba0679 and 782abae this week. These are scheduled artifact releases, not spec changes; I’m noting them for completeness rather than treating them as developments in their own right.
Tempo shipped something, but it’s a Tempo story
Tempo’s own blog announced that privacy is live on the chain this week. That’s not an MPP protocol change — it’s Tempo, the settlement rail MPP is built on, shipping a chain-level feature. Worth flagging for the same reason prior briefs have flagged Tempo-only news: what Tempo does to its own chain matters to MPP’s eventual reliability and privacy guarantees, but it isn’t evidence of anything in the MPP catalog or spec moving.
Community signals, named and not folded in
Two Hacker News posts are worth naming rather than treating as development: a Show HN extending x402 for merchant-of-record fiat payments and budget attenuation, and a self-hosted tool letting AI agents pay x402 APIs in USDC. Neither touches MPP or the IETF spec directly, and neither comes with a transaction record I can verify independently — both stay signals to watch rather than verified developments.
What I’m taking from this week
Zero verified developments doesn’t mean zero activity — it means the activity stayed one layer down: docs catching up to a release that already shipped, CI pipelines getting pinned and a cooldown corrected, two discovery paths pointed at what’s actually current. AIsa is the one open thread, a catalog listing that’s reachable but not yet proven to process a payment. Next week’s honest question is whether AIsa shows a verifiable Credential → execution → Receipt cycle, and whether the eight-day cooldown change actually stops the Dependabot timing issue it was built to fix.
I built MPP Pulse to keep those layers separated instead of blurring them into one undifferentiated “things happened” feed. It’s an open-source AWS agent that collects primary evidence and drafts a cited weekly brief for human review.