A primary-source review of MPP, Payment Auth, Tempo and HTTP 402 for the week ending October 25, 2026.
Last week was docs catching up to a release and CI getting pinned, with one catalog listing still waiting on a confirmed payment. This week doesn’t add a new integration, payment term, or protocol capability either — the primary record shows zero verified new development for the seven days ending October 25. What it does show is three security patches landing quietly, a service-discovery flag flipping for 19 services at once, and a new catalog entry becoming easier to actually find.
Three vulnerabilities patched, not exploited
Three merged PRs addressed distinct issues this week: mpp PR #1103 bounds docs MCP requests and updates vulnerable dependencies behind a memory-exhaustion risk, with its implementing commit; PR #1102 upgrades Vite to patch a Windows editor command-injection path, via its commit; and PR #1104 patches the remaining vulnerable transitive dependencies, with its commit.
Nothing in the primary record indicates any of these were exploited — this is the maintainers finding and closing gaps, not incident response. But a memory-exhaustion path in MCP request handling and a command-injection path in a dev-tooling dependency are the kind of findings worth taking seriously precisely because they’re boring until someone finds them first. Worth verifying next: that the patched dependency versions actually ship in the next mppx release, not just in the repositories’ own tooling.
Service discovery drops legacy credits for MACH, across 19 services at once
mpp PR #1096 changes service discovery to advertise MACH support instead of legacy credits, with the commit touching 19 services and their shared merchant configuration in one pass.
Nineteen services moving together on one discovery flag is a bigger blast radius than the usual single-entry catalog edit, and it’s worth being precise about what changed: this is what discovery advertises, not independent proof that all 19 services now process payments differently under the hood. The useful follow-up is runtime, not textual — whether an agent hitting any of those 19 services actually sees MACH-flavored behavior at the 402 challenge, or just a relabeled credits path.
Livecheck becomes easier to actually find
mpp PR #1075 added Livecheck — live job-posting and listing status checks — to the service directory, with its commit. PR #1100 followed by adding stock, sold-out and product search terms to the listing, via its commit, so an agent searching for those terms is more likely to surface it.
That’s discoverability work on top of a listing, not evidence the listing is being used — the same gap every new catalog entry carries until something shows a paid call actually landing. Worth testing next is whether Livecheck’s job-posting and listing checks return real, current status when queried, and whether the broadened search terms change how often agents actually find it.
Docs sync, cache warming, and Actions pins
mpp PR #1088 synced the SDK documentation with mppx 0.13.5’s public changes — charge limits, attribution helpers, and error handling — via its commit. On the infrastructure side, PR #1107 warmed the pnpm store and Twoslash caches in CI, with its commit, and mpp PR #1099 together with mpp-specs PR #380 pinned GitHub Actions references to commit 35019557, landing via a matching commit across both repositories. None of this changes what an agent can do against MPP — it changes how fast and how reproducibly the people maintaining it can ship the next thing that does.
A dead catalog route cleared, and smaller cleanup underneath
mpp PR #1092 removes missing Orthogonal catalog routes, with its commit — the same genre of correction as the larger Locus delisting two weeks ago, just smaller. PR #1091 fixed a bug preserving generated Markdown sections, and PR #1089 refactored the codebase to use viem’s token constants rather than ad hoc ones — both internal-quality changes with no effect on what the catalog offers.
Spec artifacts, refreshed on schedule
The recurring auto-published spec build — this week’s release, giving HTML, TXT, XML, and PDF renderings of the IETF Payment Auth specification — came out of the same commit that pinned the Actions references. As in prior weeks, I’m noting it for completeness rather than treating a scheduled artifact rebuild as a spec change.
A community signal, named and not folded in
A Hacker News post is worth naming rather than treating as development: Algernon, a B2B compliance and security oracle for AI agents on Base, built on x402. It doesn’t touch MPP or the IETF spec, and it doesn’t come with a transaction record I can verify independently — it stays a signal to watch, not a verified development, same as the x402 tools this brief has flagged in prior weeks.
What I’m taking from this week
Zero verified developments again, but the texture is different from recent quiet weeks: this time the work clusters around hardening something that already exists rather than documenting it. Three real vulnerabilities got patched before anything in the record suggests they were exploited. Nineteen services got relabeled from legacy credits to MACH support in discovery, which is either quietly significant or cosmetic depending on whether the actual charge flow changed with it — the primary record doesn’t say yet. Livecheck went from merged-but-hard-to-find to merged-and-searchable. Next week’s honest question is whether any of those 19 MACH-flagged services shows a verifiable 402 challenge that actually behaves differently, and whether Livecheck turns up in an agent’s search the way the new terms intend.
I built MPP Pulse to keep those layers separated instead of blurring them into one undifferentiated “things happened” feed. It’s an open-source AWS agent that collects primary evidence and drafts a cited weekly brief for human review.