{"name":"io.github.100xPercent/pop-pay","slug":"100xpercent-pop-pay","title":null,"description":"Runtime security for AI agent commerce. CLI + MCP server blocks hallucinated purchases.","url":"https://mcp.market/server/100xpercent-pop-pay","rating":null,"grade":"C","score":68,"certified":false,"status":"active","category":"ai","tags":["ai","security"],"presence":{"score":23,"stars":1,"forks":2,"downloads_week":100,"last_push_at":"2026-07-07T06:20:33.000Z","license":"MIT"},"uptime":null,"claimed":false,"transport":"npm","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/100xPercent/pop-pay","website":null,"version":"0.5.7","remotes":[],"packages":[{"registryType":"npm","identifier":"pop-pay","version":"0.5.7","transport":{"type":"stdio"},"runtimeArguments":[{"isRequired":true,"value":"launch-mcp","type":"positional"}],"environmentVariables":[{"description":"Chrome DevTools Protocol endpoint for credential injection (default: http://localhost:9222)","format":"string","default":"http://localhost:9222","name":"POP_CDP_URL"},{"description":"JSON array of allowed vendor categories (e.g. '[\"aws\",\"cloudflare\"]')","format":"string","default":"[\"aws\",\"cloudflare\"]","name":"POP_ALLOWED_CATEGORIES"},{"description":"Per-transaction spending limit in USD","format":"string","default":"100.0","name":"POP_MAX_PER_TX"},{"description":"Daily spending limit in USD","format":"string","default":"500.0","name":"POP_MAX_DAILY"},{"description":"Guardrail engine: 'keyword' (offline, default) or 'llm' (requires API key)","format":"string","default":"keyword","name":"POP_GUARDRAIL_ENGINE"}]}],"tools":[{"name":"request_purchaser_info","description":"Auto-fill purchaser/billing info (name, email, phone, address) from the user's pre-configured profile. Call when on a billing/contact info page WITHOUT card fields visible.","write_action":false,"price_micros":0,"input_schema":null},{"name":"request_virtual_card","description":"Request a one-time virtual credit card for an automated purchase. ONLY call when card input fields are visible on the checkout page.","write_action":false,"price_micros":0,"input_schema":null},{"name":"request_x402_payment","description":"Pay for an API call or service using the x402 HTTP payment protocol.","write_action":true,"price_micros":0,"input_schema":null}],"scan":{"score":68,"grade":"C","scanned_at":"2026-09-27T22:34:37.900Z","report":{"scannerVersion":"0.1.9","scannedAt":"2026-09-27T22:34:37.870Z","components":{"code":{"score":13,"max":25,"notes":["42 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":12,"max":15,"notes":["local package, no credentials required"]},"maintenance":{"score":12,"max":15,"notes":["last push 83 days ago"]},"identity":{"score":7,"max":10,"notes":["registry namespace matches repository owner"]}},"findings":[{"id":"exec.shell-concat","severity":"high","component":"code","title":"Shell command built from a string (injection risk)","evidence":"dist/cli.js: … try { const found = execSync(`which ${name}`, { encoding: \"utf8\" }).trim(); …"}],"inputs":{"packages":[{"registryType":"npm","identifier":"pop-pay","version":"0.5.7","found":true,"license":"MIT","hasInstallScripts":false,"dependencyCount":5,"publishedAt":"2026-04-13T23:03:32.257Z","repositoryUrl":"git+https://github.com/100xPercent/pop-pay.git","weeklyDownloads":100}],"repo":{"found":true,"owner":"100xPercent","repo":"pop-pay","archived":false,"pushedAt":"2026-07-07T06:20:33Z","stars":1,"forks":2,"openIssues":5,"ownerType":"Organization","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/275220085?v=4","ownerCreatedAt":"2026-04-11T03:30:55Z","license":"MIT"},"icon":{"url":null,"source":"none"},"presence":{"stars":1,"forks":2,"downloadsWeek":100,"license":"MIT","lastPushAt":"2026-07-07T06:20:33.000Z","score":23}}}},"grade_history":[],"reviews":[]}