io.github.CryptoAPIs-io/mcp-x402-pay

Est-ce que io.github.CryptoAPIs-io/mcp-x402-pay est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.CryptoAPIs-io/mcp-x402-pay » est classé « Vérifié ». Aucun comportement malveillant détecté au test comportemental. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Versions auditées & empreintes

Vérifiez la version que vous utilisez : son empreinte doit correspondre à celle listée ici — sinon vous n'utilisez pas la version auditée.

⚠ La dernière version publiée (0.5.3) n'a pas encore été auditée. Un nouveau pentest est programmé ; les verdicts ci-dessous portent sur les versions listées.

Vous utilisez ce serveur ? Suivez-le (créez un compte) pour être alerté dès qu'une nouvelle version paraît ou que le verdict change.

Les 3 outils

• x402_pay≈ 1018 tokens

  Fetch an HTTP resource and, if it returns 402 Payment Required, pay it automatically with x402 and return the paid response. On a 402 it: parses the merchant's price, authorizes via the CryptoAPIs buyer /authorize, signs the payment LOCALLY (non-custodial — the key never leaves this process), and retries with the X-PAYMENT header. Returns { status, paid, body, settlement? }. This is for HTTP URLs — to pay a paid MCP TOOL on another server, use x402_pay_tool instead. Supported today: EVM (eip712, e.g. Base USDC) and Solana. Tron, UTXO (bitcoin/ltc/doge/dash/bch/zcash), Kaspa and XRP are UPCOMING — wired but not yet enabled, and paying on them returns a clear coming-soon (family_not_yet_supported) result. Set CRYPTOAPIS_API_KEY + X402_WALLET_ID once, plus the signing key(s) for the chain(s)

  Paramètres, retour & exemple (16)

  Paramètres

  • url · string · requis
    The (possibly paywalled) resource URL to fetch
  • body · string · optionnel
    Request body (string; set content-type via headers if needed)
  • apiKey · string · optionnel
    Your CryptoAPIs API key with the X402_BUYER feature (used only to call the buyer /authorize). Falls back to the CRYPTOAPIS_API_KEY env var — set it once and omit this.
  • method · string · optionnel · GET | POST | PUT | PATCH | DELETE
    HTTP method (default GET)
  • headers · object · optionnel
    Extra request headers
  • tronKey · string · optionnel
    Tron private key (hex). Falls back to X402_TRON_KEY, then to privateKey/X402_PRIVATE_KEY (same secp256k1 curve).
  • utxoWif · string · optionnel
    UTXO private key in WIF format — signs utxo-transaction payments (bitcoin/ltc/doge/dash/bch/zcash). Falls back to X402_UTXO_WIF.
  • xrpSeed · string · optionnel
    XRP secret/seed (base58, e.g. s...) — signs xrp-transaction payments. Falls back to X402_XRP_SEED.
  • kaspaKey · string · optionnel
    Kaspa private key (hex, 32 bytes) — signs kaspa-transaction payments. Falls back to X402_KASPA_KEY.
  • walletId · string · optionnel
    The CryptoAPIs buyer-service wallet RECORD ID (the id returned by POST /wallets) — NOT the on-chain address; passing an address returns wallet_not_found. Falls back to the X402_WALLET_ID env var. Create one first (once per blockchain+network): POST https://ai.cryptoapis.io/x402/buyer/wallets with {blockchain, network (CAIP-2 id like eip155:8453 or solana:<genesisHash> — NOT a bare name), address (your public address; required for Solana/Kaspa)} → returns walletId.
  • maxAmount · string · optionnel
    Optional safety cap: refuse to pay if the required atomic-unit amount exceeds this
  • svmSecret · string · optionnel
    Solana secret key, base58-encoded (64-byte keypair secret) — signs svm-transaction payments. Falls back to X402_SVM_SECRET.
  • privateKey · string · optionnel
    EVM private key (hex, 0x optional) — signs the eip712 (EVM) payment, and Tron by default. Falls back to X402_PRIVATE_KEY. SECURITY: trusted local environments only.
  • allowedHosts · array · optionnel
    Restrict WHICH HOSTS may be paid, e.g. ["api.acme.com"] (a leading dot matches subdomains: ".acme.com"). A url outside the list is refused BEFORE any network call. Falls back to the X402_ALLOWED_HOSTS env var (comma-separated) — set it there to pin the allowlist OUTSIDE the model's reach, so a prompt-injected url cannot widen it.
  • buyerBaseUrl · string · optionnel
    Override the buyer service base URL (default https://ai.cryptoapis.io/x402/buyer)
  • allowedNetworks · array · optionnel
    Restrict which CAIP-2 networks to pay on (e.g. ["eip155:8453"])

  Exemple d'appel

  {"name": "x402_pay", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• x402_discover≈ 408 tokens

  Discover x402-gated APIs you can pay for — browse the facilitator's Bazaar catalogue of registered x402 resources, each with the price and payment terms it accepts. Use this BEFORE x402_pay whenever you need to FIND a paid endpoint rather than call one you were already given: the pay tool only fetches a URL you hand it, so this is the only way to locate a monetized API on your own. Returns { resources: [{ resource, type, x402Version, accepts: [{ scheme, network, amount, asset, payTo }], lastUpdated, metadata? }], pagination: { limit, offset, total } } — `amount` is in ATOMIC units (USDC 6-decimals: "10000" = $0.01), so convert before quoting a price to the user. PUBLIC: needs no API key, no wallet and spends nothing, so it is always safe to call. Filter with `type` (e.g. "http") and page w

  Paramètres, retour & exemple (4)

  Paramètres

  • type · string · optionnel
    Filter by resource type, e.g. "http". Omit to list every type.
  • limit · integer · optionnel
    Max results to return, 1-100 (default 20). The facilitator clamps out-of-range values rather than erroring.
  • offset · integer · optionnel
    How many results to skip, for paging (default 0). Use with `pagination.total` from a previous call.
  • facilitatorBaseUrl · string · optionnel
    Override the facilitator base URL (default https://ai.cryptoapis.io/x402/merchant). Useful against QA/local.

  Exemple d'appel

  {"name": "x402_discover", "arguments": {"type": "texte", "limit": 1, "offset": 1, "facilitatorBaseUrl": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• x402_pay_tool≈ 866 tokens

  Call a TOOL on another MCP server and, if that tool requires payment, pay it automatically with x402 and return the paid result. This is the MCP-transport twin of x402_pay: use x402_pay for an HTTP url, and THIS for a paid tool on another MCP server. On a challenge it reads the PaymentRequired (from structuredContent, falling back to content[0].text), authorizes via the CryptoAPIs buyer /authorize, signs LOCALLY (non-custodial — the key never leaves this process), and retries the tool call once with the payment in _meta["x402/payment"] (a raw object, no base64 — MCP carries structured JSON natively). Returns { paid, result, settlement? }; the settlement receipt comes back in _meta["x402/payment-response"]. The upstream server is launched over stdio for the call and shut down afterwards. Sa

  Paramètres, retour & exemple (14)

  Paramètres

  • apiKey · string · optionnel
    Your CryptoAPIs API key with the X402_BUYER feature (used only to call the buyer /authorize). Falls back to the CRYPTOAPIS_API_KEY env var.
  • server · object · requis
    The upstream MCP server to call, launched over stdio. It is started for this call and shut down afterwards.
  • tronKey · string · optionnel
    Tron private key (hex). Falls back to X402_TRON_KEY, then to privateKey/X402_PRIVATE_KEY.
  • utxoWif · string · optionnel
    UTXO private key in WIF format. Falls back to X402_UTXO_WIF.
  • xrpSeed · string · optionnel
    XRP secret/seed. Falls back to X402_XRP_SEED.
  • kaspaKey · string · optionnel
    Kaspa private key (hex). Falls back to X402_KASPA_KEY.
  • toolName · string · requis
    The name of the tool to call on that server
  • walletId · string · optionnel
    The CryptoAPIs buyer-service wallet RECORD ID (from POST /wallets) — NOT the on-chain address. Falls back to the X402_WALLET_ID env var.
  • arguments · object · optionnel
    Arguments to pass to that tool
  • maxAmount · string · optionnel
    Safety cap: refuse to pay if the required atomic-unit amount exceeds this
  • svmSecret · string · optionnel
    Solana secret key, base58-encoded — signs svm-transaction payments. Falls back to X402_SVM_SECRET.
  • privateKey · string · optionnel
    EVM private key (hex, 0x optional) — signs the eip712 payment, and Tron by default. Falls back to X402_PRIVATE_KEY. SECURITY: trusted local environments only.
  • buyerBaseUrl · string · optionnel
    Override the buyer service base URL (default https://ai.cryptoapis.io/x402/buyer)
  • allowedNetworks · array · optionnel
    Restrict which CAIP-2 networks to pay on (e.g. ["eip155:8453"])

  Exemple d'appel

  {"name": "x402_pay_tool", "arguments": {"server": {}, "toolName": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

Badge pour votre README

Ce serveur a passé le pentest comportemental. Le badge porte son nom et renvoie à cette fiche — la preuve, c'est la fiche (verdict live qu'on contrôle), pas l'image.

[![Vérifié par MCP Hub](https://dokore.fr/badge/io.github.cryptoapis-io--mcp-x402-pay.svg)](https://dokore.fr/serveur/io.github.cryptoapis-io--mcp-x402-pay)

<a href="https://dokore.fr/serveur/io.github.cryptoapis-io--mcp-x402-pay"><img src="https://dokore.fr/badge/io.github.cryptoapis-io--mcp-x402-pay.svg" alt="Vérifié par MCP Hub" height="20"></a>

Réévalué en continu : si le comportement change, le verdict tombe et le badge disparaît. Un badge qui ne pointe pas vers une fiche dokore.fr ne prouve rien. Comment ça marche

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

@cryptoapis-io/mcp-x402-pay@0.5.3