Hermes Plant
Agent Action Safety for autonomous tools
APINow-compatible x402 workflows
APINow's no-spend discovery endpoint currently returns exact Base USDC quotes for both native Hermes bundles. That proves quote compatibility only; paid proxy execution, body forwarding, upstream settlement, the returned response, and receipt delivery are unverified.
Two native bundles
Upstream prices are fixed below. APINow shows its current proxy fee in the live quote; require the exact asset, recipient, amount, fee, and total before authorizing. A quote is not cryptographically bound to a later call.
Hermes upstream: $0.25
One signed preflight for an autonomous x402 payment: WalletGuard counterparty screening, Payment Policy challenge validation, and structured evidence verification. Returns allow, deny, or needs_review plus the component findings and a tamper-evident service receipt. Caller-provided wallet context only; no external chain-intelligence feed.
POST /api/agent-services/spend-assurance/runHermes upstream: $0.45
CashflowLens return and DCF analytics plus PortfolioGuard concentration and risk scoring in one paid call, with structured internal evidence and a tamper-evident signed receipt. Pure math from caller-provided cashflows, holdings, and returns; no market-data feed and no claim that inputs are independently verified.
POST /api/agent-services/investment-evidence/analyzeOnly no-spend quote compatibility is verified. Paid proxy execution has not been independently tested, a formal APINow partnership is not claimed, and catalog publication remains a separate owner-signed action with public owner-bound readback.
Reject any mismatch in method, amount, asset, recipient, proxy fee, or total. APINow's current SDK cannot bind this inspected quote to the later automatically signed challenge, so this guide intentionally does not call callExternal.
const target = "https://hermesplant.com/api/agent-services/spend-assurance/run";
const asset = "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913";
const payTo = "0x5171c72a59b994a80097b6ab52d4a4fcb8bf4c1b";
const upstream = 250_000n;
const maxProxyFee = 10_000n;
const maxTotal = 260_000n;
function usdToMicrounits(value) {
const match = /^\$?(\d+)(?:\.(\d{1,6}))?$/.exec(value);
if (!match) throw new Error("Malformed USD amount");
return BigInt(match[1]) * 1_000_000n + BigInt((match[2] ?? "").padEnd(6, "0"));
}
// Free, keyless preflight. Fail closed on every payment-critical field.
const quoteUrl = new URL("https://www.apinow.fun/api/x402-proxy");
quoteUrl.searchParams.set("url", target);
quoteUrl.searchParams.set("method", "POST");
const response = await fetch(quoteUrl, { headers: { accept: "application/json" } });
if (!response.ok) throw new Error(`APINow quote failed: ${response.status}`);
const quote = await response.json();
const exact = quote.upstreamAccepts?.find((accept) =>
accept.scheme === "exact" && accept.network === "eip155:8453" &&
BigInt(accept.amount) === upstream && accept.asset.toLowerCase() === asset &&
accept.payTo.toLowerCase() === payTo
);
const proxyFee = usdToMicrounits(quote.proxyFee);
const total = usdToMicrounits(quote.totalPrice);
if (quote.url !== target || quote.method !== "POST" || !quote.isX402 ||
quote.network !== "eip155:8453" || usdToMicrounits(quote.upstreamPrice) !== upstream ||
!exact || proxyFee > maxProxyFee || total !== upstream + proxyFee || total > maxTotal) {
throw new Error("Quote exceeds the authorized payment policy");
}
// Stop here: callExternal has no max-price or payment-challenge policy hook.
// Do not authorize execution until the final challenge can be validated or bound.Last no-spend compatibility check: 2026-07-21T00:25:18.250Z. Both targets returned exact x402 quotes on Base. This timestamp proves only the recorded check; use each live quote before a paid call.