Lumi Trades: x402 seller checks and test-buys

io.github.cypher-osiris由 GitHub 帳號 cypher-osiris 發布v0.9.9更新於 Oct 28, 2026

Free signed allow/warn/block before paying x402 sellers; test-buys on XRPL, Base and Stellar

已驗證Streamable HTTP可網頁執行金融安全與監控商業與電商

概覽

AI 產生的概覽

Lumi Trades 在助理向 x402 賣家付款前進行檢查，回傳 allow/warn/block 結論、賣家評分與報告，付費工具按次以加密貨幣付款。

可以做什麼
  • 查詢 x402 賣家，依 URL、網域或 payTo 位址取得附原因代碼的 allow/warn/block 付款前結論
  • 檢視賣家評分、完整賣家報告，含報價檢查與測試購買紀錄、延遲、上線率與價格趨勢
  • 瀏覽端點目錄、即時價格、截斷的產品樣本以及 x402 報價，無需付費
  • 查看賣家監控方案、測試購買套裝與信任資料來源的授權條款
  • 為已完成的購買簽署收據，可選擇分享鏈與交易 ID
適用情境
當助理即將向某個 x402 端點付款、需要一份簽章的付款前檢查時使用；也適合在投入資金前了解賣家的可靠性、上線率與報價歷史。
執行需求
npm 套件需 Node 20+，或使用 api.lumitrades.io 的遠端 Streamable HTTP 端點（無錢包，付費工具只回傳價格條款）。付費工具需要已儲值的 Base 錢包（EVM_PRIVATE_KEY，USDC，免 gas）或 XRPL 錢包（XRPL_SEED）；可選上限 LUMI_MAX_USD_PER_CALL、LUMI_MAX_XRP_PER_CALL、LUMI_SESSION_BUDGET、LUMI_PAY_ASSET 與 XRPL_NETWORK。免費工具無需錢包。
安裝前請注意
付費工具每次呼叫會花真錢（約 0.01 至 0.02 美元，另有監控與資料來源方案），請把單次與單工作階段上限設低。EVM_PRIVATE_KEY 與 XRPL_SEED 是錢包密鑰，請使用專用的低餘額代理錢包。收據分享預設關閉；開啟後會分享鏈上公開、可與付款錢包連結的交易 ID。結果僅為自動觀測，不是評等，也不構成財務建議。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Lumi Trades: x402 seller checks and test-buys，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/io.github.cypher-osiris%2Flumi-trades-mcp/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "lumi-trades-x402-seller-checks-and-test": {
      "type": "http",
      "url": "https://api.lumitrades.io/mcp"
    }
  }
}

README

lumi-trades-mcp

MCP server (stdio) for Lumi Trades: Lumi Check, a free signed allow/warn/block check before your agent pays an x402 seller, backed by Lumi's own paid test-buys on XRPL, Base and Stellar: x402 seller trust you can verify. Works with Claude Desktop, Cursor, Claude Code, Cline, Windsurf and any other MCP client. Paid tools pay per call via x402 with your own wallet: USDC on Base (gasless) or XRP / RLUSD / USDC on the XRP Ledger (the API also accepts USDC on Stellar; this package pays only on Base or the XRP Ledger). No API key, no account: each paid tool call is one small payment, signed locally on your machine.

Automated observations by Lumi, not a rating, endorsement or guarantee.

Changed in 0.9.9: this package is now only about checking x402 sellers. Tools for API routes retired on Oct 25, 2026 were removed; those routes answer 410 Gone and are never charged. Use lumi_check / /v1/check to check a seller before paying. zod is now required at the patched range (GHSA-mrhx-c7xc-m3w5) for every dependency.

No install needed to browse: the same tools are also served remotely at https://api.lumitrades.io/mcp (Streamable HTTP), for clients that take a remote MCP server URL. A remote connector has no wallet, so its paid tools return the price and how to pay; use this package when you want paid tools to pay automatically from your own wallet.

Tools

General (free)

ToolPaid?Price (USD)What you get
lumi_catalogfree–Endpoints, live prices, this server's wallet + spend caps
lumi_samplesfreeroute?Truncated, labelled samples of every paid product with USD price and full URL
lumi_quotefree–The x402 quote for any paid path, without paying

Lumi Trades seller checks (x402)

ToolPaid?Price (USD)What you get
lumi_verdict$0.01url payTo? amount?One label before paying, same data and signing as /v1/check: checks_passed (Delivered in recent checks) / check_first (Check first) / checks_failed (Recent checks failed) / no_data (Not enough data), with dates, evidence window, sample count, reason codes, evidence and appeal links. Paying Lumi never changes a result
lumi_vendor_scoresfreeurl? domain? payTo? vendor_id?Look up any x402 seller before paying: tier (catalogued / quote-checked, low confidence / test-bought), last free 402-quote check, price and payTo vs its Bazaar listing, on-chain test-buy evidence. No args: Lumi's curated vendor scores
lumi_seller_monitoringfreeenrollment_id?Seller monitoring plans (per endpoint per 30d: Watch $5, Watch Pro $20; 10+ endpoints -20% or 3 terms prepaid -10%, not stacked; Audit $99 one-off; test-buy packs: Re-test $6.50 for 30 test-buys, Founder $5.00 for 24 test-buys, first 10 sellers; free Watch tier; 14-day Watch trial), enrolment steps; with an id, that seller's public entry and badge. Paying never changes a score
lumi_trust_feedfree–Trust data feed plans (free key 1,000 lookups/month, Feed $99/30d, Feed Pro $199/30d) and licence terms
lumi_checkfreeurl? pay_to? amount_usd? network?Lumi Check before you pay any x402 seller: allow / warn / block with reasons, the seller's score and a link to its live report. Signed by Lumi and verified locally. Only origin + path of the URL is sent. Fail-open: warn if Lumi is unreachable within 2.5 s
lumi_scan_sellerfreeurlFetch an x402 seller's 402 quote without paying, plus a dry-run test-buy plan against local caps
lumi_report_receiptfreeendpoint network tx_hash …Sign a receipt for a purchase you already made. submit: true is tier 2 sharing: off by default, needs LUMI_SHARE_RECEIPTS=1 or lumi-scan sharing on. Shares the payment's chain and transaction ID, which is public on-chain and linkable to the paying wallet. Verified receipts earn a public badge only
lumi_trust_checkpaid$0.02Pre-payment check of any x402 URL you are about to pay: payTo/price mismatches vs listings and Lumi's observations. url required
lumi_vendor_reportpaid$0.02Full observation history for one x402 vendor on Lumi's trust list: every quote check (90 days) and paid test-buy with tx hash and delivered yes/no, latency stats and trend, uptime %, agent reports, vendor replies, confidence labels. vendor_id required

How to pay, in order of preference: 1. USDC on Base (gasless, EVM_PRIVATE_KEY), 2. the XRP Ledger (XRPL_SEED): RLUSD or USDC at the same USD price, or XRP at the live XRP/USD rate (quoted per call, rounded up to 0.0001 XRP). Prices are read live from each 402 quote; the table is for orientation. You only pay when you get an answer: the API checks your input before quoting (4xx, nothing charged) and answers 503 "Not charged." when it cannot answer, so a payment is never settled without an answer.

Install

Requires Node 20+. Published on npm as lumi-trades-mcp and in the official MCP Registry as io.github.cypher-osiris/lumi-trades-mcp.

bash
npx -y lumi-trades-mcp

Claude Desktop / Cursor / any MCP client (mcpServers JSON)

json
{  "mcpServers": {    "lumi-trades": {      "command": "npx",      "args": ["-y", "lumi-trades-mcp"],      "env": {        "EVM_PRIVATE_KEY": "0x...your Base agent wallet key (holds USDC, no ETH needed)...",        "LUMI_MAX_USD_PER_CALL": "0.30",        "LUMI_SESSION_BUDGET": "1"      }    }  }}

Paying on the XRP Ledger instead: set "XRPL_SEED": "sEd..." (and optionally "LUMI_PAY_ASSET": "RLUSD" or "USDC", default XRP) in place of EVM_PRIVATE_KEY.

From a clone instead: "command": "node", "args": ["/absolute/path/to/lumi-api/mcp/src/index.js"] (after npm install in mcp/). Claude Code: claude mcp add lumi-trades -e EVM_PRIVATE_KEY=0x... -- npx -y lumi-trades-mcp (or -e XRPL_SEED=sEd...).

Without a wallet the free tools work and paid tools return the price quote instead of paying.

Lumi Check from your own code (x402 / MCP hooks)

js
import { lumiCheckHooks } from "lumi-trades-mcp/src/check.js";const { lumi, x402Hook, mcpHook } = await lumiCheckHooks();   // options: { failMode: "open"|"closed", timeoutMs, publicKeys }
x402Client.onBeforePaymentCreation(x402Hook);   // @x402 core: returns { abort: true, reason } on "block"mcpClient.onPaymentRequired(mcpHook);           // @x402/mcp: returns { abort: true } on "block" (checked by payTo)const v = await lumi.check({ url, payTo, amountUsd: 0.01 }); // { decision, reasons, score, link, verified }

Defaults: fail-open (a timeout or an unverifiable answer gives warn, payment goes ahead) and a 2.5 s timeout. Set failMode: "closed" to block instead. Paying Lumi never changes any seller's score, tier, ranking or badge. The adapters come from lumi-check on npm (Apache-2.0); scoring and verification stay on Lumi's servers.

What the kit shares: nothing until the user says yes. The lumi-scan CLI asks once, after the first check ("Share your results to help improve Lumi's public trust list? [Y/n]"). The MCP server cannot ask, so here sharing stays off and one hint is written to stderr; turn it on with LUMI_CHECK_TELEMETRY=on or lumi-scan telemetry on. Tier 1 is only an anonymous delivery outcome after a paid call: seller host, delivered yes/no, a coarse status class and a random one-time token. No wallet, amount, tx hash, query string or stable ID. Sharing never changes any score. Tier 2 (off by default) sends full signed receipts. Each receipt shares the payment's chain and transaction ID (no amount or wallet field); a transaction ID is public on-chain and can be linked to the paying wallet. Contributors get a public badge only, nothing of monetary value. See the kit README.

Configuration (environment)

VariableDefaultMeaning
EVM_PRIVATE_KEY–0x private key of your Base wallet that pays in USDC via an EIP-3009 authorization (gasless: the facilitator pays gas). Kept in memory only; never logged, returned to the model or sent anywhere (only the signature is sent). Use a dedicated low-balance agent wallet.
XRPL_SEED–Seed of your XRPL wallet that pays. Kept in memory only; never logged, returned to the model or sent anywhere (payments are signed locally, the API only receives the signed blob). Use a dedicated low-balance agent wallet.
LUMI_PAY_ASSETXRP if XRPL_SEED is set, else BASE_USDCBASE_USDC (USDC on Base), or XRP, RLUSD, USDC on the XRP Ledger (XRPL stablecoins need a trust line + balance)
LUMI_MAX_XRP_PER_CALL0.25Refuse any XRP quote above this
LUMI_MAX_USD_PER_CALL0.30Refuse any stablecoin quote (Base or XRPL) above this. The refusal message names this variable and the value needed
LUMI_SESSION_BUDGET1Max total spend per server process, in the pay asset
XRPL_NETWORKxrpl:0xrpl:0 mainnet, xrpl:1 testnet
LUMI_API_URLhttps://api.lumitrades.ioAPI base URL
LUMI_EXPECTED_PAY_TOLumi's wallets on the official API: rM8kmmnz5qPMg7V3r7SHYXgDGvm8PhzLvM (XRPL mainnet), 0x5E617bac19912e6d212CB303ae84655E9E203532 (Base)Refuse to pay any other address
LUMI_CHECK_APILUMI_API_URLBase URL for lumi_check
LUMI_KIT_HOME / LUMI_KIT_CONFIG~/.lumi-scanner-kit/config.jsonKit config (saved sharing answer, telemetry and sharing switches)
LUMI_CHECK_TELEMETRYoff (until the user says yes)on enables tier 1 outcome reports, off disables them; overrides the saved answer
LUMI_SHARE_RECEIPTSoff1 enables tier 2 receipt submission
LUMI_CONTRIB_KEY_FILE–Contributor key for tier 2 submissions (lumi-scan keygen)
XRPL_WS_URLwss://xrplcluster.com / wss://testnet.xrpl-labs.comLedger connection used to autofill and sign

Safety: before signing, the server checks network, scheme, asset, payee, per-call cap and session budget. Anything off and it does not sign. Every paid result carries the on-chain transaction hash.

Tests

bash
npm test                         # spend-cap / payee / settings unit tests + a mocked Base USDC payment through @x402/fetchnode scripts-e2e-testnet.mjs     # testnet only: real x402 payments through MCP against a local testnet API (see the file header)

License

MIT

來源：mcp/README.md，提交 3013662

工具

9

lumi_catalog

Lumi: endpoints and prices (free)

Free. Lists Lumi API endpoints, live prices (XRP / RLUSD / USDC on the XRP Ledger, USDC on Base), payment settings of this MCP server and the caller wallet address.

無需輸入參數。

lumi_samples

Lumi: free samples of every paid product

Free. A truncated, clearly labelled SAMPLE of each paid product (trust_check, vendor report) with its USD price and full URL, so you can see the shape and quality before paying. Lists are cut to 2 entries; up to 10 minutes old. Pass route to get one product.

輸入參數route

lumi_quote

Lumi: price check without paying (free)

Free. Shows the x402 price quote (XRP / RLUSD / USDC on the XRP Ledger, USDC on Base) for any Lumi paid path, e.g. /v1/trust/check?url=..., without paying. A 503 means the data is not fresh right now and the call would not be sold.

輸入參數path必填

lumi_vendor_scores

Lumi: x402 vendor observations (free)

Free. Check an x402 seller before you pay it: pass url (the resource you are about to buy), domain, or payTo (the address in its 402 quote, case-insensitive). Lumi ingests the full CDP x402 Bazaar catalog daily and runs free, unpaid 402-quote checks of listings on a rotating schedule (valid quote, price and payTo vs the listing, latency, domain age; live coverage counts in the response), labelled 'quote-checked, low confidence', plus Lumi's own test-buys confirmed on-chain, labelled 'test-bought' and counted per chain (Base USDC buys of Bazaar listings; XRPL buys of a small curated list, separately). Answer-only: tx evidence is in the paid trust check. Observations, not ratings; no match is not a negative finding. With no arguments: the curated XRPL vendor scores and catalog counts; vendor_id gives one curated vendor's summary (tx evidence is in the paid vendor report).

輸入參數urlpayTodomainvendor_id

lumi_verdict

Lumi: one-label pre-payment check ($0.01)

GET /v1/verdict costs $0.01 per call over x402 (this tool returns the price terms; the free signed /v1/check has the same data). Before paying an x402 URL or seller domain: one label from the same data and signing key as /v1/check: checks_passed (Delivered in recent checks), check_first (Check first), checks_failed (Recent checks failed) or no_data (Not enough data), with as-of date, evidence window, conclusive test-buy count, last delivered/failed dates, reason codes, evidence and appeal links, and observed on-chain payments as ranges only. Paying Lumi never changes a result. Observations, not a guarantee.

輸入參數url必填payToamount

lumi_seller_monitoring

Lumi: seller monitoring plans and monitored sellers (free)

For x402 sellers, priced per endpoint per 30 days: Watch $5 (hourly quote checks, weekly test-buy, alerts), Watch Pro $20 (15 min checks, daily buys on up to 3 chains, limited by the test-buy budget, signed monthly report); 10+ endpoints -20%, 3 terms prepaid -10% (discounts do not stack: the larger applies). Audit $99 one-off (every listed endpoint, signed report). Test-buy packs, one-off: Re-test pack $6.50 for 30 test-buys ("Fixed something? Get re-tested now"), Founder pack $5 for 24 test-buys (first 10 sellers, one place per company); both valid 12 months, each buy capped at $0.10. Free Watch tier (1 endpoint, daily quote check, no test-buys) and a one-per-seller 14-day Watch trial (no card, never converts; on day 14 nothing is charged, checks stop, the badge comes off and history freezes read-only). No auto-renew; payTo proven by signature; paying never changes a score. No args: plans, enrolment steps and safeguards. enrollment_id: that seller's public entry (disclosure, findings, replies) and live badge status. Plans are paid over x402 at the REST URL.

輸入參數enrollment_id

lumi_trust_feed

Lumi: trust data feed plans and licence (free)

Free. Licensed trust data feed for facilitators, wallets and frameworks: free key with 1,000 lookups/month (wallet signature), $1.50 per 1,000 extra lookups, Feed $99/30 days, Feed Pro $199/30 days (snapshot export, webhooks). Returns plans, endpoints and licence terms (no resale, attribution).

無需輸入參數。

lumi_trust_check

Lumi: trust check (paid)

Should I pay this x402 URL? allow / warn / block with coded reasons, from Lumi's daily CDP Bazaar index, free 402-quote checks and Lumi's own test-buys (Base USDC for Bazaar listings; XRPL only for a small curated vendor list, counted separately). Pass url, and optionally the payTo and USD amount you were quoted, to catch address or price mismatches. Links the free lookup and, for curated vendors, the $0.02 full report. Observations, not a guarantee. Paid: $0.02 per call (USDC/RLUSD, or the XRP equivalent).

輸入參數url必填payToamount

lumi_vendor_report

Lumi: vendor report (paid)

Detailed report on one x402 vendor from Lumi's trust list: full observation history (every free 402-quote check over 90 days, every paid test-buy with tx hash and delivered yes/no), latency stats and 7-day trend, uptime % (24h/7d/30d/90d) and daily series, quoted-price history, agent reports, vendor replies, sample sizes and confidence labels. Automated observations, not a rating. Paid ($0.02: ~0.015 XRP / 0.02 RLUSD / 0.02 USDC). The free summary is lumi_vendor_scores.

輸入參數vendor_id必填

版本歷史

6
  1. v0.9.9最新Oct 26, 2026
  2. v0.9.7Oct 26, 2026
  3. v0.9.4Oct 25, 2026
  4. v0.8.1Oct 23, 2026
  5. v0.6.1Oct 22, 2026
  6. v0.3.0Oct 22, 2026

評分

已滿足適用檢查項的 100%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分