Non-custodial x402 MCP payment layer for AI agents — the open-source alternative to Vercel x402-mcp
Drift inferred · capture-to-capture
tool count over time
08-14 09:31 now
23t
0t
transport stdio · http
verified
reported
listed in the official MCP registry counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 513ad0d · analyzer v33 · 2d ago
skills & prompt files 2
- agent-rules up2itnow0822-agentpay-mcp-513ad0d/.cursorrules
- agent-rules up2itnow0822-agentpay-mcp-513ad0d/AGENTS.md
danger signals14
- suspicious endpoint 169.254.169.254 (cloud metadata) up2itnow0822-agentpay-mcp-513ad0d/tests/otel-budget.test.ts :440
const result = registerPolicy(killPolicy('http://169.254.169.254/kill')) - suspicious endpoint 192.0.0.1 up2itnow0822-agentpay-mcp-513ad0d/tests/otel-budget.test.ts :536
['http://192.0.0.1/kill', 'IETF protocol assignments 192.0.0.0/24'], - suspicious endpoint 192.0.0.170 up2itnow0822-agentpay-mcp-513ad0d/tests/otel-budget.test.ts :537
['http://192.0.0.170/kill', 'NAT64 discovery inside 192.0.0.0/24'], - suspicious endpoint 93.184.216.7 up2itnow0822-agentpay-mcp-513ad0d/tests/otel-budget.test.ts :600
'https://93.184.216.7/kill', - suspicious endpoint 93.184.216.34 up2itnow0822-agentpay-mcp-513ad0d/tests/otel-budget.test.ts :601
'https://93.184.216.34:8443/kill', - suspicious endpoint 192.0.1.1 up2itnow0822-agentpay-mcp-513ad0d/tests/otel-budget.test.ts :607
'https://192.0.1.1/kill', - suspicious endpoint 192.0.3.1 up2itnow0822-agentpay-mcp-513ad0d/tests/otel-budget.test.ts :608
'https://192.0.3.1/kill', - suspicious endpoint 198.17.255.254 up2itnow0822-agentpay-mcp-513ad0d/tests/otel-budget.test.ts :609
'https://198.17.255.254/kill', - suspicious endpoint 198.20.0.1 up2itnow0822-agentpay-mcp-513ad0d/tests/otel-budget.test.ts :610
'https://198.20.0.1/kill', - suspicious endpoint 198.51.101.7 up2itnow0822-agentpay-mcp-513ad0d/tests/otel-budget.test.ts :611
'https://198.51.101.7/kill', - suspicious endpoint 203.0.114.10 up2itnow0822-agentpay-mcp-513ad0d/tests/otel-budget.test.ts :612
'https://203.0.114.10/kill', - suspicious endpoint 192.31.196.1 up2itnow0822-agentpay-mcp-513ad0d/tests/otel-budget.test.ts :615
'https://192.31.196.1/kill', - suspicious endpoint 192.52.193.1 up2itnow0822-agentpay-mcp-513ad0d/tests/otel-budget.test.ts :616
'https://192.52.193.1/kill', - suspicious endpoint 192.175.48.1 up2itnow0822-agentpay-mcp-513ad0d/tests/otel-budget.test.ts :617
'https://192.175.48.1/kill',
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 102
filesystem 29
- fs (weak) up2itnow0822-agentpay-mcp-513ad0d/examples/value-packs/research-agent.ts :28
import * as fs from 'fs'; - fs (weak) up2itnow0822-agentpay-mcp-513ad0d/examples/value-packs/shared/cache.ts :12
import * as fs from 'fs'; - fs (weak) up2itnow0822-agentpay-mcp-513ad0d/scripts/clean-install-x402-smoke.mjs :2
import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'; - fs (weak) up2itnow0822-agentpay-mcp-513ad0d/tests/authorized-cybersecurity-scan-profile.test.ts :1
import { readFileSync } from 'node:fs'; - fs (weak) up2itnow0822-agentpay-mcp-513ad0d/tests/batch-settlement-channels-docs.test.ts :1
import { readFileSync } from 'node:fs'; - fs (weak) up2itnow0822-agentpay-mcp-513ad0d/tests/bazaar-observability-docs.test.ts :1
import { readFileSync } from 'node:fs'; - fs (weak) up2itnow0822-agentpay-mcp-513ad0d/tests/buyer-flow-and-gateway-docs.test.ts :1
import { readFileSync } from 'node:fs'; - fs (weak) up2itnow0822-agentpay-mcp-513ad0d/tests/channel-affiliate-controls-docs.test.ts :1
import { readFileSync } from 'node:fs'; - fs (weak) up2itnow0822-agentpay-mcp-513ad0d/tests/dependency-pin-policy.test.ts :1
import { readFileSync } from 'node:fs'; - fs (weak) up2itnow0822-agentpay-mcp-513ad0d/tests/directory-introspection-docs.test.ts :1
import { readFileSync } from 'node:fs'; - fs (weak) up2itnow0822-agentpay-mcp-513ad0d/tests/dispatcher-error-envelope.test.ts :16
import { readFileSync } from 'node:fs'; - fs (weak) up2itnow0822-agentpay-mcp-513ad0d/tests/funding-ux-benchmark-docs.test.ts :1
import { readFileSync } from 'node:fs';
show 17 more
- fs (weak) up2itnow0822-agentpay-mcp-513ad0d/tests/hosted-proxy-verification-docs.test.ts :1
import { readFileSync } from 'node:fs'; - fs (weak) up2itnow0822-agentpay-mcp-513ad0d/tests/multi-sdk-batch-settlement-parity-docs.test.ts :1
import { readFileSync } from 'node:fs'; - fs (weak) up2itnow0822-agentpay-mcp-513ad0d/tests/p143-p145-docs.test.ts :1
import { readFileSync } from 'node:fs'; - fs (weak) up2itnow0822-agentpay-mcp-513ad0d/tests/p146-p148-docs.test.ts :1
import { readFileSync } from 'node:fs'; - fs (weak) up2itnow0822-agentpay-mcp-513ad0d/tests/p149-p151-docs.test.ts :1
import { readFileSync } from 'node:fs'; - fs (weak) up2itnow0822-agentpay-mcp-513ad0d/tests/paid-provider-health-proof-docs.test.ts :1
import { readFileSync } from 'node:fs'; - fs (weak) up2itnow0822-agentpay-mcp-513ad0d/tests/paid-provider-health-proof.test.ts :1
import { readFileSync } from 'node:fs'; - fs (weak) up2itnow0822-agentpay-mcp-513ad0d/tests/paid-tool-quality-threshold.test.ts :1
import { readFileSync } from 'node:fs'; - fs (weak) up2itnow0822-agentpay-mcp-513ad0d/tests/scanner-readiness-docs.test.ts :1
import { readFileSync } from 'node:fs'; - fs (weak) up2itnow0822-agentpay-mcp-513ad0d/tests/smithery-paid-mcp-installation-docs.test.ts :1
import { readFileSync } from 'node:fs'; - fs (weak) up2itnow0822-agentpay-mcp-513ad0d/tests/tvm-readiness-docs.test.ts :1
import { readFileSync } from 'node:fs'; - fs (weak) up2itnow0822-agentpay-mcp-513ad0d/tests/whatsapp-controls-docs.test.ts :1
import { readFileSync } from 'node:fs'; - fs (weak) up2itnow0822-agentpay-mcp-513ad0d/tests/x402-chain-neutral-gateway-profile-docs.test.ts :1
import { readFileSync } from 'node:fs'; - fs (weak) up2itnow0822-agentpay-mcp-513ad0d/tests/x402-chain-neutral-gateway-profile.test.ts :1
import { readFileSync } from 'node:fs'; - fs (weak) up2itnow0822-agentpay-mcp-513ad0d/tests/x402-dynamic-paid-mcp-manifest-drift-docs.test.ts :1
import { readFileSync } from 'node:fs'; - fs (weak) up2itnow0822-agentpay-mcp-513ad0d/tests/x402-dynamic-paid-mcp-manifest-drift.test.ts :1
import { readFileSync } from 'node:fs'; - fs (weak) up2itnow0822-agentpay-mcp-513ad0d/tests/x402-v211-and-directory-docs.test.ts :1
import { readFileSync } from 'node:fs';
shell / exec 3
- shell (weak) up2itnow0822-agentpay-mcp-513ad0d/scripts/clean-install-x402-smoke.mjs :6
import { spawnSync } from 'node:child_process'; - shell (weak) up2itnow0822-agentpay-mcp-513ad0d/scripts/security-check.mjs :1
import { spawnSync } from 'node:child_process' - shell (weak) up2itnow0822-agentpay-mcp-513ad0d/tests/directory-introspection-docs.test.ts :2
import { execFileSync, spawnSync } from 'node:child_process';
network 5
- net (weak) up2itnow0822-agentpay-mcp-513ad0d/examples/value-packs/shared/x402-client.ts :67
const response = await fetch(url, { - net (weak) up2itnow0822-agentpay-mcp-513ad0d/examples/x402-clean-demo/server.mjs :1
import http from "node:http"; - net up2itnow0822-agentpay-mcp-513ad0d/src/tools/otel-budget.ts :457
* that answers with a public address here and a private one to the fetch (DNS - net up2itnow0822-agentpay-mcp-513ad0d/src/tools/session.ts :274
const response = await x402Client.fetch(input.endpoint, requestInit); - net up2itnow0822-agentpay-mcp-513ad0d/src/tools/x402.ts :277
const response = await fetch(input.url, requestInit);
secrets 3
- secrets (weak) up2itnow0822-agentpay-mcp-513ad0d/examples/value-packs/shared/x402-client.ts :98
const privateKey = config.privateKey ?? process.env['AGENT_PRIVATE_KEY']; - secrets up2itnow0822-agentpay-mcp-513ad0d/src/utils/client.ts :51
const agentPrivateKey = process.env['AGENT_PRIVATE_KEY']; - secrets (weak) up2itnow0822-agentpay-mcp-513ad0d/tests/chain-drift.test.ts :26
delete process.env['AGENT_PRIVATE_KEY'];
install hooks 1
- prepublishOnly up2itnow0822-agentpay-mcp-513ad0d/package.json :37
npm run clean && npm run build && npm run typecheck && npm run smoke:clean-install
declared dependencies 14
- @modelcontextprotocol/sdk@^1.0.4
- @hono/node-server@1.19.17
- agentwallet-sdk@^6.2.1
- viem@2.56.0
- zod@^3.22.4
- @types/node@^20.11.0
- @typescript-eslint/eslint-plugin@^8.57.1
- @typescript-eslint/parser@^8.57.1
- @vitest/coverage-v8@^4.0.18
- eslint@^10.1.0
- globals@^17.4.0
- typescript@^5.3.3
show 2 more
- typescript-eslint@^8.57.1
- vitest@^4.0.18