Tooling
Packages
The six npm packages. What each is for, who installs it, and which one to pick for your role and protocol.
All six packages are TypeScript, ESM-only, licensed under Apache-2.0, and need Node.js 20 or later.
Pick by role
| You are | Protocol | Install | Docs |
|---|---|---|---|
| Buyer with an MCP client (Claude, Cursor…) | any | nothing: add npx -y @zanora/mcp to your config | Buy from an MCP client |
| Buyer who already picked one seller | MCP | nothing: add npx -y @zanora/mcp-proxy <url> | Use one seller's tools |
| Buyer writing code | REST or MCP | npm install @zanora/sdk | Buy from code |
| Seller with an MCP server | MCP | npm install @zanora/middleware-mcp @modelcontextprotocol/sdk | Sell an MCP tool |
| Seller with an Express app | REST | npm install @zanora/middleware-express express | Sell an HTTP endpoint |
| Seller who'd rather not write code | any | nothing: @zanora/mcp with ZANORA_ROLE=seller | Manage listings from an MCP client |
The packages
| Package | What it is |
|---|---|
@zanora/sdk | the buyer's SDK. ZanoraAgent discovers, pays over x402 (HTTP and MCP), and verifies receipts. ZanoraClient wraps the other API routes |
@zanora/mcp | an MCP server with two profiles: a buyer's ten tools (discover, invoke, balance, receipts…) and a seller's eleven (publish, edit, verification, sales, earnings). Runs over stdio with npx |
@zanora/mcp-proxy | puts one paid MCP server in front of your agent so its tools appear under their own names, and pays as they're called |
@zanora/middleware-mcp | seller side, for MCP. zanoraSeller().sell() publishes a tool with a price and returns a wrapper for its handler. Works with any MCP server library |
@zanora/middleware-express | seller side, for HTTP. zanora({ backend, capabilityId }) is Express middleware that handles the 402 handshake |
@zanora/core | shared types, amount handling, ed25519 signing and the x402-over-MCP encoding. Installed as a dependency of the others. You only need it directly to build against the protocol |
Status
Pre-release
The packages are versioned at 0.1.x and may not be on the public npm registry yet. Check with:
npm view @zanora/sdk versionIf that returns 404, the packages haven't been published. You can still call the HTTP API directly from any language. Everything the packages do goes through it.
Other languages
The gateway is plain HTTPS and JSON, so any language can buy. Payment proofs are ed25519 signatures over canonical JSON, and x402 protocol documents the exact steps. For selling, the middleware only calls four routes on the gateway: challenge, authorize, complete and fail. A port to FastAPI, Go or anything else follows the same steps.