
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
ronin-buyer
Advanced tools
RONIN web research as a native paid tool: buyer SDK, MCP, AgentKit, OpenClaw and framework adapters. x402 Base USDC, 0.010000 per call.
Install ronin_web_research in a buyer agent to search the web, retrieve sources and verify research claims. The tool knows its production URL, handles x402 402 → authorization → one retry, and returns the full RONIN result plus receipt. 0.010000 USDC per call, on Base. Installing this package is free; research calls are paid.
Production resource: https://seller.agratys.website/machine-services/search-router.
Network eip155:8453; canonical USDC 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913;
recipient 0xaD1dedD19cC97C54509F63B3ad03259de3Fb7D26; atomic amount 10000.
EIP-712 token domain: USD Coin, version 2. A challenge advertising the ticker USDC as the domain name is rejected before signing; the actual Base token uses USD Coin.
Node 20.18+ (use your OpenClaw host's required Node version for OpenClaw).
npm install https://seller.agratys.website/integrations/ronin-buyer/ronin-buyer-0.1.0.tgz
The same package supports SDK, MCP, AgentKit and the thin adapters below. A registry install (npm install ronin-buyer) is available only after npm publication; the versioned RONIN-hosted tarball is the direct distribution path. SHA-256: sha256.txt.
import { Ronin } from 'ronin-buyer';
import { signer } from './your-existing-wallet.js';
const ronin = new Ronin({ signer, maxTotalAtomicAmount: '10000' });
const matches = ronin.find('source verification'); // Local capability lookup, free.
const tool = ronin.use(matches[0].tool);
const result = await tool.call({ query: 'Find primary sources for this research question' });
console.log(result.data, result.receipt, result.paymentResponse);
// Equivalent: ronin.search({ task: '...' }) or ronin.call('ronin_web_research', { query: '...' }).
Pass your existing @x402/core client as { x402Client } instead of { signer } if payment is already configured. The package does not load, persist, request or log private keys. The optional fetch setting is a plain HTTP transport for applications/tests, not an auto-paying fetch wrapper.
Input accepts query, topic, task, claim, q, prompt, question, subject, text, keywords, search; result-count aliases are numResults, num_results, max_results, limit, count (1–50). Production handles the search logic and supported metadata; the SDK validates and supplies a canonical query plus request ID. It never accepts an endpoint or payment recipient from a model.
The maximum per-call payment is fixed at 10000 atomic units. maxPaymentAtomicAmount can lower that ceiling, never raise it. The default total budget is one call; operators may set maxTotalAtomicAmount for a longer session. Budget reservations and request-ID deduplication last for this client process; use your wallet's durable policy for budgets across restarts or hosts. Paid timeouts/5xx keep their reservation. Do not blindly retry an ambiguous payment with a new ID.
Configure your buyer's existing wallet in a trusted local module exporting createRoninOptions(); see examples/buyer-module.mjs. Set the absolute local path, not a private key, in RONIN_BUYER_MODULE.
{
"mcpServers": {
"ronin": {
"command": "npx",
"args": ["--yes", "--package=https://seller.agratys.website/integrations/ronin-buyer/ronin-buyer-0.1.0.tgz", "ronin-mcp"],
"env": { "RONIN_BUYER_MODULE": "/absolute/path/to/buyer-module.mjs" }
}
}
}
Use npx.cmd for Windows clients that require an executable command. CLI equivalent: ronin-mcp --buyer-module /absolute/path/to/buyer-module.mjs. The MCP tool is ronin_web_research; its description explains research and source-retrieval selection. tools/list works without a signer; paid calls then return BUYER_SIGNER_REQUIRED. Transport is local stdio; the public tools.json is metadata, not a remote MCP endpoint. The buyer retains wallet authority.
npm install @coinbase/agentkit@0.10.4
import { AgentKit } from '@coinbase/agentkit';
import { roninActionProvider } from 'ronin-buyer/agentkit';
import { walletProvider, signer } from './your-existing-wallet.js';
const kit = await AgentKit.from({
walletProvider,
actionProviders: [roninActionProvider({ signer, maxTotalAtomicAmount: '10000' })],
});
const actions = kit.getActions(); // ronin_search and ronin_about
// Supply these through your usual AgentKit framework binding.
Supports Base mainnet. The signer/x402 client comes from the buyer application; this provider does not mint a new wallet or request broad wallet permissions. No dynamic service registration is required. ronin_about is free.
curl -fSL -o ronin-buyer-0.1.0.tgz https://seller.agratys.website/integrations/ronin-buyer/ronin-buyer-0.1.0.tgz
openclaw plugins install npm-pack:./ronin-buyer-0.1.0.tgz
Configure the enabled plugin and allow its optional paid tool in your existing OpenClaw configuration:
{
"plugins": { "entries": { "ronin-buyer": { "enabled": true, "config": { "buyerModule": "/absolute/path/to/buyer-module.mjs" } } } },
"tools": { "alsoAllow": ["ronin_web_research"] }
}
The plugin bundles ronin-web-research/SKILL.md: intent → installed tool → bounded payment → sources and receipt. Merge these fields with existing configuration. Restart/reload the gateway as required by your OpenClaw version, then inspect with openclaw plugins inspect ronin-buyer --runtime --json. Plugin registration is tested against the public registration contract; a full OpenClaw gateway is not installed in the build environment. Alternatively install the RONIN MCP server and use the same skill with that tool.
import { roninOpenAITools } from 'ronin-buyer/openai';
const { tools, chatTools, execute } = roninOpenAITools(ronin);
// Responses API: tools. Chat Completions: chatTools.
// On function_call: await execute(call.name, JSON.parse(call.arguments));
// Return JSON.stringify(result) as function_call_output with the original call_id.
npm install @langchain/core@1.2.11
import { roninLangChainTools } from 'ronin-buyer/langchain';
const tools = roninLangChainTools(ronin); // DynamicStructuredTool[]
// Pass tools to your LangChain agent/tool router.
No LLM calls, API keys or paid model dependencies are added by these adapters.
Independent local tests exercise the real MCP client/stdio transport, AgentKit getActions, LangChain invocation, a deterministic intent router, an unfunded ephemeral signer and a loopback mock payment gate. They cryptographically verify the authorization. A separate Python test feeds the same SDK envelope through the unmodified production resource + roninQuote validator and stops at a mock facilitator. These tests are not paid sales or live model-selection evidence.
BUYER_SIGNER_REQUIRED, BUYER_BUDGET_EXHAUSTED, PAYMENT_POLICY_REJECTED and RONIN_QUOTE_EXPIRED stop before payment. PAID_RESPONSE_UNKNOWN, PAID_REQUEST_FAILED and RECEIPT_MISSING_OR_UNCONFIRMED retain the request ID; reconcile any mayHavePaid outcome before authorizing another call. HTTP receipt contents are returned as seller evidence; this SDK does not independently recognize seller revenue or perform blockchain reconciliation.
x402 contract, OpenAPI, agents.json, tool metadata. The production 402 also carries Bazaar metadata. server.json is the prepared official MCP Registry submission; it is not proof of registry publication.
MIT for this package. Clean implementation using the official x402 and MCP libraries; no Agent402 code or private state is included. See NOTICE for architecture references and third-party license boundaries.
FAQs
RONIN web research as a native paid tool: buyer SDK, MCP, AgentKit, OpenClaw and framework adapters. x402 Base USDC, 0.010000 per call.
The npm package ronin-buyer receives a total of 17 weekly downloads. As such, ronin-buyer popularity was classified as not popular.
We found that ronin-buyer demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.