Pop Pay

io.github.100xPercentPublished by GitHub account 100xPercentv0.5.7Updated Oct 24, 2026

Runtime security for AI agent commerce. CLI + MCP server blocks hallucinated purchases.

VerifiedSTDIODesktop onlyBrowser Automation Finance Security & Monitoring

Server details

Identifier: io.github.100xPercent/pop-pay
Transport: STDIO
Runtime: Desktop only
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account 100xPercent for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.100xPercent%2Fpop-pay.svg)](https://sourceweft.com/mcp/io.github.100xPercent%2Fpop-pay?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

Local MCP server that lets an AI agent issue virtual cards, fill billing details and pay x402 API calls, with spending limits and injection scanning.

What you can do: Issue a virtual card and inject card credentials into a checkout page through Chrome DevTools Protocol, with automatic scanning for hidden prompt injections on the page. Auto-fill billing and contact information (name, address, email, phone) on forms, also with injection scanning. Pay for API calls through the x402 HTTP payment protocol. Guardrails apply keyword or LLM-based checks, per-transaction and daily USD limits, and loop blocking; card data is kept out of the agent's context and masked in responses.
When to use it: Use it when an agent needs to complete purchases or checkout flows and you want a spending cap and credential isolation between the agent and the card. It suits development with mock cards as well as controlled production payments through a local encrypted vault or Stripe Issuing.
Requirements: Runs as a local process via npm (Node.js 18+ for the curl installer) or Homebrew, or in Docker with headless Chromium. Needs a Chrome instance with CDP remote debugging, by default at the configured POP_CDP_URL. An encrypted vault must be initialized and unlocked; Stripe Issuing requires POP_STRIPE_KEY. Limits and categories are set through POP_MAX_PER_TX, POP_MAX_DAILY, POP_ALLOWED_CATEGORIES and POP_GUARDRAIL_ENGINE.

Before you install

It handles real payment credentials and can spend money: set POP_MAX_PER_TX and POP_MAX_DAILY deliberately and keep POP_ALLOWED_CATEGORIES narrow. The vault passphrase and POP_STRIPE_KEY are sensitive secrets. LLM guardrail mode sends each request's reasoning to an LLM provider, and the server drives a browser and fills forms, so page content and redirects matter. Desktop only.

Installation

In SourceWeft

Open Pop Pay in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

[npm version] [License: MIT] [CI] [Node.js]

[Point One Percent (AgentPay)]

Point One Percent — pop-pay

it only takes 0.1% of Hallucination to drain 100% of your wallet.

The runtime security layer for AI agent commerce. Drop-in CLI + MCP server. Card credentials are injected directly into the browser DOM via CDP — they never enter the agent's context window. One hallucinated prompt can't drain a wallet it can't see.

[Point One Percent — live CDP injection demo]

📄 Research Dataset & Reproduction — this repository hosts the open dataset and reproduction harness for "The Illusion of Single-Attacker Rankings". research: jump to Research Dataset & Reproduction.

Install

Choose your preferred method:

Homebrew (macOS)

curl (Linux / macOS) — bootstraps via npm; requires Node.js 18+

npm (global)

npx (no install — one-off runs)

All install paths expose the same binaries: pop-pay, pop-launch, pop-init-vault, pop-unlock.

Also available as @100xpercent/mcp-server-pop-pay — identical package under the MCP @scope/mcp-server-<name> convention. Tracks the same version on every release.

Using Python? Check out pop-pay-python — pip install pop-pay. Same security model, same vault format, independent release cycle — safe to switch between runtimes.

Quick Start (CLI)

1. Initialize the encrypted credential vault

This encrypts your card credentials into ~/.config/pop-pay/vault.enc (AES-256-GCM). For stronger protection (blocks agents with shell access):

bash

pop-pay init-vault --passphrase   # one-time setuppop-pay unlock                     # run once per session

pop-pay init-vault --passphrase   # one-time setuppop-pay unlock                     # run once per session

2. Launch Chrome with CDP remote debugging

This opens a Chromium instance on http://localhost:9222 that pop-pay injects credentials into. Your agent (via MCP, browser automation, or x402) then drives the checkout flow — card details never leave the browser process.

3. Plug into your agent

The CLI launches infrastructure; the actual payment tool calls come from your agent. Two supported paths:

MCP server — add pop-pay to any MCP-compatible client (Claude Code, Cursor, Windsurf, OpenClaw). See MCP Server below.
x402 HTTP — pay for API calls via the x402 payment protocol.

Full CLI reference: pop-pay --help.

MCP Server (optional)

Add to your MCP client

Standard config for any MCP-compatible client:

json

{  "mcpServers": {    "pop-pay": {      "command": "npx",      "args": ["-y", "pop-pay", "launch-mcp"],      "env": {        "POP_CDP_URL": "http://localhost:9222"      }    }  }}

{  "mcpServers": {    "pop-pay": {      "command": "npx",      "args": ["-y", "pop-pay", "launch-mcp"],      "env": {        "POP_CDP_URL": "http://localhost:9222"      }    }  }}

[Install in VS Code] [Install in VS Code Insiders] [Install in Cursor]

Claude Code

Claude Code uses its own CLI — the JSON config above is not needed.

--scope user makes it available across all projects. To remove: claude mcp remove pop-pay

Cursor / Windsurf / VS Code

Add the JSON config above to:

Cursor: ~/.cursor/mcp.json
Windsurf: ~/.codeium/windsurf/mcp_config.json
VS Code (Copilot): .vscode/mcp.json in project root

OpenClaw / NemoClaw

OpenClaw has its own CLI — the JSON config above is not needed.

Or add to ~/.openclaw/mcp_servers.json using the JSON config above.

For System Prompt templates and NemoClaw sandbox setup, see Integration Guide §4.

Docker

Runs the MCP server + headless Chromium with CDP. Mount your encrypted vault from the host.

MCP Tools

Tool	Description
`request_virtual_card`	Issue a virtual card and inject credentials into the checkout page via CDP. Automatically scans the page for hidden prompt injections.
`request_purchaser_info`	Auto-fill billing/contact info (name, address, email, phone). Automatically scans the page for hidden prompt injections.
`request_x402_payment`	Pay for API calls via the x402 HTTP payment protocol.

Tip for Claude Code users: Add the following to your project's CLAUDE.md to help the agent know when to call pop-pay: "When you encounter a payment form or checkout page, use the request_virtual_card tool. For billing/contact info forms, use request_purchaser_info first."

Configuration

Core variables in ~/.config/pop-pay/.env. See ENV_REFERENCE.md for the full list.

Variable	Default	Description
`POP_ALLOWED_CATEGORIES`	`["aws","cloudflare"]`	Approved vendor categories — see Categories Cookbook
`POP_MAX_PER_TX`	`100.0`	Max USD per transaction
`POP_MAX_DAILY`	`500.0`	Max USD per day
`POP_BLOCK_LOOPS`	`true`	Block hallucination/retry loops
`POP_AUTO_INJECT`	`true`	Enable CDP card injection
`POP_GUARDRAIL_ENGINE`	`keyword`	`keyword` (zero-cost) or `llm` (semantic)

Guardrail Mode

	`keyword` (default)	`llm`
Mechanism	Keyword matching on reasoning string	Semantic analysis via LLM
Cost	Zero — no API calls	One LLM call per request
Best for	Development, low-risk workflows	Production, high-value transactions

To enable LLM mode, see Integration Guide §1.

Providers

Provider	Description
BYOC (default)	Bring Your Own Card — encrypted vault credentials, local CDP injection.
Stripe Issuing	Real virtual cards via Stripe API. Requires `POP_STRIPE_KEY`.
Lithic	Multi-issuer adapter (Stripe Issuing / Lithic).
Mock	Test mode with generated card numbers for development.

Priority: Stripe Issuing → BYOC Local → Mock.

Security

Layer	Defense
Context Isolation	Card credentials never enter the agent's context window or logs
Encrypted Vault	AES-256-GCM with XOR-split salt and native scrypt key derivation (Rust)
TOCTOU Guard	Domain verified at the moment of CDP injection — blocks redirect attacks
Repr Redaction	Automatic masking (`****-4242`) in all MCP responses, logs, and tracebacks

See THREAT_MODEL.md for the full STRIDE analysis and COMPLIANCE_FAQ.md for enterprise details.

Architecture

TypeScript — MCP server, CDP injection engine, guardrails, CLI
Rust (napi-rs) — Native security layer: XOR-split salt storage, scrypt key derivation
Node.js crypto — AES-256-GCM vault encryption (OpenSSL binding)
Chrome DevTools Protocol — Direct DOM injection via raw WebSocket

Documentation

Threat Model — STRIDE analysis, 5 security primitives, 10 attack scenarios
Guardrail Benchmark — Cross-model evaluation (Anthropic / OpenAI / Gemini) across 585 payloads, 11 attack categories
Compliance FAQ — PCI DSS, SOC 2, GDPR details
Environment Reference — All POP_* environment variables
Integration Guide — Setup for Claude Code, Node.js SDK, and browser agents
Categories Cookbook — POP_ALLOWED_CATEGORIES patterns and examples

Research Dataset & Reproduction

This repository hosts the open-source dataset and harness for the cross-vendor attacker-stability methodology described in the corresponding research paper. Reviewer/researcher reproduction artifacts:

Corpus (585 attack payloads, 11 categories): tests/redteam/corpus/
- attacks.json — full payload set with category labels
- GENERATION.md — corpus generation protocol
- schema.json — payload schema
Run JSONLs (26,325 rows, 9 models × 585 payloads × N=5): tests/redteam/runs/
- PRIMARY whitebox-no-feedback runs: runs/adaptive/2026-04-28T19-50-*
- Static panel runs: runs/static/
- Prompt-ablation (v3 / strict / paranoid): runs/ablation/
Manifest hashes: tests/redteam/runs/MANIFEST.sha256 — byte-level integrity for all artifacts
Croissant 1.0 metadata (Core + RAI fields): paper-artifacts/croissant.json
Reproduction scripts (regenerate paper tables/figures from JSONL):
- python3 paper-artifacts/gen-tables.py --table all — Tab.~bypassk / threat-ablation / cross-vendor
- python3 paper-artifacts/gen-taxonomy-map.py — Fig.~taxonomy-map
License: corpus CC BY-SA 4.0, harness MIT.

For dataset schema, statistical methodology (bootstrap CI, Holm-Bonferroni, McNemar), full from-scratch re-collection instructions, JSONL row data dictionary, and responsible-disclosure policy, see docs/PAPER_REPRODUCTION.md.

License

MIT

Source: README.md at commit d44f764

Tools

SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

v0.5.7LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts