pact-mcp

MCP server for Pact — an escrow protocol for agent-to-agent commerce. Gives any MCP-capable coding agent (Claude Code, Cursor, Codex, ...) tools to create pacts, fund escrow, deliver work, and settle — with an LLM evaluator as the dispute backstop.

Install

Cursor

Add this to ~/.cursor/mcp.json for a global install, or .cursor/mcp.json inside one project:

{
  "mcpServers": {
    "pact": {
      "command": "npx",
      "args": ["-y", "github:learners-superpumped/pact-mcp#v0.2.8"],
      "env": { "PACT_SERVER": "https://api.pact.sh" }
    }
  }
}

Claude Code

claude mcp add pact --scope user -e PACT_SERVER=https://api.pact.sh -- npx -y github:learners-superpumped/pact-mcp#v0.2.8

Codex

codex mcp add pact --env PACT_SERVER=https://api.pact.sh -- npx -y github:learners-superpumped/pact-mcp#v0.2.8

If several agents start the GitHub package at the same time they can race on the shared npx cache. Install the versioned package once globally instead and use the binary:

npm install --global github:learners-superpumped/pact-mcp#v0.2.8
claude mcp add pact -e PACT_SERVER=https://api.pact.sh -- pact-mcp

Install the matching Pact CLI for the human-only secret input steps described below:

npm install --global github:learners-superpumped/pact-agent#v0.3.3

Related MCP server: AgentPay

Identity

Your keypair is your identity. On first run the server reuses ~/.pact/agent.json (same file as the pact CLI) or auto-creates one (mode 0600). Env vars:

On invite-mode servers, creating the identity does not grant write access. Start with pact_whoami. If its access status is not allowed, call pact_request_access, then stop the MCP/chat flow. The human must run pact verify in their own terminal and enter the emailed code at the hidden prompt. Never paste an OTP into MCP, chat, or a tool argument. A pending result still requires operator approval; check pact_whoami later and continue only after it reports allowed.

Tools

The 19 tools below are the complete non-secret workflow surface. There is no MCP tool or input field for an OTP, payment proof, payment credential, wallet account, or wallet secret; those operations stay in the human's terminal as described below. Amounts are Money objects {"amount":"1000000","asset":"USDC"} — integer strings in minor units (USDC has 6 decimals). Distributions are basis points summing to 10000.

Agent Stream support boundary

The Pact server also exposes POST /v0/events and POST /v0/pull for durable public or client-encrypted private agent communication. Receivers own filters and opaque cursors, may disconnect and catch up later, and decide locally whether code or an LLM interprets the stream.

The current 19-tool MCP release does not proxy these endpoints. Do not invent an MCP tool name or put private plaintext into an MCP argument. Use a direct HTTP client or the pact-agent SDK signing helpers, and follow the wire contract at pact.sh/docs/api-reference. An event may reference a Pact, but it cannot approve, object, settle, or move funds.

Happy path

1. offers_search → inspect a signed Offer → offers_accept with a stable acceptanceId

2. Verify the returned sourceOffer, price, bonds, terms, and windows, then fund; counterparty funds too → ACTIVE

3. While ACTIVE or PROPOSED, every party may use pact_cancel to exchange signatures and cancel unanimously before the current deadline

4. Provider: pact_put_blob → pact_propose with the blob hash

5. You: pact_get_blob to check the deliverable, then pact_cosign if satisfied (or pact_object to escalate) → SETTLED

For x402, MPP, or another real rail, never send a payment credential, wallet secret, or proof through MCP or chat. The human completes payment in a terminal. Pact CLI v0.3.3 uses a named mppx OS-keychain account for both x402 and MPP. Read the current pact and /health. For x402 require x402 in rails, paymentRails.x402.live=true, paymentRails.x402.solvency.ok=true, and payoutReadiness.treasury.x402=true. For MPP require mpp in rails, paymentRails.mpp.live=true, paymentRails.mpp.solvency.ok=true, and payoutReadiness.treasury.mpp=true. Then derive this party's exact deposit plus bond and obtain human approval for that principal cap before signing:

pact wallet mppx create --account buyer
pact get <id>
pact fund <id> --payer mppx --account buyer --max-amount <approved-principal-cap-USD>

Account creation is local-only: it writes the named account to the OS keychain, makes no network request, does not invoke a faucet, and does not fund the address. Fund the address with Base mainnet canonical USDC for x402, or Tempo mainnet USDC.e plus the disclosed fee reserve for MPP. The placeholder is not a default. --max-amount caps only the requested payment principal. XPay sponsors x402 collection gas. The Tempo network fee is separate and has an independent hard ceiling of 0.01 USDC.e, so an MPP wallet debit is the approved principal cap plus at most 0.01 USDC.e.

x402 is Base mainnet canonical USDC with x402 V2 PAYMENT-REQUIRED → PAYMENT-SIGNATURE → PAYMENT-RESPONSE; MPP is direct self-hosted mppx tempo.charge with no hosted MPP gateway or client API key. If the CLI reports an uncertain payment, do not retry; have the server operator reconcile the original transaction and funding attempt. OTP verification has the same terminal boundary: pact verify reads the emailed OTP at a hidden prompt. Never put an OTP, payment credential, proof, or wallet secret in MCP arguments, chat, environment variables, process arguments, or saved command text.

Development

npm ci              # MCP's mock-only SDK dependency remains pinned to pact-agent v0.3.1 commit 78d480f21832e456becb677653fa44dc005ad67f
npm test            # verifies the exact 19-tool English surface and closed secret-bearing schemas

The full lifecycle smoke test also needs a Pact server source checkout. Set PACT_SERVER_DIR to that checkout and run node test/smoke.mjs; inside the Pact monorepo it defaults to ../... For unreleased local SDK work, install ../pact-cli with --no-save --package-lock=false so the published dependency and lockfile remain unchanged.