Mcp X402 Pay

io.github.CryptoAPIs-ioPublished by GitHub account CryptoAPIs-iov0.5.3Updated Oct 25, 2026

MCP server that pays x402-gated HTTP endpoints — fetch, and on a 402 authorize, sign, retry

VerifiedSTDIODesktop onlyWeb Search & ScrapingFinance

Overview

AI-generated overview

Local MCP server that lets an AI agent discover x402-paid HTTP resources and pay for them by signing a payment locally and retrying the request.

What you can do
Discover x402 resources and their prices from the facilitator catalogue, with filtering and paging, without spending anything or needing a key or wallet. Fetch a URL and, on a 402 Payment Required response, authorize the payment through the CryptoAPIs buyer service, sign locally, retry with a payment header and return the paid response plus settlement details. Constrain payments with an allowed-network list, a maximum amount cap and an allowed-hosts list that can be pinned outside the model's reach.
When to use it
Use it when an agent needs to call paywalled x402 HTTP APIs and pay per request from a CryptoAPIs agent wallet, or when it should first browse the x402 catalogue to find a paid resource and its price. It is a buyer-side tool only; merchants charging for their own API need the separate merchant SDK.
Requirements
Runs as a local stdio process from the npm package, so Node.js is needed. A CryptoAPIs API key with the X402_BUYER feature, an agent wallet record id created once per blockchain and network via the buyer API, and the wallet's private key passed per tool call. Supported chains today are EVM (eip712, e.g. Base USDC) and Solana; network values must be CAIP-2 ids. Network access to the target URL and the CryptoAPIs buyer service.
Before you install
The private key is a tool parameter and may be logged by MCP clients or kept in conversation history, so use only in trusted local environments. Payments spend real funds: set maxAmount and allowedHosts, ideally via X402_ALLOWED_HOSTS so the allowlist stays outside the model's reach. Amounts in the catalogue are atomic units and must be converted before quoting a price. Tron, Bitcoin/UTXO, XRP and Kaspa are not yet enabled.

Installation

In SourceWeft

  1. Open Mcp X402 Pay in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@cryptoapis-io/mcp-x402-pay

This is the BUYER side of x402 — the tool an agent uses to spend (pay for a resource). Merchants who want to charge for an API use the middleware SDK (@cryptoapis-io/x402-merchant-sdk), not an MCP tool.

An MCP server that lets an AI agent find and pay x402-gated HTTP endpoints.

  • x402_pay — fetches a URL and, if the server returns 402 Payment Required, authorizes the payment via the CryptoAPIs buyer service, signs locally, retries, and returns the paid response.
  • x402_discover — browses the facilitator's catalogue of x402 resources and their prices, so an agent can find a paid API instead of only calling one it was handed.

Non-custodial: the private key is passed per request and never leaves the process (no HTTP server — stdio only).

Supported today: EVM (eip712, e.g. Base USDC) and Solana. Tron, Bitcoin/UTXO, XRP and Kaspa are upcoming — wired but not yet enabled; paying on them returns a clear family_not_yet_supported ("coming soon") result.

Run

bash
node dist/cli.js            # stdio MCP server (no --api-key at startup; keys are per-tool-call)

Prerequisite — an agent walletId

x402_pay pays from a CryptoAPIs agent wallet (walletId). Create one ONCE per blockchain+network before paying — a single POST to the buyer API returns the id (non-custodial: you register only your PUBLIC address):

bash
curl -X POST https://ai.cryptoapis.io/x402/buyer/wallets \  -H "x-api-key: $CRYPTOAPIS_API_KEY" -H "content-type: application/json" \  -d '{"blockchain":"base","network":"eip155:8453","address":"0xYourAddress"}'# → { "walletId": "…" }

network MUST be the CAIP-2 id (eip155:8453, solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp, …), not a bare name — and exactly one of address (any chain; required for Solana/Kaspa) or xpub (xpub-capable chains). A malformed body returns a clear 400 malformed_request. Set the returned id as X402_WALLET_ID (or pass walletId).

Tool: x402_pay

InputRequiredDescription
url✓the (possibly paywalled) resource
apiKey✓your CryptoAPIs key (X402_BUYER feature) — only used to call the buyer /authorize
walletId✓the wallet record id from POST /wallets (a registry _id) — NOT the on-chain address (an address gets wallet_not_found)
privateKey✓the wallet's EVM key — signs locally, never sent anywhere
method/body/headersthe request to make
allowedNetworksrestrict which CAIP-2 networks to pay on
maxAmountsafety cap — refuse if the required atomic-unit amount exceeds it
allowedHostsrestrict WHICH SITES may be paid, e.g. ["api.acme.com"] (leading dot = subdomains). A url outside the list is refused before any network call. Falls back to X402_ALLOWED_HOSTS (comma-separated) — pin it there to keep the allowlist outside the model's reach

Returns { status, paid, body, settlement? }. On a 402 with no acceptable option (or over maxAmount), paid:false with a reason — nothing is signed or paid.

Tool: x402_discover

Browse the x402 "Bazaar" — the registered x402 resources and what each charges (spec §8).

InputRequiredDescription
typefilter by resource type, e.g. "http"
limitpage size, 1–100 (default 20)
offsetrows to skip, for paging (default 0)
facilitatorBaseUrloverride the facilitator (QA/local)

Returns { resources: [{ resource, type, x402Version, accepts, lastUpdated, metadata? }], pagination }.

Public — no API key, no wallet, spends nothing, so it is always safe to call. Note accepts[].amount is in atomic units (USDC 6-decimals: "10000" = $0.01) — convert before quoting a price to a user. Pass a chosen resource to x402_pay to actually buy it.

Flow

  1. fetch(url). Not 402 → return it.
  2. 402 → pick an accepts entry (allowlist-aware), authorize via buyer /authorize → the signing artifact.
  3. Sign locally (@cryptoapis-io/mcp-signer evm_sign typed-data) → build the x402 PaymentPayload (wire scheme is always exact; the family is in network).
  4. Retry with the base64 X-PAYMENT header; return the paid response + the X-PAYMENT-RESPONSE settlement.

Security

The private key is a tool parameter and may be logged by MCP clients or stored in conversation history — use only in trusted local environments. This mirrors @cryptoapis-io/mcp-signer.

Source: README.md at commit 847b9df

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

4
  1. v0.5.3LatestSep 24, 2026
  2. v0.5.2Sep 24, 2026
  3. v0.5.1Sep 23, 2026
  4. v0.4.0Sep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts