Changelog

August 2026

Product naming update 2026-08

The products now carry the names they ship under. Nothing about the API changed: every /v1 endpoint path, request shape, and response shape is exactly as it was, and no migration is needed.

• Monetize Gateway is now Gate, the x402 gateway. Put an x402 paywall in front of any API or MCP server and get paid in USDC on Base. The old docs URL redirects to the new one.
• Payment links are part of Collect, CodeSpar's direct-charge product. Shareable payment links are its first surface. The endpoint family is still /v1/payment-links.
• Guardrails replaces the AgentGate name for the policy layer that gates agent spend. Same hooks, same ordering, same audit events; the name no longer collides with Gate.

Meter documentation, in beta 2026-08

Meter is post-paid metered pricing on a Gate paywall: the 402 advertises a spending ceiling the buyer signs once, your upstream reports the actual work in a response header you configure, and the difference is refunded on-chain automatically. A missing or malformed header falls back to the minimum multiplier, so a silent upstream can never overcharge the caller. The receipt is re-sealed with all three amounts (ceiling, actual, refunded) and GET /v1/paywalls/:id/stats reports gross against net.

Meter is merged and in beta while final mainnet validation completes. Gate's flat, tiered, and dynamic pricing models are live.

codespar_get_started documented 2026-08

The meta-tool registry has 15 entries, not 14. The one that was missing from these docs is codespar_get_started, a read-only setup planner that returns the ordered happy path for the authenticated workspace. It moves no money, it is always available, and it is the only tool surfaced when the API key is missing or invalid.

July 2026

codespar_checkout is live on the Pix rail 2026-07-03

The sell-side checkout meta-tool now executes end to end. Pass items[] and the meta-tool lowers them to an inbound charge, routed on the pix rail with provider failover. The response carries a hosted payment page (charge_url) plus pix_copy_paste, so the shopper can pay from a link or straight from the copia-e-cola string. See codespar_checkout.

Hosted remote MCP productized 2026-07-03

One URL now serves any remote MCP client: https://connect.codespar.dev/mcp (Streamable HTTP). Authenticate with a csk_ bearer key or OAuth 2.1, with RFC 9728 protected-resource discovery served per host. Claude Code setup is one line:

claude mcp add --transport http codespar https://connect.codespar.dev/mcp --header "Authorization: Bearer <key>"

See the MCP adapter docs for the full remote setup.

June 2026

Multi-slot consumer wallet in production 2026-06-25

One wallet per consumer, with per-currency slots (BRL + USDC) minted from a single mandate signature. There is no FX inside the wallet: each slot is its own spend authority in its own currency. Shipped surface: GET /v1/consumers/:id/wallet, slot-to-slot transfer with onramp and offramp legs, and mandate-gated spend against each slot. See codespar_wallet.

@codespar/sdk 0.10 is the current line 2026-06

The SDK moved to the 0.10 line. Typed Session wrappers expanded to cover the newer meta-tools, including session.issue(args) and session.ledger(args), and the framework adapters now track ^0.10. If you are pinned to ^0.9.0, bump the pin; the 0.9 surface carries over additively.

MCP Generator — dashboard wizard + OpenAPI & GitHub source modes 2026-06-09

The MCP Generator is now a point-and-click flow in the dashboard at Develop › Generate — no install required. Scan your API three ways (paste source, an OpenAPI 3.x spec, or a GitHub repo), pick the endpoints to expose, review the generated server, then onboard and activate it. Activated servers become a project-scoped rail in the router (gen_<project>_<slug>), so agent calls to your own API run through the same policy engine, credential vault, and audit chain as Pix and NF-e — isolated from other projects. The CLI and library still emit standalone server code; the wizard is the path that makes a server routable. See MCP Generator.

New meta-tools: codespar_ledger + codespar_issue 2026-06-05

Two new meta-tools (with typed SDK wrappers) join the catalog. codespar_ledger is a double-entry ledger backed by the tenant's self-hosted Lerian Midaz — post journal entries, read balances, create accounts. It is your books, distinct from the rails that move real money. codespar_issue issues and controls payment cards via our card-issuing partner (virtual / physical, freeze / unfreeze / cancel) — the agent-spend-card primitive. Both are wrapped by session.ledger(args) and session.issue(args). See codespar_ledger and codespar_issue.

LATAM catalog expansion + new auth engines 2026-06-05

The provider catalog grew past 60 rails across BR, MX, AR, CO, CL, and PE. codespar_pay now spans 28 providers — including nine Brazilian banks connected direct over mTLS (Banco do Brasil, Itaú, Bradesco, Santander, Caixa, Sicoob, Sicredi, C6, Original) for Pix straight from the account — and codespar_charge spans 17 (Getnet, PagSeguro, Rede, Clip, Kushki, Izipay, Niubiz, Bold, ePayco, Payway, PicPay, Nequi, and more). A new auth engine landed alongside them: two_header (two co-equal credential headers, no Bearer — Cielo, Transbank, Kushki, Payway). See codespar_pay, codespar_charge, and authentication.

codespar_checkout and codespar_shop — the two sides of checkout 2026-06-04

Two meta-tools cover the two sides of a purchase. codespar_checkout is the sell-side primitive: as a merchant, create and process a checkout for a shopper to pay you (cart, pricing, tax, payment), routing to Stripe ACP, Asaas, or x402 by payment method. codespar_shop is the buy-side primitive: the agent acts as the shopper, searching a store and buying — a cart engine resolves product and price with adapters for VTEX, Mercado Livre, and a hosted browser-worker (for sites without a programmatic API), minting the store's real Pix to settle via codespar_pay. See codespar_checkout and codespar_shop.

Cross-border rails on codespar_crypto_pay — onramp + offramp + payout 2026-06-01

codespar_crypto_pay gains three new rails served by our BRL↔USDC on/offramp partner, covering the full cross-border lifecycle: onramp (fiat → USDC via Pix BRL / US wire / EUR SEPA — returns a hosted QR / wire instruction the agent surfaces to the payer), offramp (USDC → fiat on a pre-registered bank account), and stablecoin-payout (USDC → external wallet address for web3 recipients). Agents chain onramp + offramp in two calls to drive a complete cross-border purchase or export flow. The receive-flow default (stablecoin × USDC × INTL) still routes to Coinbase Commerce. See codespar_crypto_pay for the rail table + chained-call examples.

Breaking change — counterparty.country is required for direction: send on codespar_crypto_pay 2026-06-01

codespar_crypto_pay calls with direction: "send" must now include counterparty.country as an ISO 3166-1 alpha-2 string (e.g. "US", "BR", "MX"). Receive-direction flows (Coinbase Commerce charges, onramp QR generation) may omit it — the buyer is anonymous until they hit the hosted URL. The coercer rejects send-direction calls missing the field before any provider dispatch. This is the destination half of cross-border tracking; an operator_country (origin) field is planned for a follow-up so the platform can derive cross-border flag deterministically across send + receive. Update agents that previously omitted the country on direction: "send" calls.

May 2026

Chat-loop policy hooks now fire on every session.send() tool call 2026-05-23

The policy engine now evaluates every tool call dispatched from the chat-loop session.send() path, not just calls made through session.execute(). Rules tuned for direct-execute traffic — deny, approval-required, rate-limit, time-window — fire identically on chat-loop dispatches. If you have an approval-required rule on a tool the chat loop picks, expect rows in /dashboard/approvals after the next test run. See Chat-loop Governance for what changes and what to check before your next release.

Audit chain now captures chat-loop tool calls 2026-05-23

Every tool call the chat loop dispatches now writes a tool_call.succeeded or tool_call.failed event to the audit chain. Event names and shape are unchanged — existing SIEM-export rules and audit-page filters pick up the new events without changes. Audit-chain volume grows roughly in proportion to chat-loop tool-call volume per day. See Chat-loop Governance for the full ordering of the Guardrails hooks.

Commerce-memory predicates now fire on chat-loop tool calls 2026-05-23

When the chat loop dispatches a tool whose capture predicate matches (Asaas charges, Stone settlements, Melhor Envio fulfillments, KYC approvals), the runtime writes a commerce-memory row per successful call. The predicates themselves are unchanged; what's new is that chat-loop traffic reaches them. Check /dashboard/commerce-memory for entries you might attribute to a workflow that previously lived only on the direct-execute path. See Chat-loop Governance for details.

v0.9.0 — meta-tool router build-out + SSE streaming 2026-05-04

@codespar/sdk@0.9.0 + @codespar/types@0.7.0 + @codespar/api-types@0.4.0 + codespar (PyPI) 0.9.0 — meta-tool router shipped end-to-end. Eight new typed Session wrappers; two new auth types; SSE streaming for async settlement + verification.

Meta-tool typed wrappers — eight new methods on Session (TypeScript + Python parity, snake_case in Python):

• session.discover(query) — semantic + lexical tool search across the catalog (pgvector + pg_trgm). Composio-analog.
• session.connectionWizard(serverId) — connection wizard backend; agents discover what's connected and initiate flows.
• session.charge(args) — typed wrapper for codespar_charge (inbound, buyer pays merchant). Distinct from outbound pay.
• session.ship(args) — typed wrapper for codespar_ship (Melhor Envio rails: domestic-label / domestic-quote / domestic-track).
• session.paymentStatus(toolCallId) — polling endpoint for async settlement of charge / pay.
• session.paymentStatusStream(toolCallId, { onUpdate?, signal? }) — Server-Sent Events variant. Heartbeats every 15s; auto-closes 5s after terminal state.
• session.verificationStatus(toolCallId) — polling endpoint for async KYC settlement (codespar_kyc). Statuses: approved / rejected / review / expired / pending.
• session.verificationStatusStream(toolCallId, { onUpdate?, signal? }) — SSE variant.

The polling siblings (paymentStatus, verificationStatus) stay live for backward compat — additive change only.

Meta-tool catalog grew from 5 → 53 routing rails across 9 meta-tools:

• codespar_pay — outbound transfers
• codespar_charge (NEW) — inbound charges (Pix BRL: Asaas / Mercado Pago / iugu / Stone; card USD: Stripe)
• codespar_invoice — fiscal invoices. Default rail NFS-e (services); pass rail: "nfe" for products. Also nfci for CFDI MX (Facturapi) + Factura AR (AFIP).
• codespar_notify — messaging (whatsapp via Z-API / Twilio, sms via Twilio, email via SendGrid)
• codespar_ship (NEW) — shipping (Melhor Envio with 3 rails)
• codespar_crypto_pay (NEW) — crypto payments via Coinbase Commerce + Bitso
• codespar_kyc (NEW) — KYC via Persona / Sift / Konduto / Truora
• codespar_discover (NEW) — tool search meta-tool
• codespar_manage_connections (NEW) — connection wizard backend

Two new auth types — total 6 supported (api_key, path_secret, oauth, cert, hmac_signed, none):

• cert — mTLS with X.509 client certificate, for BR open-banking corporate APIs (Banco do Brasil pilot; Itaú, Santander, Bradesco, Caixa next batch).
• hmac_signed — per-request signature (timestamp + method + path + body) with shared key + secret pair. For Foxbit and crypto exchanges following that pattern.

Catalog scale (as of release):

• 109+ MCP servers published on npm
• 2,200+ individual tools
• 53 routing rails in META_TOOL_CATALOG
• 6 LATAM countries covered: BR, MX, AR, CO, CL, PE
• 9 verticals: payments, banking, crypto, communication, ecommerce, erp, fiscal, fraud, identity

@codespar/api-types@0.4.0 — added cert + hmac_signed to the auth_type enum (AuthTypeSchema) and cert to AuthSchemaFieldKindSchema. Web dashboard's Provider Connect modal now renders cert (file-upload) and hmac_signed (KEY/SECRET) flows directly.

@codespar/types@0.7.0 — new wire-contract types: DiscoverResult, ConnectionWizardResult, PaymentStatusResult, PaymentStatusStreamOptions, VerificationStatusResult, VerificationStatusStreamOptions, ChargeArgs / ChargeResult, ShipArgs / ShipResult.

Adapter peerDeps — framework adapters (@codespar/claude, @codespar/openai, @codespar/vercel, @codespar/mcp, @codespar/langchain, @codespar/google-genai, @codespar/mastra, @codespar/crewai, @codespar/autogen, @codespar/llama-index, @codespar/letta, @codespar/camel) remain on 0.3.0. They consume only the SessionBase surface; the new methods land additively on Session.

See the SDK reference for the full method-by-method shape and Auth concepts for the new auth types.

April 2026

v0.3.0 — API canonicalization + 2-level tenancy 2026-04-19

@codespar/sdk@0.3.0 — Breaking alignment with the canonical wire contract.

• codespar.create(userId, config) replaces codespar.sessions.create(config). userId is now a required first positional argument; credentials, audit logs, and billing scope to it.
• session.execute(toolName, params) replaces session.execute({ name, arguments }). Two positional arguments instead of a single object.
• session.send(message) and session.sendStream(message) take a natural-language string and run a Claude tool-use loop on the backend, returning SendResult / StreamEvent. The previous framing as fire-and-forget / streaming variants of execute is removed.
• session.mcp is a property { url, headers } instead of a method call.
• 2-level tenancy (Account → Project) shipped end-to-end: projectId on SessionConfig, x-codespar-project header support, Zod schema validation on client (/^prj_[A-Za-z0-9]{16}$/).
• Python package codespar@0.1.1+ on PyPI with matching surface (sync + async).

See Sessions and the SDK Reference for the full canonical shape.

v0.2.0 — SDK + 12 Adapters 2026-04-16

@codespar/sdk@0.2.0 — Major alignment with the api.codespar.dev backend contract.

• session.execute() now returns tool_call_id and called_at for audit
• session.loop() — Complete Loop orchestration with step callbacks and retry policies
• session.send() / session.sendStream() — natural language tool execution
• SessionConfig.preset — connect all servers for a country in one line
• SessionConfig.manageConnections — block until servers are connected

12 Provider Adapters — all published at v0.2.0:

57 MCP Servers — all published on npm under @codespar/mcp-*:

• 14 payments, 5 fiscal, 5 logistics, 5 messaging, 8 banking
• 8 ERP, 3 e-commerce, 4 crypto, 1 public data, 4 agentic protocols
• Coverage: Brazil (35+), Mexico (5), Argentina (5), Colombia (4)

Documentation 2026-04-17

• 12 provider docs pages with full agent loop examples
• 4 cookbooks: Pix Payment Agent, E-Commerce Checkout, Multi-Provider, Streaming Chat
• "How CodeSpar Works" architecture explainer
• Servers & Toolkits catalog (57 servers)
• Expanded API Reference: Sessions, Tools, Connections, Servers
• MCP Generator guide
• Debugging & observability guide
• Build Your Own Server guide
• llms.txt and llms-full.txt for AI assistant context
• Fumadocs callouts fix (46 callouts migrated to <Callout> components)
• Theme toggle (light/dark/system), GitHub link, Discord link, Dashboard CTA
• Fraunces display font for toolkits pages

March 2026

v0.1.0 — Initial Release 2026-03-31

• @codespar/sdk@0.1.0 — initial SDK with session management
• @codespar/claude, @codespar/openai, @codespar/vercel, @codespar/mcp — first 4 adapters
• 20 MCP servers (Brazil-focused)
• Basic docs: intro, quickstart, 4 provider pages, concepts, API reference