x402-mcp
Enables signing and broadcasting x402 USDC payments on the Solana network (SPL USDC transfer) to purchase PrivadoVPN access.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@x402-mcpbuy a 1-month VPN plan with USDC and save the credentials"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
@privadovpn/x402-mcp
Local stdio MCP server that signs and broadcasts x402 USDC payments (Solana, EVM) to buy PrivadoVPN access.
Security model
This server signs payments locally and never transmits your private key anywhere.
SOLANA_PRIVATE_KEYandEVM_PRIVATE_KEYare read from local process environment variables. They are used only to sign transactions in-process and are never sent over the network or written to disk by this server.The only data that leaves the machine is a signed payment authorization (EVM EIP-3009) or a broadcast transaction signature (Solana), sent to
X402_BASE_URLto fulfill a purchase.Use a dedicated, low-balance wallet for this server — never point it at a primary or high-balance wallet.
wallet_statusreturns configured addresses and network selection only. It never returns private keys or any secret material.Credentials returned after a successful purchase are written only to
~/.privado/on your local machine.
Related MCP server: agentmetal/mcp
Quick start
npx -y @privadovpn/x402-mcpClaude Desktop (claude_desktop_config.json):
{
"mcpServers": {
"privadovpn-x402-mcp": {
"command": "npx",
"args": ["-y", "@privadovpn/x402-mcp"],
"env": {
"SOLANA_PRIVATE_KEY": "<your-base58-key>"
}
}
}
}Claude Code:
claude mcp add privadovpn-x402-mcp -e SOLANA_PRIVATE_KEY=<your-base58-key> -- npx -y @privadovpn/x402-mcpCursor (.cursor/mcp.json):
{
"mcpServers": {
"privadovpn-x402-mcp": {
"command": "npx",
"args": ["-y", "@privadovpn/x402-mcp"],
"env": {
"SOLANA_PRIVATE_KEY": "<your-base58-key>"
}
}
}
}Configuration
Variable | Required | Default | Description |
| At least one of | — | Base58-encoded Solana secret key (32 or 64 bytes) used to sign and pay in SPL USDC. |
| At least one of | — | Hex-encoded EVM private key used to sign EIP-3009 USDC authorizations. |
| No |
| Which network to prefer when a quote offers both. Accepts |
| No |
| Base URL of the x402 payment backend used for catalog, quote, and fulfillment requests. |
| No |
| Solana RPC endpoint used to check balances and broadcast transactions. |
| Required for EVM payments | — | EVM RPC endpoint used to check balances and broadcast transactions. |
Tools
Tool | Purpose |
| Show configured wallet addresses and network selection. Never returns private keys. |
| List purchasable VPN plans and supported server country codes. |
| Preferred purchase flow: quote, sign and pay on-chain, fulfill, and save credentials in one call. |
| Recovery only: exchange an already-broadcast payment for VPN credentials. |
| Debug only: sign and broadcast payment without fulfilling. Prefer |
Purchase flow and recovery
Each GET /pay request creates a new invoice on the server. Because of this, buy_vpn must be called exactly once per purchase attempt — calling it again after funds have already been sent creates a second invoice and results in a duplicate charge.
If buy_vpn reports that the on-chain payment succeeded but fulfillment failed (for example, due to a network error when exchanging the payment for credentials), do not call buy_vpn again. Instead call fulfill_payment with the plan, invoice_no, payment_signature, and settlement_tx values from the error. This exchanges the already-completed payment for credentials without creating a new invoice or sending additional funds.
buy_vpn and sign_and_pay both accept a dry_run flag that performs balance checks without broadcasting a transaction. Note that a dry run still creates a real invoice on the server; it does not need to be followed by a real purchase, but it should not be repeated for the same purchase attempt.
How it works
sequenceDiagram
participant Agent
participant MCP as Local MCP (this server)
participant Backend as x402.privadovpn.com
Agent->>MCP: buy_vpn(plan, country)
MCP->>Backend: GET /pay?plan=...
Backend-->>MCP: 402 Payment Required + quote (accepts[])
MCP->>MCP: sign payment locally (private key never leaves process)
MCP->>Backend: broadcast transaction on-chain
Backend-->>MCP: transaction confirmed
MCP->>Backend: GET /pay (PAYMENT-SIGNATURE, X-Settlement-Transaction)
Backend-->>MCP: VPN credentials
MCP-->>Agent: credentials + settlement_tx + credentials_pathSupported networks: Solana (SPL USDC transfer) and EVM (EIP-3009 transferWithAuthorization USDC).
Server-side discovery
Catalog and payment discovery:
https://x402.privadovpn.com/.well-known/x402-paymentAgent-readable service description:
https://x402.privadovpn.com/llms.txtRemote MCP (catalog/docs only, no wallet access):
https://x402.privadovpn.com/mcp
Development
git clone git@github.com:privadovpn/x402-mcp.git
cd x402-mcp
npm install
npm run build
npm testRun with the MCP Inspector:
npx @modelcontextprotocol/inspector node dist/index.jsLicense
MIT. See LICENSE.
mcp-name: io.github.privadovpn/x402-mcp
Available Tools
5 toolsbuy_vpnA
PREFERRED. Buy VPN in one call: quote → pay on-chain → fulfill → save credentials. Call ONCE per purchase. Do not use curl/shell against /pay. Do not call dry_run then buy again (each quote creates a new invoice). If this errors after payment, call fulfill_payment with the recovery fields from the error — never retry buy_vpn.
| Name | Required | Description | Default |
|---|---|---|---|
| plan | Yes | ||
| country | No | ||
| dry_run | No | ||
| network | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses the end-to-end side effects (on-chain payment, credential saving), the idempotency constraint (each quote creates a new invoice), and the precise recovery path via fulfill_payment. It omits auth requirements, rate limits, and return format, leaving some behavioral gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Highly front-loaded ('PREFERRED.' plus the workflow) and every sentence carries distinct operational weight — constraints, sequencing, and recovery are all packed without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations and no output schema, the description covers the critical operational context well: purchase flow, idempotency, and error recovery. It falls short on documenting the four input parameters, which an agent still needs to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for 4 parameters, so the description must compensate but largely does not. It only alludes to dry_run's semantics via the 'do not call dry_run then buy again' warning and says nothing about plan, country, or network formats.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Buy VPN in one call') and enumerates the full internal pipeline (quote → pay on-chain → fulfill → save credentials). It clearly distinguishes itself from siblings by referencing fulfill_payment and the dry_run path, so an agent can route without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when/when-not guidance: call ONCE per purchase, do not use curl/shell against /pay, do not dry_run then buy again, and if it errors after payment use fulfill_payment instead. It names the alternative tool and the exact condition selecting it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fulfill_paymentA
Recovery only: exchange an already-broadcast payment for VPN credentials. Requires plan, invoice_no, payment_signature, settlement_tx from a prior buy_vpn/sign_and_pay. Does not create a new invoice or send money. Use when fulfill failed after payment — never call buy_vpn again.
| Name | Required | Description | Default |
|---|---|---|---|
| plan | Yes | ||
| country | No | ||
| invoice_no | Yes | ||
| settlement_tx | Yes | ||
| payment_signature | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden and does well: it declares the tool does not create an invoice or send money (non-destructive, idempotent-looking recovery), and requires artifacts from a prior call. It doesn't state auth requirements or what happens if the inputs are stale/invalid, so a small gap remains.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, tightly front-loaded with the 'Recovery only' scope before the requirements and the negative guidance. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No annotations and no output schema, so the description must stand alone; it covers purpose, prerequisites, and exclusions well. It stops short of describing what the returned VPN credentials look like or how errors/failed recovery are surfaced, and it ignores the optional country field.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, and it does partially: it names the four required parameters and tells the agent where they come from (prior buy_vpn/sign_and_pay). It adds no format or validation detail for invoice_no, payment_signature, settlement_tx, and never mentions the optional 'country' parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (exchange) and resource (already-broadcast payment → VPN credentials) plus an explicit scope qualifier ('Recovery only'). It also distinguishes itself from siblings by naming buy_vpn/sign_and_pay as the source of the required inputs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use it ('when fulfill failed after payment') and when not to ('never call buy_vpn again', 'does not create a new invoice or send money'). The alternative is named and the triggering condition is given, leaving nothing to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_vpn_catalogA
List purchasable VPN plans (id, USD price, duration) and supported server country codes from X402_BASE_URL discovery.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It usefully discloses the data source ('X402_BASE_URL discovery') and that the result is a list of purchasable items, implying a safe read, but it says nothing about auth requirements, rate limits, caching, or failure modes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One dense sentence, front-loaded with the verb and the primary resource, with the returned fields tucked into a compact parenthetical. Nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no parameters, the description compensates well by enumerating the return contents (id, USD price, duration, country codes). It is close to complete for a simple discovery call, though auth/access expectations for the X402_BASE_URL endpoint remain unstated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema declares zero parameters, so there is no parameter semantics to convey and the baseline of 4 applies. The description correctly signals a no-argument call.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb ('List') plus a precisely scoped resource ('purchasable VPN plans ... and supported server country codes'), and even names the fields returned. This is clearly distinguishable from the write/payment siblings (buy_vpn, sign_and_pay) without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: an agent can infer this is the pre-purchase discovery call, especially given the buy_vpn sibling, but the description never says when to call it or that it precedes a purchase. No alternatives or exclusions are named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sign_and_payA
DEBUG ONLY. Broadcasts on-chain payment and returns payment_signature + settlement_tx but does NOT fetch VPN credentials. Prefer buy_vpn. If you use this, you MUST next call fulfill_payment with the same invoice_no — never curl /pay and never call buy_vpn again (double charge).
| Name | Required | Description | Default |
|---|---|---|---|
| accepts | Yes | ||
| dry_run | No | ||
| network | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden and does so well: it discloses the irreversible side effect (real on-chain broadcast), the missing outcome (no VPN credentials fetched), the required follow-up call, and the double-charge failure mode. These are precisely the behavioral traits an agent cannot infer from the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences, warning first, recommendation second, mandatory follow-up third. No filler, and the highest-risk information (DEBUG ONLY, double charge) is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description usefully names the returns (payment_signature, settlement_tx) and the required continuation, which is the critical path context for a payment tool. The remaining gap is parameter-level detail for a 0%-coverage schema, notably dry_run.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description only indirectly touches one parameter, the invoice_no that must be reused in fulfill_payment. The nested 'accepts' array structure, dry_run, and network are not explained anywhere, so the description only partially compensates for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Broadcasts on-chain payment') plus concrete return values, and immediately marks it as DEBUG ONLY, which distinguishes it from the sibling buy_vpn. An agent can tell what it does and what it is not for without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit routing: 'Prefer buy_vpn', plus a mandatory next step ('you MUST next call fulfill_payment with the same invoice_no') and two named prohibitions (never curl /pay, never call buy_vpn again due to double charge). This is exactly the when/when-not/alternatives guidance the dimension asks for.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
wallet_statusA
Show which wallets are configured (addresses only, never private keys).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It does disclose one meaningful behavioral trait (addresses only, never private keys), which signals a safe read, but says nothing about permissions, what happens when no wallets are configured, or any limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with no filler, front-loading the verb and resource and appending the one detail worth knowing (no private keys). Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple zero-param read tool with no output schema, the description states what is returned at a high level (configured wallet addresses) and removes the obvious security ambiguity. It could say a bit more about the return shape or the empty-configuration case, but it is essentially complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is nothing for the description to disambiguate beyond what the empty schema already shows. Baseline 4 for a parameterless tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a concrete verb+resource ("Show which wallets are configured") and adds a scope qualifier about what is and isn't returned. It is clearly distinguishable from the payment/VPN siblings, though it does not name them explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: an agent would call this to inspect configured wallets. There is no statement of when to use it versus alternatives, nor any prerequisites or exclusions, so it sits at minimum viable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v1.0.0- First observed
buy_vpn - First observed
fulfill_payment - First observed
list_vpn_catalog - First observed
sign_and_pay - First observed
wallet_status
TDQS
Scored across 5 tools
Three of the five tools (sign_and_pay, buy_vpn, fulfill_payment) operate in the same payment territory and could plausibly be misselected. The descriptions work hard to draw boundaries (DEBUG ONLY, PREFERRED, recovery only), so overlap exists but is mitigated by explicit guidance.
All names use snake_case, and most follow a verb_noun pattern (list_vpn_catalog, buy_vpn, fulfill_payment). Minor deviations like wallet_status (noun-based) and sign_and_pay (verb_and_verb) keep it from being perfectly uniform.
Five tools is well-scoped for a VPN purchase flow: discovery, wallet check, purchase, and recovery. Each tool earns its place with no filler.
The surface covers catalog discovery, wallet status, purchasing, and payment recovery, giving a full purchase lifecycle. Minor gaps remain (e.g., no way to list saved credentials or view past purchases), but core workflows are covered.
Maintenance
Related MCP Connectors
x402 V2 payment-to-access on Solana USDC with receipts, entitlements, atomic metering and webhooks.
Payment rails for AI agents. Pay merchants in USDC on Base. Dual-protocol: x402 + OKX APP.
Buy private git repos and agent skills with USDC over x402. Read the manifest free, then pay.
- mcpOAuthai.agentgates
Confidential compute and inference sold to agents over x402 USDC, plus an agent wallet over MCP.
Related MCP Servers
- AlicenseAqualityCmaintenanceEnables AI agents to autonomously buy and operate mobile proxies via MCP, supporting both API key and on-chain USDC payments for tasks like port creation, IP rotation, and traffic management.4429 npmMIT
- AlicenseAqualityBmaintenanceEnables AI agents to provision, manage, and renew cloud servers with USDC payments via x402, requiring no human signup.1179 npm2MIT
- AlicenseNot gradedqualityFmaintenanceEnables AI agents to make micropayments using USDC on Solana via the x402 protocol, supporting payment requests, on-chain verification, and revenue tracking.MIT
- AlicenseAqualityBmaintenanceEnables AI agents to discover, inspect, and pay for paid HTTP and MCP services using USDC on Solana with a self-custodial wallet.439 npm7Apache 2.0