I build payment infrastructure on Stellar / Soroban: x402 and MPP payment rails, service discovery, and non-custodial treasury automation.
Most of my public work is either a protocol implementation I maintain or a bug I found in something I depend on and then sent a patch for. Everything below links to the actual issue, PR, or running service — no claim here that you can't click and check yourself.
| Project | What it actually is |
|---|---|
| Periplo · periplo.xyz | An x402 payment facilitator for Stellar with a "Bazaar" discovery catalog, so an agent can find a payable service it has never seen before. Facilitator is live on stellar:testnet — GET /supported responds without setup. Apache-2.0, TypeScript + Soroban. |
| Nirium · nirium.xyz | Autonomous treasury and machine-to-machine payments on Stellar — Soroban contracts in Rust, an x402 payment layer, and MCP integration. Non-custodial: the client's wallet signs, the protocol never holds funds. Apache-2.0. |
| nirium-sdk | The TypeScript and Python packages plus CLI behind Nirium — x402 pay/serve, MPP session budgets, IPFS audit anchoring. Apache-2.0. |
| Contextio · contextio.xyz | Legal Context Protocol (LCP) on Stellar — verifiable, non-custodial binding of legal context to treasury and payroll operations, with SEP-53 wallet auth. Apache-2.0. |
| nirium-pollar-adapter | Adapter that lets a wallet onboarded through the Pollar SDK pay x402 requests and anchor audit receipts. MIT. |
I use these libraries in production, so when one breaks I try to arrive with the diff rather than just the complaint. Snapshot below is accurate as of 2026-08-29; the live queries at the bottom always supersede it.
| PR | Repo | Merged |
|---|---|---|
#103 — point ECOSYSTEM_CARDS copyValue at raw content, not GitHub's blob HTML page |
stellar/stellar-dev-skill |
2026-08-28 |
#102 — update Contextio SDK copyValue to the renamed SKILL.md path |
stellar/stellar-dev-skill |
2026-08-15 |
| #101 — reposition Contextio SDK's catalog description around LCP | stellar/stellar-dev-skill |
2026-08-15 |
| #98 — add Contextio SDK to community skills | stellar/stellar-dev-skill |
2026-08-15 |
| #96 — add Nirium to community skills | stellar/stellar-dev-skill |
2026-08-15 |
| PR | Repo | Fixes |
|---|---|---|
| #3228 — scope EVM/SVM client signer derivation to the selected families | x402-foundation/x402 |
#3187 |
| #3215 — derive one wildcard pattern per namespace, not one per registration | x402-foundation/x402 |
#3172 |
| #3138 — use the raw resource URL as canonical for opaque-origin schemes | x402-foundation/x402 |
— |
#3098 — upto scheme implementation spec for Stellar |
x402-foundation/x402 |
#3097 |
| #1672 — walk every CAP-71 delegate node, not just the top level | stellar/js-stellar-sdk |
#1655 |
| #844 — drop the Lazy-mode expiration check that validates the wrong value | OpenZeppelin/stellar-contracts |
#840 |
#4960 — bump heck 0.3 → 0.5 to drop the unbounded edition2024 landmine |
otter-sec/anchor |
— |
| #97 — production patterns for x402 + MPP | stellar/stellar-dev-skill |
— |
- eas-sdk#132 —
getUIDsFromAttestReceipttrusted logtopic0without checking the emitter address, so a malicious resolver could inject spoofed UIDs inmultiAttest(). Closed as completed. - x402#3171 —
paymentRequirementsMatchAcceptedthrew on a missing/nullpayload.accepted, leaking a raw internal error to the resource server. Closed as completed. - x402#3270 —
HTTPFacilitatorClient.settle()/verify()decoded theEXTENSION-RESPONSESheader and then discarded it, so resource servers couldn't branch on extension outcomes. Picked up by another contributor as #3278 ("Fixes #3270"), currently open.
Reported and awaiting maintainer response:
x402-foundation/x402— #3121 (broken canonical URL formcp://tool/{toolName}), #3148 (payment-erroradvertised in CORS, never emitted), #3169 (double percent-encoding bypassesisValidRouteTemplate's traversal and scheme-injection checks)stellar/js-stellar-sdk— #1681, #1683 (auth-entry signing against the wrong public key)OpenZeppelin/stellar-contracts— #839 (__check_authtraps on aSigner::Delegated+CallContractauth entry)stellar/stellar-mpp-sdk— #58 (allow an external SEP-43 signer instead of a raw secret key)Creit-Tech/Stellar-Wallets-Kit— #105 (signMessage()JSDoc says SEP-43 hex, Freighter returns base64)foundry-rs/foundry— #16209 (cast wallet new <name>still fails with a bare account name)
Totals as of 2026-08-29 — 18 pull requests and 29 issues opened across 19 repositories I don't own, belonging to 16 different accounts; 5 PRs merged. Not every one landed, and the closed-unmerged ones are in the same search: all my PRs · all my issues
Protocols — x402, MPP (Charge and Channel), SEP-41 / SAC, SEP-43, SEP-53, CAP-71 delegated auth, MCP Chains — Stellar / Soroban primarily; some EVM and Solana work
- Small PRs, one root cause each, with the reproduction in the description.
- If I file a bug in a dependency, I try to open the fix alongside it — #3187 → #3228, #1655 → #1672, #840 → #844.
- When I'm not sure whether it's my bug or theirs, I say so in the issue rather than asserting a diagnosis I can't back (#839 is an example).
- Every contract I ship is non-custodial by construction: the client signs, the protocol never holds a key that can move funds.
Open an issue on any repo above, or start with periplo.xyz · nirium.xyz · contextio.xyz