stall-row-mcp

Standalone home: QuincyGB/stall-row-mcp — sibling of the fleet's token-verdict-mcp, route-verdict-mcp, list-smith-mcp and lock-smith-mcp wrappers.

MCP server for StallRow — the "Verdict Row" utility stall: 17 pay-per-call tools for agents, sold over x402 in USDC on Base, no account, no API key. Wallet snapshots and verdicts, a buyer-side Pre-Trade Guard, web/YouTube/repo utilities, continuous re-checks of catalogued x402 listings, the Verdict Index change feed, and the fleet's bulk products (Recheck Packs, Fleet Pass, Orchestrate).

This package gives any MCP host (Claude Desktop, Cursor, …) native tools that handle the full x402 v2 payment flow themselves — 402 challenge → EIP-3009 TransferWithAuthorization signature (USDC on Base, EIP-712) → paid retry — using your agent wallet.

Tools

Verdicts are automated checks over public data — sanctions screens, catalog history, chain reads — with the evidence attached. A flag is a lead to review, not proof of wrongdoing, and no verdict is a guarantee.

Related MCP server: x402-gateway-mcp

Install

pip install stall-row-mcp
# or run without installing:
uvx stall-row-mcp

Configuration

All configuration is environment variables — set them on the MCP server process in your host's config. Your key never leaves your machine; the service only ever sees a signed payment authorization.

Without a signer the tools never pay. They return the parsed 402 challenge as a structured error — {"error": "payment_required", "accepts": […], …} — so the calling agent can see the exact price, asset, network and payTo and decide what to do. With a signer, charges above the spend guard are likewise refused before signing.

MCP host config

{
  "mcpServers": {
    "stall-row": {
      "command": "uvx",
      "args": ["stall-row-mcp"],
      "env": {
        "AGENT_PRIVATE_KEY": "0xYOUR_AGENT_WALLET_KEY"
      }
    }
  }
}

The service being wrapped

POST https://stall-row-production.up.railway.app/v1/pre-trade-guard
{"pay_to": "0x…", "resource": "https://seller.example/v1/thing"}
→ 200 {"verdict": "PROCEED", "risk_score": 10, "reasons": [...],
       "evidence": {...}}

The schemas in src/stall_row_mcp/schemas.py are copied verbatim from the service's own discovery document (/.well-known/x402) — the published contract, not a paraphrase.

Development

pip install -e ".[dev]"
pytest

Tests mock the HTTP layer and use a throwaway signer generated at test time — no network, no real money, no key material in the repo. The 402 fixtures in tests/fixtures/ are real: captured from unpaid probes of production on 2026-10-27.

License

MIT