Hermes Plant
Agent Action Safety for autonomous tools
APINow-compatible x402 workflows
APINow's no-spend discovery endpoint exposes a live quote for each native Hermes bundle. Validate that quote against the canonical price, Base USDC asset, recipient, fee, and total before treating it as compatible. Paid proxy execution, body forwarding, upstream settlement, the returned response, and receipt delivery remain unverified.
Two native bundles
Upstream prices are fixed below. APINow shows its current proxy fee in the live quote; require the exact asset, recipient, amount, fee, and total before authorizing. A quote is not cryptographically bound to a later call.
Hermes upstream: $0.25
One signed preflight for an autonomous x402 payment: WalletGuard counterparty screening, Payment Policy challenge validation, and structured evidence verification. Returns allow, deny, or needs_review plus the component findings and a tamper-evident service receipt. Caller-provided wallet context only; no external chain-intelligence feed.
POST /api/agent-services/spend-assurance/runHermes upstream: $0.25
CashflowLens return and DCF analytics plus PortfolioGuard concentration and risk scoring in one paid call, with structured internal evidence and a tamper-evident signed receipt. Pure math from caller-provided cashflows, holdings, and returns; no market-data feed and no claim that inputs are independently verified.
POST /api/agent-services/investment-evidence/analyzeAs of 2026-07-28 16:57 UTC, APINow still quoted the previous $0.45 Investment Evidence price after Hermes changed the canonical price to $0.25. Do not execute that route through APINow until the no-spend quote converges. Paid proxy execution has not been independently tested, a formal APINow partnership is not claimed, and catalog publication remains a separate owner-signed action with public owner-bound readback.
Reject any mismatch in method, amount, asset, recipient, proxy fee, or total. APINow's current SDK cannot bind this inspected quote to the later automatically signed challenge, so this guide intentionally does not call callExternal.
const target = "https://hermesplant.com/api/agent-services/spend-assurance/run";
const asset = "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913";
const payTo = "0x5171c72a59b994a80097b6ab52d4a4fcb8bf4c1b";
const upstream = 250_000n;
const maxProxyFee = 10_000n;
const maxTotal = 260_000n;
function usdToMicrounits(value) {
const match = /^\$?(\d+)(?:\.(\d{1,6}))?$/.exec(value);
if (!match) throw new Error("Malformed USD amount");
return BigInt(match[1]) * 1_000_000n + BigInt((match[2] ?? "").padEnd(6, "0"));
}
// Free, keyless preflight. Fail closed on every payment-critical field.
const quoteUrl = new URL("https://www.apinow.fun/api/x402-proxy");
quoteUrl.searchParams.set("url", target);
quoteUrl.searchParams.set("method", "POST");
const response = await fetch(quoteUrl, { headers: { accept: "application/json" } });
if (!response.ok) throw new Error(`APINow quote failed: ${response.status}`);
const quote = await response.json();
const exact = quote.upstreamAccepts?.find((accept) =>
accept.scheme === "exact" && accept.network === "eip155:8453" &&
BigInt(accept.amount) === upstream && accept.asset.toLowerCase() === asset &&
accept.payTo.toLowerCase() === payTo
);
const proxyFee = usdToMicrounits(quote.proxyFee);
const total = usdToMicrounits(quote.totalPrice);
if (quote.url !== target || quote.method !== "POST" || !quote.isX402 ||
quote.network !== "eip155:8453" || usdToMicrounits(quote.upstreamPrice) !== upstream ||
!exact || proxyFee > maxProxyFee || total !== upstream + proxyFee || total > maxTotal) {
throw new Error("Quote exceeds the authorized payment policy");
}
// Stop here: callExternal has no max-price or payment-challenge policy hook.
// Do not authorize execution until the final challenge can be validated or bound.Last two-target compatibility check under the then-current prices: 2026-07-21T00:25:18.250Z. That historical timestamp does not prove compatibility after a price change; use the current no-spend audit and each live quote before a paid call.