Skip to main content
Glama

@privadovpn/x402-mcp

Local stdio MCP server that signs and broadcasts x402 USDC payments (Solana, EVM) to buy PrivadoVPN access.

npm version CI license MCP registry

Security model

This server signs payments locally and never transmits your private key anywhere.

  • SOLANA_PRIVATE_KEY and EVM_PRIVATE_KEY are read from local process environment variables. They are used only to sign transactions in-process and are never sent over the network or written to disk by this server.

  • The only data that leaves the machine is a signed payment authorization (EVM EIP-3009) or a broadcast transaction signature (Solana), sent to X402_BASE_URL to fulfill a purchase.

  • Use a dedicated, low-balance wallet for this server — never point it at a primary or high-balance wallet.

  • wallet_status returns configured addresses and network selection only. It never returns private keys or any secret material.

  • Credentials returned after a successful purchase are written only to ~/.privado/ on your local machine.

Related MCP server: agentmetal/mcp

Quick start

npx -y @privadovpn/x402-mcp

Claude Desktop (claude_desktop_config.json):

{
  "mcpServers": {
    "privadovpn-x402-mcp": {
      "command": "npx",
      "args": ["-y", "@privadovpn/x402-mcp"],
      "env": {
        "SOLANA_PRIVATE_KEY": "<your-base58-key>"
      }
    }
  }
}

Claude Code:

claude mcp add privadovpn-x402-mcp -e SOLANA_PRIVATE_KEY=<your-base58-key> -- npx -y @privadovpn/x402-mcp

Cursor (.cursor/mcp.json):

{
  "mcpServers": {
    "privadovpn-x402-mcp": {
      "command": "npx",
      "args": ["-y", "@privadovpn/x402-mcp"],
      "env": {
        "SOLANA_PRIVATE_KEY": "<your-base58-key>"
      }
    }
  }
}

Configuration

Variable

Required

Default

Description

SOLANA_PRIVATE_KEY

At least one of SOLANA_PRIVATE_KEY / EVM_PRIVATE_KEY

—

Base58-encoded Solana secret key (32 or 64 bytes) used to sign and pay in SPL USDC.

EVM_PRIVATE_KEY

At least one of SOLANA_PRIVATE_KEY / EVM_PRIVATE_KEY

—

Hex-encoded EVM private key used to sign EIP-3009 USDC authorizations.

PREFERRED_NETWORK

No

solana if SOLANA_PRIVATE_KEY is set, else evm

Which network to prefer when a quote offers both. Accepts solana or evm (eip155 is an accepted alias for evm).

X402_BASE_URL

No

https://x402.privadovpn.com

Base URL of the x402 payment backend used for catalog, quote, and fulfillment requests.

SOLANA_RPC_URL

No

https://api.mainnet-beta.solana.com

Solana RPC endpoint used to check balances and broadcast transactions.

EVM_RPC_URL

Required for EVM payments

—

EVM RPC endpoint used to check balances and broadcast transactions.

Tools

Tool

Purpose

wallet_status

Show configured wallet addresses and network selection. Never returns private keys.

list_vpn_catalog

List purchasable VPN plans and supported server country codes.

buy_vpn

Preferred purchase flow: quote, sign and pay on-chain, fulfill, and save credentials in one call.

fulfill_payment

Recovery only: exchange an already-broadcast payment for VPN credentials.

sign_and_pay

Debug only: sign and broadcast payment without fulfilling. Prefer buy_vpn.

Purchase flow and recovery

Each GET /pay request creates a new invoice on the server. Because of this, buy_vpn must be called exactly once per purchase attempt — calling it again after funds have already been sent creates a second invoice and results in a duplicate charge.

If buy_vpn reports that the on-chain payment succeeded but fulfillment failed (for example, due to a network error when exchanging the payment for credentials), do not call buy_vpn again. Instead call fulfill_payment with the plan, invoice_no, payment_signature, and settlement_tx values from the error. This exchanges the already-completed payment for credentials without creating a new invoice or sending additional funds.

buy_vpn and sign_and_pay both accept a dry_run flag that performs balance checks without broadcasting a transaction. Note that a dry run still creates a real invoice on the server; it does not need to be followed by a real purchase, but it should not be repeated for the same purchase attempt.

How it works

sequenceDiagram
    participant Agent
    participant MCP as Local MCP (this server)
    participant Backend as x402.privadovpn.com

    Agent->>MCP: buy_vpn(plan, country)
    MCP->>Backend: GET /pay?plan=...
    Backend-->>MCP: 402 Payment Required + quote (accepts[])
    MCP->>MCP: sign payment locally (private key never leaves process)
    MCP->>Backend: broadcast transaction on-chain
    Backend-->>MCP: transaction confirmed
    MCP->>Backend: GET /pay (PAYMENT-SIGNATURE, X-Settlement-Transaction)
    Backend-->>MCP: VPN credentials
    MCP-->>Agent: credentials + settlement_tx + credentials_path

Supported networks: Solana (SPL USDC transfer) and EVM (EIP-3009 transferWithAuthorization USDC).

Server-side discovery

  • Catalog and payment discovery: https://x402.privadovpn.com/.well-known/x402-payment

  • Agent-readable service description: https://x402.privadovpn.com/llms.txt

  • Remote MCP (catalog/docs only, no wallet access): https://x402.privadovpn.com/mcp

Development

git clone git@github.com:privadovpn/x402-mcp.git
cd x402-mcp
npm install
npm run build
npm test

Run with the MCP Inspector:

npx @modelcontextprotocol/inspector node dist/index.js

License

MIT. See LICENSE.

mcp-name: io.github.privadovpn/x402-mcp

Available Tools

5 tools
buy_vpnA

PREFERRED. Buy VPN in one call: quote → pay on-chain → fulfill → save credentials. Call ONCE per purchase. Do not use curl/shell against /pay. Do not call dry_run then buy again (each quote creates a new invoice). If this errors after payment, call fulfill_payment with the recovery fields from the error — never retry buy_vpn.

ParametersJSON Schema
NameRequiredDescriptionDefault
planYes
countryNo
dry_runNo
networkNo

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses the end-to-end side effects (on-chain payment, credential saving), the idempotency constraint (each quote creates a new invoice), and the precise recovery path via fulfill_payment. It omits auth requirements, rate limits, and return format, leaving some behavioral gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Highly front-loaded ('PREFERRED.' plus the workflow) and every sentence carries distinct operational weight — constraints, sequencing, and recovery are all packed without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no annotations and no output schema, the description covers the critical operational context well: purchase flow, idempotency, and error recovery. It falls short on documenting the four input parameters, which an agent still needs to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for 4 parameters, so the description must compensate but largely does not. It only alludes to dry_run's semantics via the 'do not call dry_run then buy again' warning and says nothing about plan, country, or network formats.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Buy VPN in one call') and enumerates the full internal pipeline (quote → pay on-chain → fulfill → save credentials). It clearly distinguishes itself from siblings by referencing fulfill_payment and the dry_run path, so an agent can route without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when/when-not guidance: call ONCE per purchase, do not use curl/shell against /pay, do not dry_run then buy again, and if it errors after payment use fulfill_payment instead. It names the alternative tool and the exact condition selecting it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fulfill_paymentA

Recovery only: exchange an already-broadcast payment for VPN credentials. Requires plan, invoice_no, payment_signature, settlement_tx from a prior buy_vpn/sign_and_pay. Does not create a new invoice or send money. Use when fulfill failed after payment — never call buy_vpn again.

ParametersJSON Schema
NameRequiredDescriptionDefault
planYes
countryNo
invoice_noYes
settlement_txYes
payment_signatureYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden and does well: it declares the tool does not create an invoice or send money (non-destructive, idempotent-looking recovery), and requires artifacts from a prior call. It doesn't state auth requirements or what happens if the inputs are stale/invalid, so a small gap remains.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, tightly front-loaded with the 'Recovery only' scope before the requirements and the negative guidance. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No annotations and no output schema, so the description must stand alone; it covers purpose, prerequisites, and exclusions well. It stops short of describing what the returned VPN credentials look like or how errors/failed recovery are surfaced, and it ignores the optional country field.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it does partially: it names the four required parameters and tells the agent where they come from (prior buy_vpn/sign_and_pay). It adds no format or validation detail for invoice_no, payment_signature, settlement_tx, and never mentions the optional 'country' parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (exchange) and resource (already-broadcast payment → VPN credentials) plus an explicit scope qualifier ('Recovery only'). It also distinguishes itself from siblings by naming buy_vpn/sign_and_pay as the source of the required inputs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use it ('when fulfill failed after payment') and when not to ('never call buy_vpn again', 'does not create a new invoice or send money'). The alternative is named and the triggering condition is given, leaving nothing to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_vpn_catalogA

List purchasable VPN plans (id, USD price, duration) and supported server country codes from X402_BASE_URL discovery.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It usefully discloses the data source ('X402_BASE_URL discovery') and that the result is a list of purchasable items, implying a safe read, but it says nothing about auth requirements, rate limits, caching, or failure modes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One dense sentence, front-loaded with the verb and the primary resource, with the returned fields tucked into a compact parenthetical. Nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and no parameters, the description compensates well by enumerating the return contents (id, USD price, duration, country codes). It is close to complete for a simple discovery call, though auth/access expectations for the X402_BASE_URL endpoint remain unstated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema declares zero parameters, so there is no parameter semantics to convey and the baseline of 4 applies. The description correctly signals a no-argument call.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb ('List') plus a precisely scoped resource ('purchasable VPN plans ... and supported server country codes'), and even names the fields returned. This is clearly distinguishable from the write/payment siblings (buy_vpn, sign_and_pay) without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: an agent can infer this is the pre-purchase discovery call, especially given the buy_vpn sibling, but the description never says when to call it or that it precedes a purchase. No alternatives or exclusions are named.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sign_and_payA

DEBUG ONLY. Broadcasts on-chain payment and returns payment_signature + settlement_tx but does NOT fetch VPN credentials. Prefer buy_vpn. If you use this, you MUST next call fulfill_payment with the same invoice_no — never curl /pay and never call buy_vpn again (double charge).

ParametersJSON Schema
NameRequiredDescriptionDefault
acceptsYes
dry_runNo
networkNo

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden and does so well: it discloses the irreversible side effect (real on-chain broadcast), the missing outcome (no VPN credentials fetched), the required follow-up call, and the double-charge failure mode. These are precisely the behavioral traits an agent cannot infer from the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences, warning first, recommendation second, mandatory follow-up third. No filler, and the highest-risk information (DEBUG ONLY, double charge) is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description usefully names the returns (payment_signature, settlement_tx) and the required continuation, which is the critical path context for a payment tool. The remaining gap is parameter-level detail for a 0%-coverage schema, notably dry_run.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the description only indirectly touches one parameter, the invoice_no that must be reused in fulfill_payment. The nested 'accepts' array structure, dry_run, and network are not explained anywhere, so the description only partially compensates for the coverage gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Broadcasts on-chain payment') plus concrete return values, and immediately marks it as DEBUG ONLY, which distinguishes it from the sibling buy_vpn. An agent can tell what it does and what it is not for without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit routing: 'Prefer buy_vpn', plus a mandatory next step ('you MUST next call fulfill_payment with the same invoice_no') and two named prohibitions (never curl /pay, never call buy_vpn again due to double charge). This is exactly the when/when-not/alternatives guidance the dimension asks for.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

wallet_statusA

Show which wallets are configured (addresses only, never private keys).

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It does disclose one meaningful behavioral trait (addresses only, never private keys), which signals a safe read, but says nothing about permissions, what happens when no wallets are configured, or any limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence with no filler, front-loading the verb and resource and appending the one detail worth knowing (no private keys). Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple zero-param read tool with no output schema, the description states what is returned at a high level (configured wallet addresses) and removes the obvious security ambiguity. It could say a bit more about the return shape or the empty-configuration case, but it is essentially complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is nothing for the description to disambiguate beyond what the empty schema already shows. Baseline 4 for a parameterless tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a concrete verb+resource ("Show which wallets are configured") and adds a scope qualifier about what is and isn't returned. It is clearly distinguishable from the payment/VPN siblings, though it does not name them explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: an agent would call this to inspect configured wallets. There is no statement of when to use it versus alternatives, nor any prerequisites or exclusions, so it sits at minimum viable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 5 tool updatesv1.0.0
    • First observedbuy_vpn
    • First observedfulfill_payment
    • First observedlist_vpn_catalog
    • First observedsign_and_pay
    • First observedwallet_status

TDQS

A4/5.0

Scored across 5 tools

Disambiguation3/5

Three of the five tools (sign_and_pay, buy_vpn, fulfill_payment) operate in the same payment territory and could plausibly be misselected. The descriptions work hard to draw boundaries (DEBUG ONLY, PREFERRED, recovery only), so overlap exists but is mitigated by explicit guidance.

Naming Consistency4/5

All names use snake_case, and most follow a verb_noun pattern (list_vpn_catalog, buy_vpn, fulfill_payment). Minor deviations like wallet_status (noun-based) and sign_and_pay (verb_and_verb) keep it from being perfectly uniform.

Tool Count5/5

Five tools is well-scoped for a VPN purchase flow: discovery, wallet check, purchase, and recovery. Each tool earns its place with no filler.

Completeness4/5

The surface covers catalog discovery, wallet status, purchasing, and payment recovery, giving a full purchase lifecycle. Minor gaps remain (e.g., no way to list saved credentials or view past purchases), but core workflows are covered.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers