Sean-Claude Van Damme's General Store • Oak City

SCVD General Store developer documentation

Agent calling-card setup: local public-profile import, a Node fetch integration, and the optional signed directory record.

A2A checks and repair kits: free card checks, authorized runtime tests and signed reports.

Build against https://scvd.store. No account, no API key, no SDK. Free endpoints are plain HTTPS; paid ones take one signed payment per request: USDC over x402 v2 on Base, Polygon, Arbitrum, World, Solana, or USDC over MPP (evm/charge) on Base for every shelf item, every publication page and the commission desk.

SCVD libraries and SDKs — source versions; check npm before installing

Protocols and their scope

Start here

Free, no payment, no account

Reselling the shelf: the trade counter

Connect over MCP

On the command line

Fixed paths a machine can know without guessing

Conventions

Authentication

No account or API key is issued. Free tools need no payment. Paid requests use USDC over x402 v2 on Base, Polygon, Arbitrum, World, Solana, or USDC over MPP (evm/charge) on Base for every shelf item, every publication page and the commission desk. Read the current quote and payment_capabilities before signing; payment is per request. Native MPP challenges and x402 terms have different retry formats. The operational instructions are at https://scvd.store/auth.md and https://scvd.store/agents.md; the service's authorization description is at https://scvd.store/.well-known/oauth-protected-resource.

Errors

4xx and 5xx return an RFC 9457 problem object (application/problem+json): type, title, status, detail, instance. The store's long-standing human-readable `error` field rides beside them and is always present, so nothing that reads it breaks.

Rate limits

Free preflight allows 30 probes per isolate per minute, with a global backstop of 60 per minute. Metered answers (200 and 429) carry RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset for the nearer ceiling; RateLimit and RateLimit-Policy name both buckets. Validation refusals (400) spend no probe and carry no limiter fields. The global counter uses eventually consistent storage, so its remaining count can read high under load. A limit refusal returns 429 with Retry-After; it describes our probe budget, not the target endpoint. Other routes enforce their own limits, including the mailbox's daily allowance, and the edge can also refuse abusive traffic. Read the affected route's response before retrying.

Versioning and deprecation

Breaking changes arrive as a new version in the URL path (/api/preflight/v1 → /v2). Within a published version, fields are added and never removed or retyped. A version being retired serves RFC 8594 Deprecation and Sunset headers on every response for at least 90 days first, and the date is published before the headers appear. Nothing is deprecated today. The whole policy, and a live table of every version served with its status and sunset date, is at https://scvd.store/deprecation — the routes read that same table before deciding whether to emit the headers, so the page cannot promise a window the wire does not honour.

Content negotiation

Send Accept: text/markdown and the agent-facing surfaces answer in markdown, including https://scvd.store/ itself. Responses carry Vary: Accept, Accept-Encoding, User-Agent so a cache keeps the variants apart. Accept is parsed by q-value, not substring-matched. For callers that would rather guess a path than send a header, https://scvd.store/index.md and https://scvd.store/pricing.md serve the same bytes their negotiated originals do, with a canonical link back. An explicit supported Accept preference takes precedence. Without a format preference, recognized agent readers may receive Markdown; ordinary search crawlers receive HTML.

What we don't do, on purpose

ai-train=yes stays

Scanners award a point for ai-train=no. This store publishes Content-Signal: search=yes, ai-train=yes, ai-input=yes in robots.txt on purpose — the same constant renders both lines, so this sentence cannot argue with that file: a shop whose product is being the x402 conformance reference WANTS to be in the corpus a model learns from. Training is distribution here, not leakage. Everything on this site is already free to fetch, most of it CC BY 4.0, and a policy we would not enforce is one we should not print.

No Wikipedia article, and no plans for one

Diligence scans look for Wikipedia and Wikidata in sameAs and score us nought for two. Both stay absent on purpose: a company this young fails notability, an article written to game a checklist gets deleted, and a deleted article is worse than none — while a sameAs naming a page that does not exist is a false claim in machine form. Revisit at real notability, not before. The GitHub repository is in sameAs, because it exists and a reader can check claims there rather than check that a claim was filed.

WebMCP and MCP Apps, exactly as far as they go

WebMCP: https://scvd.store/webmcp.js registers 12 free instruments (check_a2a_card, check_purchase, read_store_guide, read_binder, look_in_window, preflight_endpoint, look_at_door, check_before_you_pay, check_conformance, verify_artifact, check_order, find_in_catalog), plus quote_store_purchase (free) and complete_store_purchase (consequential). The latter submits only a payment already signed by the buyer's wallet/client; it never signs or retries by itself. MCP Apps remain 2 display-only cards, with no payment tools attached. Without WebMCP support and a compatible signer, an agent can browse but cannot pay. https://scvd.store/mcp.md describes the doors.

Protocol claims follow implemented scope

Current protocol scope: x402: Payment challenges, endpoint inspection and signed offer/receipt verification. The current quote names available checkout rails. MPP: Read-only MPP endpoint inspection and native MPP checkout for enabled items. Current payment capabilities declare checkout availability, network and currency; inspection does not establish completed payment or delivery. A2A: The agent card declares the current endpoint, capabilities and version. UCP: Business profile, catalog search, lookup and product detail at the pinned 2026-08-25 release. Checkout and order are advertised in the profile exactly when this deployment has them switched on; the profile's status block says which items and rails. No third-party conformance claim. Current payment capabilities and each protocol profile describe deployment availability.

No sandbox, and that is the product

Readiness checks look for a test environment and find none, and there is not going to be one. https://scvd.store/try is a live counter: real x402 settlement, real signed artifacts, real chain, from a fraction of a cent. A sandbox is where integrations pass and production is where they fail, and that gap is the single most common thing this store observes in other people's endpoints. A test mode behaving differently from the real door is a second implementation to keep honest, and the first time it drifted, everyone who rehearsed against it rehearsed against fiction. The cheapest door here costs less than the hour it takes to configure a sandbox key. The one sandbox here is the trade counter's, for marketplaces proving an HMAC signer: account `sandbox`, secret published, check desk at https://scvd.store/api/trade/sandbox/check.

Maintained packages and language clients

SCVD maintains x402-verify · source 1.11.0, x402-sign · source 1.0.3, scvd-preflight · source 0.3.1, scvd-corpus-client · source 0.1.0, scvd-defects · source 0.22.0, scvd-mcp-starter · source 0.2.0, alongside the CLI and tab. Preflight language guides: JavaScript preflight SDK, Python preflight SDK, Go preflight SDK. Package docs and installation: https://scvd.store/developers. HTTP contract: https://scvd.store/openapi.json.

The MCP card CSP is stricter than the checklist wants

A scan grades the MCP App card's Content-Security-Policy on four categories and scores 2 of 4, wanting connect-src to include our MCP origin and img-src and style-src to name specific origins. The card declares `connect-src 'none'`, `form-action 'none'` and `img-src 'none'` — not a narrower allowance but NO allowance, stricter than anything that could score full marks. That is the keeper's G2 ruling made into a fence a host verifies by parsing one tag: the cards are display-only, and a card that could reach the network is a card that could act. `frame-ancestors` is absent because CSP Level 3 says it MUST be ignored in a meta element, the only channel an MCP-served resource has. The pages' own header carries, since 2026-09-05, what the card cannot: `connect-src` (this origin, which is the MCP origin) and `frame-ancestors` (this origin and the two chat hosts), both tightenings.

The documentation door is the same shelf, not a second implementation

Scans look for two MCP servers, one to act and one for the docs, and until 2026-09-05 read ours as running both with the docs one down: https://scvd.store/mcp.md was a page, 200 on GET, 405 on a POSTed handshake. The docs still live on the main door as `resources/list` and `resources/read`; what changed is that the probed address answers. POST https://scvd.store/mcp.md (and https://scvd.store/mcp/docs) is a JSON-RPC server whose catalog is those same resources, read by the same function, plus one tool returning any by name. Nothing acts.

No AggregateRating, and the refusal is the product

Structured-data checks award a point for AggregateRating or Review as social proof an answer engine can quote. This store publishes neither, for its own house sentence: never a ranking, and never a verdict without its derivation and denominator beside it. Every verdict it issues is one dated observation that expires and is re-taken, or a derivation that prints its rule and its fraction, and a shop that would not put stars on somebody else's endpoint has no business wearing them. The structured data carries what is checkable instead — Organization, WebSite, Product, Offer, Service, ItemList — and the evidence a rating asks you to take on trust is at https://scvd.store/corpus.json, signed, verifiable offline.

The agent-auth rows this store cannot score honestly

Two checks want doors that do not exist here. One looks for a 401 carrying `WWW-Authenticate: Bearer resource_metadata=...`; every path it probes answers 200, because every one is free, and manufacturing a 401 on a public document would be the plainest false claim this store could make. The signpost goes where it IS true: every 402 carries that header pointing at https://scvd.store/.well-known/oauth-protected-resource, which RFC 9110 permits outside a 401, with the scheme token X402 because no bearer token is accepted. The other wants `register_uri`, `claim_uri` and `revocation_uri` to resolve; all three are `null`, because no credential is ever issued, and standing up three endpoints that do nothing would be the stale-metadata failure that spec exists to prevent.

Markdown by Accept first; by user-agent only where the client said nothing

Scanners check for markdown served to an agent-shaped user-agent. This store negotiates on Accept, parsed with q-values, and any header that names a type wins. Until 2026-09-05 it stopped there, and a probe found GPTBot and a browser receiving identical storefront bytes. Now a named reader — a training crawler or a user-initiated fetcher, classed by its vendor's stated purpose, never by guessing at a string — that states no preference gets markdown where a page genuinely has one and the page elsewhere; a named indexer keeps the page and its JSON-LD; an unnamed agent's bare fetch still gets JSON. `Vary` has named User-Agent since 2026-09-02.

Contact

A person reads this address: sean@recordcreativeco.com.

What you can do with this

Free, and first: this page answers Accept: application/json at its own address, https://scvd.store/developers — the same content as data, with no key and no account. The whole machine map is at /atlas.json.

Nothing on the shelf sells a deeper read of this page. What is here is all of it, free and complete. Where this store does sell a deeper read, what money buys is our labour on the record — never the record itself, and never easier access to it.

Or hand it to your agent. Paste this and it will do the whole thing without you: “Fetch https://scvd.store/developers with the header Accept: application/json. That is this page as data — free, no key, and the same numbers a person reads.”

Back to the front of the store. Agents: /llms.txt, /skill.md, or /menu.json.