Skip to main content

​
Current releases and prepared candidates

Last verified: September 7, 2026 Grantex packages are versioned independently. There is no single version number that represents every SDK, integration, service, and protocol artifact in this repository.
TypeScript 0.6.0, Python 0.5.0, Go v0.3.0, and x402 0.4.0 are published and registry verified. Installing any SDK does not provision external custody, principal notification delivery, or merchant idempotency storage; see Prepaid Wallet Production Readiness.
The SDK patch versions differ because each language package is released on its own schedule. A newer package version does not imply a newer protocol or API contract version.

​
Published and source-only changes

The September 7 dependency integration updates repository test tooling to Vitest 5 and the auth service to SimpleWebAuthn 14. Use Node.js 24 LTS when building or testing this checkout. These maintenance changes do not publish new SDK versions; the registry versions above remain authoritative. Python 0.5.0 and Go v0.3.0 were published on September 7, 2026. Both add EVM payment responses and authenticated principal/agent reconciliation and retain bounded refresh recovery. Full tests passed against a clean PyPI wheel and the public Go module, including Go race tests. Neither language adds an automatic x402 HTTP payment-and-retry wrapper. TypeScript 0.6.0 and x402 0.4.0 were published on September 7, 2026. Both registry integrity hashes match the tested tarballs. A clean npm install passed public-export, license/notice, Base safety, and authenticated reconciliation checks with zero reported consumer vulnerabilities. The x402 adapter provides opt-in request-bound Base USDC 402/sign/retry. See Base USDC Custody for the custody and RPC prerequisites.
As of August 10, 2026, published @grantex/cli@0.3.0 includes the Hermes, OpenClaw, and portable Agent Skills installer. Repository source on main includes corrected Go Agent/Audit read/write contracts and layered prepaid wallet clients across TypeScript, Python, and Go. TypeScript 0.6.0, Python 0.5.0, and Go v0.3.0 include matching bounded refresh-recovery behavior. Standard developer API-key plan throughput and custom-auth quotas remain separate from SDK publication.

​
Which Grantex package should I use?

  • Hermes, OpenClaw, or another shell-capable agent: use published @grantex/cli@0.3.0; install its bundled skills with grantex agent install. No agent-specific SDK is required.
  • TypeScript application: use npm-verified @grantex/sdk@0.6.0 for bounded refresh recovery, layered prepaid-wallet governance, and OAuth Agent Grants.
  • x402 prepaid-wallet application: use published @grantex/x402@0.4.0 with published @grantex/sdk@0.6.0; keep external custody disabled until an operator adapter passes review.
  • Python application: use PyPI-verified grantex==0.5.0 for bounded refresh recovery and layered prepaid-wallet governance.
  • Go application: use public-proxy-verified github.com/mishrasanjeev/grantex-go@v0.3.0 for bounded refresh recovery, corrected Agent/Audit contracts, and layered prepaid-wallet governance.
  • MCP HTTP transport authorization: use an established MCP-compatible authorization server and maintained MCP SDK that implement the current MCP authorization specification.
  • Agent-specific MCP tool enforcement: after transport authorization, use a primary Grantex SDK or direct JWKS validation at each tool boundary. Treat @grantex/mcp-auth@2.0.2 as single-process evaluation software.
  • Current revocation: local JWT verification is insufficient by itself; perform an online state check or synchronize revocation data.

​
Known limitations in the current published artifacts

MCP Auth 2.0.2: use a single process for evaluation only. Authorization codes are always process-local, consentUi does not create a page, onTokenIssued is not called, allowedRedirectUris is not a server-wide allowlist, middleware/introspection do not check current revocation state, and the Grantex authorization code is not persisted for the token handler. See MCP Auth Server for the detailed endpoint and deployment matrix.

​
Reproducible installation

Pin exact versions in applications, examples, CI, and deployment manifests:
Unpinned npm install, pip install, and go get commands resolve according to their registries and module proxy. Use the pinned commands above when the build must be repeatable.

​
How to read release information

​
Upgrade checklist

  1. Read the package-specific notes in the compatibility matrix and changelog.
  2. Confirm the required Node.js, Python, or Go toolchain version.
  3. Update the exact dependency version and regenerate the relevant lockfile.
  4. Run your authorization, token-verification, scope-enforcement, and revocation tests before deployment.
  5. For self-hosted environments, verify the API contract used by your service; an SDK-only patch does not upgrade the service automatically.
Do not infer publication from a repository manifest or marketing page alone. Confirm the exact artifact on its public registry before promoting a release.

​
Ownership

Grantex is owned by Orchestrum Technologies LLP. Inventor and owner: Sanjeev Kumar. Ownership contact: sanjeev@orchestrum.in or mishra.sanjeev@gmail.com.
Last modified on September 7, 2026