Kura
The server exposes Kura's local AI-agent EVM wallet as MCP tools: read wallet balances/status/history, look up on-chain agent records, request user-approved payments, and fetch paid (x402) web resources.
get_balances — Read ETH and USDC balances on the active Base network (testnet or mainnet).
get_wallet_status — Read wallet state and public address (encrypted/legacy/none); no password needed.
get_history — List recent transaction attempts (sent, blocked, failed, signed, settled, settle_failed) with an optional limit.
lookup_agent — Query an ERC-8004 agent's on-chain identity record and optionally compare a pay_to address or resource domain against the registered wallet/domain.
request_payment — Request a USDC or ETH payment; the wallet app shows an approval window and the user must approve with a password (autopay only under user-enabled conditions).
x402_fetch — Fetch a URL; if it returns HTTP 402, request user approval, sign an EIP-3009 payment, and re-fetch with the payment header to return the content.
Kura (蔵 — a storehouse that guards your treasures)
A local EVM wallet for AI agents. On a Mac, when an AI like Claude makes an internet payment (x402), this is the wallet where a human approves it with a password.
Not a human wallet (like MetaMask) — it's for AI agents
Not a cloud SaaS — it runs locally only. Keys never leave this computer.
AI requests a payment → a human approves with a password → it executes
The chain is Base (Ethereum L2, near-zero fees). Default is the testnet (Base Sepolia)
At a glance
[ AI 앱 (Claude Code / 데스크톱) ]
│ MCP로 "결제해줘" 요청
▼
[ Kura 데스크톱 앱 ] ← 승인 팝업 → 사람이 비밀번호 입력
│ 서명 (키는 이 앱 안에서만)
▼
[ Base 체인 / x402 페이실리테이터 ] ← 실제 결제The password is only ever entered in the Kura app's input field. It never goes into chat windows, MCP, or config files.
Related MCP server: cardzero-mcp
Installation
Apple Silicon Mac (macOS 11 or later)
(A) Homebrew
brew install --cask dinggi5/tap/kura(B) Download the DMG directly
Download Kura_<version>_aarch64.dmg from Releases, open it, and drag Kura into the Applications folder.
Since this is an app you're entrusting with your keys, I've written down the exact commands for verifying that the app you received is really the one I built in SECURITY.md.
(C) Build from source
Prerequisites: Rust, Node.js (20.19+ or 22.12+ — required by Vite 7), macOS.
git clone https://github.com/dinggi5/kura.git
cd kura
git checkout v0.1.1 # 배포본과 같은 소스. 빼면 개발 중인 최신 코드가 받아져요
npm ci # package-lock.json 그대로 설치 (install 은 버전이 올라갈 수 있어요)
# 개발 모드로 바로 실행
npm run tauri dev
# 앱으로 빌드해 /Applications에 설치
npm run tauri build -- --bundles app --no-sign
ditto src-tauri/target/release/bundle/macos/Kura.app /Applications/Kura.app
open /Applications/Kura.appUpdates
The app updates itself.
Go to Settings → About to check the version and changelog, then click Install now and restart.
Only the check is automatic — installation always requires you to click it.
Downloaded files are installed only after their signature is verified (signature verification cannot be disabled). Details are in the "Updates" section of SECURITY.md.
If you don't want the automatic update-check traffic, turn off Settings → About → Check on startup.
Uninstalling
⚠️ Uninstalling the app does not delete your wallet. Keys, settings, and transaction history live in ~/.jigap outside the app, so removing just the app leaves them intact — I did this on purpose so you don't accidentally lose your assets (even brew uninstall --zap won't remove them).
# 앱만 제거 (지갑은 남음 — 나중에 다시 설치하면 그대로 이어서 써요)
brew uninstall --cask dinggi5/tap/kura # 또는 /Applications/Kura.app 을 휴지통으로To completely erase the wallet too on this Mac, follow this order:
First make sure you have the 12-word recovery phrase in hand. You can view it again via the key button in the app's header.
If there's a balance left, move it to another wallet.
Quit Kura completely (right-click the menu bar icon → Quit). If it's running, it writes a state file to
~/.jigapevery few seconds, so a deleted folder will reappear right away.Also quit any AI tools (like Claude Code) that have the Kura MCP attached.
If you had auto-start enabled, turn it off or run
rm ~/Library/LaunchAgents/Kura.plist(this file remains if you delete the app via Trash. If you uninstall withbrew uninstall --cask, it goes away with it).Then run
rm -rf ~/.jigap
Running that final rm -rf ~/.jigap without the 12 words means no one can ever recover that wallet's assets.
First run
Kura lives in the menu bar. When you launch it, a storehouse icon (◻︎) appears in the menu bar at the top of your screen, and the window only drops down when you click that icon. Clicking elsewhere closes it, and the app stays in the background waiting for AI payment requests. To quit completely, right-click the icon → Quit. (On first launch when no wallet exists yet, the window opens by itself.)
Create a wallet — set a password (8+ characters) that you'll enter for every transfer. Your key is encrypted and stored with this password (
~/.jigap/wallet.enc).Back up the seed — 12 words are shown. This is the real proof of ownership of your assets, so write them down on paper or in a password manager. Even if you forget your password, the 12 words alone can recover it: quit the app, first make sure you have the 12 words in hand, then delete
~/.jigap/wallet.encand relaunch the app — you can restore it via Import on the first screen (you can also put them into any other standard BIP-39 wallet). However, deleting this file without the 12 words means losing your assets forever.Welcome tour — walks you through funding, AI connection, and safety features. You can revisit it anytime from the ⓘ Help in the header.
Funding (USDC)
To make payments, your wallet needs USDC (digital dollars).
Tap Receive in the app to see your address and QR code.
When sending from an exchange or another wallet, be sure to select the Base network. Sending on another network will lose your funds.
On the testnet (default), it's not real money. Use the Faucet button on the receive screen to get free test coins and practice.
ETH is optional — for x402 payments, the facilitator pays the fee, so you can have 0 ETH. You only need a little ETH for gas when sending directly via the app's Send (Base fees are around a cent). Funding with USDC alone is enough.
Connecting AI (Claude)
Register the Kura server in your AI app's MCP settings to connect. Once connected, a "Claude connected" badge appears on the main screen. Since 0.1.2, the MCP server is built into the app, so you can connect without cloning the source or installing Rust.
The easiest way — the "AI Connect" screen in the app
Click the "AI not connected" badge at the top of the main screen to open the connection screen.
Claude Desktop — click the "Connect" button and an extension install window appears in Claude. Just click 'Install' and you're done.
Claude Code — registered with one click (the app runs
claude mcp addfor you). From the nextclaudelaunch, it's connected from any folder.
Below is how to do the same thing by hand.
Claude Desktop — one extension file is all you need
Download kura-<version>.mcpb from the releases page and double-click it — Claude Desktop will ask to install it. (Or go to Claude Settings → Extensions → Choose file.)
The extension contains no executable — it only has a launcher that verifies the signature of the signed and notarized MCP server inside the installed Kura.app and then runs it. So you need to install the Kura app first.
Claude Code · other MCP apps
Register the in-app binary with its absolute path:
claude mcp add --scope user kura -- /Applications/Kura.app/Contents/MacOS/kura-mcp(--scope user is the option that makes it available everywhere, not just "this folder". If you only want it in one project, you can omit it.)
For other MCP apps, write it in the settings like this:
{
"mcpServers": {
"kura": {
"command": "/Applications/Kura.app/Contents/MacOS/kura-mcp"
}
}
}If you're developing from source
The repo root already has .mcp.json. Running claude in this folder picks it up automatically (the first time it asks whether to use the server — approve it). This path is for development, rebuilding with cargo run every time — if you're using an installed build, registering the app path above is the right approach.
Tools the AI can use: get_wallet_status · get_balances · get_history (read-only) · request_payment (payment request → approval popup in the app) · x402_fetch (calls a URL that requires 402 payment).
If you change the MCP tools, restart the AI app for it to take effect (the server is loaded once at session start).
How a payment flows
The AI requests a payment.
The Kura window appears showing how much, to where (it pops up automatically even if the window was hidden).
Enter the password and approve.
The payment executes and the result goes back to the AI. If you don't approve within 5 minutes, it's automatically rejected.
Security model
Password approval — by default, every payment requires password approval (if autonomous payments are enabled, exceptions apply only under the conditions below). Keys are stored encrypted (Argon2id + AES-256-GCM) and are only decrypted at payment time, then wiped immediately (if an autonomous payment session is enabled, they're kept in memory only while unlocked).
Limits — set how much can be sent per transaction / per day in settings (default: 5 USDC single, 20 USDC daily). Anything over is blocked.
Emergency lock — turning on the shield button in the header immediately blocks all transfers.
Trusted addresses · autonomous payments — for automatic approval without a password, session unlock + small limits + trusted address must all be satisfied. Otherwise, a password is always required.
Transaction history — records all outgoing transfers, blocked attempts, and signatures.
Local-first — keys (
~/.jigap/) live outside the repo and never get committed to git.No analytics, no font CDN — the app connects to the internet on its own for only three things: ①the RPC server used for balance lookups and transfers ②x402 addresses requested by the AI ③update checks (GitHub). Usage data is never sent anywhere, and fonts are bundled in the app, so the UI renders fine offline too.
Update checks can be disabled — on launch it asks GitHub whether a new version exists (your IP and current version are logged there). Turning off Settings → About → Check on startup removes even this traffic. Whether the check is on or off, installation only proceeds when you click it — nothing ever changes silently.
For developers
You can also drive the same wallet from the CLI kura (it shares the MCP server and core logic). It's already inside the installed app, so one line on your PATH and you're set:
sudo mkdir -p /usr/local/bin
sudo ln -sf /Applications/Kura.app/Contents/MacOS/kura-cli /usr/local/bin/kura
kura statusTo run from source:
cargo run --manifest-path ./kura-mcp/Cargo.toml --bin kura -- status
cargo run --manifest-path ./kura-mcp/Cargo.toml --bin kura -- balance
cargo run --manifest-path ./kura-mcp/Cargo.toml --bin kura -- history --limit 10
cargo run --manifest-path ./kura-mcp/Cargo.toml --bin kura -- pay <주소> <금액> --token usdc
cargo run --manifest-path ./kura-mcp/Cargo.toml --bin kura -- fetch <URL>pay/fetch never take a password via the CLI — the Kura app must be running, and a human enters the password in the approval popup.
Tests:
(cd src-tauri && cargo test) # 백엔드(지갑·암호화·한도·송금)
(cd kura-mcp && cargo test) # MCP/CLI 어댑터
npx tsc --noEmit && npx vite build # 프론트The procedure for producing a release build (signed, notarized DMG) is in docs/RELEASE.md. It needs an Apple Developer account and a one-time setup, and after that it's one line:
./scripts/release.shTech stack
Desktop | Tauri (Rust + web frontend) |
Frontend | React + Tailwind CSS, Framer Motion, Lucide, Pretendard |
Chain | Base / alloy-rs |
Payments | x402 (EIP-3009 off-chain signatures) |
AI connect | MCP server (rmcp) |
Structure: [Rust core (src-tauri)] ← MCP / CLI adapters (kura-mcp). Only the GUI process has key access (signing) — that's the last line of defense.
License · status
MIT license — since this is code that handles keys and money, I believe it should be something you can read, verify, and modify yourself.
If you find a vulnerability, please report it through the private channel in SECURITY.md before filing an issue. The same document also lists what Kura cannot protect against.
The bundled Pretendard font is under the SIL Open Font License 1.1 (full text).
The number one user is myself — a wallet for Korean developers and creators on Apple Silicon Macs who pay with local LLMs/Claude. It's still an early 0.1.x version, so I recommend learning on the default testnet first and only putting what you can afford to lose on mainnet.
Available Tools
6 toolsget_balancesA
Reads the active account's USDC (for payments) and gas-token balances on the active network (Base mainnet, Base Sepolia, or Arc testnet, per the user's setting). The eth field is the gas balance and is ABSENT on chains where gas is paid in USDC itself (Arc) — there the USDC balance already covers gas, so never add the two together. Errors if there is no wallet.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full responsibility. It discloses the absence of the `eth` field on Arc and warns against summing balances, plus states the error condition (no wallet). It does not explicitly state that the operation is read-only, but 'Reads' implies non-mutation. It is transparent but could explicitly mention read-only to be fully clear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is moderately sized but every sentence adds value. The core purpose is front-loaded, and the critical caveat about Arc is included without unnecessary elaboration. It could be slightly more compact, but the detail is justified given the network-specific behavior.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter read tool with no output schema, the description provides essential behavioral context: what fields to expect, the special case for Arc, and the failure condition. An agent can predict the return shape and understand the cross-chain nuance without additional documentation. This is complete for its complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters and schema coverage is 100%, so the description has no burden to explain parameters. The baseline for no-param tools is 4, and the description correctly focuses on what the tool returns rather than input semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as reading two balance types (USDC and gas token) for the active account on the active network, with specific chain names. It distinguishes itself from sibling tools by its focus on balances only, and the mention of the `eth` field and its absence on Arc adds precision.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
While it does not explicitly list alternatives or exclusion scenarios, it provides strong contextual cues (active account, active network, chain-specific behavior) that imply when to use it. The note about never adding USDC and gas on Arc is a critical usage guideline, but it does not state when to prefer other tools like get_history or get_wallet_status. Slightly short of perfect guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_historyA
Returns the active account's recent transaction attempts, newest first. status is one of sent, blocked, failed, signed (x402 signed, awaiting settlement), settled (x402 settled, settle_tx is the settlement tx), or settle_failed. Use limit to cap how many come back (default 20).
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | How many recent entries to return (default 20, max 200). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
There are no annotations, so the description carries the transparency burden. It discloses meaningful behavior: ordering, limit default, and the full status semantics, including x402-specific states and what settle_tx means. It doesn't describe error behavior or response container, but it goes well beyond a minimal definition.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three efficient sentences with no filler, and the most important outcome is front-loaded. The status enumeration is dense but justified because there's no output schema; structurally it's clean and scannable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter read tool with no output schema, the description supplies necessary context: what is returned, ordering, status vocabulary, and default limit. Some response-shape details are unstated, but the status enumeration compensates for the missing output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter, limit, is fully documented in the schema with default and max. The description adds 'Use limit to cap how many come back (default 20)', but this largely restates the schema and offers no material new semantic info.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a concrete verb ('returns'), names the resource ('the active account's recent transaction attempts'), and explicitly includes ordering ('newest first'). This clearly distinguishes the tool from sibling get_balances/get_wallet_status without needing to inspect schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description makes the intended use inferable: when an agent needs recent transaction attempts of the active account. However, it doesn't explicitly say when not to use it, nor does it contrast alternatives like get_wallet_status or x402_fetch, so the usage guidance stays implicit rather than directive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_wallet_statusA
Returns the wallet's state and address. state is encrypted (normal), legacy, or none. address is the ACTIVE account's address; accounts lists every account in the wallet (index, address, label) and account is the active index. Balances, history, and payment requests all use the active account, and only the user can switch accounts, in the wallet app. No password needed — read only.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full burden of behavioral disclosure. It states 'No password needed — read only', discloses state value semantics, and clarifies that account switching can only be done by the user. These are valuable non-obvious behaviors for an agent. It falls short of 5 only by not mentioning error cases or what happens when no wallet is present, but for this simple read the disclosure is quite adequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is about 85 words and front-loads the core action then clarifies the fields. Every sentence contributes: the state vs. address, the accounts list, the active-account context, and the read-only note. There is no filler. One minor phrasing in 'state is encrypted (normal), legacy, or none' could be clearer, but it does not materially hurt readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, this description is the complete contract for what the tool returns. It defines the 'state' enum, 'address', 'accounts' with index/address/label, and 'account' as active index. It also weaves in why this matters for sibling tools and that the user alone can switch accounts. For a parameter-less read-only status call, this is complete enough.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
This tool takes 0 parameters and the schema is complete (empty). With no parameters, the description does not need to add parameter meaning. The parameter_semantics baseline for 0 params is thus a 4, and the description has no unnecessary parameter-related bloat.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the verb and resource: 'Returns the wallet's state and address.' It then enumerates exactly which fields are returned (state, address, accounts, account) and even gives possible state values. It differentiates itself from sibling tools by noting that balances, history, and payment requests all use the active account, making clear why this wallet-status read is distinct.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context: 'Balances, history, and payment requests all use the active account, and only the user can switch accounts, in the wallet app.' That tells an agent this tool supplies the account context needed before or alongside the sibling calls. It does not explicitly say 'call this before get_balances/get_history/request_payment', nor does it name the alternatives, so it stops short of a full when/when-not instruction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
lookup_agentA
Reads an agent's ERC-8004 record from the registry on the active Base network (read-only, on-chain only — the wallet never fetches the agent's website). Give it agent_id, the agent's number in the Identity Registry. Returns: registered, owner, wallet (the registered agentWallet), token_uri and the uri_domain read from it, declared_name (what the record calls itself), and feedback_clients (how many addresses left feedback). Pass pay_to and/or resource to also get a comparison: whether the address equals the registered wallet and whether the resource's domain equals the domain listed on-chain. IMPORTANT: registration is permissionless — anyone can register any name, domain, or wallet, and anyone can leave feedback. Being registered is NOT proof of safety. Only a mismatch is a strong signal, and only when the agent number came from a source you trust (the service's own docs), not from the payment response itself.
| Name | Required | Description | Default |
|---|---|---|---|
| pay_to | No | Optional: an address to compare against the agent's registered wallet. | |
| agent_id | Yes | The agent's ERC-8004 number (agentId — the Identity Registry NFT token id). | |
| resource | No | Optional: a resource URL whose domain is compared with the domain listed on-chain. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral disclosure burden and does so thoroughly. It states the operation is read-only and on-chain only, clarifies that the wallet does not fetch the website, enumerates the returned fields, and prominently warns about the trust implications of permissionless registration and feedback. This exceeds typical descriptions in transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but front-loaded with the core purpose and then systematically covers parameters, return values, and safety caveats. Every sentence adds information, but the length is near the upper bound for a tool definition; some of the caveat text could arguably be tightened. Still, structure is logical and skimmable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having no output schema and no annotations, the description gives a complete picture: what the tool does, which network it operates on, what parameters do, what is returned, and how to interpret the results safely. The warning about trusting the agent number source and the permissionless nature of registration is critical context that would otherwise be missing. Nothing essential for correct invocation or interpretation is omitted.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already covers 100% of the parameters with descriptions, so the baseline is 3. The description adds meaningful value by explaining agent_id as 'the agent's number in the Identity Registry' and by clarifying that pay_to and resource trigger comparisons against the registered wallet and on-chain domain. This goes beyond the schema's field-level descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Reads an agent's ERC-8004 record from the registry on the active Base network.' It clearly distinguishes itself from sibling tools by explicitly noting it is read-only, on-chain only, and never fetches the agent's website, which separates it from x402_fetch and the balance/history tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description makes the usage context clear: call it with an agent_id to read the registry record, and optionally pass pay_to/resource for comparisons. It also gives important guidance about when the result is meaningful, warning that registration is permissionless and only a mismatch is a strong signal. It does not explicitly name sibling alternatives or state 'use this instead of X', but the context is sufficiently clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
request_paymentA
Asks the user to make a payment. The wallet app opens an approval window, and the payment is only sent once the user approves it with their password (it waits up to 5 minutes). The one exception is autopay, which the user turns on themselves — only then can a payment be approved automatically, and only within an unlocked session, a small limit, and a trusted address. Arguments: to (recipient address), amount (decimal string), token (USDC by default, or ETH), memo (what the payment is for — the user reads it to decide, so always fill it in), and optionally agent_id (the recipient's ERC-8004 number, if a service told you one — the wallet then shows the user whether the address matches that agent's registered wallet). Per-payment and daily limits and the emergency lock are enforced by the app. Never send a password as an argument — the user types it in the app. Returns: status (approved/rejected/failed), tx_hash, and an explorer link.
| Name | Required | Description | Default |
|---|---|---|---|
| to | Yes | Recipient address (42 characters, starting with 0x). | |
| memo | No | What the payment is for — the user reads this in the approval window, so fill it in. | |
| token | No | Token: "USDC" (default) or "ETH". | |
| amount | Yes | Amount as a decimal string, for example "1.5". | |
| agent_id | No | Optional: the recipient's ERC-8004 agent number, if you know it from the service's own documentation or agent card. The wallet reads that agent's on-chain record and tells the user whether the address you are paying is the one registered for that agent. A mismatch is the useful part — a match is not proof of anything, since anyone can register. Leave it out if you don't know it; a wrong number just produces a "no such agent" note. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations present, the description carries the full burden of explaining side effects cell. It discloses the approval window, the 5-minute wait, the autopay exception, app-enforced per-payment and emergency-lock limits, and the security-relevant fact that passwords must never be supplied.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense and front-loaded with the core action before moving into details.example. The parameter walk-through is efficient, though the long middle sentence about autopay could be slightly better structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no output schema, yet the description states the return shape: status, tx hash, and explorer link. Context such as user-approval flow, timeouts, limits, autopay exceptions, and parameter usage is all present, making the tool safely callable without additional documentation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Even though schema coverage is high, the description adds meaning beyond parameter names: token defaults to USDC, amount is a decimal string, memo is user-facing, and agent_id is used to verify the recipient's registered wallet address. It also tells the agent that password is not a valid argument.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence, 'Asks the user to make a payment,' clearly identifies the tool's action and target, and the rest of the description clarifies that it initiates a user-approved payment rather than sending funds directly. It is unambiguous and distinct enough from the sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit operational guidance: always fill in the memo because the user reads it, supply agent_id only if a service provided it, and never pass a password as an argument. It also clarifies when automatic approval is possible versus when user approval is required.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
x402_fetchA
Fetches an x402 paid resource (a URL). It GETs the URL first; if the server answers 402 Payment Required, it asks the user to approve the required payment (exact scheme, the active Base network, USDC) in the wallet app, builds an EIP-3009 signature, and re-requests the same URL with an X-PAYMENT header to return the content. If no payment is required (no 402), it just returns the body. Approval works exactly as in request_payment (password by default; automatic only when the user has turned autopay on), and the app enforces per-payment and daily limits and the emergency lock. Never send a password as an argument. Arguments: url (required), memo (what the payment is for — the user reads it to decide). Returns: paid, status, http_status, body, and amount/pay_to/settlement when paid.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | URL of the paid resource to fetch (http/https). | |
| memo | No | What the payment is for — the user reads this in the approval window, so fill it in. | |
| agent_id | No | Optional: the seller's ERC-8004 agent number, if you know it from the service's own documentation or agent card. The wallet then reads that agent's on-chain record and shows the user whether the payment address and the resource domain match what is registered. Leave it out if you don't know it — a wrong number just produces a "no such agent" note. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It thoroughly walks through the GET request, handling of a 402 response, user approval, EIP-3009 signature construction, and re-request with the X-PAYMENT header. It also discloses approval defaults, autopay behavior, per-payment and daily limits, the emergency lock, and explicitly warns never to send a password as an argument. This is exemplary transparency for a complex payment-flow tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but every sentence earns its place: purpose, flow, fallback, approval behavior, safety warning, argument summary, and return values. It is front-loaded with the core action and reads naturally despite covering a multi-step process. The length is justified by the complexity of the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description explains the full behavior, safety constraints, and return fields, which is important given the absence of an output schema. It lists the returned keys (paid, status, http_status, body, amount/pay_to/settlement). However, it does not detail error cases such as user rejection, network failures, or the distinction between status and http_status, leaving minor gaps for a tool with this complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all three parameters in detail. The description adds a small amount of context for memo ('the user reads it to decide'), but it does not add meaningful semantics for url or agent_id beyond what the schema provides. The baseline of 3 is appropriate because the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening sentence states a specific verb and resource: 'Fetches an x402 paid resource (a URL).' It then describes the full fetch-and-pay flow, making the tool's purpose unmistakable. It is clearly distinct from sibling tools like get_balances or get_history, and it references request_payment only to clarify the approval mechanism, not the core purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description makes it clear that this tool is for fetching a URL that may trigger a payment, and it explains what happens when no payment is required. It references request_payment for approval behavior, which implicitly signals the sibling relationship, but it does not explicitly state when to choose x402_fetch over request_payment or other alternatives. No exclusions or when-not-to-use guidance is given, but the context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
1 tool update
v0.4.0- Changed
request_payment1 field changed- added
Input schema / properties / agent_idAdded value: +{ + "default": null, + "description": "Optional: the recipient's ERC-8004 agent number, if you know it from the service's own\ndocumentation or agent card. The wallet reads that agent's on-chain record and tells the\nuser whether the address you are paying is the one registered for that agent. A mismatch\nis the useful part — a match is not proof of anything, since anyone can register.\nLeave it out if you don't know it; a wrong number just produces a \"no such agent\" note.", + "format": "uint64", + "minimum": 0, + "nullable": true, + "type": "integer" +}
2 tool updates
v0.3.0- Added
lookup_agent - Changed
x402_fetch1 field changed- added
Input schema / properties / agent_idAdded value: +{ + "default": null, + "description": "Optional: the seller's ERC-8004 agent number, if you know it from the service's own\ndocumentation or agent card. The wallet then reads that agent's on-chain record and shows\nthe user whether the payment address and the resource domain match what is registered.\nLeave it out if you don't know it — a wrong number just produces a \"no such agent\" note.", + "format": "uint64", + "minimum": 0, + "nullable": true, + "type": "integer" +}
5 tool updates
v0.2.0- First observed
get_balances - First observed
get_history - First observed
get_wallet_status - First observed
request_payment - First observed
x402_fetch
TDQS
Scored across 6 tools
Each tool has a distinct purpose: balances, history, wallet state, payment requests, agent lookup, and paid resource fetching. There is no meaningful overlap between them, and each description clearly scopes its responsibility.
The get_* tools follow a consistent verb_noun pattern right away, and request_payment and lookup_agent also follow it. x402_fetch is slightly inconsistent with the others, but it remains recognizable and does not create real confusion.
Six tools is well-scoped for a wallet/payment server: three read-only state queries, one payment request, one agent lookup, and one paid fetch. Each tool earns its place without redundancy.
The tool surface covers the core wallet operations an agent needs: checking balances, reading transaction history, requesting payments, fetching paid resources, and verifying agents. Minor gaps exist—such as no way to inspect limits or manage network settings—but those are user-controlled in the wallet app, so the set feels reasonably complete.
Maintenance
Related MCP Connectors
Encrypted, pay-per-use persistent memory storage for AI agents, gated by x402 payments on Base.
Give your AI agent an x402 wallet: discover and pay for services in USDC, or earn from your own.
Pay-per-call crypto market intelligence for AI agents. USDC on Base via x402.
Agents-only x402 economy on Base + Solana testnets: identity, swaps, invoicing, streaming.
Related MCP Servers
AlicenseAqualityDmaintenanceProvides a non-custodial USDC wallet on Base for AI agents, with human-in-the-loop approval for every payment.414MIT- AlicenseAqualityDmaintenanceGives AI agents a smart-contract wallet on Base (USDC) with 10 stdio tools: create wallets, send USDC payments, pay x402-protected HTTP resources, and run ERC-8183 escrow Jobs for A2A service delivery.109MIT
- AlicenseAqualityAmaintenanceA budget-bound x402 payment wallet for AI agents: it autonomously pays HTTP 402 payment-gated URLs across every major chain (EVM, Solana, and many non-EVM families). Self-custodial and backendless, your key, your RPC, with spend caps enforced before any on-chain send.89MIT

token4u-mcpofficial
AlicenseAqualityBmaintenanceEnables AI agents to call LLM APIs via x402 micropayments in USDC on Base network, manage a local wallet, and query consumption records.364MIT