Mmcp.market

X402 Payagent MCP server

by stevemilton·io.github.stevemilton/x402-payagent-mcp·v4.1.0
No reviews yet

Pay x402 APIs in USDC on Base, Solana, and BNB Chain with spend mandates, receipts, idempotency.

B77/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B77/100

full report

Adoption
Growing

0 stars124 downloads/wk

Reviews

Write one

Nobody has reviewed X402 Payagent yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

X402 Payagent tools (11, 2 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • balance
  • check_payment_signal
  • create_agentwrite action
  • discover
  • fund_agent
  • history
  • inspect
  • list_agents
  • paywrite action
  • rename_agent
  • setup

Public scan report

scanner v0.1.9 · 2026-09-21 · same rubric, same numbers if you re-run it

no findings
  • Code scan3 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 25 days ago15/15
  • Maintainer identitynamespace and repository owner differ4/10
Overall 77/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

What the publisher says

From the X402 Payagent repository's README, as published. We do not edit it. Read it on GitHub

@arispay/payagent-mcp

One coherent USDC payment product for AI agents: call x402-paid APIs, with spend mandates, receipts, and idempotency. Works with Claude Desktop, Cursor, Windsurf, or any MCP client. A thin wrapper around the payagent SDK.

Two ways to hold the wallet:

  • Local key (zero signup). Set PAYAGENTPRIVATEKEY to a funded EOA key. pay signs EIP-3009 locally — no ArisPay account, no email. The only guardrail is the wallet balance; use a dedicated low-balance wallet.
  • Delegated custody (managed, recommended). setup({ email }) self-provisions an account, a CDP-managed wallet, and a spend mandate in one call. ArisPay enforces per-transaction, daily, and monthly limits server-side before signing; no private key ever lives in this process.

Tools

Seven core tools (the default surface):

Wallet administration (createagent, fundagent, listagents, renameagent) loads only when the host config sets PAYAGENTMCPPROFILE=admin.

Every tool declares MCP safety annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); pay and checkpaymentsignal are the only destructive tools — both spend real money.

Support matrix

Notes:

  • All prices are quoted by sellers in the 402 challenge; pay prefers an EVM variant and falls back to Solana when the seller offers no EVM option.
  • Delegated mandates are integer cents, validated server-side before any signature exists. Local mode has no server-side cap.
  • Settlement is a single on-chain transferWithAuthorization (EIP-3009): it succeeds or reverts atomically. When the seller returns X-PAYMENT-RESPONSE, the receipt carries the settlement transaction hash.
  • ArisPay's own facilitator (facilitator.arispay.app) charges no facilitator fee; sellers may use any facilitator, and their fee/finality policy applies.

Setup

Add the server to your MCP client config. No environment variables are required — pick a wallet mode later, from inside the chat, or set one of the env options below.

Claude Desktop

Edit ~/Library/Application Support/Claude/claudedesktopconfig.json:

{
  "mcpServers": {
    "arispay": {
      "command": "npx",
      "args": ["-y", "@arispay/payagent-mcp"]
    }
  }
}

For the zero-signup mode, add the key to the env block:

"env": { "PAYAGENT_PRIVATE_KEY": "0x..." }

Cursor

Same server block in .cursor/mcp.json. Windsurf: same pattern in ~/.codeium/windsurf/mcp_config.json.

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Install directly

Runs npx -y @arispay/payagent-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add x402-payagent-mcp -- npx -y @arispay/payagent-mcp
Add to Cursor

X402 Payagent: common questions

Is X402 Payagent MCP server safe?
Mostly: it is graded B (77/100). Read the X402 Payagent safety report
How do I install X402 Payagent?
It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
Does X402 Payagent need an API key?
Yes. The registry entry asks for ARISPAY_API_KEY, PAYAGENT_PRIVATE_KEY.
Is X402 Payagent maintained?
The last commit was 25 days ago (2026-08-27). The latest release is v4.1.0.

More from stevemilton →