deploy-operator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited deploy-operator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Deploy or redeploy Fase 5 PaymentOperators across all supported chains. Use when the user says "deploy operator", "redeploy operators", "deploy on ethereum", "deploy payment operator", or similar.
YOUR_DEV_WALLET (key in .env.local as WALLET_PRIVATE_KEY) needs native gas tokens on target chain:--dry-run first.cd scripts && npm installEach Fase 5 operator deployment creates 4 contracts per chain:
1. StaticFeeCalculator(1300bps = 13%) — splits fees at release
2. StaticAddressCondition(Facilitator) — authorizes our Facilitator
3. OrCondition([Payer, Facilitator]) — release condition
4. PaymentOperator — the operator itselfAll deployed via x402r factory contracts (CREATE2 pattern). The script verifies factory bytecode on-chain before attempting deployment.
Key config:
cd scripts
npx tsx deploy-payment-operator.ts --fase5 --network <chain> --dry-runExpected output:
cd scripts
npx tsx deploy-payment-operator.ts --fase5 --network <chain>Expected output (4 TXs):
0x...0x...0x...0x...Save the PaymentOperator address — this goes in sdk_client.py and CLAUDE.md.
File: mcp_server/integrations/x402/sdk_client.py
Find the network in NETWORK_CONFIG and set the "operator" field:
"<network>": {
...
"operator": "<deployed_operator_address>",
...
}Add a row to the On-Chain Contracts table:
| **EM PaymentOperator (Fase 5)** | **<Network>** | **`<address>`** |Contact the Facilitator team (IRC #Agents or direct):
New EM operators to allowlist:
- <Network>: <operator_address>The Facilitator needs the operator address in its addresses.rs allowlist to authorize gasless operations.
# Verify on-chain (read-only, no gas needed)
cd scripts
npx tsx deploy-payment-operator.ts --fase5 --network <chain> --dry-run
# Should show "Existing operator found: 0x..."For full E2E: create a $0.10 task with payment_network=<chain> and run through the lifecycle.
If the fee structure changes (e.g., new BPS rate) or conditions change, redeploy ALL operators:
cd scripts
# Dry run all chains first
for chain in base ethereum polygon arbitrum avalanche monad celo optimism; do
echo "=== $chain ==="
npx tsx deploy-payment-operator.ts --fase5 --network $chain --dry-run
done
# Deploy (skip chains that already have the right config)
npx tsx deploy-payment-operator.ts --fase5 --network ethereum
npx tsx deploy-payment-operator.ts --fase5 --network polygon
npx tsx deploy-payment-operator.ts --fase5 --network arbitrum
npx tsx deploy-payment-operator.ts --fase5 --network avalanche
npx tsx deploy-payment-operator.ts --fase5 --network monad
npx tsx deploy-payment-operator.ts --fase5 --network celo
npx tsx deploy-payment-operator.ts --fase5 --network optimism
# Base usually doesn't need redeployment (it's our primary chain)Then update sdk_client.py with all new addresses and register in Facilitator.
| Source | What it contains |
|---|---|
@x402r/sdk repo packages/core/src/config/index.ts | x402r sub-factory addresses per chain (BackTrack deploys these) |
mcp_server/integrations/x402/sdk_client.py (NETWORK_CONFIG) | Our operator addresses + x402r infra per chain |
scripts/deploy-payment-operator.ts (CHAIN_CONFIGS) | Same x402r infra addresses (must match sdk_client.py) |
CLAUDE.md On-Chain Contracts table | Human-readable reference |
If addresses seem wrong, always verify against the x402r-sdk repo first:
https://github.com/BackTrackCo/x402r-sdk/blob/main/packages/core/src/config/index.ts| Chain | Operator | Status |
|---|---|---|
| Base | 0x271f9fa7f8907aCf178CCFB470076D9129D8F0Eb | Active |
| Ethereum | 0x69B67962ffb7c5C7078ff348a87DF604dfA8001b | Active |
| Polygon | 0xB87F1ECC85f074e50df3DD16A1F40e4e1EC4102e | Active |
| Arbitrum | 0xC2377a9Db1de2520BD6b2756eD012f4E82F7938e | Active |
| Avalanche | 0xC2377a9Db1de2520BD6b2756eD012f4E82F7938e | Active |
| Monad | 0x9620Dbe2BB549E1d080Dc8e7982623A9e1Df8cC3 | Active |
| Celo | 0xC2377a9Db1de2520BD6b2756eD012f4E82F7938e | Active |
| Optimism | 0xC2377a9Db1de2520BD6b2756eD012f4E82F7938e | Active |
BackTrack hasn't deployed sub-factories on that chain. Contact Ali on IRC.
Fund the deployer wallet (0x857f...) with native tokens on that chain.
The default eth.llamarpc.com can be very slow. Options:
X402_RPC_URL env varCHAIN_CONFIGS.ethereum.rpcUrl in deploy scriptsdk_client.py — operator address must be in NETWORK_CONFIGEM_ESCROW_MODE=direct_release for Fase 5Deploy a new operator with the correct BPS. Old operators remain on-chain but unused. Update sdk_client.py to point to the new one.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.