Community provider: pay-per-call tools from an x402 marketplace (spend-guarded)

[anatshad]

Description

Hey there! I maintain Fatstack (fatstack.net), a non-custodial marketplace where AI agents discover MCP/API tools and pay per call in USDC on Base via the x402 protocol.

I've built and published a tool provider for the AI SDK: @fatstack/ai-sdk-tools (npm). One import points an agent at our machine-readable registry and returns callable tools; payments run through a paying fetch with required spend guards - the constructor refuses to build without a daily cap, so there is no unguarded default. Runnable example against Base Sepolia included.

Before opening a PR, I wanted to ask how you'd prefer this to land: as an entry in the community providers registry/docs pointing at the published package, or is there a different home for third-party tool providers now? Happy to follow whatever structure you prefer - the package already mirrors the conventions from recently merged community providers.

Context on the marketplace side, in case it matters for review: catalog metrics are derived from confirmed on-chain payments (never self-reported), and the payment path is audited against published x402 attack classes - the write-up is public.

Reproduction

No response

AI SDK Version

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[ai-sdk-factory]

Identify issue type

Identified as Documentation
Confidence: Medium

Rationale

The request is primarily about documenting and listing an existing community provider, although it also seeks guidance on the appropriate location.

Evidence

• The author asks whether the published third-party tool package should be added to the community providers registry/docs.
• No broken SDK behavior or required product behavior change is described.
• The proposed outcome is a documentation/registry entry pointing to an existing package.

[ai-sdk-factory]

Identify documentation type

• Identified as Needs Maintainer
• Confidence: High

Rationale

The package already exists, but the requested documentation scope is unclear. The issue asks mainly for guidance on a registry entry linking to the package, which may be only a bare catalog mention rather than usable new integration documentation.

Evidence

• The author has published the external integration as @fatstack/ai-sdk-tools, so runtime implementation does not appear to be missing.
• The requested outcome is phrased as an entry in the community providers registry/docs pointing to the package.
• The issue does not clearly propose installation, configuration, or usage documentation, although it mentions that a runnable example exists.
• The author explicitly asks maintainers to decide the appropriate documentation location and structure.

Maintainer action required

Apply exactly one of documentation-fix or documentation-addition.

[anatshad]

Happy to make this zero-work for whoever picks it up: I've prepared the full docs entry - installation, configuration (including the required spend-guard setup), a usage example, and the registry line - following the structure of the existing community provider pages. I can open the PR against the docs as soon as someone confirms documentation-addition is the right label, or just open it now if that's easier to review. Whichever you prefer.

[halobartku]

Tested the marketplace end-to-end today (we run an x402 storefront on Base ourselves and wanted to list) and hit a hard blocker at sign-in worth flagging before this lands in the docs:

/api/auth/verify returns HTTP 500 for smart-contract wallets (ERC-1271 signatures). Repro (2026-09-08 ~16:40Z):

1. GET /api/auth/nonce → 200, nonce OK
2. POST /api/auth/message {address, nonce} → 200, well-formed SIWE message (Chain ID 8453)
3. personal_sign that message with a smart wallet (ours is a Crossmint smart wallet on Base) → the signature is a valid ERC-1271 contract signature
4. POST /api/auth/verify {message, signature, nonce} → HTTP 500, empty body — for a garbage 0x + ab×65 signature too, so the endpoint appears to crash on any signature it can't ecrecover instead of returning a 4xx.

Why it matters for this exact audience: smart wallets are the default wallet class for x402 agents on Base (CDP smart wallets, Crossmint, etc.). If providers can't sign in with one, the marketplace only accepts EOAs — which cuts against the "AI agents discover and pay per call" positioning. If the fix is isValidSignature (ERC-1271) fallback after ecrecover fails, the SIWE libs (siwe npm / siwe Rust) both support it via verify({ siwe })… actually the short version: fall back to ERC-1271 validation and return 400-with-reason on verification failure instead of a bare 500.

Happy to re-test the moment it's patched — we'd genuinely like to list our tool there (Solana Anchor static-analysis scan, live at audit.askzephy.com, USDC-on-Base via x402 since August). That's the use case working end-to-end for a provider with a smart wallet.

[anatshad]

Tested the marketplace end-to-end today (we run an x402 storefront on Base ourselves and wanted to list) and hit a hard blocker at sign-in worth flagging before this lands in the docs:

/api/auth/verify returns HTTP 500 for smart-contract wallets (ERC-1271 signatures). Repro (2026-09-08 ~16:40Z):

1. GET /api/auth/nonce → 200, nonce OK
2. POST /api/auth/message {address, nonce} → 200, well-formed SIWE message (Chain ID 8453)
3. personal_sign that message with a smart wallet (ours is a Crossmint smart wallet on Base) → the signature is a valid ERC-1271 contract signature
4. POST /api/auth/verify {message, signature, nonce} → HTTP 500, empty body — for a garbage 0x + ab×65 signature too, so the endpoint appears to crash on any signature it can't ecrecover instead of returning a 4xx.

Why it matters for this exact audience: smart wallets are the default wallet class for x402 agents on Base (CDP smart wallets, Crossmint, etc.). If providers can't sign in with one, the marketplace only accepts EOAs — which cuts against the "AI agents discover and pay per call" positioning. If the fix is isValidSignature (ERC-1271) fallback after ecrecover fails, the SIWE libs (siwe npm / siwe Rust) both support it via verify({ siwe })… actually the short version: fall back to ERC-1271 validation and return 400-with-reason on verification failure instead of a bare 500.

Happy to re-test the moment it's patched — we'd genuinely like to list our tool there (Solana Anchor static-analysis scan, live at audit.askzephy.com, USDC-on-Base via x402 since August). That's the use case working end-to-end for a provider with a smart wallet.

Thank you - this was exactly right, and now it's fixed and deployed. Verification goes through a public client: ecrecover → ERC-1271 isValidSignature → ERC-6492 for not-yet-deployed smart accounts. And no more bare 500s: every rejection is a 400 with a reason code (invalid_signature, nonce_mismatch, …)

I'll be glad if you find time to re-test and give your feedback!

[ai-sdk-factory]

Documentation addition assessment

• Subject: Fatstack (@fatstack/ai-sdk-tools)
• External AI SDK evidence: inconclusive
• Maintainer approval: not yet approved
• Assessed: 2026-09-08T19:15:28.340Z

Fatstack's public pages document @fatstack/x402 and payFetch, but provide no concrete instructions for using @fatstack/ai-sdk-tools with the Vercel AI SDK. The claimed npm package returned HTTP 403 during inspection, and no public canonical repository was found, so its README, runnable example, and compatibility with the current AI SDK could not be verified.

Evidence

• Fatstack — pay-per-call tools for AI agents — Documents @fatstack/x402 payFetch with spend guards, but does not mention @fatstack/ai-sdk-tools or show Vercel AI SDK usage.
• How payment works · Fatstack — Explains x402 payments and spending limits but contains no Vercel AI SDK installation, configuration, or code.
• Consumer console · Fatstack — Generates @fatstack/x402 payFetch configuration, not tools usable through the Vercel AI SDK.
• Provider dashboard · Fatstack — Provides wallet sign-in for marketplace providers but no AI SDK integration instructions.
• List a tool · Fatstack — Provides marketplace listing access but no AI SDK integration documentation.
• @fatstack/ai-sdk-tools · npm — The package page returned HTTP 403 during inspection, preventing verification of its README, example, package version, and current AI SDK compatibility.
• anatshad · GitHub — The issue author's public profile has no public repositories, so no canonical provider-controlled README or example could be verified there.

Next step

The issue author can add or correct provider-controlled AI SDK documentation links in a new comment. Factory will reassess author comments; a maintainer may explicitly override this evidence requirement by applying the approval label.