Gib Claude (oder jedem anderen MCP-kompatiblen Agenten) ein nicht-verwahrtes USDC-Wallet auf Base — mit einer „Human-in-the-loop“-Freigabe für jede Zahlung.
@grip-foundation/grip-mcp ist ein Model Context Protocol-Server, der vier Tools für jeden MCP-fähigen Client (Claude Desktop, Claude Code, Continue, etc.) bereitstellt:
Tool | Was es tut | Wer genehmigt |
| Gibt die Smart-Account-Adresse des Agenten + USDC-Guthaben auf Base zurück. | — |
| Bereitet eine Zahlung vor (off-chain). Gibt ein Freigabe-Token zurück. | — |
| Schließt eine vorbereitete Zahlung ab oder lehnt sie ab. Bei Genehmigung wird eine echte USDC-Überweisung auf dem Base-Mainnet ausgeführt. | Mensch, im Chat |
| Listet kürzliche Zahlungen der Sitzung auf. | — |
Der Agent bewegt niemals Geld ohne dich. Der Ablauf ist: Agent bereitet vor → du bestätigst im Chat → Agent schließt ab. Es gibt keine programmatische automatische Genehmigung.
Related MCP server: @arispay/payagent-mcp
npx (nach der ersten Veröffentlichung)In ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) oder %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"grip": {
"command": "npx",
"args": ["-y", "@grip-foundation/grip-mcp"]
}
}
}git clone https://github.com/grip-foundation/grip-mcp.git
cd grip-mcp
pnpm install
pnpm run buildVerweise dann in Claude Desktop auf die erstellte Datei:
{
"mcpServers": {
"grip": {
"command": "node",
"args": ["/absolute/path/to/grip-mcp/dist/server/index.js"]
}
}
}Starte Claude Desktop nach dem Bearbeiten der Konfiguration neu.
Beim ersten Start des Servers wird ein brandneuer EOA-Private-Key generiert und unter ~/.grip-mcp/agent-key (Modus 0600) gespeichert. Dieser Schlüssel steuert das Smart-Account.
Frage in Claude:
Zeig mir mein Grip-Wallet
Claude ruft grip_wallet auf und antwortet mit deiner Smart-Account-Adresse, dem Guthaben und den Limits. Sende USDC auf Base an diese Adresse, um das Wallet aufzuladen.
Sobald Guthaben vorhanden ist, frage Claude etwa so:
Sende 5 USDC an 0xba14744FfD57FA7d03b20D4c8BeDAaC301E865d1
Claude wird:
grip_create_payment aufrufen, um die Zahlung off-chain vorzubereiten.
Dir die Details (Betrag, Empfänger, Verwendungszweck) anzeigen und um Bestätigung bitten.
Auf deine Antwort warten.
Wenn du „genehmigen“ sagst → grip_settle_payment(token, "approve") aufrufen → wird auf Base ausgeführt.
Wenn du „nein“ sagst → grip_settle_payment(token, "reject") aufrufen → keine On-Chain-Aktion.
Tx-Hash + Basescan-Link werden nach Abschluss zurückgegeben.
Umgebungsvariable | Standard | Was sie tut |
| (automatisch generiert) | Überschreibt den Private-Key des Agenten-Signers. Nützlich, um ein Wallet auf verschiedenen Geräten wiederherzustellen. |
|
| Speicherort des automatisch generierten Schlüssels. |
|
| Maximales USDC pro einzelner Zahlung. |
|
| Maximales USDC über alle Zahlungen pro UTC-Tag. |
Nicht-verwahrt (Non-custodial). Die Grip Foundation verwahrt weder deine Schlüssel, noch deine USDC, noch Aufzeichnungen deiner Zahlungen. Alles läuft auf deinem Rechner.
Verwalteter Paymaster, keine Registrierung. Gas wird in USDC über den Pimlico-Paymaster bezahlt, der über den gehosteten Proxy von Grip geleitet wird. Du benötigst kein Pimlico-Konto.
Human-in-the-loop wird durch das Protokoll erzwungen, nicht durch das Modell. grip_create_payment bereitet nur vor. grip_settle_payment ist ein separater Tool-Aufruf. Die meisten MCP-Clients (einschließlich Claude Desktop) fragen vor der Ausführung von Tool-Aufrufen nach einer menschlichen Bestätigung – das ist eine zweite Sicherheitsebene.
Limits werden serverseitig erzwungen. Selbst wenn das Modell versucht, eine Zahlung über deinem Limit pro Transaktion oder Tageslimit zu tätigen, verweigert der Server die Vorbereitung.
Claude Desktop
│ MCP (stdio)
▼
grip-mcp (this server)
│ @grip-labs/sdk
▼
Grip-managed paymaster proxy → Pimlico bundler → Base mainnet
▲
Coinbase Smart Wallet
(your smart account)Das Smart-Account ist ein Coinbase Smart Wallet (ERC-4337) auf Base. Die erste Zahlung von einem neuen Wallet führt ein einmaliges Bootstrap-UserOp aus, das das Konto bereitstellt und den Paymaster für die USDC-Rückerstattung genehmigt; nachfolgende UserOps werden in USDC bezahlt.
Die erste Zahlung erfordert möglicherweise einen erneuten Versuch. In @grip-labs/sdk@0.4 werden das Bootstrap-UserOp (Bereitstellung + Paymaster-Genehmigung) und das eigentliche Überweisungs-UserOp als zwei separate Vorgänge übermittelt. Es gibt ein kleines Zeitfenster, in dem viems internes getFactoryArgs() veraltetes getCode vom öffentlichen RPC liest, nachdem das Bootstrap beim Pimlico-Bundler abgeschlossen wurde – viem fügt dann initCode in das zweite UserOp ein und der Bundler lehnt es mit AA10 sender already constructed ab.
Wenn deine erste Zahlung mit diesem Fehler fehlschlägt, bitte den Agenten einfach um einen erneuten Versuch. Der erneute Versuch ist erfolgreich, da sich der On-Chain-Status bis dahin verbreitet hat. Nachfolgende Zahlungen vom selben Wallet sind sauber – das Bootstrap läuft höchstens einmal pro Wallet.
Ein Fix erscheint in @grip-labs/sdk@0.5, der Bootstrap + erste Überweisung in ein einzelnes gesponsertes UserOp mittels executeBatch zusammenfasst, wodurch die Race-Condition konstruktionsbedingt eliminiert wird und ca. 30 % Gas bei der ersten Zahlung gespart werden. grip-mcp wird dies in 0.1.1 übernehmen.
MIT
Grip Foundation · offene Identitäts- und Zahlungs-Rails für KI-Agenten.
Stages a payment from the agent's Grip wallet to a recipient. DOES NOT execute on-chain. Returns an approval_token. You MUST then show the payment details (amount, recipient, memo) to the human in plain language and ASK FOR EXPLICIT CONFIRMATION before calling grip_settle_payment. Never auto-approve. The human must say 'approve' (or equivalent) before settling. If they say 'no', call grip_settle_payment with decision='reject'.
| Name | Required | Description | Default |
|---|---|---|---|
| recipient | Yes | ||
| amount_usdc | Yes | ||
| memo | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses that the tool does not execute on-chain, returns an approval_token, and requires a two-step human approval process. This adds significant context beyond annotations (which only indicate non-read-only and non-destructive). No contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, front-loaded with the core purpose, and structured logically: action, caution, required follow-up steps. Every sentence serves a purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite lacking an output schema, the description explains the return value (approval_token) and the complete workflow (stage, confirm, settle/reject). It references sibling tools and provides enough context for a complex, multi-step tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description mentions 'amount, recipient, memo' but does not elaborate on schema constraints like the Ethereum address pattern or USDC amount limits. With 0% schema description coverage, the description adds minimal value over the schema itself.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that this tool stages a payment without executing on-chain, distinguishing it from sibling tools like grip_settle_payment. It specifies the action ('create pending payment') and resource ('agent's Grip wallet to recipient').
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly instructs the agent to never auto-approve, to show payment details to the human, and to ask for explicit confirmation before calling grip_settle_payment. It also covers the rejection case ('If they say 'no', call grip_settle_payment with decision='reject'').
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Returns recent payments (pending, settled, rejected, failed) staged or executed in this MCP session. Read-only. Useful when the human asks 'what have I paid today' or 'what's pending'.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, destructiveHint, and idempotentHint. The description adds 'Read-only' (consistent) and specifies session-scoped payments, which is not in annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences: first states purpose and resource, second gives usage examples. No wasted words, front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple tool (one optional parameter, rich annotations, no output schema), the description covers purpose, scope, and use cases adequately.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage for the limit parameter, and the description does not mention the parameter or add meaning beyond the schema's min/max constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'returns' and the resource 'payments', specifying they are 'staged or executed in this MCP session', which distinguishes it from sibling tools like grip_create_payment.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit usage guidance with examples like 'what have I paid today' or 'what's pending', but does not mention when not to use it or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Executes the on-chain transfer for a previously-staged payment, or marks it as rejected. ONLY call this after the human has explicitly confirmed (or declined) the payment in plain language. If the human has not confirmed, do not call this tool. On approve, this performs a real USDC transfer on Base mainnet via the Pimlico paymaster — it is irreversible.
| Name | Required | Description | Default |
|---|---|---|---|
| approval_token | Yes | ||
| decision | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond annotations (destructiveHint=true, idempotentHint=true), the description adds critical context: 'performs a real USDC transfer on Base mainnet via Pimlico paymaster — it is irreversible'. This fully discloses the irreversible and destructive nature.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences with no wasted words. The first sentence covers the primary action, and subsequent sentences add critical usage guidance and behavioral context. Highly efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's destructive and irreversible nature, the description provides essential context (on-chain transfer, paymaster). However, the lack of parameter detail for 'approval_token' means the agent may lack complete information to use the tool correctly. Minor gap prevents a 5.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description does not adequately explain the 'approval_token' parameter (e.g., format, source). It only mentions 'decision' with enum values, leaving a significant gap for the agent to understand how to obtain or use the approval_token.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it executes an on-chain transfer or marks a payment as rejected, with specific verb 'executes' and resource 'previously-staged payment'. It distinguishes from siblings like grip_create_payment and grip_list_payments by focusing on settlement.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states to call only after human confirmation, with a clear prohibition ('do not call this tool') if not confirmed. This provides excellent guidance on when to use vs. not use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Returns this agent's Grip Pay wallet address (Base mainnet smart account) and current USDC balance. Use this when the human asks about the wallet, where to fund it, how much USDC the agent has, or before suggesting any payment.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, idempotentHint=true, and openWorldHint=true. The description adds behavioral context by detailing the returned data (wallet address and USDC balance), which is valuable beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, consisting of two short sentences. The key purpose is front-loaded, and there is no unnecessary information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of output schema and the simplicity of the tool, the description covers the essential aspects: what it returns and when to use it. It could be slightly improved by mentioning the format of the output, but it is largely complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has no parameters, and the description does not need to add parameter information. The baseline score of 4 is appropriate given 100% schema description coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that the tool returns the agent's wallet address and USDC balance. It uses a specific verb ('Returns') and resource ('wallet info'), and the purpose is distinct from sibling tools which deal with payments.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly lists scenarios when to use the tool: when the human asks about the wallet, where to fund it, how much USDC the agent has, or before suggesting any payment. This provides clear guidance without needing to mention alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.1.0grip_create_paymentgrip_list_paymentsgrip_settle_paymentgrip_walletScored across 4 tools
Each tool has a clear, distinct purpose: creating staged payments, listing payments, settling/rejecting, and checking wallet info. No overlap or ambiguity.
All tools start with 'grip_' and most follow a verb_noun pattern (create_payment, list_payments, settle_payment). The exception is 'grip_wallet', which is a noun phrase, but the inconsistency is minor given the small set.
Four tools is well-scoped for a payment/wallet MCP server. It covers staging, settling, listing, and wallet info without being too few or excessive.
The tool surface covers the core payment workflow: create, settle/reject, list, and wallet info. A potential minor gap is lack of explicit cancellation for staged payments, but the reject option in settle effectively handles that.
Give AI agents a wallet with a spending limit. Non-custodial USDC on Base, server-enforced limits.
Monetization and execution gateway for autonomous AI agents on Base Mainnet
Crypto wallet for AI agents: balances, payments, swaps and trading with owner controls.
Marketplace for AI agents: hire, sell, get paid in USDC on Base. Identity, jobs, reputation.
