MCP.Market

Pop Pay MCP server

by 100xPercent·io.github.100xPercent/pop-pay·v0.5.7·1 stars
No reviews yet

Runtime security for AI agent commerce. CLI + MCP server blocks hallucinated purchases.

C68/100grade C
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
C68/100

full report

Adoption
Growing

1 stars100 downloads/wk

Reviews

Write one

Nobody has reviewed Pop Pay yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Pop Pay tools (3, 1 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • request_purchaser_info

    Auto-fill purchaser/billing info (name, email, phone, address) from the user's pre-configured profile. Call when on a billing/contact info page WITHOUT card fields visible.

  • request_virtual_card

    Request a one-time virtual credit card for an automated purchase. ONLY call when card input fields are visible on the checkout page.

  • request_x402_paymentwrite action

    Pay for an API call or service using the x402 HTTP payment protocol.

Public scan report

scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it

1 high
  • Code scan42 source files scanned13/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 83 days ago12/15
  • Maintainer identityregistry namespace matches repository owner7/10

Findings (1)

  • highShell command built from a string (injection risk)exec.shell-concat
    dist/cli.js: … try { const found = execSync(`which ${name}`, { encoding: "utf8" }).trim(); …
Overall 68/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Pop Pay compares

Against every graded AI and agents MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
68/100
higher than 33% of 4,460 AI and agents servers
Tools
3
the typical AI and agents server has 6
Tools that change things
33%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
1
more than 50% of 2,711 AI and agents servers
Downloads a week
100
more than 64% of 1,538 AI and agents servers with a package

What its tools let an agent do: 2 read · 1 change

Install Pop Pay in Claude Code, Cursor or VS Code

Runs npx -y pop-pay on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add pop-pay -- npx -y pop-pay
Add to Cursor

What the publisher says

From the Pop Pay repository's README, as published. We do not edit it. Read it on GitHub

Point One Percent — pop-pay

it only takes 0.1% of Hallucination to drain 100% of your wallet.

The runtime security layer for AI agent commerce. Drop-in CLI + MCP server. Card credentials are injected directly into the browser DOM via CDP — they never enter the agent's context window. One hallucinated prompt can't drain a wallet it can't see.

📄 Research Dataset & Reproduction — this repository hosts the open dataset and reproduction harness for "The Illusion of Single-Attacker Rankings". research: jump to Research Dataset & Reproduction.

Install

Choose your preferred method:

Homebrew (macOS)

brew install 100xpercent/tap/pop-pay

curl (Linux / macOS) — bootstraps via npm; requires Node.js 18+

curl -fsSL https://raw.githubusercontent.com/100xPercent/pop-pay/main/install.sh | sh

npm (global)

npm install -g pop-pay

npx (no install — one-off runs)

npx -y pop-pay <command>

All install paths expose the same binaries: pop-pay, pop-launch, pop-init-vault, pop-unlock.

Also available as @100xpercent/mcp-server-pop-pay — identical package under the MCP @scope/mcp-server- convention. Tracks the same version on every release.

Using Python? Check out pop-pay-python — pip install pop-pay. Same security model, same vault format, independent release cycle — safe to switch between runtimes.

Quick Start (CLI)

1. Initialize the encrypted credential vault

pop-pay init-vault

This encrypts your card credentials into ~/.config/pop-pay/vault.enc (AES-256-GCM). For stronger protection (blocks agents with shell access):

pop-pay init-vault --passphrase   # one-time setup
pop-pay unlock                     # run once per session

2. Launch Chrome with CDP remote debugging

pop-pay launch

This opens a Chromium instance on http://localhost:9222 that pop-pay injects credentials into. Your agent (via MCP, browser automation, or x402) then drives the checkout flow — card details never leave the browser process.

3. Plug into your agent

The CLI launches infrastructure; the actual payment tool calls come from your agent. Two supported paths:

  • MCP server — add pop-pay to any MCP-compatible client (Claude Code, Cursor, Windsurf, OpenClaw). See MCP Server below.
  • x402 HTTP — pay for API calls via the x402 payment protocol.

Full CLI reference: pop-pay --help.

MCP Server (optional)

Add to your MCP client

Standard config for any MCP-compatible client:

{
  "mcpServers": {
    "pop-pay": {
      "command": "npx",
      "args": ["-y", "pop-pay", "launch-mcp"],
      "env": {
        "POP_CDP_URL": "http://localhost:9222"
      }
    }
  }
}

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Pop Pay: common questions

Is Pop Pay MCP server safe?
With care: it is graded C, so read the findings first (68/100). Read the Pop Pay safety report
How do I install Pop Pay?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Pop Pay need an API key?
No secret keys are declared. It reads 5 settings from the environment.
Is Pop Pay maintained?
The last commit was 120 days ago (2026-07-07). The latest release is v0.5.7.
What can I use instead of Pop Pay?
Servers from other publishers that do the same job: Agent Security Scanner MCP server, HOL Guard MCP server and mcptoon MCP server.
How does Pop Pay compare with other AI and agents MCP servers?
safety score 68/100 (higher than 33% of 4,460 AI and agents servers); tools 3 (the typical AI and agents server has 6); tools that change things 33% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Pop Pay

Same job from other publishers: the closest match first, then the best rated.

  • Agent Security Scanner
    Security layer for AI agents: blocks prompt injection, detects fake packages, scans vulnerabilities.
    C
  • HOL Guard
    Local-first AI agent security evidence and approval workflows through HOL Guard's stdio MCP server.
    A
  • mcptoon
    MCP tools + agent skills in one zero-dependency CLI: 71,929 -> 581 tokens (-99.2%, measured).
    A
  • yutu
    CLI, MCP server, and AI agent to automate YouTube workflows
    A
  • Decionis Commerce Gate MCP
    Commerce preflights, D365 authorization; opt-in agent writes require authorized backend connectors.
    A