NVM Pay

Latest Audit Result

NVM Pay (Nevermined x402 card delegation) is a payment-only integration, not an SDK consumer. The exa-labs/nvm-exa repo does not exist on GitHub; the actual implementation lives in exa-labs/monorepo at typescript/team-management/team_management/nevermined/ (router.ts, x402-middleware.ts, routes/provision.ts, services/provisioning.ts, services/topup.ts) and is documented at docs/integrations/nvm-pay.mdx. The integration exposes a single endpoint POST /team-management/nevermined/purchase-key that verifies an x402 token, settles the $10 payment via @nevermined-io/payments, and either provisions a new Exa team+API key (with Orb billing) or tops up an existing payer's key. It does NOT call /search, /contents, /findSimilar, /answer, or /research; the user uses the returned API key directly against api.exa.ai. No exa-js or exa-py SDK is installed (current_sdk_version: null; latest exa-js on npm: 2.12.1). The Nevermined SDK (@nevermined-io/payments ^1.3.2) is at the latest published version. Health=needs_audit because the integrations registry declares search/get_contents/search_type=auto/content=text capabilities that the integration does not actually implement — these declarations should be removed or relabelled as 'payment gateway only / not an SDK wrapper'.

Missing Features (8)

• search (declared but integration does not call /search; only provisions keys)
• get_contents (declared but integration does not call /contents)
• search_type=auto (no search params are passed through; integration is payment-only)
• content=text (no content options are passed through; integration is payment-only)
• findSimilar (issued key supports it but not declared/wrapped in integration)
• answer (issued key supports it but not declared/wrapped in integration)
• research (issued key supports it but not declared/wrapped in integration)
• exa-js / exa-py SDK is not used at all in this integration