x402ai-mcp

A local MCP server that lets AI clients (Claude Desktop, Claude Code, Cursor and others) call the paid x402ai endpoints, paying per call in USDC on Base through the x402 protocol, plus a free inspector for any x402 endpoint.

It runs on your machine over stdio. You give it a buyer key; it answers each HTTP 402 payment challenge by signing a USDC authorization, and returns the result. Nothing is hosted for you and no account is needed.

Tools

Paid tools take one input string of up to 3,000 characters. health and inspect need no key.

Before you start: use a dedicated wallet

This server holds a private key that can spend money. Use a new wallet that exists only for this, funded with a few dollars of USDC on Base at most. Payments are gasless for the payer (EIP-3009), so the wallet needs USDC only, no ETH. Never use a wallet that holds anything you can't afford to lose. The wallet balance is your real spending limit.

Can you trust this package?

This server asks for a key that can spend money, and fake "x402 MCP" packages that steal keys have been reported. Don't take this README's word for it: the claims below are meant to be checked.

• The package never sends or logs your key. It is read once from X402AI_BUYER_PRIVATE_KEY and used only to sign payment authorizations locally, and it is scrubbed from error messages. It stays in this process's environment and memory while the server runs, so anything that can read those (other code in this process, other programs running as your user, your client's config file) can read the key. Clearing the variable inside the process would not change that, because Linux keeps a process's starting environment readable under /proc.
• Every host it contacts. No request follows a redirect; a redirect is refused and the call fails.
  • https://api.x402ai.dev: the paid tools and health. Signed authorizations go only here, only for the calling tool's own route and price, and expire within 300 seconds.
  • https://api.cdp.coinbase.com: only when you run inspect (Coinbase's validator and merchant lookup).
  • The URL you pass to inspect: one unpaid request (with a fixed body for POST). Nothing is signed.
• No telemetry, analytics or update checks.
• Small and readable. Five source files in src/ (about 660 lines), built with tsc into dist/. The published package contains only dist/, this README, LICENSE and package.json.
• Pinned dependencies. Direct dependencies are pinned to exact versions. npm resolves their dependencies fresh, within the ranges they declare, when you install, so those aren't frozen; the repository's package-lock.json records the exact set that was tested. No dependency runs an install script. All dependencies have verified npm registry signatures (npm audit signatures). The x402 client is @x402/fetch 2.29.0, with a per-payment cap set in code.
• The spend safeguards stop honest code from overspending; they do nothing against a malicious package. That is why the points above are checkable.

How to check: compare the published files with the source (npm pack x402ai-mcp@<version> downloads the exact tarball for inspection), confirm the package name is exactly x402ai-mcp, and read src/.

Don't run unvetted MCP servers in the same client as a funded key. Any other program running as your us

... View full README on GitHub