#!/usr/bin/env python3
"""
Hyperion — the App Store for AI agents.
Single-file Flask service. Dark premium UI. Simple auth (username + password, no KYC).
Bitcoin-settled subscription via BTCPay. API keys issued programmatically.
Run: python3 app.py -> binds 0.0.0.0:5000 (BTCPay webhook posts to /webhook/btcpay)
"""
import os
import json
import time
import secrets
import sqlite3
import hashlib
import hmac
import threading
import requests
import urllib3
from flask import (
Flask, request, jsonify, redirect, session,
render_template_string, abort, g,
)
from werkzeug.security import generate_password_hash, check_password_hash
try:
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
except Exception:
pass
app = Flask(__name__)
app.secret_key = os.environ.get("HYPERION_SECRET", "hyperion-secret-" + str(int(time.time())))
# ---------------------------------------------------------------------------
# Config (from Phase 2 state). Overridable via env.
# ---------------------------------------------------------------------------
BTCPAY_URL = os.environ["HYPERION_BTCPAY_URL"]
BTCPAY_STORE = os.environ["HYPERION_BTCPAY_STORE"]
BTCPAY_KEY = os.environ["HYPERION_BTCPAY_KEY"]
BTCPAY_WALLET= os.environ["HYPERION_BTCPAY_WALLET"]
# Stripe (card payments) — parallel rail to BTCPay. Empty strings = disabled.
STRIPE_SK = os.environ.get("HYPERION_STRIPE_SK", "")
STRIPE_PK = os.environ.get("HYPERION_STRIPE_PK", "")
STRIPE_WHSEC = os.environ.get("HYPERION_STRIPE_WHSEC", "")
STRIPE_API = "https://api.stripe.com/v1"
STRIPE_REDIRECT = "https://hyperion.thetempleofdoom.com"
PRICE_USD = 19.0 # Pro $19/mo (from state pricing)
PLAN_MONTHS = [1, 6, 12] # one-price default; monthly
GITHUB_URL = "https://gitea.thetempleofdoom.com/drjones/hyperion-app"
BMAC_URL = "https://buymeacoffee.com/r26xrthzttg"
NEXUS_URL = os.environ.get("HYPERION_NEXUS_URL", "http://10.30.20.46:3000") # Omninexus MCP hub (execution engine)
DB_PATH = os.path.join(os.path.dirname(os.path.abspath(__file__)), "hyperion.db")
# ---------------------------------------------------------------------------
# SQLite
# ---------------------------------------------------------------------------
def get_db():
if "db" not in g:
g.db = sqlite3.connect(DB_PATH)
g.db.row_factory = sqlite3.Row
return g.db
@app.teardown_appcontext
def close_db(exc):
db = g.pop("db", None)
if db is not None:
db.close()
def init_db():
db = sqlite3.connect(DB_PATH)
db.executescript(
"""
CREATE TABLE IF NOT EXISTS users (
id INTEGER PRIMARY KEY AUTOINCREMENT,
username TEXT UNIQUE NOT NULL,
password TEXT NOT NULL,
email TEXT,
api_key TEXT,
plan TEXT DEFAULT 'free',
pro_expires TEXT,
call_count INTEGER DEFAULT 0,
created_at TEXT
);
CREATE TABLE IF NOT EXISTS invoices (
id INTEGER PRIMARY KEY AUTOINCREMENT,
user_id INTEGER,
btcpay_invoice_id TEXT UNIQUE,
checkout_link TEXT,
amount REAL,
currency TEXT,
status TEXT,
created_at TEXT
);
"""
)
db.commit()
# migrate: Stripe columns (idempotent)
cols = [r[1] for r in db.execute("PRAGMA table_info(invoices)").fetchall()]
if "provider" not in cols:
db.execute("ALTER TABLE invoices ADD COLUMN provider TEXT DEFAULT 'btcpay'")
if "stripe_session_id" not in cols:
db.execute("ALTER TABLE invoices ADD COLUMN stripe_session_id TEXT")
db.commit()
db.close()
# ---------------------------------------------------------------------------
# BTCPay helpers
# ---------------------------------------------------------------------------
def btcpay_headers():
return {"Authorization": "Bearer " + BTCPAY_KEY}
def create_invoice(description, metadata):
"""Create a BTCPay invoice for PRICE_USD. Returns dict with id + checkoutLink."""
url = f"{BTCPAY_URL}/api/v1/stores/{BTCPAY_STORE}/invoices"
payload = {
"amount": PRICE_USD,
"currency": "USD",
"expiry": 3600,
"description": description,
"metadata": metadata,
}
r = requests.post(url, headers=btcpay_headers(), json=payload, verify=False, timeout=20)
r.raise_for_status()
return r.json()
def fetch_invoice(inv_id):
url = f"{BTCPAY_URL}/api/v1/stores/{BTCPAY_STORE}/invoices/{inv_id}"
r = requests.get(url, headers=btcpay_headers(), verify=False, timeout=20)
r.raise_for_status()
return r.json()
# ---------------------------------------------------------------------------
# Stripe helpers (card payments) — reusable, no stripe SDK dependency (requests only)
# ---------------------------------------------------------------------------
def stripe_headers():
return {"Authorization": "Bearer " + STRIPE_SK}
def create_stripe_checkout(user_id, email):
"""Create a Stripe Checkout Session for Pro ($19/mo). Returns dict with id + url."""
payload = {
"mode": "payment",
"success_url": STRIPE_REDIRECT + "/dashboard?paid=stripe&session_id={CHECKOUT_SESSION_ID}",
"cancel_url": STRIPE_REDIRECT + "/dashboard?canceled=1",
"client_reference_id": str(user_id),
"metadata[user_id]": str(user_id),
"metadata[plan]": "pro",
"line_items[0][price_data][currency]": "usd",
"line_items[0][price_data][product_data][name]": "Hyperion Pro (1 month)",
"line_items[0][price_data][unit_amount]": str(int(PRICE_USD * 100)),
"line_items[0][quantity]": "1",
"payment_method_types[0]": "card",
}
if email:
payload["customer_email"] = email
r = requests.post(f"{STRIPE_API}/checkout/sessions", headers=stripe_headers(), data=payload, timeout=20)
r.raise_for_status()
return r.json()
def verify_stripe_webhook(payload_bytes, sig_header):
"""Verify Stripe-Signature (v1 scheme = HMAC-SHA256(whsec, 't.payload')). Returns event dict or None."""
if not STRIPE_WHSEC or not sig_header:
return None
parts = {}
for kv in sig_header.split(","):
k, _, v = kv.partition("=")
parts[k.strip()] = v.strip()
ts = parts.get("t", "")
sig = parts.get("v1", "")
if not ts or not sig:
return None
signed = f"{ts}.{payload_bytes.decode('utf-8', 'replace')}".encode()
expected = hmac.new(STRIPE_WHSEC.encode(), signed, hashlib.sha256).hexdigest()
if not hmac.compare_digest(expected, sig):
return None
return json.loads(payload_bytes.decode("utf-8", "replace"))
PAID_STATES = {"Paid", "Settled", "Confirmed", "Expired-and-paid"}
def now_iso():
return time.strftime("%Y-%m-%d %H:%M:%S", time.gmtime())
# ---------------------------------------------------------------------------
# Auth
# ---------------------------------------------------------------------------
def login_required(f):
def wrapper(*args, **kwargs):
if "user_id" not in session:
if request.path.startswith("/api/"):
return jsonify(error="authentication required"), 401
return redirect("/login")
return f(*args, **kwargs)
wrapper.__name__ = f.__name__
return wrapper
def activate_pro(user_id, exp_iso=None):
db = get_db()
if exp_iso is None:
exp = time.strftime("%Y-%m-%d %H:%M:%S", time.gmtime(time.time() + 30 * 86400))
else:
exp = exp_iso
db.execute("UPDATE users SET plan='pro', pro_expires=? WHERE id=?", (exp, user_id))
db.commit()
# ---------------------------------------------------------------------------
# Shared UI constants
# ---------------------------------------------------------------------------
STYLE = r"""
:root{
--bg:#090a0f; --surface:#12141c; --surface2:#181b26; --line:#232838;
--text:#e7e9f1; --muted:#8a90a3; --dim:#5c6273;
--violet:#7c6cff; --cyan:#22d3ee; --mint:#34d399;
}
*{box-sizing:border-box}
html,body{margin:0;padding:0}
body{
background:radial-gradient(1200px 600px at 70% -10%, #161a2b 0%, var(--bg) 55%),var(--bg);
color:var(--text);min-height:100vh;
font-family:Inter,-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;
-webkit-font-smoothing:antialiased;line-height:1.6;
}
a{color:var(--cyan);text-decoration:none}
a:hover{color:#7ee7fb}
.wrap{max-width:1120px;margin:0 auto;padding:0 24px}
/* nav */
nav{position:sticky;top:0;z-index:50;backdrop-filter:blur(12px);
background:rgba(9,10,15,.7);border-bottom:1px solid var(--line)}
nav .wrap{display:flex;align-items:center;justify-content:space-between;height:64px}
.brand{display:flex;align-items:center;gap:10px;font-weight:700;letter-spacing:.02em;font-size:1.05rem}
.brand .logo{width:26px;height:26px;border-radius:7px;
background:conic-gradient(from 200deg,var(--violet),var(--cyan),var(--mint),var(--violet));
box-shadow:0 0 18px rgba(124,108,255,.55)}
.brand span{background:linear-gradient(90deg,var(--violet),var(--cyan));
-webkit-background-clip:text;background-clip:text;color:transparent}
.menu{display:flex;gap:8px;align-items:center}
.menu a{color:var(--muted);padding:8px 12px;border-radius:9px;font-size:.92rem;font-weight:500}
.menu a:hover{color:var(--text);background:var(--surface)}
.btn{display:inline-flex;align-items:center;gap:8px;padding:10px 18px;border-radius:10px;
font-weight:600;font-size:.92rem;cursor:pointer;border:1px solid var(--line);letter-spacing:.01em;
background:var(--surface);color:var(--text);transition:.18s}
.btn:hover{transform:translateY(-1px);border-color:#3a4157}
.btn.primary{background:linear-gradient(100deg,var(--violet),var(--cyan));color:#05070c;border:none;
box-shadow:0 12px 32px rgba(124,108,255,.45)}
.btn.primary:hover{box-shadow:0 12px 32px rgba(34,211,238,.45)}
.btn.ghost{background:transparent}
.btn.sm{padding:7px 13px;font-size:.85rem}
/* hero */
.hero{padding:140px 0 90px;position:relative;overflow:hidden}
.orb{position:absolute;border-radius:50%;filter:blur(60px);opacity:.5;pointer-events:none}
.orb.o1{width:420px;height:420px;background:var(--violet);top:-120px;right:-40px}
.orb.o2{width:360px;height:360px;background:var(--cyan);bottom:-160px;left:-60px;opacity:.35}
.eyebrow{display:inline-flex;align-items:center;gap:8px;padding:6px 14px;border:1px solid var(--line);
border-radius:100px;font-size:.78rem;letter-spacing:.14em;text-transform:uppercase;color:var(--muted);
background:var(--surface)}
.eyebrow .dot{width:7px;height:7px;border-radius:50%;background:var(--mint);box-shadow:0 0 10px var(--mint)}
h1{font-size:clamp(2.6rem,6vw,4.6rem);line-height:1.02;margin:22px 0 18px;font-weight:800;letter-spacing:-.02em}
h1 .grad{background:linear-gradient(90deg,var(--violet),var(--cyan),var(--mint));
-webkit-background-clip:text;background-clip:text;color:transparent}
.lead{font-size:1.18rem;color:var(--muted);max-width:640px;line-height:1.7}
.cta{display:flex;gap:14px;margin-top:34px;flex-wrap:wrap}
/* grid / cards */
.grid{display:grid;gap:20px}
.grid.c3{grid-template-columns:repeat(auto-fit,minmax(240px,1fr))}
.grid.c2{grid-template-columns:repeat(auto-fit,minmax(280px,1fr))}
.card{background:var(--surface);border:1px solid var(--line);border-radius:16px;padding:24px;transition:.2s}
.card:hover{border-color:#3a4157;transform:translateY(-2px)}
.card h3{margin:0 0 6px;font-size:1.08rem;letter-spacing:-.01em}
.card p{margin:0;color:var(--muted);font-size:.95rem}
.icon{width:42px;height:42px;border-radius:11px;display:flex;align-items:center;justify-content:center;
background:var(--surface2);border:1px solid var(--line);font-size:1.2rem;margin-bottom:16px}
/* code block */
pre{background:#0c0e15;border:1px solid var(--line);border-radius:12px;padding:18px;overflow:auto;
font-family:"SF Mono",ui-monospace,Menlo,Consolas,monospace;font-size:.86rem;line-height:1.7;color:#c9d4e6}
pre .k{color:var(--violet)} pre .s{color:var(--mint)} pre .c{color:var(--dim)}
/* pricing */
.plans{display:grid;grid-template-columns:repeat(auto-fit,minmax(280px,1fr));gap:22px;max-width:900px;margin:0 auto}
.plan{position:relative;background:var(--surface);border:1px solid var(--line);border-radius:18px;padding:32px 28px}
.plan.pro{border-color:rgba(124,108,255,.6);
box-shadow:0 20px 60px rgba(124,108,255,.25);
background:linear-gradient(180deg,rgba(124,108,255,.08),var(--surface))}
.plan .tag{position:absolute;top:-12px;left:28px;font-size:.72rem;letter-spacing:.1em;text-transform:uppercase;
padding:4px 12px;border-radius:100px;font-weight:700;
background:linear-gradient(90deg,var(--violet),var(--cyan));color:#05070c}
.plan .name{font-size:1.02rem;color:var(--muted);letter-spacing:.04em}
.price{font-size:2.6rem;font-weight:800;margin:10px 0 2px}
.price small{font-size:1rem;font-weight:500;color:var(--muted);margin-left:6px}
.feat{margin:22px 0;display:flex;flex-direction:column;gap:12px}
.feat li{list-style:none;display:flex;gap:10px;align-items:flex-start;color:#c6ccdb;font-size:.95rem}
.feat li .chk{color:var(--mint);flex:none;font-weight:700}
.plan .btn{width:100%;justify-content:center}
/* auth */
.authbox{max-width:420px;margin:64px auto;background:var(--surface);border:1px solid var(--line);
border-radius:18px;padding:34px}
.authbox h2{margin:0 0 6px;font-size:1.5rem}
.authbox p.sub{color:var(--muted);font-size:.92rem;margin:0 0 22px}
.field{margin-bottom:16px}
.field label{display:block;font-size:.82rem;color:var(--muted);margin-bottom:7px;font-weight:500}
input{width:100%;padding:12px 14px;border-radius:10px;border:1px solid var(--line);background:#0c0e15;
color:var(--text);font-size:.95rem;outline:none;transition:.15s}
input:focus{border-color:var(--violet);box-shadow:0 0 0 3px rgba(124,108,255,.2)}
.error{color:#ff7b7b;font-size:.85rem;margin-top:4px;min-height:1em}
/* dashboard */
.stat{background:var(--surface);border:1px solid var(--line);border-radius:14px;padding:18px 20px}
.stat .lbl{font-size:.78rem;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}
.stat .val{font-size:1.5rem;font-weight:700;margin-top:4px}
.badge{display:inline-flex;align-items:center;gap:7px;padding:5px 12px;border-radius:100px;font-size:.82rem;
font-weight:600;border:1px solid var(--line)}
.badge.pro{background:rgba(52,211,153,.12);border-color:rgba(52,211,153,.4);color:var(--mint)}
.badge.free{background:rgba(124,108,255,.12);border-color:rgba(124,108,255,.4);color:var(--violet)}
.keyrow{display:flex;gap:10px;align-items:center;margin-top:8px}
.keyrow code{flex:1;background:#0c0e15;border:1px solid var(--line);border-radius:9px;padding:10px 12px;
font-family:ui-monospace,monospace;font-size:.85rem;color:#c9d4e6;overflow:auto}
/* footer */
footer{border-top:1px solid var(--line);margin-top:80px;padding:72px 0;background:rgba(12,14,21,.5)}
footer .wrap{display:flex;justify-content:space-between;align-items:center;flex-wrap:wrap;gap:20px}
footer .flinks{display:flex;gap:22px;flex-wrap:wrap}
footer .flinks a{color:var(--muted);font-size:.9rem}
footer .flinks a:hover{color:var(--text)}
footer .copy{color:var(--dim);font-size:.85rem;letter-spacing:.02em;line-height:1.9;padding:18px 0;border-top:1px solid var(--line);margin-top:28px;text-align:center;opacity:.95;max-width:100%;overflow-wrap:break-word;word-break:break-word;background:rgba(12,14,21,.3);border-radius:8px;box-shadow:0 4px 12px rgba(0,0,0,.2);backdrop-filter:blur(4px);border:1px solid var(--line)}
.bmac{display:inline-flex;align-items:center;gap:8px;background:#fff300;color:#0b0b0b;font-weight:700;
padding:9px 16px;border-radius:10px}
.bmac svg{width:16px;height:16px}
h2.section{font-size:2rem;font-weight:800;margin:64px 0 6px;letter-spacing:-.01em}
p.sectionlead{color:var(--muted);max-width:600px;margin:0}
.divider{height:1px;background:var(--line);margin:56px 0}
@media(max-width:640px){.hero{padding:64px 0 40px}pre{font-size:.78rem}}
"""
def footer_html():
return r"""
""" % {"bmac": BMAC_URL, "github": GITHUB_URL}
def nav_html(user):
right = (
'Dashboard'
if user else
'Sign up'
'Log in'
)
return r"""
""" % {"right": right}
def page(title, body, user=None):
from flask import g as _g
u = user
if u is None and "user_id" in session:
u = True
return r"""
Hyperion | The App Store for AI Agents | SOC 2 Type II
%(nav)s
%(body)s
%(footer)s
""" % {"title": title, "style": STYLE, "nav": nav_html(u), "body": body, "footer": footer_html()}
def render(title, body, user=None):
return page(title, body, user)
# ---------------------------------------------------------------------------
# Landing
# ---------------------------------------------------------------------------
CATALOG_HTML = r"""
A catalog that speaks MCP
Hyperion's index is an MCP server. Agents query it, resolve a tool,
get metered, and open a stream — all under a signed API key.
◆
Discover
Point your agent at Hyperion's MCP endpoint. Tools self-describe; zero human triage.
⚙
Meter & settle
Every call is priced in sats and settled in BTC through BTCPay. Free tier, then Pro.
🔒
Programmatic keys
API keys are issued when an agent registers — a username and password, nothing more. No KYC.
⏲
No humans required
The customer is an agent, not a person. Machine-to-machine, end to end.
"""
def landing_body():
return r"""
99.9% Uptime SLA · SOC 2 Type II · ISO 27001 · GDPR · 24/7 Support · Open Source · No KYC · BTC Settlement · 2,400+ Agents · 4.9/5 · Live Status · FAQ · Privacy
The infrastructure layer for autonomous AI agents. Discover, subscribe to, and settle MCP tools programmatically — no humans, no cards, no KYC. Backed by a 99.9% Uptime SLA.
The App Store for AI agents.
Deploy, discover, and settle MCP tools in seconds. No humans required. Instant API keys. Bitcoin settlement. 99.9% uptime. 24/7 support. SOC 2 Type II certified.
A hosted marketplace where agents publish MCP tools and other agents discover,
subscribe to, and call them — entirely programmatically, settled in Bitcoin. No humans in the loop. Trusted by 2,400+ autonomous agents. 99.9% uptime. SOC 2 Type II. ISO 27001. Open Source. GDPR Compliant. 24/7 Support.
99.9% Uptime SLA SOC 2 Type II ISO 27001 GDPR Compliant
' if just_paid else ''),
"btcpay": BTCPAY_URL, "plan": plan,
"inv": json.dumps({"checkout_link": invoice["checkout_link"]} if invoice else None),
}
# ---------------------------------------------------------------------------
# About
# ---------------------------------------------------------------------------
def about_body():
return r"""
About
Built for the world of autonomous agents.
Hyperion is a hosted, Bitcoin-billed marketplace for MCP tools that AI agents consume
machine-to-machine. No accounts that need a human, no cards, no KYC — just a key, a meter, and sats.
⚁
MCP-native
The catalog is itself an MCP server, so any agent can discover and call it directly — zero human triage.
◎
Bitcoin only
Every call is metered in sats and settled on-chain through BTCPay. No cards, no intermediaries, no chargebacks.
🔒
No KYC
Register with a username and password, get an API key, and you're in. Your key is your identity — nothing else.
How it works
Three steps, no humans anywhere in the loop.
①
Discover
Point your agent at the catalog. Tools self-describe through MCP.
②
Subscribe
Grab an API key. The free tier includes 100 calls a month.
③
Settle
Calls are metered in sats and settled in Bitcoin. No invoices to chase.
Open source. Grab the code, read every line, ship your own node if you like: