Skip to main content
Glama

LiveAuth MCP Server

npm version MIT license L402 MCP

AIエージェントとMCPツールのための認証、従量課金メータリング、署名付きレシート: Bitcoinネイティブ、Lightning対応、L402互換。

このMCPサーバーを使うと、任意のAIエージェントがproof-of-work(無料、アカウント不要)またはLightning Networkマイクロペイメント(sats)でAPIに対して認証し、その後のツール呼び出しを呼び出しごとの価格設定、冪等な収益イベント、監査者がオフラインで検証できるHMAC署名付きレシートでメータリングおよび収益化できます。

次のような場合に使用します:

  • APIまたはMCPツールを実際の計算コストまたは実際のsatsの背後に置く(CAPTCHAではなく、設計上スパム防止)。

  • AIエージェントにアカウント登録をさせずに、呼び出しごとに課金する。

  • 有料のツール呼び出しごとに、改ざん防止の監査証跡(署名付きmcp-call-receipt-v1)を発行する。

  • プリペイドMCPセッションのために、Lightning対応のL402バンドルアクセスを提供する。

5秒で試す — アカウント不要、APIキー不要:

npx @liveauth-labs/mcp-server

設定なしの場合、サーバーはLiveAuthの匿名デモプロジェクトと実際のPoWフローを使用します。特定のプロジェクトのポリシー、価格設定、帰属が必要な場合にのみLIVEAUTH_API_KEYを追加してください。


利用可能なツール(Glama / MCP自動検出)

ツール

目的

liveauth_mcp_start

セッションを開始します。PoWチャレンジ、Lightningインボイス、またはL402バンドルヒントを返します。

liveauth_mcp_confirm

解決済みのPoWチャレンジ、支払済みのLightningインボイス、またはL402マカロンを送信 → JWTを受け取ります。

liveauth_mcp_charge

呼び出し後の使用量をメータリングします。toolNameを指定すると、登録済みツールの価格を解決し、有料の収益イベントを記録します。

liveauth_mcp_refresh

リフレッシュトークンを新しいJWTと交換します — 再認証は不要です。

liveauth_mcp_status

セッション/支払いステータスをポーリングします(Lightning確認、有効期限)。

liveauth_mcp_lnurl

セッションのBOLT11インボイスを取得します(lnget互換)。

liveauth_mcp_usage

残り予算、使用済み呼び出し数、レート制限ウィンドウを照会します。

完全なパラメータとレスポンススキーマは、以下のツールリファレンスにあります。


Related MCP server: Agent Receipts

5分クイックスタート

オプション1 — 資格情報不要のPoW(アカウント不要、キー不要、ウォレット不要)

npx @liveauth-labs/mcp-server

MCPクライアントでliveauth_mcp_startを呼び出し、次に返されたquoteIdのみを指定してliveauth_mcp_confirmを呼び出します。パッケージは既存のPoWソルバーをローカルで再利用し、LiveAuth APIは署名付きチャレンジを検証してから、短期間のセッションJWTを発行します。

オプション2 — 本番モード

  1. liveauth.appでAPIキーを取得します。

  2. Claude Desktopのclaude_desktop_config.jsonに追加します:

{
  "mcpServers": {
    "liveauth": {
      "command": "npx",
      "args": ["-y", "@liveauth-labs/mcp-server"],
      "env": {
        "LIVEAUTH_API_BASE": "https://api.liveauth.app",
        "LIVEAUTH_API_KEY": "la_pk_your_public_key"
      }
    }
  }
}
  1. Claudeを再起動します。完了です。

オプション3 — プログラムによる使用(CLI / SDK)

export LIVEAUTH_API_KEY=la_pk_xxx
npx @liveauth-labs/mcp-server

このパッケージはTypeScript SDKでもあります — 以下のSDKの使用法を参照してください。CLIバイナリはliveauth-mcpです。

なぜLiveAuthなのか?

APIプロバイダー / ツール開発者向け:

  • プロトコル層でボットを阻止します。PoWとLightning satsはリプレイ不可能で、フィッシング不可能で、ユーザーアカウントを必要としません。

  • 呼び出しごとにsatsで課金します。監査人、顧客、または会計士に見せられる署名付きレシートを発行します。

  • 任意のMCPツールを1行(createMcpGate)でラップでき、ツールごとの収益、ツールごとの最小/最大価格設定、冪等なリトライが得られます。

AIエージェント / エージェントビルダー向け:

  • 有料APIへの許可不要のアクセス — PoWを解くかsatsを支払うとJWTを取得。サインアップ不要、メール不要、OAuthの手間も不要。

  • エージェントアクセスにはPoW、Lightningインボイス、またはL402バンドルマカロンを使用できます。

  • プロジェクトは設定されている場合、カスタムLightningノードを通じて決済できます。それ以外の場合、支払いはLiveAuthCore設定ノードを使用します。

重要な計算: ツールがボットにスクレイピングされている場合、呼び出しごとに1 satを請求するだけで、スクレイパーを不採算にできます。これを攻撃コスト経済学と呼び、それが私たちが存在する理由です。

インストール

npm install -g @liveauth-labs/mcp-server

またはnpxで直接使用:

npx @liveauth-labs/mcp-server

Goose

Goose向けのLiveAuthは、他のすべてのクライアントと同じ標準ベースのstdio MCPサーバーを使用します。Gooseラッパー、デーモン、重複した認証ランタイムはありません。

Gooseにインストール

または、公式ディープリンクと現在のフォールバックを出力します:

npx @liveauth-labs/mcp-server setup goose

1回限りのGoose CLIセッションの場合:

goose session --with-extension "liveauth:npx -y @liveauth-labs/mcp-server"

ディープリンクが利用できない場合の手動Goose stdio設定:

extensions:
  liveauth:
    type: stdio
    name: LiveAuth
    enabled: true
    cmd: npx
    args: ["-y", "@liveauth-labs/mcp-server"]
    env_keys: []
    envs: {}
    timeout: 300

既存のGoose設定を破壊的に編集しないでください。ディープリンクまたはgoose configureを優先してください。後でプロジェクト設定を追加する場合は、共有プレーンテキストYAMLではなく、Gooseの拡張機能シークレット設定から入力してください。

Gooseクイックテスト

Gooseに次のように依頼します:

LiveAuthを使用してデフォルトの認証フローを開始します。返されたクォートを確認し、次に私のLiveAuth使用状況を表示します。

初期フローは匿名デモプロジェクトのPoWチャレンジを使用し、ウォレットは不要です。プロジェクトの公開キーはオプションです:

変数

設定するタイミング

LIVEAUTH_API_KEY

プロジェクト固有のポリシー、価格設定、帰属。

LIVEAUTH_API_BASE

https://api.liveauth.appの代わりにセルフホストのLiveAuth API。

LIVEAUTH_DEMO=true

古いローカルシミュレートLightningデモを明示的にオプトイン。

有料フローが要求された場合、ツール結果は既存のインボイスフィールドを保持し、ポータブルな構造化データも含みます:

{
  "lightning": {
    "invoice": "lnbc...",
    "lightningUri": "lightning:lnbc...",
    "amountSats": 21,
    "expiresAt": "2030-03-17T17:46:40.000Z",
    "status": "pending"
  }
}

MCP Appsをサポートするクライアントは、含まれるQRコード、Open Walletアクション、有効期限、ライブの支払済み/保留中/期限切れ状態をレンダリングできます。他のクライアントは、JSONとQR画像コンテンツを通常のMCP結果として受け取ります。

Gooseトラブルシューティング

  • リンクが開かない場合は、npx @liveauth-labs/mcp-server setup gooseを実行し、その1セッションまたは手動フォールバックを使用します。

  • npxが利用できない場合は、現在のNode.jsリリース(Node 18以降)をインストールします。

  • 提供されたプロジェクトキーが拒否された場合は、それを削除して匿名PoWフローを確認します。無効または失効したキーは、意図的にデモにフォールバックしません。

  • Lightningインボイスが期限切れになった場合は、liveauth_mcp_startを再度呼び出して新しいクォートを取得します。

  • リフレッシュトークンや非公開の資格情報をログやプレーンテキスト設定に保存しないでください。

LiveAuthを使用すると、エージェントはすべてのツールに事前に永続的な資格情報をプロビジョニングする代わりに、実行時に認証を取得できます。

SDKの使用法

このパッケージはTypeScript/JavaScript SDKとしてもインポートできます。パッケージをインポートしてもstdio MCPサーバーは起動しません。CLIはliveauth-mcpバイナリにあります。

クライアント認証ヘルパー

import { createMcpClient } from '@liveauth-labs/mcp-server';

const liveauth = createMcpClient({
  publicKey: 'la_pk_xxx',
  baseUrl: 'https://api.liveauth.app',
  onInvoice(invoice) {
    // Render invoice.bolt11 as a QR code for a paid Lightning test.
    console.log(invoice.bolt11);
  },
});

const session = await liveauth.start();
const token = await liveauth.confirm(session);

console.log(token.jwt);

クライアントは確認済みのJWTを保存し、リフレッシュトークンが返された場合は有効期限前にリフレッシュし、現在のトークンをliveauth.tokenを通じて公開します。アプリがシャットダウンするときにliveauth.destroy()を呼び出して、トークン状態とリフレッシュタイマーをクリアします。

実際の有料インボイスを要求するには:

const session = await liveauth.start({ forceLightning: true });
console.log(session.invoice?.bolt11);

// Poll this after the invoice is paid.
const token = await liveauth.confirmLightning(session);

サーバーゲートヘルパー

import { createMcpGate } from '@liveauth-labs/mcp-server';

const gate = createMcpGate({
  publicKey: 'la_pk_xxx',
  baseUrl: 'https://api.liveauth.app',
});

const result = await gate.invoke(
  jwtFromYourTransport,
  { message: 'hello' },
  async (input, context) => ({
    content: [{ type: 'text', text: input.message }],
    charge: context.liveAuth.charge,
  }),
  {}
);

gate.invoke(...)はJWTを検証し、設定されたsatsコストまたはバックエンドプロジェクトのデフォルトを請求し、context.liveAuthをハンドラーに渡します。古いgate.gateTool(...)名も引き続きサポートされています。

有料ツールの帰属

MCPサーバーに登録済みのLiveAuthツールIDがある場合は、ゲートを作成するときにtoolIdを渡します。請求は次の場所に送られます:

POST /api/mcp/tools/{toolId}/charge

レガシーの汎用エンドポイントの代わりに:

POST /api/mcp/charge

登録済みのツールスラッグ/名前をtoolNameとして渡すこともできます。そのモードでは、請求はボディにツールIDを含む汎用エンドポイントに送られます:

POST /api/mcp/charge

ツールの請求は同じセッション予算チェックを保持しますが、総sats、LiveAuthプラットフォーム手数料、開発者純sats、ツールメソッド名、支払いプロジェクト/セッション/トークン、メタデータ、冪等キーを含む不変の収益イベントも記録します。costSatsが省略された場合、LiveAuthCoreは登録済みツールのデフォルト価格を使用します。toolIdまたはtoolNameがない場合、プロジェクトのグローバルMCP価格にフォールバックします。

登録済みツールには、有料呼び出しWebhook URLを設定することもできます。新しい有料呼び出しが成功するたびに、LiveAuthCoreはツールID、総/プラットフォーム/純sats、収益イベントID、メタデータ、署名付きレシートを含むliveauth.mcp.tool.paid_call Webhookをキューに入れます。ツールWebhook URLが空白の場合、LiveAuthCoreはプロジェクトのWebhook URLにフォールバックします。冪等なリトライは重複をエンキューしません。

import { createMcpGate } from '@liveauth-labs/mcp-server';

const gate = createMcpGate({
  publicKey: process.env.LIVEAUTH_PUBLIC_KEY!,
  baseUrl: process.env.LIVEAUTH_API_URL ?? 'https://api.liveauth.app',
  toolName: 'paid-research-tool',
});

const result = await gate.invoke(
  jwtFromYourTransport,
  { url: 'https://example.com' },
  async (input, context) => {
    const page = await fetch(input.url).then(r => r.text());

    return {
      text: page,
      revenueEventId: context.liveAuth.charge.revenueEventId,
      receipt: context.liveAuth.charge.receipt,
      netSats: context.liveAuth.charge.netSats,
    };
  },
  { requestId: 'req_123' },
  {
    toolMethodName: 'web_fetch',
    idempotencyKey: 'req_123',
    agentId: 'agent_abc',
    metadata: {
      urlHost: new URL('https://example.com').hostname,
    },
  }
);

toolIdまたはtoolNameが設定されている場合、GateToolOptionsは以下をサポートします:

オプション

目的

costSats

この呼び出しに請求するオプションのsats。省略すると、登録済みツールの価格またはプロジェクトのグローバル価格を使用します。

toolName

汎用エンドポイントを使用する場合の、呼び出しごとのツールスラッグ/名前のオプションのオーバーライド。

toolMethodName

ツール内のメソッド(web_fetchsearchなど)。

idempotencyKey

リトライセーフなキー。同じツールに再利用すると、二重請求ではなく元の収益イベントと署名付きレシートが返されます。

agentId

レポート用のオプションの呼び出し元/エージェント識別子。

metadata

監査コンテキスト用の小さなJSONオブジェクト。プライベートなツール出力をここに保存しないでください。

ツールの請求レスポンスには、通常の予算カウンターに加えて収益会計が含まれます:

{
  "status": "ok",
  "callsUsed": 3,
  "satsUsed": 15,
  "grossSats": 5,
  "platformFeeSats": 1,
  "netSats": 4,
  "feeBasisPoints": 500,
  "revenueEventId": "event-guid",
  "toolId": "tool-guid",
  "toolName": "Paid Research Tool",
  "toolSlug": "paid-research-tool",
  "receipt": {
    "version": "mcp-call-receipt-v1",
    "payload": "base64url-canonical-json",
    "signature": "base64url-hmac-sha256",
    "signatureAlgorithm": "HMAC-SHA256",
    "keyId": "liveauth-mcp-receipt-v1",
    "body": {
      "receiptId": "mcp_receipt_eventguid",
      "revenueEventId": "event-guid",
      "mcpToolId": "tool-guid",
      "toolName": "Paid Research Tool",
      "toolSlug": "paid-research-tool",
      "toolMethodName": "web_fetch",
      "grossSats": 5,
      "platformFeeSats": 1,
      "netSats": 4,
      "idempotencyKey": "req_123"
    }
  }
}

レシートは、有料ツールの請求に対してLiveAuthCoreが返す署名付きの呼び出しごとの監査アーティファクトです。請求の証明や後日の照合が必要な場合は、ツール結果と一緒に保存してください。

toolIdまたはtoolNameが設定されていない場合、SDKは後方互換性のある使用量メータリングのために/api/mcp/chargeを引き続き使用します。

設定

Claude Desktop

claude_desktop_config.jsonに追加します:

{
  "mcpServers": {
    "liveauth": {
      "command": "npx",
      "args": ["-y", "@liveauth-labs/mcp-server"],
      "env": {
        "LIVEAUTH_API_BASE": "https://api.liveauth.app",
        "LIVEAUTH_API_KEY": "la_pk_your_public_key"
      }
    }
  }
}

資格情報不要モード: LIVEAUTH_API_KEYを省略すると、サーバーはプロジェクトヘッダーなしで通常のMCPエンドポイントを呼び出します。LiveAuthは設定された匿名デモプロジェクトをバインドし、署名付きPoWチャレンジを返し、通常の検証、JWT、レート制限、メータリング境界を維持します。LIVEAUTH_DEMO=trueは、古いローカルシミュレートLightningプレビューへの明示的なオプトインのままです。

その他の環境変数:

変数

デフォルト

目的

LIVEAUTH_API_KEY

(未設定)

あなたのLiveAuthプロジェクト公開キー(la_pk_…)。

LIVEAUTH_API_BASE

https://api.liveauth.app

セルフホストLiveAuth用のオーバーライド。

LIVEAUTH_DEMO

false

レガシーのローカルシミュレートLightningデモを明示的に使用。

その他のMCPクライアント

サーバーはstdio(JSON-RPC 2.0)を話します。次のように起動します:

liveauth-mcp

また、Cursor、VS Code、ChatGPT、Windsurf、Continue、Clineなど、MCP互換のクライアントでも動作します。

ツールリファレンス

各MCPツールの完全なスキーマです。各ツールはJSON-RPC 2.0互換で、src/index.test.tssrc/cli.test.tsでテストされています。

liveauth_mcp_start

新しいLiveAuth MCPセッションを開始します。デフォルトではPoWチャレンジを返し、forceLightning=trueの場合はLightningインボイスを返します。

パラメータ:

  • forceLightning (boolean, 任意): trueの場合、PoWチャレンジの代わりにLightningインボイスを要求します

  • forceL402 (boolean, 任意): trueの場合、L402バンドルマカロンで確認するセッションを開始します

戻り値 (PoW):

{
  "quoteId": "uuid-of-session",
  "powChallenge": {
    "projectId": "guid",
    "projectPublicKey": "la_pk_...",
    "challengeHex": "a1b2c3...",
    "targetHex": "0000ffff...",
    "difficultyBits": 18,
    "expiresAtUnix": 1234567890,
    "signature": "sig..."
  },
  "invoice": null
}

戻り値 (Lightning):

{
  "quoteId": "uuid-of-session",
  "powChallenge": null,
  "invoice": {
    "bolt11": "lnbc...",
    "amountSats": 50,
    "expiresAtUnix": 1234567890,
    "paymentHash": "abc123..."
  },
  "lightning": {
    "invoice": "lnbc...",
    "lightningUri": "lightning:lnbc...",
    "amountSats": 50,
    "expiresAt": "2009-02-13T23:31:30.000Z",
    "expiresAtUnix": 1234567890,
    "status": "pending"
  }
}

戻り値 (L402バンドル):

{
  "quoteId": "uuid-of-session",
  "powChallenge": null,
  "invoice": null,
  "authHint": "l402_bundle"
}

liveauth_mcp_confirm

解決済みのproof-of-workチャレンジを送信するか、パッケージにキャッシュされたチャレンジを解決させるか、Lightning支払いをポーリングするか、L402マカロンを提示してJWT認証トークンを受け取ります。

パラメータ:

  • quoteId (string): startレスポンスのquoteId

  • challengeHex (string, 任意, PoWのみ): startレスポンスのチャレンジの16進数

  • nonce (number, 任意, PoWのみ): PoWチャレンジを解決するnonce

  • hashHex (string, 任意, PoWのみ): 結果のハッシュ (projectPublicKey:challengeHex:nonce のsha256)

  • expiresAtUnix (number, 任意, PoWのみ): チャレンジの有効期限タイムスタンプ

  • difficultyBits (number, 任意, PoWのみ): チャレンジの難易度ビット

  • signature (string, 任意, PoWのみ): チャレンジの署名

  • macaroon (string, L402のみ): L402バンドル請求フローから返されたバンドルマカロン

チャレンジがこのMCPサーバーから来た場合、quoteIdのみでconfirmを呼び出すと、パッケージの既存のPoWソルバーが再利用されます。明示的な解決フィールドは互換性のために引き続きサポートされます。

戻り値:

{
  "jwt": "eyJhbGc...",
  "expiresIn": 600,
  "remainingBudgetSats": 10000,
  "refreshToken": "abc123def456..."
}

注記: refreshTokenは安全に保管してください。これはMCPツールデータで返されますが、stderrやアプリケーションログには書き込まれません。再認証せずに新しいJWTを取得するにはliveauth_mcp_refreshを使用してください。

liveauth_mcp_charge

認証済み呼び出しの後にAPI使用量を計測します。バンドルされたMCPサーバーは汎用の/api/mcp/chargeエンドポイントを呼び出します。toolNameを指定すると、LiveAuthが登録済みツールを解決し、設定された価格を適用して、有料ツールの収益イベントを作成します。toolNameを省略すると、後方互換性のある汎用メータリングが維持されます。

パラメータ:

  • callCostSats (number, 任意): API呼び出しのコスト(sats単位)。省略するとバックエンドの価格設定が使用されます。

  • toolName (string, 任意): ツールごとの価格設定と帰属のための登録済みMCPツールのスラッグ/名前。

戻り値:

{
  "status": "ok",
  "callsUsed": 5,
  "satsUsed": 15
}

予算を超えた場合:

{
  "status": "deny",
  "callsUsed": 100,
  "satsUsed": 1000,
  "reason": "budget_exceeded"
}

liveauth_mcp_status

MCPセッションのステータスを確認します。Lightning支払いの確認をポーリングするために使用します。

パラメータ:

  • quoteId (string): startレスポンスのquoteId

戻り値:

{
  "quoteId": "uuid-of-session",
  "status": "pending",
  "paymentStatus": "pending",
  "expiresAt": "2026-02-17T12:00:00Z"
}

paymentStatusが"paid"の場合、セッションは確認済みです。JWTを取得するにはliveauth_mcp_confirmを再度呼び出してください。

liveauth_mcp_lnurl

セッションのLightningインボイスを取得します(lnget互換)。任意のLightningウォレットで支払うためのBOLT11インボイスを取得するために使用します。

パラメータ:

  • quoteId (string): startレスポンスのquoteId

戻り値:

{
  "pr": "lnbc2100n1...",
  "routes": []
}

注記: これはlngetやその他のLightning支払いツールと互換性があります。liveauth_mcp_confirmが"payment pending"を返した場合、インボイスをポーリングするためにこれを使用してください。

liveauth_mcp_usage

課金を行わずに現在の使用量と残りの予算を照会します。API呼び出しを行う前にステータスを確認するために使用します。

パラメータ: (必須なし)

戻り値:

{
  "status": "active",
  "callsUsed": 5,
  "satsUsed": 15,
  "maxSatsPerDay": 10000,
  "remainingBudgetSats": 9985,
  "maxCallsPerMinute": 60,
  "expiresAt": "2026-02-17T12:00:00Z",
  "dayWindowStart": "2026-02-17T00:00:00Z"
}

liveauth_mcp_refresh

再認証せずにJWTトークンを更新します。confirmから返されたrefreshTokenを使用して、現在のトークンの有効期限が切れたときに新しいJWTを取得します。

パラメータ:

  • refreshToken (string): confirmレスポンスのrefreshToken

戻り値:

{
  "jwt": "eyJhbGc...",
  "expiresIn": 600,
  "remainingBudgetSats": 9985
}

注記: refreshTokenは安全に保存してください。新しいPoWを解決したり、別のLightning支払いを行ったりせずにセッションを延長するために必要になります。

使用例

PoW認証

  1. liveauth_mcp_startを呼び出してPoWチャレンジとquoteIdを取得します

  2. quoteIdを指定してliveauth_mcp_confirmを呼び出します。MCPサーバーは既存のパッケージソルバーでキャッシュされたチャレンジを解決します

  3. 高度なクライアントは明示的な解決策を送信することもできます(hash = sha256(projectPublicKey:challengeHex:nonce)、ここでhash < targetHex

  4. APIリクエストのAuthorization: Bearer <token>ヘッダーでJWTを使用します

  5. 各汎用API呼び出しの後、呼び出しコストを指定してliveauth_mcp_chargeを呼び出すか、省略してプロジェクト全体のMCP価格を使用します

  6. 収益化されたMCPツールの場合、各呼び出しが収益イベントと署名付きレシートを作成するように、createMcpGate({ toolId })またはcreateMcpGate({ toolName })でハンドラーをラップします

Lightning認証

  1. forceLightning: trueを指定してliveauth_mcp_startを呼び出し、Lightningインボイスを取得します

  2. liveauth_mcp_lnurl(またはliveauth_mcp_statusのポーリング)を使用してBOLT11インボイスを取得します

  3. Lightningノード/ウォレットを使用してインボイスを支払います

  4. quoteIdを指定してliveauth_mcp_statusをポーリングし、paymentStatusが"paid"になるまで待ちます

  5. quoteIdのみを指定してliveauth_mcp_confirmを呼び出し、JWTを受け取ります

  6. 汎用のliveauth_mcp_chargeメータリングまたはSDKの有料ツール帰属のいずれかでJWTを使用します

認証フロー

┌─────────────────┐     ┌─────────────────┐     ┌─────────────────┐
│  AI Agent       │────▶│  MCP Server     │────▶│  LiveAuth API   │
│                 │     │                 │     │                 │
│ 1. Start       │     │ /api/mcp/start  │     │ Returns PoW    │
│ 2. Solve PoW   │     │                 │     │ challenge       │
│ 3. Confirm     │     │ /api/mcp/confirm│     │ Returns JWT    │
│ 4. API calls   │     │                 │     │                 │
│ 5. Charge      │     │ /api/mcp/charge │     │ Meter usage    │
└─────────────────┘     └─────────────────┘     └─────────────────┘

有料ツールサーバーは同じJWTを使用しますが、帰属エンドポイントを通じて課金します:

Agent calls MCP tool
→ Tool server calls POST /api/mcp/tools/{toolId}/charge
  or POST /api/mcp/charge with toolName
→ LiveAuth validates JWT and budget
→ LiveAuth records gross / platform fee / net revenue and returns a signed receipt
→ Tool handler runs and returns the result

L402バンドルフロー

LiveAuthCoreは、プリペイドMCPアクセスのためのLightning対応L402バンドルをサポートしています。バンドルを購入し、支払い後にマカロンを請求し、L402モードでMCPセッションを開始して、そのマカロンで確認します。

# 1. Create a bundle invoice.
curl -X POST https://api.liveauth.app/api/public/l402/bundle/invoice \
  -H "Content-Type: application/json" \
  -d '{"publicKey":"la_pk_xxx","tier":"starter","agentId":"agent_abc"}'

# 2. After the invoice is paid, claim a macaroon.
curl -X POST https://api.liveauth.app/api/public/l402/bundle/claim \
  -H "Content-Type: application/json" \
  -d '{"publicKey":"la_pk_xxx","paymentHash":"payment_hash_from_step_1"}'

# 3. Start and confirm an MCP session with the macaroon.
curl -X POST https://api.liveauth.app/api/mcp/start \
  -H "X-LW-Public: la_pk_xxx" \
  -H "Content-Type: application/json" \
  -d '{"forceL402":true}'

curl -X POST https://api.liveauth.app/api/mcp/confirm \
  -H "X-LW-Public: la_pk_xxx" \
  -H "Content-Type: application/json" \
  -d '{"quoteId":"quote_id_from_step_3","macaroon":"macaroon_from_step_2"}'

開発

# Install dependencies
npm install

# Build
npm run build

# Run locally
node dist/cli.js

リソース

ライセンス

MIT


カテゴリ: authentication · payments · lightning · l402 · bitcoin · pay-per-call · metering · agent-tools · anti-abuse · mcp-server · typescript

Available Tools

7 tools
liveauth_mcp_chargeA

Meter API usage after making an authenticated call. Call this with the cost in sats for each API request made using the JWT.

ParametersJSON Schema
NameRequiredDescriptionDefault
toolNameNoOptional registered MCP tool slug or name for per-tool pricing and revenue attribution.
callCostSatsNoOptional cost of the API call in sats. Omit to use LiveAuth project or tool pricing.

TDQS

A3.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description must disclose behavioral traits on its own. It mentions the action 'Meter API usage' but does not explain side effects like deducting sats, idempotency (e.g., calling twice), prerequisites beyond JWT authentication, or error behavior. As a monetary/charge operation, the lack of these details is a significant gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise—two short sentences that front-load the core action ('Meter API usage') and then provide the invocation details. There is no redundant or filler content; every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with two optional parameters, the description gives a decent overview of purpose and usage. However, with no annotations or output schema, it omits important context such as the expected response, idempotency, and failure modes. It is minimally sufficient but not fully complete for a financial metering operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides full documentation for both parameters (100% coverage). The description adds minor context (e.g., 'cost in sats for each API request') but does not meaningfully enrich the understanding of toolName or callCostSats beyond their schema descriptions. The high schema coverage justifies the baseline score of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Meter API usage after making an authenticated call.' It identifies a specific verb (meter/charge) and resource (API usage), and the context (after an authenticated call) distinguishes it from sibling tools like liveauth_mcp_usage, which likely queries usage rather than recording it.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly instructs when to call the tool: 'Call this with the cost in sats for each API request made using the JWT.' This clearly conveys per-request usage after authentication. However, it doesn't explicitly mention alternatives or conditions when not to use it, preventing a perfect score.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

liveauth_mcp_confirmA

Submit the solved proof-of-work challenge (or poll for Lightning payment) to receive a JWT. For Lightning, call with just quoteId to check/poll payment status.

ParametersJSON Schema
NameRequiredDescriptionDefault
nonceNoThe nonce that solves the PoW challenge (PoW only)
hashHexNoThe resulting hash hex (PoW only)
quoteIdYesThe quoteId from the start response
macaroonNoL402 bundle macaroon (L402 only)
signatureNoSignature from the challenge (PoW only)
challengeHexNoThe challenge hex from the start response (PoW only)
expiresAtUnixNoExpiration timestamp from the challenge (PoW only)
difficultyBitsNoDifficulty bits from the challenge (PoW only)

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden. It discloses the dual-mode behavior (PoW vs Lightning), that polling is possible, and the outcome (JWT). However, it does not disclose failure modes, side effects like challenge invalidation, or retry semantics, leaving important behavioral gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the main action, and the second provides a specific usage tip. No waste or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 8 parameters and two distinct flows, with no annotations and no output schema. The description covers the core purpose and outcome but lacks details on error conditions, success/failure responses, and safety of repeated calls. It is adequate but not comprehensive for the complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds mode-specific guidance: 'call with just quoteId' for Lightning, implying PoW uses the other fields. This clarifies how to select parameters by mode, going beyond the schema's individual descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action: submitting a solved proof-of-work challenge or polling for Lightning payment to receive a JWT. This clearly distinguishes it from siblings like start (which likely initiates) and status (which likely checks overall status).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit guidance: for Lightning, call with just quoteId to check/poll payment status, and PoW requires the challenge-solution fields. It does not explicitly name alternatives or when-not-to-use, but the sibling names and context make it inferable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

liveauth_mcp_lnurlB

Get the Lightning invoice for a session (lnget-compatible). Use this to retrieve the BOLT11 invoice for payment.

ParametersJSON Schema
NameRequiredDescriptionDefault
quoteIdYesThe quoteId from the start response

TDQS

B3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It only states that the tool retrieves an invoice, but does not clarify side effects, return format, expiration, or whether it is a read-only operation. The mention of 'lnget-compatible' is vague and adds little transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short and front-loaded, but the two sentences are somewhat redundant: 'Get the Lightning invoice' is repeated as 'retrieve the BOLT11 invoice.' It could be condensed into a single sentence without losing information, so it is not maximally concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has only one parameter with good schema coverage, but no output schema and no annotations. The description does not explain what the response looks like, potential errors, or any behavioral context like payment flow or invoice validity. Given the lack of structured metadata, this is insufficient for an agent to fully understand the tool's role.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides 100% coverage by describing quoteId as 'The quoteId from the start response.' The description adds no additional meaning about the parameter, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Get the Lightning invoice for a session' and also mentions 'retrieve the BOLT11 invoice for payment.' This provides a specific verb and resource, but it does not explicitly differentiate from sibling tools like start, status, or charge, so it does not reach a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description says 'Use this to retrieve the BOLT11 invoice for payment,' which implies the tool is for obtaining an invoice after starting a session. However, it does not explicitly state when to use it versus alternatives, nor does it mention any prerequisites or exclusions. This falls under implied usage rather than clear guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

liveauth_mcp_refreshA

Refresh the JWT token without re-authenticating. Use the refreshToken returned from confirm to get a new JWT.

ParametersJSON Schema
NameRequiredDescriptionDefault
refreshTokenYesThe refreshToken from the confirm response

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses a key behavior (no re-authentication required) and the outcome (new JWT). However, it does not mention token rotation, single-use semantics, error handling, or response format, leaving gaps for an agent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences, no filler. The main purpose is front-loaded, and the parameter guidance is integrated naturally. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter tool with no output schema, the description is nearly complete: it explains the purpose, the input source, and the expected result (new JWT). It lacks only minor details like potential errors or whether the refresh token is reusable, but these are not critical for basic invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description for refreshToken already provides full coverage (100%), and the tool description essentially restates the same source. Since the schema does the heavy lifting, the description adds minimal extra meaning, hence the baseline score of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb+resource ('refresh the JWT token') and explicitly states what it achieves ('get a new JWT'). It also distinguishes itself from siblings by referencing the confirm response, making its role in the auth flow clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly states when to use this tool: after confirm, using the refreshToken from confirm. It implies it is the alternative to re-authenticating, providing a clear context. It does not explicitly list exclusions or alternatives, but the sibling set makes the intended use obvious.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

liveauth_mcp_startA

Start a new LiveAuth MCP session. Returns a PoW challenge (default), Lightning invoice, or L402 bundle auth hint.

ParametersJSON Schema
NameRequiredDescriptionDefault
forceL402NoIf true, request an L402 bundle auth session
forceLightningNoIf true, request Lightning invoice instead of PoW challenge

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description must fully disclose behavioral traits. It does state the return types and the default PoW challenge, but it omits potential side effects, such as whether starting a new session invalidates existing ones or requires prior authentication. This leaves important behavioral context undisclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that directly states the action and the possible outcomes. It contains no redundant or filler phrases, making it highly concise and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with two optional parameters and no output schema, the description covers the core return types and default behavior. While it could provide more detail about the response structure or next steps, the information given is sufficient to understand the tool's basic operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage with descriptive definitions for both boolean parameters. The description adds no additional parameter-level meaning, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'Start' and resource 'LiveAuth MCP session', making the purpose unambiguous. It distinguishes itself from sibling tools by clearly indicating this is the initialization action, and it enumerates the distinct return types (PoW challenge, Lightning invoice, L402 bundle).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this is the entry point for starting a session, but it does not explicitly state when to use it versus sibling tools like liveauth_mcp_status or liveauth_mcp_charge. No prerequisites or alternative usage scenarios are provided, so the guidance remains at an implied level.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

liveauth_mcp_statusA

Check the status of an MCP session. Use to poll for Lightning payment confirmation. Also returns the invoice via lnurl compatibility.

ParametersJSON Schema
NameRequiredDescriptionDefault
quoteIdYesThe quoteId from the start response

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It reveals that the tool returns an invoice via lnurl compatibility and implies a read-only polling nature, but it doesn't explicitly state read-only behavior, side effects, or what constitutes a 'status.' This is adequate but lacks rich safety or state-change disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the primary purpose, and includes a specific usage example. Every sentence adds value with no fluff or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (single parameter, no output schema), the description covers the essential context: what it does, when to use it, and a hint about the returned invoice. However, it doesn't describe the full status response structure or possible statuses, which might be useful for a polling tool, but overall it's sufficient for the low complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% with the only parameter 'quoteId' described as 'The quoteId from the start response.' The description adds no additional parameter-level meaning, but the schema already covers it fully, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Check the status of an MCP session' with a specific use case ('poll for Lightning payment confirmation'). It also distinguishes itself from siblings by focusing on status and polling, and the added detail about lnurl compatibility further clarifies the tool's unique role.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Use to poll for Lightning payment confirmation,' which provides clear guidance for when to invoke this tool. It doesn't mention alternatives or exclusions, but the polling context is sufficient for a status tool in a payment flow, making it clear this is the follow-up to start/confirm actions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

liveauth_mcp_usageA

Query current usage and remaining budget for the MCP session. Use this to check how many sats and calls have been used without making a charge.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full burden. It does disclose a key behavioral trait: 'without making a charge' indicates the call is non-destructive and free. However, it doesn't clarify whether the usage query itself counts as a call or affect the budget, nor does it explain any side effects or limit conditions. This is a minor gap for a read-only usage tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, front-loaded with the core purpose, and contains no filler. Every word contributes to understanding the tool's function and when to use it.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with no parameters and no output schema, the description is complete. It clearly states what it queries (usage and remaining budget), the metrics (sats and calls), and the key safety aspect (no charge). No additional context is necessary.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the baseline is 4. The description adds no parameter details, but none are needed. It correctly focuses on the tool's purpose and usage rather than param syntax.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'Query' and identifies a clear resource: 'current usage and remaining budget for the MCP session.' It also distinguishes itself from siblings like 'status' and 'charge' by focusing on budget/calls usage, making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use the tool: 'Use this to check how many sats and calls have been used without making a charge.' This provides clear context and implies it's a non-charging alternative to 'liveauth_mcp_charge'. It doesn't explicitly name alternatives or exclusions, but the guidance is practical and sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 7 tool updatesv1.0.8
    • First observedliveauth_mcp_charge
    • First observedliveauth_mcp_confirm
    • First observedliveauth_mcp_lnurl
    • First observedliveauth_mcp_refresh
    • First observedliveauth_mcp_start
    • First observedliveauth_mcp_status
    • First observedliveauth_mcp_usage

TDQS

A3.8/5.0
Disambiguation4/5

Each tool maps to a distinct auth lifecycle step: start initiates, lnurl fetches invoice, confirm resolves auth, refresh renews token, charge/usage handle metering, and status reports state. Slight overlap exists between status and confirm when polling payment, but descriptions clarify their primary roles.

Naming Consistency4/5

All tools share the consistent liveauth_mcp_ prefix and snake_case format. Most use verbs (start, confirm, refresh, charge), but status, usage, and lnurl are noun-based, creating minor deviations from a strict verb pattern.

Tool Count5/5

With 7 tools, the set is well-scoped for the server's purpose. Each tool covers a specific function without redundancy, fitting comfortably in the ideal 3-15 tool range.

Completeness5/5

The toolset provides full lifecycle coverage: starting a session, retrieving invoices, confirming authentication, refreshing tokens, and tracking/metering usage. No significant operational gaps are apparent for the stated authentication and payment domain.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    B
    maintenance
    MCP server that enables AI agents to make autonomous Bitcoin Lightning Network payments using the L402 protocol. Agents can pay for API access, purchase resources, and complete transactions without human intervention — invoice comes in, sats go out, done.
    17
    9
    MIT
  • A
    license
    A
    quality
    A
    maintenance
    L402 + x402 client MCP. AI agents discover, pay for, and consume any payment-gated API autonomously. Supports Lightning (NWC), Cashu ecash, stablecoins, and human-in-the-loop payments.
    11
    284
    MIT
  • A
    license
    A
    quality
    C
    maintenance
    MCP server that gates API calls to AI agents using proof-of-work (free) or Lightning payment (3 sats), providing challenge, verify, and status tools for per-call authentication without accounts.
    3
    76
    1
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/dulzuradev/liveauth-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server