spend-guard
This MCP server lets an agent make guarded x402 payments and inspect spending rules/status, but not approve payments or change policy.
pay_and_fetch: fetch an http(s) URL and, on HTTP 402, pay the x402 paywall through Spend Guard if budget, payee allowlist, and price-spike checks pass; flagged payments wait for dashboard approval. Returns HTTP status, payment details, and response body. Redirects are not followed.spending_status: view today's spend vs daily budget, pending approvals, and recent payments with outcomes and reasons.spending_policy: read-only view of allowed networks, daily/per-payment limits, approval threshold, spike ratio, and known services/payees.No tool exists to approve a payment or modify the policy; only the user can approve on the dashboard or change rules.
Supports payments on Circle's Arc testnet via plain USDC transfers and x402 exact EIP-3009 authorizations, with policy checks before anything is signed or sent.
Integrates Circle Gateway nanopayments and Circle developer-controlled wallets for USDC payments, with spending policy checks before authorizations or transfers.
Supports native NEAR transfers on NEAR testnet through Spend Guard's payment policy checks.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@spend-guardfetch this paywalled API URL if it's within my daily budget"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Spend Guard
A spending guard for AI agents that pay for APIs in USDC.

A real run on Arc testnet with x402 exact (node demo/agent.js --arc-x402 --dashboard), trimmed and sped up: the guard refuses a 40x price spike and a swapped payout address before anything is signed, and a $0.30 payment goes out only after a person clicks Approve on the dashboard.
Agents are starting to pay per call over HTTP 402: the server answers 402 Payment Required with a price, the agent pays and gets the data (the x402 protocol). An agent that can pay can also be talked into paying: a prompt injection, a retry loop, or a paywall that raises its price or swaps its payout address. Spend Guard sits between the agent and its money. Every payment is checked against budgets, a payee allowlist and the endpoint's usual price, and anything unusual waits for a person to approve it. All of this happens before any USDC leaves and before any authorization is signed. It pays on Circle's Arc testnet by plain USDC transfer, by x402 exact (EIP-3009) and by Circle Gateway nanopayments, from a local key, and in NEAR on NEAR testnet. A rail for Circle developer-controlled wallets is tested offline only. Claude and other MCP clients can use it as an MCP server.
Status: testnet only, not audited. On npm as @vulinh1704/spend-guard and in the official MCP Registry as io.github.vulinh1704/spend-guard. MIT licensed.
Quickstart (1 minute, no keys)
You need git and Node 22.22.2 or later. No keys and no wallet: the payments are mocked, and nothing leaves your machine after the install.
git clone https://github.com/vulinh1704/spend-guard
cd spend-guard
npm ci
node demo/agent.js # a scripted agent against a demo paywall that turns bad
node demo/agent.js --dashboard # the same run, paced, with the live page on http://localhost:4400With --dashboard, open http://localhost:4400 while it runs. The $0.30 /report waits there for Approve or Deny, and is declined after 120 seconds without an answer. The page stays up until you press Ctrl+C. If 4400 is taken, the demo takes a free port and prints it; DASHBOARD_PORT picks another.
Related MCP server: halowerk-mcp
What it stops
The demo paywall behaves for a few calls and then turns bad. /quotes raises its price 40x, and /maps asks to be paid at a look-alike address. /report stays honest but costs more than the agent may pay without asking. This is the offline demo, node demo/agent.js:
✓ paid $0.01 /weather {"city":"Hanoi","tempC":29,"sky":"clear"}
✓ paid $0.02 /news {"headlines":["Stablecoin volume hits a record","New L2 opens its testnet"]}
✓ paid $0.01 /quotes {"NEAR":2.5,"BCH":450}
✓ paid $0.01 /quotes {"NEAR":2.5,"BCH":450}
✓ paid $0.01 /quotes {"NEAR":2.5,"BCH":450}
✗ denied /quotes $0.40 is 40x the usual $0.01 for 127.0.0.1:33955/quotes; $0.40 is above the $0.25 that needs your approval
✓ paid $0.015 /maps {"route":"Hoan Kiem → My Dinh","km":11.2}
✓ paid $0.015 /maps {"route":"Hoan Kiem → My Dinh","km":11.2}
✗ denied /maps 127.0.0.1:33955 asked to be paid at rnaps.paywall.testnet, which is not one of its known addresses
✓ paid $0.01 /weather {"city":"Hanoi","tempC":29,"sky":"clear"}
? asks you: $0.30 is above the $0.25 that needs your approval → no
✗ declined /report $0.30 is above the $0.25 that needs your approval
spent today $0.10 of $1.00; 3 payments stoppedThe same run on Arc testnet with x402 exact (node demo/agent.js --arc-x402, 31 Oct 2026) paid in real test USDC. The agent only signed. The paywall settled each signature on chain and paid the gas, so the agent's balance fell by exactly the $0.10 it spent:
agent 0xBbc0B612C19beA521D2eA1Ad7dfEe91D23753244 · Arc testnet (USDC) · x402 v2 exact, EIP-3009
✓ paid $0.01 /weather … https://testnet.arcscan.app/tx/0x92414aea1d896cd7ebd032c85ca32a84764d743931e61f4474a92f434a61fae3
✗ denied /maps … asked to be paid at 0xF870cC7D7c258Cc856197fB6C3C819AD6Bb324b5, which is not one of its known addresses
agent wallet $17.999436 → $17.899436 USDC (-$0.10)Rule | What it catches |
A per-payment limit, a daily budget and a per-call cap for each service | overpriced calls; a loop's total stops at the daily budget |
Payee allowlist per service | a paywall that starts asking to be paid somewhere else |
Price spike against the endpoint's usual price | a sudden 5x, 40x, 1000x |
Human approval above a threshold, or for an unknown service | large payments, a payment to a host the policy doesn't list, such as one an injected page pointed the agent to |
One decision at a time (with a ledger file, across processes too) | parallel tool calls racing the daily budget |
Every decision, paid or not, is recorded with its reasons. The rules and their exact messages are in docs/policy.md.
How it works
agent ── payingFetch(url) ──► paywall: 402 + offer (PAYMENT-REQUIRED)
│
▼
Guard ── policy: budgets, payees, usual price ── ledger
│ └─ flagged? ask the person on the dashboard
▼
Rail ── USDC transfer · EIP-3009 signature · Gateway authorization · Circle wallet
│
payingFetch ──► paywall: PAYMENT-SIGNATURE ──► 200 + data + PAYMENT-RESPONSE (settlement)The guard decides before a rail moves money or signs anything. A rail that signs uses the payee and amount the guard approved, never the paywall's own numbers, and it pins the chain and token it signs for. More in docs/architecture.md.
Rails
Rail | How the agent pays | Status |
Arc USDC transfer ( | ERC-20 | Works on Arc testnet, for example this payment. |
x402 | Signs an EIP-3009 | Works on Arc testnet. The demo paywall is its own settler. |
Circle Gateway ( | Signs a Gateway authorization against USDC deposited once in Circle's Gateway Wallet. Circle settles the payments in batches. | Works on Arc testnet, with no Circle account or API key. One earlier run's payments landed in one batch transaction. |
Circle Wallets | A Circle developer-controlled wallet transfers or signs, so no private key sits in the agent's process. | Tested offline against Circle's SDK. Not run against Circle yet, because it needs your Circle account (setup). |
NEAR testnet ( | Native NEAR transfer. | Works on NEAR testnet. |
Mock | Nothing moves. | Tests and the offline demo. |
Bitcoin Cash, Concordium | Planned. |
Details for each rail are in docs/rails.md.
x402 v2 and the exact scheme (EIP-3009)
payingFetch speaks x402 v2. It reads the offer from the PAYMENT-REQUIRED header, and still reads v1 JSON bodies. For an exact offer in USDC on Arc that names the token's EIP-712 domain, the agent signs a transferWithAuthorization and sends no transaction. The signature is the payment, so the guard decides first and counts it as spent when it is signed. Each signature is for the approved payee and amount only, has a fresh random nonce, and is valid for at most 120 seconds. Offers for another chain (the same key works on Arc mainnet), another token, or Permit2 and escrow flows are refused before anything is signed, with the reason.
node scripts/arc-testnet-wallet.js # agent key and demo payees in .env; fund the agent at https://faucet.circle.com (Arc Testnet)
node scripts/arc-facilitator.js # the demo paywall's settling key, topped up with a little test USDC for gas
node demo/agent.js --arc-x402 --dashboardCircle Gateway nanopayments
The agent deposits USDC into Circle's Gateway Wallet once. After that each call is an off-chain authorization: no gas and no transaction per call, so a $0.01 call costs $0.01. Circle settles the payments on Arc in batches a few minutes later. A Gateway authorization stays valid for at least 7 days, so the guard decides before it is signed. The rail also signs nothing the deposit can't cover, counting what is signed but not settled yet.
node scripts/gateway-deposit.js 1 # approve and deposit 1 test USDC (two Arc transactions)
node demo/agent.js --gateway --dashboard # nanopayments to an x402 v2 seller that settles each one with Circle
node scripts/gateway-status.js # Gateway balance, and each payment's batch transaction on ArcCircle Wallets
With CircleWalletRail, Circle holds the key (MPC) and signs when asked. The agent's process has a testnet API key and an entity secret, but no private key, and Spend Guard still checks every payment before Circle is asked to send or sign. Circle's own controls (custody, screening, DENIED) still apply after the guard says yes. docs/circle-wallets.md explains the setup, which needs your own Circle developer account, and how the two layers fit together.
Use it from Claude or any MCP client
spend-guard mcp serves the guard over stdio and gives an MCP client three tools:
pay_and_fetchfetches a URL and pays its x402 paywall through the guard.spending_statusandspending_policyare read-only views of the budget, recent payments and the rules.
There is no tool to approve a payment or to change the policy. Payments the policy flags wait for you on the dashboard. They are declined after 55 seconds without an answer, and a call the client cancels never pays.
The config goes in .mcp.json (Claude Code, project scope) or claude_desktop_config.json (Claude Desktop). Cursor and other clients take the same mcpServers shape.
From npm. The default mock rail pays nothing, so this is a safe first try:
{
"mcpServers": {
"spend-guard": {
"command": "npx",
"args": ["-y", "@vulinh1704/spend-guard", "mcp"],
"env": { "SPEND_GUARD_POLICY": "/abs/path/policy.json" }
}
}
}The mock rail pretends to pay on near-testnet, so this policy must allow that network: list "networks": ["near-testnet"], or leave networks out and the server allows the networks of the rails it runs. A policy that lists only Arc networks leaves the mock rail nothing it may pay. To have something to pay, run the demo paywall from a clone, node demo/paid-api.js, and ask the agent to fetch http://localhost:4402/weather. demo/mcp-policy.json is a mock policy that knows its payees.
From a clone, and for the rails that pay. Node reads the keys from .env with --env-file, which npx can't pass on, so they stay out of the client's config:
{
"mcpServers": {
"spend-guard": {
"command": "node",
"args": ["--env-file=/abs/path/spend-guard/.env", "/abs/path/spend-guard/bin/spend-guard.js", "mcp"],
"env": { "SPEND_GUARD_POLICY": "/abs/path/policy.json", "SPEND_GUARD_RAILS": "arc,gateway" }
}
}
}Or in Claude Code: claude mcp add spend-guard -- npx -y @vulinh1704/spend-guard mcp, or from a clone claude mcp add spend-guard --env SPEND_GUARD_POLICY=/abs/path/policy.json --env SPEND_GUARD_RAILS=arc -- node --env-file=/abs/path/spend-guard/.env /abs/path/spend-guard/bin/spend-guard.js mcp
A policy.json for the arc,gateway config. Its networks are the ones those two rails pay on; with other rails, list theirs or leave networks out:
{ "networks": ["arc-testnet", "arc-testnet-gateway"], "dailyUsd": 1, "perPaymentUsd": 0.5, "askAboveUsd": 0.25, "spikeRatio": 5, "unknownService": "ask",
"services": { "api.example.com": { "payTo": ["0xPayeeAddress"], "maxUsd": 0.1 } } }Variable | Meaning |
|
|
| the policy file. Without one, every service is unknown, so every payment asks you. Without |
| decisions file, read back on start, so a restart keeps today's spend. Servers on one file share one budget. Default |
| dashboard port on 127.0.0.1, default 4400; |
| seconds a payment waits for you (default 55). Raise it together with your client's tool timeout. |
| the network the |
| for |
| for |
Keys come from .env through --env-file and never go in the client's config. Run the paying agent without shell or browser tools: with them it could read .env, or press Approve itself.
Try it without a model: node scripts/mcp-demo.js (mock), or node scripts/mcp-demo.js --arc (real test USDC on Arc).
Approve on the dashboard

The dashboard is a live page on http://localhost:4400. It shows the budget, every decision with its reasons and a link to its transaction, and an Approve or Deny card with a countdown for each flagged payment. It listens on 127.0.0.1 only and answers to localhost names only, and an approval is accepted only from the page itself (same Origin, loopback peer, JSON body). It has light and dark themes and a responsive layout (it answers on localhost only, so approving from a phone is on the roadmap), and is checked with Mantis (scripts/check-dashboard.sh: 0 errors and 0 warnings on mobile and desktop, light and dark).
node demo/agent.js --dashboard # the offline demo, paced for watching; /report waits for your answerInstall and test
npm ci
npm test # 189 tests, offline: no network, no keys
node demo/agent.js # offline demo, mock paymentsYou need Node 22.22.2 or later, because near-api-js 7 does (Circle's SDK needs Node 22). The testnet demos read keys from .env, which is git-ignored, and the setup scripts write them there. Testnet tokens have no value. Never point the scripts at mainnet.
Demo | Needs |
|
|
| the above, plus |
| the above, plus |
|
|
Add --dashboard to any of them to watch on the live page.
Use it as a library
import { Guard, payingFetch } from '@vulinh1704/spend-guard';
import { ArcRail } from '@vulinh1704/spend-guard/rails/arc';
import { GatewayRail } from '@vulinh1704/spend-guard/rails/gateway';
const guard = new Guard({
policy: {
networks: ['arc-testnet', 'arc-testnet-gateway'],
dailyUsd: 5, perPaymentUsd: 1, askAboveUsd: 0.25, spikeRatio: 5, unknownService: 'ask',
services: { 'api.example.com': { payTo: ['0xPayeeAddress'], maxUsd: 0.5 } },
},
rails: [new ArcRail({ privateKey: process.env.ARC_PRIVATE_KEY }), new GatewayRail({ privateKey: process.env.ARC_PRIVATE_KEY })],
approve: async (intent, verdict) => askTheHuman(verdict.reasons), // never the model
});
const res = await payingFetch(guard, 'https://api.example.com/data'); // pays a 402 through the guardpayingFetch throws GuardRefused with the reasons when the guard says no. Approvals is the queue the dashboard and the MCP server use for approve. Install it with npm install @vulinh1704/spend-guard (Node 22.22.2 or later).
Docs
Architecture: one paid request, step by step.
Policy reference: every field, rule and message.
Rails: each rail, what the paywall checks, and how to write one.
Circle Wallets: setup, and Circle's controls next to the guard's.
Threat model: what it stops, what it can't, and the known gaps.
Publishing: releasing to npm and the MCP Registry.
Roadmap
Not built yet. This is the order I plan to build them in:
Circle Wallets live. Run the rail against Circle's testnet with a developer account, then offer it in the MCP server, so an agent pays from a wallet whose key never leaves Circle.
Settle through Circle instead of my own settler. Use Circle's facilitator for x402
exacton Arc where it is available, and Gateway on more chains from the same deposit.Close the known gaps. Count gas in the budgets, keep Gateway's unsettled count across restarts, and accept smart-wallet payers (ERC-1271), such as Circle SCA wallets, whose gas Circle's Gas Station can sponsor.
A hosted policy and approvals page for teams.
Mainnet, only after an external review of the guard and the rails.
License
MIT
Available Tools
3 toolspay_and_fetchFetch, paying the paywall if there is oneADestructive
Fetch a URL and, if it answers HTTP 402 (an x402 paywall), pay it through the user's Spend Guard. The payment goes out only if it fits the user's budget, goes to an address the service is known to use and is not a price spike; larger payments and unknown services wait for the user to approve them on the dashboard. Returns the HTTP status, what was paid (amount, payee, transaction) and the response body. Redirects are not followed. A refused payment is final: tell the user what was refused and why, and do not try to pay another way.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | The http(s) URL to fetch. | |
| body | No | Request body, for POST, PUT and PATCH. | |
| method | No | Default GET. | |
| headers | No | Extra request headers, e.g. {"accept": "application/json"}. Payment, cookie and origin headers are set by the guard or dropped. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare this is an open-world, non-idempotent, destructive (spending) operation, and the description adds substantial context beyond that: the budget/payee/price-spike gating logic, the human-approval escalation, the finality of a refused payment, and the no-redirect behavior. It also describes the return payload, which matters since there is no output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose and the 402-payment mechanic are front-loaded, followed by the decision rules, then the return shape and constraints. Every sentence carries distinct operational information with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 4-parameter tool with no output schema, the description covers the full behavioral picture an agent needs: what triggers payment, when a human must approve, what is returned, and how to handle a refusal. Annotations handle the safety profile and the schema handles parameters, so nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and each parameter (url, method, body, headers) is documented in the schema, including the guard dropping payment/cookie/origin headers. The description adds essentially no per-parameter detail, so the baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb (fetch) and resource (URL) and adds the distinguishing twist: it transparently handles HTTP 402 paywalls via the Spend Guard. This is clearly separable from the spending_status and spending_policy siblings, which report on or configure spending rather than performing a fetch-and-pay.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit conditions for when payment proceeds automatically (within budget, known payee, no price spike) versus when it waits for dashboard approval (larger payments, unknown services), and states that redirects are not followed and a refusal must not be worked around. It does not name the sibling tools as alternatives or say when to prefer spending_status/policy first, so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
spending_policySpending rulesARead-only
The rules the guard enforces: the networks it can pay on, the daily and per-payment limits, the amount above which the user approves, the price-spike ratio, and the known services with the addresses they may be paid at. Read only: only the user can change them.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered; the description adds that the rules are user-mutable only, meaning there is no write path here and the agent should not look for one. It also discloses the field-level shape of the returned configuration, which annotations cannot express.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the resource definition, followed by the read-only constraint. The middle enumeration is dense but each item earns its place by telling the agent what data is available without an output schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no parameters and no output schema, the description carries the burden of describing the return shape, and it does so by listing the rule categories an agent can expect. What is missing is only a hint about when to consult it versus spending_status.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline is 4; there is nothing for the description to disambiguate. It correctly spends no words on arguments.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific noun-resource ('the rules the guard enforces') and then enumerates exactly what those rules cover: payable networks, daily/per-payment limits, approval threshold, price-spike ratio, and allowed services/addresses. An agent can tell this is a configuration/policy read rather than a live status or a payment action, though it never names the siblings it differs from.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: the content list hints the agent should read this before deciding whether a payment is permissible, but there is no explicit 'use this when...' clause and no discussion of spending_status or pay_and_fetch as alternatives. 'Read only: only the user can change them' is a constraint, not routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
spending_statusSpending so farARead-only
What has been spent today against the user's daily budget, payments waiting for the user's approval, and the latest payments with their outcome (paid, denied, declined or failed) and every reason. Check it before a series of paid calls.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | How many recent payments to list. Default 10. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true, so the safety profile is covered; the description adds substantive value by enumerating exactly what content comes back (budget consumption, pending approvals, per-payment outcome and reasons). Remainder: no mention of how much data defaults to or error behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with what is returned and closing with the when-to-call cue. Slightly dense enumeration but no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, so the description must explain return content – and it does, itemizing the three data groups and payment outcome values. Sufficient to call confidently; a note on default result size (implied by schema) or freshness would complete it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Single optional param with 100% schema coverage (limit, default 10, max 50). The description says nothing the schema doesn't already state, so the baseline 3 holds.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific resource and clear breakdown of the three things returned: today's spend against daily budget, pending approvals, and latest payment outcomes with reasons. Distinct from siblings pay_and_fetch (action) and spending_policy (rules) without needing to open a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a concrete trigger: 'Check it before a series of paid calls.' Doesn't explicitly contrast with spending_policy or say when not to call, but the pre-flight guidance is actionable and clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
3 tool updates
v0.1.0- First observed
pay_and_fetch - First observed
spending_policy - First observed
spending_status
TDQS
Scored across 3 tools
Each tool has a clearly distinct purpose: one performs fetch-and-pay, one reports spending state, and one describes policy. There is no overlap in action or resource, so an agent can easily pick the right tool.
Names are readable but use mixed conventions: pay_and_fetch is verb_and_verb while spending_status and spending_policy are noun phrases. The shared spending_ prefix helps, but the set does not follow a predictable verb_noun pattern.
Three tools is slightly thin but well matched to a narrow spend-guard purpose. Each tool earns its place, though a few more operations could be reasonable.
The surface covers the core lifecycle: paying via fetch, checking budget/status, and reading enforced policy. Minor gaps exist around explicit history or approval workflows, but these are intentionally left to the user dashboard.
Maintenance
Related MCP Connectors
Pay-per-action access to APIs and MCP tools over Lightning L402 and Base USDC x402.
Pay for APIs with USDC. Read-only x402 payment discovery, verification, evidence, and status.
Discover machine-payable APIs, probe x402 payment terms, and run seller operations. Non-custodial.
x402 MCP with exact and batched payments for recurring wallet, trading, market and web workflows.
Related MCP Servers
- AlicenseAqualityFmaintenanceEnables MCP clients to access all endpoints of an x402 gateway by paying real-time microtransactions (USDC on Base) per API call, with automatic tool discovery and spend guardrails.2352 npmMIT

halowerk-mcpofficial
AlicenseAqualityFmaintenanceProvides access to 70 paid APIs as MCP tools with per-call and session budgets, paying via x402/USDC on Base without requiring an account or login. Includes a built-in allowlist of hosts and safe defaults to prevent unintended payments.1472 npmMIT- AlicenseNot gradedqualityAmaintenanceEnables existing MCP clients to access paid MCP servers by signing x402 payments locally and proxying tool calls, with automatic line management, retries, and spend limits.379 npmApache 2.0

@vapi-network/mcpofficial
AlicenseNot gradedqualityBmaintenanceLets MCP clients discover x402 APIs, pay for calls from a local non-custodial wallet, and inspect balances and payment receipts.11Apache 2.0