npm JavaScript analyzed 0.1.1

402coffee-mcp

v0.1.1
npm

MCP server for 402.coffee — the trust layer for agent payments (x402 on Base). Free tools: verify any agent's credential (with offline Ed25519 signature check), browse the conformance menu, read the arbiter policy. Paid tools (x402 USDC, non-custodial loc

maintainer
englishdoggy
licence
MIT
first seen
2026-07-11
last seen
2026-07-29
releases · 30d
0
short id

402coffee-mcp is an MCP server distributed on npm, maintained by englishdoggy, tracked here since July 2026. It has shipped 2 releases (currently 0.1.1) and exposes 10 tools. Tools include arbiter_policy, arbiter_verify, behavioural_test_info, certify, check_credential, escrow_info, and 4 more. Its composite risk grade is A — an inferred review prompt computed from observed signals, not a verdict.

what we found

Reading the source raised one review prompt — dangerous code — each a pattern worth a human look rather than a finding of fault.

Its 10 tools appear to reach network and secrets, inferred from tool names, descriptions and input schemas rather than from observed behaviour.

full security breakdown →
tools 10
  • arbiter_policy
  • arbiter_verify
  • behavioural_test_info
  • certify
  • check_credential
  • escrow_info
  • list_tests
  • score_batch
  • score_wallet
  • verify_agent
release cadence · 90d 2 releases
06-20 00:00 08-03 00:00 now
recent releases last 2
version date src
0.1.1 2026-07-10 npm
0.1.0 2026-07-10 npm

view all →