Kura
Kura (蔵 — 守护宝物的地方)
面向 AI 代理的本地 EVM 钱包。 在 Mac 上,当 Claude 等 AI 进行互联网支付(x402)时,由人类用密码批准的钱包。
不是给人用的钱包(如 MetaMask)——而是面向 AI 代理
不是云端 SaaS——只在本地运行。密钥不会离开这台电脑。
AI 请求支付 → 人用密码批准 → 执行
链是 Base(以太坊 L2,手续费几乎为零)。默认是测试网(Base Sepolia)
一览
[ AI 앱 (Claude Code / 데스크톱) ]
│ MCP로 "결제해줘" 요청
▼
[ Kura 데스크톱 앱 ] ← 승인 팝업 → 사람이 비밀번호 입력
│ 서명 (키는 이 앱 안에서만)
▼
[ Base 체인 / x402 페이실리테이터 ] ← 실제 결제密码只在 Kura 应用的输入框中输入。不会进入聊天窗口、MCP 或配置文件中的任何地方。
Related MCP server: cardzero-mcp
安装
Apple Silicon Mac(macOS 11 及以上)
(A) Homebrew
brew install --cask dinggi5/tap/kura(B) 直接下载 DMG
从 Releases 下载 Kura_<版本>_aarch64.dmg 并打开,将 Kura 拖入 Applications 文件夹。
这是一个托管密钥的应用,所以如何确认收到的应用确实是我制作的,在 SECURITY.md 中连命令都写好了。
(C) 从源码构建
前置准备:Rust、Node.js(20.19+ 或 22.12+ — 需要 Vite 7)、macOS。
git clone https://github.com/dinggi5/kura.git
cd kura
git checkout v0.1.1 # 배포본과 같은 소스. 빼면 개발 중인 최신 코드가 받아져요
npm ci # package-lock.json 그대로 설치 (install 은 버전이 올라갈 수 있어요)
# 개발 모드로 바로 실행
npm run tauri dev
# 앱으로 빌드해 /Applications에 설치
npm run tauri build -- --bundles app --no-sign
ditto src-tauri/target/release/bundle/macos/Kura.app /Applications/Kura.app
open /Applications/Kura.app更新
应用会自动更新。
在设置 → 关于中查看版本和变更内容,然后点击立即安装并重新启动。
只有检查是自动的,安装始终需要手动点击。
收到的文件只有在验证签名正确后才会被安装(签名验证无法关闭)。详情写在 SECURITY.md 的"更新"一节中。
如果不想自动检查更新,可以在设置 → 关于 → 启动时检查中关闭。
卸载
⚠️ 即使删除应用,钱包也不会被删除。 密钥、设置、交易记录都在应用外部的 ~/.jigap 文件夹中,只删除应用的话它们会保留——这是为了避免意外丢失资产而故意这样设计的(brew uninstall --zap 也不会删除)。
# 앱만 제거 (지갑은 남음 — 나중에 다시 설치하면 그대로 이어서 써요)
brew uninstall --cask dinggi5/tap/kura # 또는 /Applications/Kura.app 을 휴지통으로如果想彻底删除这台 Mac 上的钱包,请务必按顺序操作:
先确认 12 个单词的恢复短语在手边。 可以在应用顶部的钥匙按钮中重新查看。
如果还有余额,请转到其他钱包。
完全退出 Kura(右键点击菜单栏图标 → 退出)。如果还在运行,它会每隔几秒向
~/.jigap写入状态文件,所以删除的文件夹会立刻重新出现。也要退出连接了 Kura MCP 的 AI 工具(如 Claude Code)。
如果开启了自动启动,请关闭它,或执行
rm ~/Library/LaunchAgents/Kura.plist(将应用拖入废纸篓删除时,这个文件会保留。用brew uninstall --cask删除时会一起删除)。然后执行
rm -rf ~/.jigap
如果没有 12 个单词就执行最后的 rm -rf ~/.jigap,那个钱包的资产任何人都无法找回。
首次运行
Kura 生活在菜单栏中。 运行后,屏幕顶部的菜单栏会出现一个仓库图标(◻︎),窗口只有在点击该图标时才会向下展开。点击其他位置就会关闭,应用会留在后台继续等待 AI 支付请求。要完全关闭,请右键点击图标 → 退出。(首次运行还没有钱包时,窗口会自动打开。)
创建钱包 — 设置每次转账时都要输入的密码(8 位以上)。密钥会用这个密码加密存储(
~/.jigap/wallet.enc)。备份助记词 — 会出现 12 个单词。这是资产真正的所有权证明,请写在纸上或密码管理器中。即使忘记密码,只要有 12 个单词就能找回:退出应用,先确认 12 个单词在手边,然后删除
~/.jigap/wallet.enc并重新运行应用,就可以通过首屏的导入恢复(也可以放入其他标准 BIP-39 钱包)。但如果没有 12 个单词就删除这个文件,资产将永远丢失。欢迎向导 — 会介绍充值、AI 连接、安全措施。随时可以通过顶部的 ⓘ 帮助 重新查看。
充值(USDC)
要支付,钱包里需要有 USDC(数字美元)。
在应用中点击接收,会显示地址和二维码。
从交易所或其他钱包发送时,必须选择 Base 网络。发送到其他网络会丢失资金。
测试网(默认) 不是真钱。点击接收界面的 Faucet 按钮领取免费测试币来练习。
ETH 是可选的 — x402 支付的手续费由支付服务商代付,所以 ETH 为 0 也可以。只有在用应用的发送功能直接转账时,才需要少量用于支付 gas 的 ETH(Base 手续费约 1 美分)。充值只需 USDC 就足够了。
连接 AI(Claude)
在 AI 应用的 MCP 设置中注册 Kura 服务器即可连接。连接后,主屏幕会显示 "Claude 已连接" 徽章。从 0.1.2 开始,应用内置了 MCP 服务器,无需克隆源码或安装 Rust 即可连接。
最简单的方法 — 应用内的"AI 连接"屏幕
点击主屏幕上方的 "AI 未连接"徽章,会打开连接屏幕。
Claude 桌面版 — 点击"连接"按钮,会弹出 Claude 的扩展安装窗口。只需点击"安装"即可。
Claude Code — 一键注册(应用会代替你执行
claude mcp add)。从下次运行claude开始,在任何文件夹中都可以连接。
以下是手动完成同样操作的方法。
Claude 桌面版 — 一个扩展文件即可
从发布页面下载 kura-<version>.mcpb 并双击,Claude 桌面版会询问是否安装。(或者 Claude 设置 → 扩展 → 选择文件。)
扩展内没有可执行文件——只包含一个启动器,它会在验证签名后运行已安装的 Kura.app 内经过签名和公证的 MCP 服务器。所以需要先安装 Kura 应用。
Claude Code · 其他 MCP 应用
将应用内的二进制文件以绝对路径注册即可:
claude mcp add --scope user kura -- /Applications/Kura.app/Contents/MacOS/kura-mcp(--scope user 是"不仅限于这个文件夹",而是让它在任何地方都能使用的选项。如果只想在一个项目中使用,可以省略。)
其他 MCP 应用在设置中这样填写:
{
"mcpServers": {
"kura": {
"command": "/Applications/Kura.app/Contents/MacOS/kura-mcp"
}
}
}如果在源码中开发
仓库根目录的 .mcp.json 已经存在。在这个文件夹中运行 claude 时会自动被识别(第一次会询问是否使用服务器,批准即可)。这个路径是每次用 cargo run 重新构建的开发用路径——如果要安装使用,请注册上面的应用路径。
AI 可以使用的工具:get_wallet_status · get_balances · get_history(只读)· request_payment(支付请求 → 应用批准弹窗)· x402_fetch(调用遇到 402 支付的 URL)。
更改 MCP 工具后,需要重启 AI 应用才能生效(服务器在会话开始时加载一次)。
支付流程如下
AI 请求支付。
Kura 窗口弹出,显示金额和去向(即使窗口隐藏也会自动弹出)。
输入密码并批准。
支付执行,结果返回给 AI。5 分钟内未批准则自动拒绝。
安全模型
密码批准 — 默认每次支付都需要密码批准(开启自主支付时,仅在以下条件下例外)。密钥加密(Argon2id + AES-256-GCM)存储,仅在支付时解密并立即清除(开启自主支付会话时,仅在解锁期间保存在内存中)。
限额 — 在设置中设定单次/每日可发送的金额上限(默认单次 5 · 每日 20 USDC)。超过则被阻止。
紧急锁定 — 开启顶部的盾牌按钮,所有转账立即被阻止。
信任地址 · 自主支付 — 要在无需密码的情况下自动批准,必须同时满足会话解锁 + 小额限额 + 信任地址三个条件。否则始终需要密码。
交易记录 — 记录所有已发送的转账、被阻止的尝试和签名。
本地优先 — 密钥(
~/.jigap/)在仓库之外,不会上传到 git。无分析、无字体 CDN — 应用自行连接互联网的情况只有三种:①用于余额查询和转账的 RPC 服务器 ②AI 请求的 x402 地址 ③更新检查(GitHub)。使用记录不会发送到任何地方,字体也内置在应用中,因此离线时屏幕也能正常显示。
更新检查可以关闭 — 启动应用时会向 GitHub 询问是否有新版本(那边会留下访问 IP 和当前版本)。在设置 → 关于 → 启动时检查中关闭,这个通信也会消失。无论检查开启还是关闭,安装都需要手动点击——不会悄悄更改。
开发者
也可以使用 CLI kura 操作同一个钱包(与 MCP 服务器共享核心逻辑)。它已经包含在已安装的应用中,只需在 PATH 中添加一行即可使用:
sudo mkdir -p /usr/local/bin
sudo ln -sf /Applications/Kura.app/Contents/MacOS/kura-cli /usr/local/bin/kura
kura status从源码运行时:
cargo run --manifest-path ./kura-mcp/Cargo.toml --bin kura -- status
cargo run --manifest-path ./kura-mcp/Cargo.toml --bin kura -- balance
cargo run --manifest-path ./kura-mcp/Cargo.toml --bin kura -- history --limit 10
cargo run --manifest-path ./kura-mcp/Cargo.toml --bin kura -- pay <주소> <금액> --token usdc
cargo run --manifest-path ./kura-mcp/Cargo.toml --bin kura -- fetch <URL>pay/fetch 不接受 CLI 密码 — 需要 Kura 应用正在运行,并且人在批准弹窗中输入密码。
测试:
(cd src-tauri && cargo test) # 백엔드(지갑·암호화·한도·송금)
(cd kura-mcp && cargo test) # MCP/CLI 어댑터
npx tsc --noEmit && npx vite build # 프론트制作发行版(签名、公证的 DMG)的流程在 docs/RELEASE.md 中。需要 Apple Developer 账户和一次性设置,之后只需一行:
./scripts/release.sh技术栈
桌面 | Tauri(Rust + Web 前端) |
前端 | React + Tailwind CSS、Framer Motion、Lucide、Pretendard |
链 | Base / alloy-rs |
支付 | x402(EIP-3009 链下签名) |
AI 连接 | MCP 服务器(rmcp) |
结构:[Rust 核心(src-tauri)] ← MCP / CLI 适配器(kura-mcp)。密钥访问(签名)仅由 GUI 进程执行——这是最终防线。
许可证 · 状态
MIT 许可证 — 这是处理密钥和资金的代码,我认为应该可以直接阅读、验证和修改。
如果发现漏洞,请在提交 issue 之前通过 SECURITY.md 中的非公开渠道告知。同一文档中也记录了 Kura 无法阻止的事情。
随附的 Pretendard 字体采用 SIL Open Font License 1.1(全文)。
第一优先用户是本人——这是为在 Apple Silicon Mac 上使用本地 LLM/Claude 进行支付的韩国开发者、创作者设计的钱包。目前还是 0.1.x 早期版本,建议先在默认的测试网上熟悉,在主网上只放入可以承受损失的金额。
Available Tools
7 toolsget_balancesBalancesARead-only
Reads the active account's USDC (for payments) and gas-token balances on the active network (Base mainnet, Arc mainnet, Base Sepolia, or Arc testnet, per the user's setting). The eth field is the gas balance and is ABSENT on chains where gas is paid in USDC itself (Arc) — there the USDC balance already covers gas, so never add the two together. Errors if there is no wallet.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true, so safety is covered; the description goes further by disclosing the no-wallet error case and a critical cross-field caveat (the `eth` gas field is absent on Arc and must never be added to the USDC balance). It does not cover rate limits or refresh/freshness behavior, so it stops short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with the core read action, followed by the field caveat and the error case. The parenthetical enumeration of the four networks is slightly heavy but genuinely useful since it defines the valid scope; nearly every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no parameters and no output schema, the description carries the burden of explaining the return shape, and it does so reasonably: it names the two balance types, flags the missing `eth` field per chain, and states the error case. Minor gap is freshness/caching and what happens across multiple networks at once.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline is 4. The description's field-level discussion (USDC vs `eth` gas balance and their relationship on Arc) concerns returned values rather than inputs, but it does add interpretive value that the empty schema cannot.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Reads') and resource (USDC and gas-token balances) for the active account, and pins the scope to the active network with named chains. An agent can immediately distinguish this from get_wallet_status or get_history without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the purpose but never stated as when-to-use or when-not-to-use, and no sibling tool is named as an alternative. The only routing signal is the failure condition ('Errors if there is no wallet'), which is a precondition rather than guidance on choosing this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_historyHistoryARead-only
Returns the active account's recent transaction attempts, newest first. status is one of sent, blocked, failed, signed (x402 signed, awaiting settlement), settled (x402 settled, settle_tx is the settlement tx), settle_failed, unknown (a signed transaction was submitted but the wallet couldn't confirm the chain received it — detail is its tx hash; it may have gone through, so never resend on the strength of this entry alone; the wallet app later rechecks it on-chain and turns it into sent or reverted), reverted (mined but reverted on-chain — no money moved, only gas), expired (an x402 signature that was never used before it expired — no money moved), or received (money that came in — to is the sender, detail the tx hash; both are empty for ETH a contract sent; found on-chain by the wallet app while it runs, back to 90 days). Use limit to cap how many come back (default 20).
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | How many recent entries to return (default 20, max 200). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare readOnlyHint and openWorldHint; the description carries substantial extra behavior: per-status meaning, which statuses mean no money moved (reverted, expired), that 'unknown' may have gone through and the wallet rechecks it on-chain, that 'received' comes from an app-driven on-chain scan back to 90 days. This is exactly the context annotations cannot supply.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The core purpose is front-loaded and every clause carries information — the status enumeration is necessary because there is no output schema. It loses a point because the status glossary is delivered as one very dense run-on sentence rather than a scannable list.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and only one optional parameter, the description fully covers what the agent needs: return ordering, default limit, and the complete semantics of every status value including financial and safety implications. Nothing material is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single 'limit' parameter, so the schema already documents default 20 and max 200; the description only restates the default. Baseline 3 applies since the schema does the heavy lifting and the description adds no new parameter syntax.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource — 'Returns the active account's recent transaction attempts, newest first' — including scope (active account) and ordering. The resource is unmistakably distinct from siblings like get_balances and get_wallet_status, so an agent can route without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the resource and by the embedded warning 'never resend on the strength of this entry alone', which quietly steers the agent away from acting on 'unknown' entries via x402_resubmit. However, it never explicitly says when to call this versus alternatives, nor states prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_wallet_statusWallet statusARead-only
Returns the wallet's state and address. state is encrypted (normal), legacy, or none. address is the ACTIVE account's address; accounts lists every account in the wallet (index, address, label) and account is the active index. Balances, history, and payment requests all use the active account, and only the user can switch accounts, in the wallet app. No password needed — read only.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, and the description goes well beyond them: it enumerates the state values (encrypted/legacy/none), clarifies that address is the ACTIVE account while accounts lists all accounts, and discloses that only the user can switch accounts in the wallet app. It also reassures no password is needed, which is actionable auth context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core purpose, then structured field-by-field. Every sentence carries information, though the trailing 'No password needed — read only' partially restates the readOnlyHint annotation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With zero parameters, no output schema, and annotations covering safety, the description supplies exactly the missing pieces: what fields come back, what the state values mean, and how the active-account concept relates to sibling tools. Nothing an agent needs to call this correctly is absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline is 4. The description additionally documents the shape of the returned object (index, address, label, active index), which is useful given no output schema exists, though these are return values rather than input semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Returns the wallet's state and address') and enumerates the exact fields returned (state, address, accounts, account). The sibling set (get_balances, get_history, request_payment) is clearly distinct, and the description anchors its scope to the active account rather than those other resources.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied rather than stated: it explains that balances, history, and payment requests all key off the active account, which tells the agent why it might call this first, but it never explicitly says when to use this tool versus get_balances/get_history, nor names an alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
lookup_agentLook up an agent (ERC-8004)ARead-only
Reads an agent's ERC-8004 record from the registry on the active network (read-only, on-chain only — the wallet never fetches the agent's website). Give it agent_id, the agent's number in the Identity Registry. Returns: registered, owner, wallet (the registered agentWallet), token_uri and the uri_domain read from it, declared_name (what the record calls itself), and feedback_clients (how many addresses left feedback). Pass pay_to and/or resource to also get a comparison: whether the address equals the registered wallet and whether the resource's domain equals the domain listed on-chain. IMPORTANT: registration is permissionless — anyone can register any name, domain, or wallet, and anyone can leave feedback. Being registered is NOT proof of safety. Only a mismatch is a strong signal, and only when the agent number came from a source you trust (the service's own docs), not from the payment response itself.
| Name | Required | Description | Default |
|---|---|---|---|
| pay_to | No | Optional: an address to compare against the agent's registered wallet. | |
| agent_id | Yes | The agent's ERC-8004 number (agentId — the Identity Registry NFT token id). | |
| resource | No | Optional: a resource URL whose domain is compared with the domain listed on-chain. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and openWorldHint, and the description goes well beyond them: it discloses that nothing is fetched off-chain, that registration is permissionless, and that being registered is not evidence of safety. This is exactly the kind of adversarial-context caveat an agent needs before treating the result as a trust signal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core action, then the return fields, then the comparison behavior, then the safety caveat. The enumerated return list is long but every item earns its place given there is no output schema. Slightly dense, but no filler sentences.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description fully enumerates the returned fields (registered, owner, wallet, token_uri, uri_domain, declared_name, feedback_clients) plus the conditional comparison outputs. For a read-only lookup with three parameters, nothing an agent needs to call or interpret it is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3, but the description adds real semantics: agent_id is the number in the Identity Registry, and pay_to/resource exist specifically to produce address and domain comparisons. That comparison behavior is not derivable from the terse schema property descriptions alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: reads an agent's ERC-8004 record from the on-chain registry on the active network. It immediately scopes what the tool does not reach ("the wallet never fetches the agent's website"), which separates it cleanly from the payment/wallet siblings. An agent can tell what this returns without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete invocation guidance (supply agent_id; optionally pass pay_to and/or resource to trigger a comparison) and states the condition under which the result is trustworthy (mismatch only matters when the agent number came from a source you trust). No sibling alternative is named, but the siblings are unrelated domains so the omission is minor. Clear context without explicit when-not-to-call routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
request_paymentRequest a paymentADestructive
Asks the user to make a payment. The wallet app opens an approval window, and the payment is only sent once the user approves it with their password (it waits up to 5 minutes). The one exception is autopay, which the user turns on themselves — only then can a payment be approved automatically, and only within an unlocked session, a small limit, and a trusted address. Arguments: to (recipient address), amount (decimal string), token (USDC by default, or ETH), memo (what the payment is for — the user reads it to decide, so always fill it in), and optionally agent_id (the recipient's ERC-8004 number, if a service told you one — the wallet then shows the user whether the address matches that agent's registered wallet). Per-payment and daily limits and the emergency lock are enforced by the app. Never send a password as an argument — the user types it in the app. Returns: status, tx_hash, detail, and an explorer link. status is approved (the chain accepted the transfer), rejected or failed (nothing was sent — safe to ask again), or unknown: the user approved but the wallet couldn't confirm whether the transfer reached the chain (tx_hash is set when known). unknown means it MAY have been sent — never ask again on your own; tell the user and have them check the history or the tx.
| Name | Required | Description | Default |
|---|---|---|---|
| to | Yes | Recipient address (42 characters, starting with 0x). | |
| memo | No | What the payment is for — the user reads this in the approval window, so fill it in. | |
| token | No | Token: "USDC" (default) or "ETH". | |
| amount | Yes | Amount as a decimal string, for example "1.5". | |
| agent_id | No | Optional: the recipient's ERC-8004 agent number, if you know it from the service's own documentation or agent card. The wallet reads that agent's on-chain record and tells the user whether the address you are paying is the one registered for that agent. A mismatch is the useful part — a match is not proof of anything, since anyone can register. Leave it out if you don't know it; a wrong number just produces a "no such agent" note. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and idempotentHint=false, but the description adds far more: a 5-minute approval timeout, password-entry-only-in-app, app-enforced per-payment/daily limits and emergency lock, autopay preconditions (unlocked session, small limit, trusted address), and the semantics of approved/rejected/failed/unknown including the no-retry rule on unknown. That is exactly the behavioral disclosure a payment tool needs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with purpose, then arguments, then return semantics in a logical order. It is long, but the length is justified by the absence of an output schema and the high stakes of an irreversible transfer; each section earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description fully documents the return contract (status, tx_hash, detail, explorer link) and the three status branches, plus the critical unknown-may-have-been-sent caveat. Nothing needed to invoke or handle the result is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds operative meaning beyond the schema: 'USDC by default', the instruction to always fill in memo because the user reads it, and a caution that agent_id mismatch is the useful signal while a match proves nothing. It largely restates the schema fields, but the added rationale has real value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Asks the user to make a payment') and immediately distinguishes it from read-only siblings like get_balances/get_history by describing the approval-window flow. An agent can tell this is the mutating spend path without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use and when-not-to-act guidance: the approval window is the normal path, autopay is the only auto-approval exception and only under user-enabled conditions, and on 'unknown' the agent must never retry on its own but hand off to the user. This is actionable routing logic, not vague context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
x402_fetchFetch a paid URL (x402)ADestructive
Calls an x402 paid API or URL. It sends the request first — GET by default, or the given method (POST, PUT, PATCH, DELETE) with optional headers and a JSON object body; if the server answers 402 Payment Required, it asks the user to approve the required payment (exact scheme, the active network, that chain's USDC) in the wallet app, then sends the SAME request (same method, headers and body) again with the payment header and returns the content. If no payment is required (no 402), it just returns the response. Redirects are not followed once a payment header is attached (nor at all when method, headers or body are given) — a redirect comes back as an error with the new address. Text and JSON come back in body. Binary responses (images, PDF, audio) are saved to a file whose path is in saved_file (with content_type); a PNG/JPEG/GIF/WebP image up to 3 MB is also attached as an image. Text longer than 100,000 characters is cut in body and kept whole in saved_file. If saving takes too long (macOS asking for Downloads access), the result comes back first and saving_file names where the file will appear. Settlement takes one of two shapes, chosen by the server's requirement: a facilitator settles the signed EIP-3009 authorization (no gas from this wallet), or — where gas is paid in USDC itself and the server asks for eip3009-client-broadcast — the wallet broadcasts the transfer itself, so the price AND its gas leave this balance. Approval works exactly as in request_payment (password by default; automatic only when the user has turned autopay on), and the app enforces per-payment and daily limits and the emergency lock. Never send a password as an argument. Arguments: url (required), method, headers, body (JSON object), memo (what the payment is for — the user reads it to decide), agent_id. Returns: payment, paid, status, http_status, body, and amount/pay_to/settlement when paid; on a chain where the wallet broadcasts the payment itself, tx and explorer point at that transaction (both are empty on the facilitator-settled path, where settlement_tx/settlement_explorer carry the transaction the seller reports in its receipt — the seller's word, not checked on-chain by the wallet). IMPORTANT — decide on payment, which says where the money is: "none" = nothing was paid, trying again is safe (declined, no 402, or "reverted": the chain rejected the transfer and only gas was spent); "confirmed" = the money left the wallet; "unknown" = it MAY have left (status pending/unknown, or settlement_failed on the facilitator path, where the server's refusal doesn't prove the facilitator didn't settle). For confirmed and unknown without content, asking again can pay a second time — stop and tell the user, showing the tx (when a tx came back without content, x402_resubmit re-sends its proof without paying again). paid is kept for older callers and is simply payment != "none". Read notice when present, and never retry on an HTTP status alone: after the money moved the server may answer with a fresh 402 challenge that reads as if the payment never happened.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | URL of the paid resource to fetch (http/https). | |
| body | No | JSON object sent as the request body (not allowed with GET). Content-Type defaults to application/json. The paid retry sends exactly the same body. | |
| memo | No | What the payment is for — the user reads this in the approval window, so fill it in. | |
| method | No | HTTP method: GET (default), POST, PUT, PATCH or DELETE. Many paid APIs (search, image generation) take POST with a JSON body. The paid retry uses the same method. | |
| headers | No | Extra request headers as a JSON object of name → value. Payment headers, Host, Content-Length and connection headers are set by the wallet and are refused here. The paid retry sends the same headers. | |
| agent_id | No | Optional: the seller's ERC-8004 agent number, if you know it from the service's own documentation or agent card. The wallet then reads that agent's on-chain record and shows the user whether the payment address and the resource domain match what is registered. Leave it out if you don't know it — a wrong number just produces a "no such agent" note. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only say destructive/openWorld/non-idempotent, while the description discloses far more: the retry-safety semantics of the `payment` field ('none'/'confirmed'/'unknown'), the double-payment hazard, facilitator vs eip3009-client-broadcast gas behavior, redirect handling under a payment header, the 100k truncation and saved_file behavior, and the warning never to retry on HTTP status alone. This is exactly the value-beyond-annotations the dimension rewards, and the destructiveHint is consistent with money leaving the wallet.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The basic request flow is front-loaded before the settlement and retry-safety detail, and nearly every sentence carries operational or safety weight. It is nevertheless very long for a single tool, with some density that could be tightened, so it stops short of a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description carries the full burden of explaining returns — and it does: payment/paid/status/http_status/body/amount/pay_to/settlement, tx/explorer vs settlement_tx, and notice. For a 6-param destructive payment tool, an agent has everything needed to call it and interpret the result safely.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds real meaning: it explains memo is what the user reads to decide, agent_id drives an on-chain ERC-8004 verification note, and it warns never to pass a password as an argument. These are semantic additions beyond the schema text.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening sentence gives a specific verb and resource ('Calls an x402 paid API or URL') and the whole description keeps the scope tight around paid HTTP fetching. It distinguishes itself from request_payment by reference ('Approval works exactly as in request_payment') and from x402_resubmit by naming it as the no-pay-again path. An agent can separate it from every sibling without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It clearly states the triggering condition (server answers 402 → user approval → same request resent), when the tool is a plain fetch (no 402), and routes to x402_resubmit when a tx came back without content. It does not give an explicit 'prefer X over request_payment when...' decision rule, but the surrounding context is strong enough to infer usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
x402_resubmitResubmit an x402 payment proofAIdempotent
Resubmits the on-chain proof of an x402 payment this wallet already broadcast itself, to get the content it paid for. Use it when x402_fetch returned a tx without content (status pending, unknown or undelivered, or settlement_failed with a tx). No new money moves and no approval is asked: the wallet re-sends the same proof (the tx plus the saved challenge values) to the same URL. It first checks the tx on-chain — if it isn't mined yet you get status pending (wait and call again), if it reverted you get reverted (payment none: nothing was paid, so paying again is a new decision). Sellers keep proofs acceptable only for a while (the reference server: 10 minutes), so a late resubmit can be refused — that is settlement_failed with a notice; do not pay again then, tell the user and show the tx. Proofs are kept for 7 days. Returns the same shape as x402_fetch.
| Name | Required | Description | Default |
|---|---|---|---|
| tx | Yes | The `tx` that x402_fetch returned for a payment the wallet broadcast itself (status pending, unknown or undelivered, or settlement_failed with a tx). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Far exceeds the annotations: it states no new money moves and no approval is requested, describes the on-chain pre-check and each resulting status (pending, reverted with payment none), and discloses the seller acceptance window (~10 minutes on the reference server) and 7-day proof retention. The idempotent/read-only nature is confirmed in prose rather than left to the hints alone.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose is front-loaded in the first clause, followed by the usage trigger and then the behavioral detail. The length is justified by the number of distinct outcomes (pending, reverted, refused) that the agent must handle correctly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Although there is no output schema, the description states the return shape matches x402_fetch and enumerates every status the caller may encounter along with the correct reaction to each. Nothing an agent needs to invoke or interpret this tool is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds real meaning: the tx must be one the wallet broadcast itself and is re-sent together with the saved challenge values to the same URL. That provenance and pairing context goes beyond the schema's bare field description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (resubmits the on-chain proof of an x402 payment this wallet already broadcast) plus the goal (to get the content it paid for). It also distinguishes itself from the sibling x402_fetch by explicitly framing itself as the follow-up for a tx that came back without content.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly names the trigger condition: 'Use it when x402_fetch returned a `tx` without content (status pending, unknown or undelivered, or settlement_failed with a tx).' It also names the alternative (x402_fetch) and warns against paying again in the settlement_failed/refused cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
1 tool update
v0.5.0- Changed
x402_fetch3 fields changed- added
Input schema / properties / bodyAdded value: +{ + "additionalProperties": true, + "description": "JSON object sent as the request body (not allowed with GET). Content-Type defaults to\napplication/json. The paid retry sends exactly the same body.", + "type": "object" +} - added
Input schema / properties / headersAdded value: +{ + "additionalProperties": { + "type": "string" + }, + "description": "Extra request headers as a JSON object of name → value. Payment headers, Host,\nContent-Length and connection headers are set by the wallet and are refused here.\nThe paid retry sends the same headers.", + "type": "object" +} - added
Input schema / properties / methodAdded value: +{ + "description": "HTTP method: GET (default), POST, PUT, PATCH or DELETE. Many paid APIs (search, image\ngeneration) take POST with a JSON body. The paid retry uses the same method.", + "type": "string" +}
1 tool update
v0.4.3- Added
x402_resubmit
4 tool updates
v0.4.1- Changed
get_history2 fields changed- removed
Input schema / properties / limit / defaultRemoved value: -null - removed
Input schema / properties / limit / nullableRemoved value: -true
- Changed
lookup_agent4 fields changed- removed
Input schema / properties / pay_to / defaultRemoved value: -null - removed
Input schema / properties / pay_to / nullableRemoved value: -true - removed
Input schema / properties / resource / defaultRemoved value: -null - removed
Input schema / properties / resource / nullableRemoved value: -true
- Changed
request_payment6 fields changed- removed
Input schema / properties / agent_id / defaultRemoved value: -null - removed
Input schema / properties / agent_id / nullableRemoved value: -true - removed
Input schema / properties / memo / defaultRemoved value: -null - removed
Input schema / properties / memo / nullableRemoved value: -true - removed
Input schema / properties / token / defaultRemoved value: -null - removed
Input schema / properties / token / nullableRemoved value: -true
- Changed
x402_fetch4 fields changed- removed
Input schema / properties / agent_id / defaultRemoved value: -null - removed
Input schema / properties / agent_id / nullableRemoved value: -true - removed
Input schema / properties / memo / defaultRemoved value: -null - removed
Input schema / properties / memo / nullableRemoved value: -true
1 tool update
v0.4.0- Changed
request_payment1 field changed- added
Input schema / properties / agent_idAdded value: +{ + "default": null, + "description": "Optional: the recipient's ERC-8004 agent number, if you know it from the service's own\ndocumentation or agent card. The wallet reads that agent's on-chain record and tells the\nuser whether the address you are paying is the one registered for that agent. A mismatch\nis the useful part — a match is not proof of anything, since anyone can register.\nLeave it out if you don't know it; a wrong number just produces a \"no such agent\" note.", + "format": "uint64", + "minimum": 0, + "nullable": true, + "type": "integer" +}
2 tool updates
v0.3.0- Added
lookup_agent - Changed
x402_fetch1 field changed- added
Input schema / properties / agent_idAdded value: +{ + "default": null, + "description": "Optional: the seller's ERC-8004 agent number, if you know it from the service's own\ndocumentation or agent card. The wallet then reads that agent's on-chain record and shows\nthe user whether the payment address and the resource domain match what is registered.\nLeave it out if you don't know it — a wrong number just produces a \"no such agent\" note.", + "format": "uint64", + "minimum": 0, + "nullable": true, + "type": "integer" +}
5 tool updates
v0.2.0- First observed
get_balances - First observed
get_history - First observed
get_wallet_status - First observed
request_payment - First observed
x402_fetch
TDQS
Scored across 7 tools
Most tools are clearly distinct (request_payment, get_wallet_status, get_balances, get_history, lookup_agent). The only partial overlaps are request_payment vs x402_fetch (both trigger payments) and x402_fetch vs x402_resubmit, though the descriptions clearly delineate direct transfer vs paid API call vs proof resubmission without new money.
Consistent snake_case verb_noun pattern (request_payment, get_wallet_status, get_balances, get_history, lookup_agent), with x402_fetch and x402_resubmit using a coherent namespace prefix. Minor deviation from pure verb_noun but overall predictable.
7 tools is well-scoped for a wallet/payment server, with each tool earning its place. No redundant or filler tools.
Covers the core wallet lifecycle: payments, status/accounts, balances, history, x402 paid fetches with resubmission, and agent registry lookup. Minor gaps like account-switching (explicitly user-only) or explicit cancellation are reasonable omissions, but no major workflow dead ends.
Maintenance
Related MCP Connectors
Self-custodial USDC wallet on Base for AI agents: on-chain caps, Face ID, one-tap pause.
Crypto wallet for AI agents: balances, payments, swaps and trading with owner controls.
Encrypted, pay-per-use persistent memory storage for AI agents, gated by x402 payments on Base.
Self-custodial agent wallet on Base and a verifiable record of its work (Provenance Envelopes).
581
Related MCP Servers
AlicenseAqualityDmaintenanceProvides a non-custodial USDC wallet on Base for AI agents, with human-in-the-loop approval for every payment.48 npmMIT- AlicenseAqualityDmaintenanceGives AI agents a smart-contract wallet on Base (USDC) with 10 stdio tools: create wallets, send USDC payments, pay x402-protected HTTP resources, and run ERC-8183 escrow Jobs for A2A service delivery.1013 npmMIT
- AlicenseAqualityBmaintenanceA budget-bound x402 payment wallet for AI agents: it autonomously pays HTTP 402 payment-gated URLs across every major chain (EVM, Solana, and many non-EVM families). Self-custodial and backendless, your key, your RPC, with spend caps enforced before any on-chain send.810MIT

token4u-mcpofficial
AlicenseAqualityBmaintenanceEnables AI agents to call LLM APIs via x402 micropayments in USDC on Base network, manage a local wallet, and query consumption records.359 npmMIT