Kaal Agent Safety (x402 paid MCP)

io.github.immoney1Published by GitHub account immoney1v1.0.0Updated Oct 29, 2026

Paid MCP tools for URL payment-safety scanning and provider recommendations; USDC on Base via x402.

VerifiedStreamable HTTPWeb executableFinanceSecurity & Monitoring

Overview

AI-generated overview

Remote MCP server offering two pay-per-call tools: a URL payment-safety scan and a ranked provider directory, paid in USDC on Base via x402.

What you can do
  • Scan a target URL for payment-safety and phishing signals, returning AVOID, CAUTION or CAUTION_NONE_DETECTED plus a signed receipt
  • Look up ranked providers and cost data for a category such as search, onchain data, agent safety, paid discovery or transaction execution
  • Verify a returned receipt through a free replayable verification endpoint
  • Discover the server's MCP and payment manifests through free well-known endpoints
When to use it
Useful when an assistant needs a quick automated check on whether a URL looks safe to pay or transact with, or a ranked cost comparison of providers in a category, and the caller is set up to pay small per-call fees in USDC on Base.
Requirements
A remote streamable-HTTP MCP endpoint; no API keys or accounts are declared. Each tools/call must carry an X-PAYMENT header with a base64 x402 exact-scheme payload, so the client needs a funded USDC-on-Base wallet and x402 payment support. Network access to the endpoint and its payment facilitator is required.
Before you install
Every tool call costs money: $0.002 per safety check and $0.005 per recommendation, settled on-chain in USDC on Base (mainnet or base-sepolia), with funds going to the configured payTo wallet. The client must sign EIP-3009 transfer authorizations, so wallet signing keys are involved. The endpoint is served from a temporary tunnel hostname, and the safety verdicts are heuristic signals, not a guarantee.

Installation

In SourceWeft

  1. Open Kaal Agent Safety (x402 paid MCP) in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.immoney1%2Fkaal-agent-safety/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "kaal-agent-safety-x402-paid": {
      "type": "http",
      "url": "https://places-wayne-experiment-facial.trycloudflare.com/mcp"
    }
  }
}

README

kaal-agent-safety — x402 paid MCP server

Two paid MCP tools plus three free HTTP endpoints. Buyers pay USDC on Base (per-call, x402 exact scheme, EIP-3009 transferWithAuthorization) — no API keys, no subscriptions. Free initialize + tools/list; payment only on tools/call (HTTP 402 with payment requirements).

Endpoints

EndpointMethodPriceNotes
/v1/safety/check?target=<url>GET$0.002deterministic payment-safety / phishing scan + signed receipt
/v1/recommend?category=<cat>GET$0.005ranked provider / cost-directory lookup
/mcpPOST (MCP)see belowstreamable-http MCP transport
/.well-known/mcp.jsonGETfreeMCP discovery manifest
/.well-known/x402GETfreex402 payment manifest (payTo, facilitator, prices)
/v1/verify?receipt=<id>GETfreereplayable receipt verification
/healthGETfreeliveness

MCP tools

  • safety_check(target) — $0.002 per call: flags credentials_in_url, no_hsts, ip_literal, lookalike hosts, missing /.well-known/x402 manifest; returns AVOID / CAUTION / CAUTION_NONE_DETECTED + signed receipt.
  • recommend(category) — $0.005 per call: ranked whitespace/cost directory across search, onchain-data, agent-safety, paid-discovery, tx-execution.

Connect

bash
claude mcp add --transport http kaal-agent-safety https://<host>/mcp# or any MCP client pointed at the streamable-http URL in server.json

Free: initialize, notifications/initialized, tools/list. Paid: tools/call requires X-PAYMENT header (base64 exact-scheme payload); server settles through an x402 facilitator and returns X-Payment-Response with the on-chain transaction.

Run

bash
npm ciRECEIPT_SECRET=<32-byte-hex> \NETWORK=base FACILITATOR_URL=http://127.0.0.1:8142 \PORT=8140 node server.js

RECEIPT_SECRET (or WALLET_FILE=<path-to-wallet-json>) signs receipts. NETWORK is base (mainnet) or base-sepolia. Settlement is non-custodial: funds go straight to the configured payTo wallet on every settlement.

Verified

  • Local E2E: unpaid 402 → EIP-3009 signed payment → verify → settle → on-chain receipt status 1.
  • Public E2E over a tunnel: paid GET /v1/safety/check settled with tx 0xd7bd01780b75d106fb3e286b6a3c55a78a6a486ee2cf439f4d2b3d8b5b1c28d7 (Base mainnet, block 53162843, gas 83208).
  • Revenue ledger + treasury sweep + systemd auto-restart are part of the production deployment.

License

MIT

Source: README.md at commit c74d51e

Tools

0
SourceWeft has not read this server's tools yet.

Version history

1
  1. v1.0.0LatestOct 29, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declaredRequired10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.