PayStage Auth Watch

xyz.paystagePublished by paystage.xyzv0.1.0Updated Oct 30, 2026

Read-only MCP tools to list and flag outstanding ERC-20, Permit2, and EIP-3009 auths

VerifiedSTDIODesktop onlyFinance Security & Monitoring

Server details

Identifier: xyz.paystage/auth-watch
Transport: STDIO
Runtime: Desktop only
Trust: Verified
Published: Oct 30, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified that this server's namespace belongs to paystage.xyz. It runs from a package rather than a hosted endpoint, so there is no endpoint to match against that domain.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/xyz.paystage%2Fauth-watch.svg)](https://sourceweft.com/mcp/xyz.paystage%2Fauth-watch?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

Read-only MCP server that lists a wallet's outstanding ERC-20, Permit2 and EIP-3009 token authorizations and flags them against a spending policy.

What you can do: List outstanding token authorizations for a wallet, covering ERC-20 allowances, Permit2 allowances and EIP-3009 nonces.
Evaluate those authorizations against a Paystage policy and flag the ones that break the rules.
Scope the scan by network, token addresses, spenders, or supplied EIP-3009 nonces.
Load the policy from a file path or pass it inline, and override the RPC endpoint.
When to use it: Useful when you want an assistant to audit a Base wallet's token approvals and see which outstanding allowances or nonces exceed a defined spending policy, without signing or sending anything.
Requirements: Runs locally as a Node.js process from the npm package. Needs network access to a Base RPC endpoint (Base mainnet or Base Sepolia by default), overridable via PAYSTAGE_RPC_URL. A policy file path can be given via PAYSTAGE_POLICY_PATH or per call. No account or API key is declared.

Before you install

The server reads wallet authorization data through a third-party RPC endpoint, so the wallet address and queried token and spender addresses are sent to that provider. Tools are described as read-only, but confirm the policy file contents before pointing the server at it, since evaluation results depend on those rules.

Installation

In SourceWeft

Open PayStage Auth Watch in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@paystage/auth-watch

Scan and evaluate outstanding token authorizations (ERC-20 allowances, Permit2 allowances, and EIP-3009 nonces) for a wallet against a Paystage policy.

Install

Library usage

import {  createRpcClient,  resolveRpcUrl,  listOutstandingAuths,  evaluateOutstandingAuths,} from "@paystage/auth-watch";import { loadPolicy } from "@paystage/policy";
const network = "eip155:8453";const rpc = createRpcClient(resolveRpcUrl(network));const policy = await loadPolicy("./paystage.policy.json");
const items = await listOutstandingAuths({  wallet: "0x...",  network,  tokens: ["0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"],  spenders: policy.allowed_spenders ?? policy.allowed_pay_to,  rpc,});
const results = evaluateOutstandingAuths(items, policy);

import {  createRpcClient,  resolveRpcUrl,  listOutstandingAuths,  evaluateOutstandingAuths,} from "@paystage/auth-watch";import { loadPolicy } from "@paystage/policy";
const network = "eip155:8453";const rpc = createRpcClient(resolveRpcUrl(network));const policy = await loadPolicy("./paystage.policy.json");
const items = await listOutstandingAuths({  wallet: "0x...",  network,  tokens: ["0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"],  spenders: policy.allowed_spenders ?? policy.allowed_pay_to,  rpc,});
const results = evaluateOutstandingAuths(items, policy);

MCP server

Tools:

list_outstanding_auths — list outstanding authorizations.
evaluate_outstanding_auths — list and evaluate against a policy.

Both accept wallet, optional network, tokens, spenders, policy_path or inline policy, eip3009_nonces, and rpc_url.

Environment

PAYSTAGE_RPC_URL — overrides the default RPC URL for the network.

Networks

eip155:8453 — Base mainnet (https://mainnet.base.org)
eip155:84532 — Base Sepolia (https://sepolia.base.org)

Source: packages/auth-watch/README.md at commit 51d940d

Tools

list_outstanding_auths

List outstanding token authorizations for a wallet

Parameterspolicytokenswalletrequirednetworkrpc_urlspenderspolicy_patheip3009_nonces

evaluate_outstanding_auths

List and evaluate outstanding token authorizations against a policy

Parameterspolicytokenswalletrequirednetworkrpc_urlspenderspolicy_patheip3009_nonces

Version history

v0.1.0LatestOct 30, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 days25 pts
Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
Tools listedRequired15 pts
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts