Lumi Trades: x402 seller checks and test-buys

io.github.cypher-osirisPublished by GitHub account cypher-osirisv0.9.9Updated Oct 28, 2026

Free signed allow/warn/block before paying x402 sellers; test-buys on XRPL, Base and Stellar

VerifiedStreamable HTTPWeb executableFinanceSecurity & MonitoringBusiness & Commerce

Overview

AI-generated overview

Lumi Trades checks x402 sellers before an assistant pays them, returning allow/warn/block verdicts, vendor scores and reports, with optional per-call crypto…

What you can do
  • Look up x402 sellers and get allow/warn/block verdicts with coded reasons before paying a URL, domain or payTo address
  • Inspect vendor scores, full vendor reports with quote-check and test-buy history, latency, uptime and price trends
  • Browse the endpoint catalog, live prices, truncated product samples and x402 price quotes without paying
  • Review seller monitoring plans, test-buy packs and trust feed licence terms
  • Sign receipts for purchases already made, with optional sharing of chain and transaction ID
When to use it
Use it when an agent is about to pay an x402 endpoint and you want a signed pre-payment check, or when you need evidence on a seller's reliability, uptime and quoted prices before committing spend.
Requirements
Node 20+ for the npm package, or the remote Streamable HTTP endpoint at api.lumitrades.io, which has no wallet and only returns price terms for paid tools. Paid tools need a funded Base wallet via EVM_PRIVATE_KEY (USDC, gasless) or an XRPL wallet via XRPL_SEED; optional caps LUMI_MAX_USD_PER_CALL, LUMI_MAX_XRP_PER_CALL, LUMI_SESSION_BUDGET, LUMI_PAY_ASSET and XRPL_NETWORK. Free tools work without a wallet.
Before you install
Paid tools spend real money per call (about $0.01 to $0.02, plus monitoring and feed plans), so keep the per-call and session caps low. EVM_PRIVATE_KEY and XRPL_SEED are wallet secrets: use a dedicated low-balance agent wallet. Receipt sharing is off by default; enabling it shares a transaction ID that is public on-chain and linkable to the paying wallet. Results are automated observations, not a rating or financial advice.

Installation

In SourceWeft

  1. Open Lumi Trades: x402 seller checks and test-buys in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.cypher-osiris%2Flumi-trades-mcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "lumi-trades-x402-seller-checks-and-test": {
      "type": "http",
      "url": "https://api.lumitrades.io/mcp"
    }
  }
}

README

lumi-trades-mcp

MCP server (stdio) for Lumi Trades: Lumi Check, a free signed allow/warn/block check before your agent pays an x402 seller, backed by Lumi's own paid test-buys on XRPL, Base and Stellar: x402 seller trust you can verify. Works with Claude Desktop, Cursor, Claude Code, Cline, Windsurf and any other MCP client. Paid tools pay per call via x402 with your own wallet: USDC on Base (gasless) or XRP / RLUSD / USDC on the XRP Ledger (the API also accepts USDC on Stellar; this package pays only on Base or the XRP Ledger). No API key, no account: each paid tool call is one small payment, signed locally on your machine.

Automated observations by Lumi, not a rating, endorsement or guarantee.

Changed in 0.9.9: this package is now only about checking x402 sellers. Tools for API routes retired on Oct 25, 2026 were removed; those routes answer 410 Gone and are never charged. Use lumi_check / /v1/check to check a seller before paying. zod is now required at the patched range (GHSA-mrhx-c7xc-m3w5) for every dependency.

No install needed to browse: the same tools are also served remotely at https://api.lumitrades.io/mcp (Streamable HTTP), for clients that take a remote MCP server URL. A remote connector has no wallet, so its paid tools return the price and how to pay; use this package when you want paid tools to pay automatically from your own wallet.

Tools

General (free)

ToolPaid?Price (USD)What you get
lumi_catalogfree–Endpoints, live prices, this server's wallet + spend caps
lumi_samplesfreeroute?Truncated, labelled samples of every paid product with USD price and full URL
lumi_quotefree–The x402 quote for any paid path, without paying

Lumi Trades seller checks (x402)

ToolPaid?Price (USD)What you get
lumi_verdict$0.01url payTo? amount?One label before paying, same data and signing as /v1/check: checks_passed (Delivered in recent checks) / check_first (Check first) / checks_failed (Recent checks failed) / no_data (Not enough data), with dates, evidence window, sample count, reason codes, evidence and appeal links. Paying Lumi never changes a result
lumi_vendor_scoresfreeurl? domain? payTo? vendor_id?Look up any x402 seller before paying: tier (catalogued / quote-checked, low confidence / test-bought), last free 402-quote check, price and payTo vs its Bazaar listing, on-chain test-buy evidence. No args: Lumi's curated vendor scores
lumi_seller_monitoringfreeenrollment_id?Seller monitoring plans (per endpoint per 30d: Watch $5, Watch Pro $20; 10+ endpoints -20% or 3 terms prepaid -10%, not stacked; Audit $99 one-off; test-buy packs: Re-test $6.50 for 30 test-buys, Founder $5.00 for 24 test-buys, first 10 sellers; free Watch tier; 14-day Watch trial), enrolment steps; with an id, that seller's public entry and badge. Paying never changes a score
lumi_trust_feedfree–Trust data feed plans (free key 1,000 lookups/month, Feed $99/30d, Feed Pro $199/30d) and licence terms
lumi_checkfreeurl? pay_to? amount_usd? network?Lumi Check before you pay any x402 seller: allow / warn / block with reasons, the seller's score and a link to its live report. Signed by Lumi and verified locally. Only origin + path of the URL is sent. Fail-open: warn if Lumi is unreachable within 2.5 s
lumi_scan_sellerfreeurlFetch an x402 seller's 402 quote without paying, plus a dry-run test-buy plan against local caps
lumi_report_receiptfreeendpoint network tx_hash …Sign a receipt for a purchase you already made. submit: true is tier 2 sharing: off by default, needs LUMI_SHARE_RECEIPTS=1 or lumi-scan sharing on. Shares the payment's chain and transaction ID, which is public on-chain and linkable to the paying wallet. Verified receipts earn a public badge only
lumi_trust_checkpaid$0.02Pre-payment check of any x402 URL you are about to pay: payTo/price mismatches vs listings and Lumi's observations. url required
lumi_vendor_reportpaid$0.02Full observation history for one x402 vendor on Lumi's trust list: every quote check (90 days) and paid test-buy with tx hash and delivered yes/no, latency stats and trend, uptime %, agent reports, vendor replies, confidence labels. vendor_id required

How to pay, in order of preference: 1. USDC on Base (gasless, EVM_PRIVATE_KEY), 2. the XRP Ledger (XRPL_SEED): RLUSD or USDC at the same USD price, or XRP at the live XRP/USD rate (quoted per call, rounded up to 0.0001 XRP). Prices are read live from each 402 quote; the table is for orientation. You only pay when you get an answer: the API checks your input before quoting (4xx, nothing charged) and answers 503 "Not charged." when it cannot answer, so a payment is never settled without an answer.

Install

Requires Node 20+. Published on npm as lumi-trades-mcp and in the official MCP Registry as io.github.cypher-osiris/lumi-trades-mcp.

bash
npx -y lumi-trades-mcp

Claude Desktop / Cursor / any MCP client (mcpServers JSON)

json
{  "mcpServers": {    "lumi-trades": {      "command": "npx",      "args": ["-y", "lumi-trades-mcp"],      "env": {        "EVM_PRIVATE_KEY": "0x...your Base agent wallet key (holds USDC, no ETH needed)...",        "LUMI_MAX_USD_PER_CALL": "0.30",        "LUMI_SESSION_BUDGET": "1"      }    }  }}

Paying on the XRP Ledger instead: set "XRPL_SEED": "sEd..." (and optionally "LUMI_PAY_ASSET": "RLUSD" or "USDC", default XRP) in place of EVM_PRIVATE_KEY.

From a clone instead: "command": "node", "args": ["/absolute/path/to/lumi-api/mcp/src/index.js"] (after npm install in mcp/). Claude Code: claude mcp add lumi-trades -e EVM_PRIVATE_KEY=0x... -- npx -y lumi-trades-mcp (or -e XRPL_SEED=sEd...).

Without a wallet the free tools work and paid tools return the price quote instead of paying.

Lumi Check from your own code (x402 / MCP hooks)

js
import { lumiCheckHooks } from "lumi-trades-mcp/src/check.js";const { lumi, x402Hook, mcpHook } = await lumiCheckHooks();   // options: { failMode: "open"|"closed", timeoutMs, publicKeys }
x402Client.onBeforePaymentCreation(x402Hook);   // @x402 core: returns { abort: true, reason } on "block"mcpClient.onPaymentRequired(mcpHook);           // @x402/mcp: returns { abort: true } on "block" (checked by payTo)const v = await lumi.check({ url, payTo, amountUsd: 0.01 }); // { decision, reasons, score, link, verified }

Defaults: fail-open (a timeout or an unverifiable answer gives warn, payment goes ahead) and a 2.5 s timeout. Set failMode: "closed" to block instead. Paying Lumi never changes any seller's score, tier, ranking or badge. The adapters come from lumi-check on npm (Apache-2.0); scoring and verification stay on Lumi's servers.

What the kit shares: nothing until the user says yes. The lumi-scan CLI asks once, after the first check ("Share your results to help improve Lumi's public trust list? [Y/n]"). The MCP server cannot ask, so here sharing stays off and one hint is written to stderr; turn it on with LUMI_CHECK_TELEMETRY=on or lumi-scan telemetry on. Tier 1 is only an anonymous delivery outcome after a paid call: seller host, delivered yes/no, a coarse status class and a random one-time token. No wallet, amount, tx hash, query string or stable ID. Sharing never changes any score. Tier 2 (off by default) sends full signed receipts. Each receipt shares the payment's chain and transaction ID (no amount or wallet field); a transaction ID is public on-chain and can be linked to the paying wallet. Contributors get a public badge only, nothing of monetary value. See the kit README.

Configuration (environment)

VariableDefaultMeaning
EVM_PRIVATE_KEY–0x private key of your Base wallet that pays in USDC via an EIP-3009 authorization (gasless: the facilitator pays gas). Kept in memory only; never logged, returned to the model or sent anywhere (only the signature is sent). Use a dedicated low-balance agent wallet.
XRPL_SEED–Seed of your XRPL wallet that pays. Kept in memory only; never logged, returned to the model or sent anywhere (payments are signed locally, the API only receives the signed blob). Use a dedicated low-balance agent wallet.
LUMI_PAY_ASSETXRP if XRPL_SEED is set, else BASE_USDCBASE_USDC (USDC on Base), or XRP, RLUSD, USDC on the XRP Ledger (XRPL stablecoins need a trust line + balance)
LUMI_MAX_XRP_PER_CALL0.25Refuse any XRP quote above this
LUMI_MAX_USD_PER_CALL0.30Refuse any stablecoin quote (Base or XRPL) above this. The refusal message names this variable and the value needed
LUMI_SESSION_BUDGET1Max total spend per server process, in the pay asset
XRPL_NETWORKxrpl:0xrpl:0 mainnet, xrpl:1 testnet
LUMI_API_URLhttps://api.lumitrades.ioAPI base URL
LUMI_EXPECTED_PAY_TOLumi's wallets on the official API: rM8kmmnz5qPMg7V3r7SHYXgDGvm8PhzLvM (XRPL mainnet), 0x5E617bac19912e6d212CB303ae84655E9E203532 (Base)Refuse to pay any other address
LUMI_CHECK_APILUMI_API_URLBase URL for lumi_check
LUMI_KIT_HOME / LUMI_KIT_CONFIG~/.lumi-scanner-kit/config.jsonKit config (saved sharing answer, telemetry and sharing switches)
LUMI_CHECK_TELEMETRYoff (until the user says yes)on enables tier 1 outcome reports, off disables them; overrides the saved answer
LUMI_SHARE_RECEIPTSoff1 enables tier 2 receipt submission
LUMI_CONTRIB_KEY_FILE–Contributor key for tier 2 submissions (lumi-scan keygen)
XRPL_WS_URLwss://xrplcluster.com / wss://testnet.xrpl-labs.comLedger connection used to autofill and sign

Safety: before signing, the server checks network, scheme, asset, payee, per-call cap and session budget. Anything off and it does not sign. Every paid result carries the on-chain transaction hash.

Tests

bash
npm test                         # spend-cap / payee / settings unit tests + a mocked Base USDC payment through @x402/fetchnode scripts-e2e-testnet.mjs     # testnet only: real x402 payments through MCP against a local testnet API (see the file header)

License

MIT

Source: mcp/README.md at commit 3013662

Tools

9

lumi_catalog

Lumi: endpoints and prices (free)

Free. Lists Lumi API endpoints, live prices (XRP / RLUSD / USDC on the XRP Ledger, USDC on Base), payment settings of this MCP server and the caller wallet address.

Takes no parameters.

lumi_samples

Lumi: free samples of every paid product

Free. A truncated, clearly labelled SAMPLE of each paid product (trust_check, vendor report) with its USD price and full URL, so you can see the shape and quality before paying. Lists are cut to 2 entries; up to 10 minutes old. Pass route to get one product.

Parametersroute

lumi_quote

Lumi: price check without paying (free)

Free. Shows the x402 price quote (XRP / RLUSD / USDC on the XRP Ledger, USDC on Base) for any Lumi paid path, e.g. /v1/trust/check?url=..., without paying. A 503 means the data is not fresh right now and the call would not be sold.

Parameterspathrequired

lumi_vendor_scores

Lumi: x402 vendor observations (free)

Free. Check an x402 seller before you pay it: pass url (the resource you are about to buy), domain, or payTo (the address in its 402 quote, case-insensitive). Lumi ingests the full CDP x402 Bazaar catalog daily and runs free, unpaid 402-quote checks of listings on a rotating schedule (valid quote, price and payTo vs the listing, latency, domain age; live coverage counts in the response), labelled 'quote-checked, low confidence', plus Lumi's own test-buys confirmed on-chain, labelled 'test-bought' and counted per chain (Base USDC buys of Bazaar listings; XRPL buys of a small curated list, separately). Answer-only: tx evidence is in the paid trust check. Observations, not ratings; no match is not a negative finding. With no arguments: the curated XRPL vendor scores and catalog counts; vendor_id gives one curated vendor's summary (tx evidence is in the paid vendor report).

ParametersurlpayTodomainvendor_id

lumi_verdict

Lumi: one-label pre-payment check ($0.01)

GET /v1/verdict costs $0.01 per call over x402 (this tool returns the price terms; the free signed /v1/check has the same data). Before paying an x402 URL or seller domain: one label from the same data and signing key as /v1/check: checks_passed (Delivered in recent checks), check_first (Check first), checks_failed (Recent checks failed) or no_data (Not enough data), with as-of date, evidence window, conclusive test-buy count, last delivered/failed dates, reason codes, evidence and appeal links, and observed on-chain payments as ranges only. Paying Lumi never changes a result. Observations, not a guarantee.

ParametersurlrequiredpayToamount

lumi_seller_monitoring

Lumi: seller monitoring plans and monitored sellers (free)

For x402 sellers, priced per endpoint per 30 days: Watch $5 (hourly quote checks, weekly test-buy, alerts), Watch Pro $20 (15 min checks, daily buys on up to 3 chains, limited by the test-buy budget, signed monthly report); 10+ endpoints -20%, 3 terms prepaid -10% (discounts do not stack: the larger applies). Audit $99 one-off (every listed endpoint, signed report). Test-buy packs, one-off: Re-test pack $6.50 for 30 test-buys ("Fixed something? Get re-tested now"), Founder pack $5 for 24 test-buys (first 10 sellers, one place per company); both valid 12 months, each buy capped at $0.10. Free Watch tier (1 endpoint, daily quote check, no test-buys) and a one-per-seller 14-day Watch trial (no card, never converts; on day 14 nothing is charged, checks stop, the badge comes off and history freezes read-only). No auto-renew; payTo proven by signature; paying never changes a score. No args: plans, enrolment steps and safeguards. enrollment_id: that seller's public entry (disclosure, findings, replies) and live badge status. Plans are paid over x402 at the REST URL.

Parametersenrollment_id

lumi_trust_feed

Lumi: trust data feed plans and licence (free)

Free. Licensed trust data feed for facilitators, wallets and frameworks: free key with 1,000 lookups/month (wallet signature), $1.50 per 1,000 extra lookups, Feed $99/30 days, Feed Pro $199/30 days (snapshot export, webhooks). Returns plans, endpoints and licence terms (no resale, attribution).

Takes no parameters.

lumi_trust_check

Lumi: trust check (paid)

Should I pay this x402 URL? allow / warn / block with coded reasons, from Lumi's daily CDP Bazaar index, free 402-quote checks and Lumi's own test-buys (Base USDC for Bazaar listings; XRPL only for a small curated vendor list, counted separately). Pass url, and optionally the payTo and USD amount you were quoted, to catch address or price mismatches. Links the free lookup and, for curated vendors, the $0.02 full report. Observations, not a guarantee. Paid: $0.02 per call (USDC/RLUSD, or the XRP equivalent).

ParametersurlrequiredpayToamount

lumi_vendor_report

Lumi: vendor report (paid)

Detailed report on one x402 vendor from Lumi's trust list: full observation history (every free 402-quote check over 90 days, every paid test-buy with tx hash and delivered yes/no), latency stats and 7-day trend, uptime % (24h/7d/30d/90d) and daily series, quoted-price history, agent reports, vendor replies, sample sizes and confidence labels. Automated observations, not a rating. Paid ($0.02: ~0.015 XRP / 0.02 RLUSD / 0.02 USDC). The free summary is lumi_vendor_scores.

Parametersvendor_idrequired

Version history

6
  1. v0.9.9LatestOct 26, 2026
  2. v0.9.7Oct 26, 2026
  3. v0.9.4Oct 25, 2026
  4. v0.8.1Oct 23, 2026
  5. v0.6.1Oct 22, 2026
  6. v0.3.0Oct 22, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts