Changelog

v1.6.0 (2026-07-15)

The agent-native control plane ships (@bolthub/mcp 0.5.1)

• Sell from the chat. Ten new account tools in the MCP server: one-click account pairing (connect_account/connect_status), create_workspace, connect_wallet (browser handoff; deployed nodes bind server-side), list_api (spec → draft listing, never auto-published), analyze_listing (seller-rubric audit with live origin probe), publish_listing (confirm-gated go-live), get_earnings/usage_summary, and get_onboarding_state. No secret ever enters the chat.
• Guided node spin-up. deploy_node walks provider → access token (entered in the browser) → region → sizes with live prices → deploy → seed ritual → payout-wallet bind.
• Account tokens. Revocable 90-day bh_pat_ tokens (dashboard → Settings → MCP setup, or the pairing flow) replace session JWTs for account tools; hard-denied on secret-bearing routes. BOLTHUB_AUTH_TOKEN still works as a silent fallback for old configs.
• Seller hardening. Owner origin-protection check endpoint, no-code origin protection recipes + the bolthub-shield proxy template, one-click NWC wallet connect on the payouts page, and payout-wallet reachability monitoring with down/recovery alerts.

v1.5.0 (2026-07-10)

Prepaid credit (and the single-endpoint bundle is retired)

• Prepaid credit. Pay one Lightning invoice for a sats budget spendable across all of a provider's per_request endpoints; subsequent calls draw the budget with no further payment. Face-value (no discount tiers) and non-custodial (one payment settles to one provider, so credit is scoped to that provider and never a pooled balance). SDKs: L402Client.buyCredit / batchFetch in @bolthub/pay 0.7.0 and buy_credit / batch_fetch in bolthub 0.7.0; the MCP buy_credit tool (@bolthub/mcp 0.4.0). Grant-backed and gated by GATEWAY_GRANTS_ENABLED; the grant's budget is taken from the invoice, never a token caveat.
• Delegation now attenuates credit. mint_scoped_token narrows the prepaid-credit credential you hold for a provider into a scoped child, so one payment funds every sub-agent slice across that provider's endpoints.
• The single-endpoint prepaid bundle is retired (@bolthub/pay 0.6.0, bolthub 0.6.0, @bolthub/mcp 0.3.0). It duplicated the token_bucket pricing model and prepaid credit; buyBundle / buy_bundle now throw. Pay per call, use token_bucket for a seller-discounted batch, or use prepaid credit for cross-endpoint prepayment.
• Docs: Using paywalled APIs, @bolthub/pay, Python SDK, MCP server, Security

v1.4.0 (2026-07-10)

Agent-native L402: delegation, refunds, receipts

• Sub-agent delegation. attenuate() v2 gains n_uses / max_sats / path_prefix (tighten-only) in both SDKs; the MCP mint_scoped_token tool narrows a multi-use credential you hold into a scoped, capped, expiring child credential (its cap reserved from the parent budget at mint), and revoke_token kills the whole delegation tree. Enforced server-side by a grant keyed on the payment hash.
• Refund semantics. Payment settles before the gateway forwards, so an origin that returns 5xx/429/408 (or is unreachable) reverts the payment and the retry is free; a real 4xx stays paid. Signaled by X-Bolthub-Payment / X-Bolthub-Payment-Code headers; the SDKs auto-retry the free-retryable failures.
• Payment receipts. A verifiable receipt (built on the Lightning preimage) for every paid call: buyer-side ReceiptStore + export/verify in both SDKs and the CLI (receipts export/verify) and the MCP export_receipts tool; seller-side export endpoint. Exports can be redacted.
• Rollout. Everything is behind default-off flags (GATEWAY_GRANTS_ENABLED, GATEWAY_PAYMENT_STATUS_HEADERS, GATEWAY_PERSIST_PREIMAGES); a normal single-payment call is unchanged.
• Docs: Using paywalled APIs, @bolthub/pay, MCP server, Python SDK, Security

v1.3.0 (2026-07-07)

Package consolidation: four packages, one job each

• @bolthub/pay 0.4.0 absorbs @bolthub/agent: the HTTP L402Client, the wallet adapters (LndWallet, LnbitsWallet, PhoenixdWallet, NwcWallet, WebLnWallet), FileSessionStore, and macaroon attenuate now ship in the payments SDK. Still zero runtime dependencies, and the browser build carries over (browser export condition).
• New in @bolthub/pay 0.4.0: an exported Budget class: share one instance between a ToolClient and an L402Client and the MCP-wire and HTTP-402 payment paths draw from a single pool; walletFromEnv() for the standard env-var → wallet mapping; per-request maxCostSats and onPaid on L402Client requests.
• New @bolthub/mcp 0.1.0 replaces @bolthub/mcp-registry and @bolthub/mcp-bridge: one stdio server (bin bolthub-mcp, listed as ai.bolthub/mcp) with three tool sources in one config: the marketplace meta-tools, gateway endpoints as namespaced tools, and a paying proxy for your other MCP servers (free tools pass through; L402 challenges are paid automatically). One budget across everything (budget.sat: 0 = free-only), and max_cost_sats on call_api is now enforced. Zero config = the old registry behavior; --gateway <url> = the old bridge behavior.
• PyPI bolthub 0.4.0 grows into the payments SDK in Python: existing L402Client/wallets/attenuate plus create_paywall, l402_rail, facilitator_rail/http_facilitator, token utils, ToolClient, l402_payer, and Budget. bolthub 0.4.1 follows up with TypeScript parity on the HTTP side: L402Client/AsyncL402Client accept a shared budget= plus per-request max_cost_sats and on_paid.
• @bolthub/cli 0.2.0 is now built on @bolthub/pay; commands and wallet env vars are unchanged.
• Old npm names (@bolthub/agent, @bolthub/mcp-registry, @bolthub/mcp-bridge) are deprecated, not unpublished; existing installs keep working.
• Docs: @bolthub/pay, MCP server, Python SDK

v1.2.0 (2026-07-02)

@bolthub/pay: the tool-payment SDK

• @bolthub/pay 0.1.0 is published on npm (bun add @bolthub/pay or npm install @bolthub/pay): add a price to any MCP tool or HTTP endpoint and settle on the rail you choose
• Seller API: createPaywall({ rails }) plus pay.tool(...), with l402Rail (Lightning) and facilitatorRail/httpFacilitator for delegating mint/verify
• Buyer API: PayingClient with l402Payer and a per-asset maxTotal budget
• MIT licensed, free, and self-hostable; no bolthub account needed to self-host
• Docs: @bolthub/pay

Hosted facilitator

• /facilitator/v1/mint and /facilitator/v1/verify endpoints for sellers on the hosted plan
• At-most-once proof redemption (replay protection)
• Usage metering and analytics in the dashboard
• Seller API keys issued from the dashboard (Settings → API keys): shown once at creation, with optional expiry
• Sellers' funds still settle directly to their own wallet; bolthub stays non-custodial
• Docs: Hosted Facilitator guide

v1.1.1

NWC wallets work out of the box

• @bolthub/mcp-registry, @bolthub/mcp-bridge, and @bolthub/cli v0.1.4 bundle NWC support — setting NWC_URI no longer requires installing @getalby/sdk separately. Previous versions crashed on startup when configured with an NWC wallet.
• Startup errors in the NWC path now report the underlying cause instead of a generic install hint.

Official MCP registry listing

• @bolthub/mcp-registry is being listed in the official MCP registry as ai.bolthub/registry.

v1.1.0

MCP Registry

• @bolthub/mcp-registry - one MCP config entry, every API on the marketplace. The recommended integration for AI agents.
• Tools: search_apis, get_api_details, call_api, preview_cost, deploy_node, node_status
• preview_cost tool lets agents check pricing without paying
• deploy_node and node_status tools let agents provision a non-custodial Lightning node via the bolthub Node Launcher and track its progress
• max_cost_sats parameter on call_api rejects invoices above a threshold
• Session spending budget via BUDGET_SATS env var or --budget flag
• Spending feedback after each call (sats spent, remaining budget)

CLI

• @bolthub/cli - search, explore, and call marketplace APIs from the terminal
• Commands: search, info, call with --max-cost, --budget, --method, --body options

Webhooks

• Webhook subscriptions for invoice.settled, session.created, session.expired, billing.cycle_closed, billing.payment_received, billing.suspended, endpoint.health_changed
• Automatic retries with exponential backoff
• Delivery history dashboard with status tracking

Directory & discovery

• API quality signals: uptime percentage, average response time, health status
• Federated directory: external L402 APIs can register via POST /external-listings
• Directory API formalized as an open standard (see Directory API guide)

Wallet support

• Phoenixd wallet adapter added - fast (<200ms), self-custodial, automatic channel management
• TypeScript SDK, MCP bridge, and CLI now support four wallet types: Phoenixd, LND, LNbits, NWC
• Python SDK now supports the same four wallet types: LND, LNbits, Phoenixd, and NWC

---

v1.0.0

Initial public release of bolthub.

Platform

• Non-custodial L402 payment gateway with five pricing models: per_request, per_kb, token_bucket, time_pass, metered
• Monthly billing cycle with auto-pay via NWC, 7-day grace period for manual payment
• 14-day free trial for new accounts (since extended to 1 month)
• Public API directory with search and tag filtering
• Embeddable SVG badges for READMEs

SDKs

• @bolthub/agent - TypeScript L402 client with wallet adapters (LND, LNbits, NWC)
• bolthub - Python L402 client with LND and LNbits support
• @bolthub/mcp-bridge - MCP server for AI agent integration

Discovery

• Auto-generated OpenAPI 3.1 specs at /.well-known/openapi.json
• L402 gateway metadata at /.well-known/l402-gateway.json
• MCP config endpoint at /directory/{slug}/mcp-config
• Gateway MCP discovery at /.well-known/mcp.json

Security

• AES-256-GCM encryption for NWC credentials at rest
• SSRF protection with DNS rebinding prevention
• HMAC-SHA256 request signing for origin verification
• Row-level security on all database tables
• Rate limiting with LRU eviction