Presidio Hardened X402 MCP server

presidio-hardened-x402-mcp

<!-- mcp-name: io.github.presidio-v/presidio-hardened-x402-mcp -->

Pre-payment safety gate for x402 — agents call screenpaymentmetadata(...), checkpaymentpolicy(...), and checkpaymentreplay(...) before signing, catching PII, budget overruns, and duplicate payments before metadata or money leaves the agent host.

Part of the presidio-hardened-* toolkit family. Thin MCP (Model Context Protocol) adapter over the presidio-hardened-x402 library, pinned for parent 0.11.x compatibility (presidio-hardened-x402>=0.11.1,<0.12.0). The >=0.11.1 floor is a security floor, not a preference — it is the release that closed the percent-encoded PII redaction bypass.

Why this exists

x402 agentic payments routinely carry user-supplied free text — descriptions, memos, query-string parameters — straight through to merchants and facilitators. When an LLM agent generates that text, it can include PII the user never intended to share. Once the merchant logs it, retention is their decision, not yours.

This MCP server gives agents a small default-deny gate before payment leaves the agent host. Three tools expose the parent library's stable pre-payment controls: PII redaction, spending policy, and replay detection. They are designed to compose with payment-execution and endpoint-safety MCP servers (x402station, Coinbase x402, Sardis, ...), while newer parent-library surfaces — evidence-ref@1 verification, the v0.9.1 SLO broker, the v0.10.0 settlement-ref@1 treasury binding, and the v0.11.0 CapabilityEnforcer — stay in the Python library unless an MCP tool explicitly wraps them later.

Install & configure

Requires Python ≥ 3.10. Distributed on PyPI; recommended invocation via uvx (no global install).

Claude Desktop / Claude Code

Add to ~/Library/Application Support/Claude/claudedesktopconfig.json (macOS) or the equivalent on your platform:

{
  "mcpServers": {
    "presidio-x402": {
      "command": "uvx",
      "args": ["presidio-hardened-x402-mcp"]
    }
  }
}

Cursor / Windsurf / Continue

Same shape — every MCP host accepts command / args / env. See your editor's MCP-server docs for the config-file path.

Environment variables

All optional. Defaults give a zero-config in-process mode with no quota, no network, and no PII storage.

Shortened. The full README is on GitHub.