{"name":"me.stabledrop/escrow-payments","slug":"stabledrop-escrow-payments","title":"Stabledrop escrow payments","description":"Stablecoin payments held in escrow the buyer can dispute, with a signed receipt of what happened.","url":"https://mcp.market/server/stabledrop-escrow-payments","rating":null,"grade":"C","score":57,"certified":false,"status":"active","category":"other","tags":[],"presence":{"score":0,"stars":null,"forks":null,"downloads_week":null,"last_push_at":null,"license":null},"claimed":false,"transport":"remote","callable_via_gateway":true,"default_price_micros":0,"repository":"https://github.com/conduit-ucpi/ap2service","website":"https://stabledrop.me","version":"1.0.20","remotes":[{"type":"streamable-http","url":"https://api.stabledrop.me/api/ap2/mcp"}],"packages":[],"tools":[{"name":"check_escrow_payment","description":"What has happened to a settled payment, from the `status_url` on its receipt.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"status_url":{"type":"string"}},"required":["status_url"],"additionalProperties":false}},{"name":"payment_qr","description":"A scannable code for a payment request, so nobody retypes an address.\n\nPass the `payment_uri` from `prepare_escrow_payment`. Returns a QR a phone wallet can scan,\nwith the token, network, destination and amount already in it.\n\n⚠️ A SEPARATE TOOL RATHER THAN PART OF `prepare`, because the two have different audiences.\n   `prepare` answers a machine and has to stay parseable; an image in its result would make\n   the structured fields something a client has to dig for. A person who needs the code asks\n   for it.\n\n⚠️ AND IT ENCODES THE URI, NOT THE BARE ADDRESS. A QR holding only an address leaves the\n   amount and the token to be entered by hand, which is the part worth removing — an escrow\n   funded with the wrong figure is not the escrow these terms derive to, and the money sits\n   at an address nothing can deploy to.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"payment_uri":{"type":"string"}},"required":["payment_uri"],"additionalProperties":false}},{"name":"prepare_escrow_payment","description":"Work out where a payment must go, before anybody signs or sends anything.\n\nReturns the escrow address these terms produce, and TWO ways to fund it. Both end at the\nsame address holding the same money; they differ only in who sends the transaction.\n\n**Transfer it yourself.** Send the tokens to the address from any wallet — a browser\nwallet, a hardware wallet, an exchange withdrawal. Nothing to sign for us, and no `payer`\nneeded, because the escrow never asks who paid: it reads its own balance. Then call\n`settle_escrow_payment` with no signature and we create the escrow around what is there.\n\n**Or let us relay it.** Pass `payer` and this returns an EIP-3009 authorization for them to\nsign. We broadcast it and pay the gas, so **the payer needs no gas at all**. This is the\nonly one an agent can complete unattended, and the only one that needs a key anywhere.\n\nEither way the address is the same, because it is a pure function of the terms. That is\nalso what makes the relayed form safe: the payer signs `to` as part of the authorization,\ncommitting to every term at once — alter any of them afterwards and the address moves and\nthe signature stops matching.\n\n`amount` is in the TOKEN's base units (1 USDC = 1000000), because that exact figure is one\nof the terms the address derives from.\n\n`expiry_timestamp` is an absolute Unix time — when the dispute window closes. `0` settles\ninstantly with no recourse. There is no default: \"instant, deliberately\" and \"nobody said\"\nare different, and a caller must not discover afterwards which one they got.\n\n`nominal_buyer` is who may dispute and receives a refund. For an agentic payment this should\nbe the PERSON, not the agent — they are the one who will later read a report and decide\nwhether to object.\n\n`external_id` keeps two otherwise-identical payments apart, and is one of the terms the\naddress derives from. **Leave it out and a unique one is generated.** That is the right\ndefault: two payments matching in seller, amount, maturity and buyer would otherwise derive\nto the SAME address, and funding the second sends money into the first escrow — recoverable\nonly after that one is claimed, and only to ITS buyer.\n\n⚠️ PASS BACK THE `external_id` THIS RETURNS, not the one you sent. A generated one is only\n   knowable from the result, and settle derives the address again from whatever it is given:\n   a different id is a different address, and the money is at this one.\n\nSupply your own for the opposite behaviour — a checkout hash gives \"one checkout, one\nescrow\", so re-presenting the same purchase returns the same address rather than a second.\n\n`description` is what the payment is FOR, in the buyer's own words — ask them for it rather\nthan defaulting. It is what they will be looking at in the dashboard weeks later deciding\nwhether to dispute, and \"Escrow payment\" tells them nothing about which one this was. It\ndoes not affect the address, so it can be set freely here.\n\n⚠️ 1 to 160 characters. Longer is refused HERE rather than at the chain, where the check\n   happens after the money has already moved.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"seller":{"type":"string"},"amount":{"type":"integer"},"expiry_timestamp":{"type":"integer"},"nominal_buyer":{"type":"string"},"external_id":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"payer":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"token_symbol":{"default":"USDC","type":"string"},"description":{"default":"Escrow payment","type":"string"}},"required":["seller","amount","expiry_timestamp","nominal_buyer"],"additionalProperties":false}},{"name":"read_published_page","description":"Read one of the published pages, for answering questions about how any of this works.\n\nUse it rather than guessing. What the fees are, how a dispute is decided and who decides it,\nwhat a buyer is agreeing to — all of it is written down, and none of it is safe to invent.\n\n    how-it-works         How an escrow payment works, start to finish\n    faq                  Common questions about escrow, fees, disputes and timing\n    arbitration-policy   How a dispute is decided, by whom, and on what evidence\n    terms-of-service     The terms a buyer and seller are agreeing to\n    privacy-policy       What is collected and why\n    plugins              The WordPress and Shopify integrations\n    home                 What the product is and who it is for","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"page":{"type":"string"}},"required":["page"],"additionalProperties":false}},{"name":"settle_escrow_payment","description":"Create the escrow around the money and return a signed receipt.\n\nWorks both ways, and which one runs is decided by whether you pass a signature:\n\n**Already transferred it yourself** — omit `authorization` and `signature`. We check the\naddress holds the amount and build the escrow around what is there. If the transfer has not\narrived it says so, and nothing is spent finding out.\n\n**Want us to relay it** — pass the payer's `authorization` and `signature`. We broadcast it\nand pay the gas, so the payer needs none. This process holds no key and signs nothing; it\nis handed a signature and carries it.\n\nPass the terms exactly as they were prepared. They ARE the escrow's address, so a single\naltered figure moves it — and with a signature, stops matching what the payer signed.\n\n⚠️ `external_id` MUST BE THE ONE `prepare_escrow_payment` RETURNED. It generates one when\n   you leave it out, and that generated value is only knowable from its result — send a\n   different one and this derives a different address, while the money is at the first.\n\n⚠️ The receipt reports what the seller will actually RECEIVE in `token_amount`, with the\n   platform fee named beside it. That is less than the amount authorised, and the two\n   reconcile: token_amount + creator_fee = amount.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"seller":{"type":"string"},"amount":{"type":"integer"},"expiry_timestamp":{"type":"integer"},"external_id":{"type":"string"},"nominal_buyer":{"type":"string"},"authorization":{"anyOf":[{"additionalProperties":true,"type":"object"},{"type":"null"}],"default":null},"signature":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"token_symbol":{"default":"USDC","type":"string"},"description":{"default":"Escrow payment","type":"string"}},"required":["seller","amount","expiry_timestamp","external_id","nominal_buyer"],"additionalProperties":false}},{"name":"verify_escrow_receipt","description":"Check a receipt's signature against the key its issuer publishes.\n\n⚠️ THE KEY IS FETCHED FROM THE RECEIPT'S OWN `iss`, NOT FROM WHOEVER HANDED IT OVER.\n   Otherwise anything that can serve a receipt can also serve the key that vouches for it,\n   and the signature stops meaning anything.\n\nUse this on receipts from anywhere, including ones this server did not produce.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"payment_receipt":{"type":"string"}},"required":["payment_receipt"],"additionalProperties":false}}],"scan":{"score":57,"grade":"C","scanned_at":"2026-09-18T00:15:42.812Z","report":{"scannerVersion":"0.1.2","scannedAt":"2026-09-18T00:15:42.708Z","components":{"code":{"score":-1,"max":25,"notes":["remote-only server, no package to scan"]},"reliability":{"score":20,"max":20,"notes":["remote reachable in 1820ms"]},"poisoning":{"score":13,"max":15,"notes":["6 tool descriptions checked"]},"auth":{"score":3,"max":15,"notes":["open endpoint exposes 1 write-action tools with no auth"]},"maintenance":{"score":3,"max":15,"notes":["repository not readable: repo not found"]},"identity":{"score":4,"max":10,"notes":["verified namespace with website, no repo"]}},"findings":[{"id":"auth.open-write","severity":"high","component":"auth","title":"Write-action tools reachable without authentication"},{"id":"poison.long-description","severity":"low","component":"poisoning","title":"Unusually long tool description (over 2,000 characters)","evidence":"tool prepare_escrow_payment: …Work out where a payment must go, before anybody signs or sends anything. Returns the escrow address these terms produce, and TWO ways to fund it. Both end at the same address holding the same money; they differ only in who sends the transaction. **Transfer it yourself.** Send the tokens to the address from any wallet — a browser wallet, a hardware wallet, an exchange withdrawal. Nothing to sign for us, and no `payer` needed, because the escrow never asks who paid: it reads its own balance. Then call `settle_escrow_payment` with no signature and we create the escrow around what is there. **Or let us relay it.** Pass `payer` and this returns an EIP-3009 authorization for them to sign. We broadcast it and pay the gas, so **the payer needs no gas at all**. This is the only one an agent can complete unattended, and the only one that needs a key anywhere. Either way the address is the same, because it is a pure function of the terms. That is also what makes the relayed form safe: the payer signs `to` as part of the authorization, committing to every term at once — alter any of them afterwards and the address moves and the signature stops matching. `amount` is in the TOKEN's base units (1 USDC = 1000000), because that exact figure is one of the terms the address derives from. `expiry_timestamp` is an absolute Unix time — when the dispute window closes. `0` settles instantly with no recourse. There is no default: \"instant, deliberately\" and \"nobody said\" are different, and a caller must not discover afterwards which one they got. `nominal_buyer` is who may dispute and receives a refund. For an agentic payment this should be the PERSON, not the agent — they are the one who will later read a report and decide whether to object. `external_id` keeps two otherwise-identical payments apart, and is one of the terms the address derives from. **Leave it out and a unique one is generated.** That is the right default: two payments matching in seller, amount, maturity and buyer would otherwise derive to the SAME address, and funding the second sends money into the first escrow — recoverable only after that one is claimed, and only to ITS buyer. ⚠️ PASS BACK THE `external_id` THIS RETURNS, not the one you sent. A generated one is only knowable from the result, and settle derives the address again from whatever it is given: a different id is a different address, and the money is at this one. Supply your own for the opposite behaviour — a checkout hash gives \"one checkout, one escrow\", so re-presenting the same purchase returns the same address rather than a second. `description` is what the payment is FOR, in the buyer's own words — ask them for it rather than defaulting. It is what they will be looking at in the dashboard weeks later deciding whether to dispute, and \"Escrow payment\" tells them nothing about which one this was. It does not affect the address, so it can be set freely here. ⚠️ 1 to 160 characters. Longer is refused HERE rather than at the chain, where the check happens after the money has already moved.…"}],"inputs":{"probes":[{"url":"https://api.stabledrop.me/api/ap2/mcp","reachable":true,"authRequired":false,"latencyMs":1820,"serverInfo":{"name":"Escrow payments with a dispute window","version":"4.0.4"}}],"packages":[],"repo":{"found":false,"owner":"conduit-ucpi","repo":"ap2service","error":"repo not found"}}}},"grade_history":[],"reviews":[]}