This week, indie.money published a detailed walkthrough of their MCP-driven payment architecture for AI agents. The core idea is elegant: the agent's execution environment contains no sign_x402 function at all. A prompt injection can't leak a tool that doesn't exist.
Their post ("We built an MCP payment flow — the AI literally cannot hijack") deserves a close reading. It's the most complete public write-up yet of a production x402 + MCP integration, and it surfaces design decisions that every agent payment builder will need to make.
indie.money's architecture stacks four layers, each solving a distinct problem:
elicitation.url — A new Model Context Protocol capability that opens the user's browser mid-tool-call, blocks the tool call, and auto-retries once the signature resolves. Currently supported by 1 of 4 major MCP clients.The key insight is that layers 1-3 define how the agent pays, and layer 4 defines what the agent cannot do. It's defense-in-depth for agent wallets: the protocol layer handles the happy path, and the sandbox layer guarantees that no prompt engineering can bypass it.
The most interesting technical detail is around MCP elicitation.url. When an agent hits a 402 response mid-execution, the MCP server needs to pause the agent, open the user's browser for signature, and resume once signed. This is a novel control flow — the agent's tool call blocks on a human action outside its process.
indie.money is candid about the current state: only 1 of 4 major MCP clients supports elicitation.url today. For the other 3, they degrade to a relayed link — "the majority path in real usage today." This means most users are clicking a link rather than experiencing the seamless pause-resume flow.
They also shipped a same-day bug: a resolved signing session was misread as unresolved, causing the auto-retry to loop. The fix was straightforward, but it highlights that MCP elicitation is new infrastructure — the edge cases are still being discovered.
indie.money is careful to acknowledge prior art. SIWX predates them by four years. x402 is an open standard. mcp-wallet-signer on GitHub already does browser-wallet signing via EIP-6963. MetaMask's ERC-7710 delegation enables one-time signing with agent reuse. Coinbase's Agentic Wallets offer a zero-install, MCP-compatible wallet with session spending caps.
Their claimed novelty is combining all four properties in one wallet-agnostic, chain-agnostic stack:
Whether this specific combination holds as a moat is debatable — Coinbase and MetaMask are building toward the same goal from different angles — but the architecture is sound and the write-up is the clearest public articulation of the problem space to date.
indie.money's post focuses on the payment mechanics — how an agent pays once it has found a service. But there's a prior question that the article doesn't address: how does the agent discover which 402-enabled services exist, what they cost, and whether they're reliable?
This is the marketplace layer. An agent that can sign x402 payments still needs to know:
The x402 protocol defines the payment handshake. MCP defines the tool-call interface. But neither defines discovery — the yellow pages for machine-payable APIs. That layer is being built right now, and it's where the agent economy's plumbing gets connected to its storefront.
The x402 ecosystem is real and growing. Looking at live marketplace data from a public x402-compatible registry:
The pattern is clear: agents don't pay for "AI." They pay for information they can't compute locally — live prices, blockchain state, web content behind CAPTCHAs, verified domain records.
Three trends are converging:
indie.money's post is a milestone because it shows what the full stack looks like when someone ships it end-to-end. The architecture is not theoretical — it's running, with real users, real signatures, and real bugs being fixed. The agent payment infrastructure is moving from white papers to production.
This analysis draws on live marketplace data from a public x402-compatible registry and the indie.money architecture post by pvdyck. The x402 protocol is an open standard stewarded through the Linux Foundation. SIWX / CAIP-122 is an open specification for chain-agnostic wallet authentication.