Halowerk MCP server

halowerk-mcp

70 paid APIs as MCP tools. No account, no login, no subscription — a throwaway wallet with a few dollars is enough.

Your spend is capped before anything is signed:

Every paid answer carries bezahltusdc, budgetrest_usdc and the transaction hash, so the model and you see the same numbers.

Try it without a wallet

Two tools work with no wallet and cost nothing: halowerkkatalog lists every service with its price, and halowerkpreis tells you what a planned call would cost. Install it, browse, decide later.

{
  "mcpServers": {
    "halowerk": { "command": "npx", "args": ["-y", "halowerk-mcp"] }
  }
}

That goes in your Claude Desktop config (claudedesktopconfig.json), Cursor's mcp.json, or Cline's MCP settings.

Paying for calls

{
  "mcpServers": {
    "halowerk": {
      "command": "npx",
      "args": ["-y", "halowerk-mcp"],
      "env": {
        "HALOWERK_PRIVATE_KEY": "0x…",
        "HALOWERK_MAX_PREIS_USDC": "0.05",
        "HALOWERK_BUDGET_USDC": "1.00"
      }
    }
  }
}

Payment is x402 with USDC on Base. There is no account to create, no card, no invoice: the call carries a signed authorisation for the exact amount, and the service settles it.

Use a throwaway wallet

Create a fresh wallet, put a few dollars of USDC on it, use it for nothing else.

Not because this package is untrustworthy — because you have no reason to trust it yet. A key in an MCP config is a key that a model-driven process can reach. The way to make that safe is not to trust the code but to make the blast radius small: if the wallet holds three dollars, three dollars is the worst case.

You do not need ETH for gas. Payment uses EIP-3009 transferWithAuthorization, so a third party submits the transaction. A balance of exactly 0 ETH is normal and correct.

What the code does with your key

• It is read from HALOWERKPRIVATEKEY and from nowhere else — no file, no argument, no prompt.
• It is never logged, never put in an error message, never returned in an answer, not even truncated. There is a test for this: npm run pruefe searches the entire output for the first eight characters of a key and fails if it finds them.
• src/x402.ts is about 300 lines and is the only file that touches it. It is meant to be read in five minutes.

Where your money can go

The server only ever pays the ten hosts baked into the catalogue at build time. The list is frozen in the package; it cannot be extended by a file, an environment variable or a tool argument.

This is the point of the whole design. A tool that accepts an arbitrary URL and pays for it is a payment instruction with a blank payee field. A model that reads a web page, a PDF or an email can be told, by that text, to call such a tool with an attacker's address. So:

• The target host must match the built-in list exactly. No suffix comparison — halowerk.com.attacker.example passes any endsWith check and is a different host.
• https only. Redirects are not followed: a 301 to a foreign host is the attack, not an inconvenience.
• No IP addresses, no localhost, no private ranges.
• On violation: refusal with the reason, before anything is signed.

halowerkrufeauf takes a tool name from the catalogue, never a URL.

Modes

Seventy tools at once makes the tool picker worse for everybody, especially if you have other MCP servers connected. So:

Shortened. The full README is on GitHub.