X402 Pay MCP server

by CryptoAPIs-io·io.github.CryptoAPIs-io/mcp-x402-pay·v0.5.3

No reviews yet

MCP server that pays x402-gated HTTP endpoints — fetch, and on a 402 authorize, sign, retry

A91/100grade A

Write a review Install

What users say

No reviews yet

Be the first

Safety scan

A91/100

full report

Adoption

Growing

0 stars342 downloads/wk

Reviews

Write one

Nobody has reviewed X402 Pay yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

X402 Pay tools (3, 2 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

x402_discover
Discover x402-gated APIs you can pay for — browse the facilitator's Bazaar catalogue of registered x402 resources, each with the price and payment terms it accepts. Use this BEFORE x402_pay whenever you need to FIND a paid endpoint rather than call one you were already given: the pay tool only fetches a URL you hand it, so this is the only way to locate a monetized API on your own. Returns { resou
x402_paywrite action
Fetch an HTTP resource and, if it returns 402 Payment Required, pay it automatically with x402 and return the paid response. On a 402 it: parses the merchant's price, authorizes via the CryptoAPIs buyer /authorize, signs the payment LOCALLY (non-custodial — the key never leaves this process), and retries with the X-PAYMENT header. Returns { status, paid, body, settlement? }. This is for HTTP URLs
x402_pay_toolwrite action
Call a TOOL on another MCP server and, if that tool requires payment, pay it automatically with x402 and return the paid result. This is the MCP-transport twin of x402_pay: use x402_pay for an HTTP url, and THIS for a paid tool on another MCP server. On a challenge it reads the PaymentRequired (from structuredContent, falling back to content[0].text), authorizes via the CryptoAPIs buyer /authorize

Public scan report

scanner v0.1.10 · 2026-11-03 · same rubric, same numbers if you re-run it

no findings

Code scan26 source files scanned25/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitylocal package, no credentials required12/15
Maintenancelast push 7 days ago15/15
Maintainer identityregistry namespace matches repository owner7/10

Overall 91/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

How X402 Pay compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score: 91/100; higher than 85% of 48,255 servers
Tools: 3; the typical server has 7
Tools that change things: 67%; typical: 0%. Fewer write tools means less an agent can break
Downloads a week: 342; more than 83% of 12,191 servers with a package

What its tools let an agent do: 1 read · 2 change

Release history: 4 versions in the registry since 2026-07-30, latest 2026-09-24, typically one every 1 day.

Install X402 Pay in Claude Code, Cursor or VS Code

Runs npx -y @cryptoapis-io/mcp-x402-pay on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add mcp-x402-pay -- npx -y @cryptoapis-io/mcp-x402-pay

Add to Cursor

What the publisher says

From the X402 Pay repository's README, as published. We do not edit it. Read it on GitHub

@cryptoapis-io/mcp-x402-pay

This is the BUYER side of x402 — the tool an agent uses to spend (pay for a resource). Merchants

who want to charge for an API use the middleware SDK (@cryptoapis-io/x402-merchant-sdk), not an MCP tool.

An MCP server that lets an AI agent find and pay x402-gated HTTP endpoints.

via the CryptoAPIs buyer service, signs locally, retries, and returns the paid response.

x402pay** — fetches a URL and, if the server returns 402 Payment Required, authorizes the payment

can find a paid API instead of only calling one it was handed.

x402discover** — browses the facilitator's catalogue of x402 resources and their prices, so an agent

Non-custodial: the private key is passed per request and never leaves the process (no HTTP server — stdio only).

Supported today: EVM (eip712, e.g. Base USDC) and Solana. Tron, Bitcoin/UTXO, XRP and Kaspa are upcoming — wired but not yet enabled; paying on them returns a clear familynotyet_supported ("coming soon") result.

Run

node dist/cli.js            # stdio MCP server (no --api-key at startup; keys are per-tool-call)

Prerequisite — an agent walletId

x402pay pays from a CryptoAPIs agent wallet** (walletId). Create one ONCE per blockchain+network before paying — a single POST to the buyer API returns the id (non-custodial: you register only your PUBLIC address):

curl -X POST https://ai.cryptoapis.io/x402/buyer/wallets \
  -H "x-api-key: $CRYPTOAPIS_API_KEY" -H "content-type: application/json" \
  -d '{"blockchain":"base","network":"eip155:8453","address":"0xYourAddress"}'
# → { "walletId": "…" }

network MUST be the CAIP-2 id (eip155:8453, solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp, …), not a bare name — and exactly one of address (any chain; required for Solana/Kaspa) or xpub (xpub-capable chains). A malformed body returns a clear 400 malformedrequest. Set the returned id as X402WALLET_ID (or pass walletId).

Tool: x402_pay

Returns { status, paid, body, settlement? }. On a 402 with no acceptable option (or over maxAmount), paid:false with a reason — nothing is signed or paid.

Tool: x402_discover

Browse the x402 "Bazaar" — the registered x402 resources and what each charges (spec §8).

Returns { resources: [{ resource, type, x402Version, accepts, lastUpdated, metadata? }], pagination }.

Public — no API key, no wallet, spends nothing, so it is always safe to call. Note accepts[].amount is in atomic units (USDC 6-decimals: "10000" = $0.01) — convert before quoting a price to a user. Pass a chosen resource to x402_pay to actually buy it.

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

X402 Pay: common questions

Is X402 Pay MCP server safe?: Yes, by our scan: it is graded A (91/100). Read the X402 Pay safety report
How do I install X402 Pay?: It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does X402 Pay need an API key?: Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is X402 Pay maintained?: The last commit was 8 days ago (2026-10-27). The latest release is v0.5.3.
How does X402 Pay compare with other MCP servers?: safety score 91/100 (higher than 85% of 48,255 servers); tools 3 (the typical server has 7); tools that change things 67% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.