Skip to main content
Glama

@privadovpn/x402-mcp

Pay-per-use VPN and SOCKS5 proxy access for AI agents, powered by x402 USDC payments. Local stdio MCP server that signs and broadcasts payments (Solana, EVM); every plan includes both an HTTP proxy and a SOCKS5 proxy.

npm version CI license MCP registry

Pricing

No subscription required — pay only for the access you use, starting at $0.05. Plans and prices are never hardcoded in this client: list_vpn_catalog always fetches the live, authoritative list from the backend's .well-known/x402-payment manifest. As of 2026-10-21, the approved pricing lineup is:

Plan ID

Display Name

Duration

Price

PREMIUMM15

Premium M15

15 minutes

$0.05

PREMIUMX1

Premium X1

1 hour

$0.15

PREMIUMX3

Premium X3

3 hours

$0.39

PREMIUMD1

Premium D1

24 hours

$0.99

PREMIUMD7

Premium D7

7 days

$2.99

PREMIUMD30

Premium D30

30 days

$5.99

Every plan currently includes both an HTTP proxy and a SOCKS5 proxy (the backend's catalog lists this per plan as services: ["http_proxy", "socks5_proxy"]) — there is no separate SOCKS5-only plan to choose. Always call list_vpn_catalog before purchasing — it returns the current, authoritative set of plans, prices, and included services.

Related MCP server: x402 Payment Gateway MCP Server

Security model

This server signs payments locally and never transmits your private key anywhere.

  • SOLANA_PRIVATE_KEY and EVM_PRIVATE_KEY are read from local process environment variables. They are used only to sign transactions in-process and are never sent over the network or written to disk by this server.

  • The only data that leaves the machine is a signed payment authorization (EVM EIP-3009) or a broadcast transaction signature (Solana), sent to X402_BASE_URL to fulfill a purchase.

  • Use a dedicated, low-balance wallet for this server — never point it at a primary or high-balance wallet.

  • wallet_status returns configured addresses and network selection only. It never returns private keys or any secret material.

  • Credentials returned after a successful purchase (including proxy and SOCKS5 passwords) are written only to ~/.privado/ on your local machine and are never logged to stdout/stderr by this server.

Quick start

npx -y @privadovpn/x402-mcp

Claude Desktop (claude_desktop_config.json):

{
  "mcpServers": {
    "privadovpn-x402-mcp": {
      "command": "npx",
      "args": ["-y", "@privadovpn/x402-mcp"],
      "env": {
        "SOLANA_PRIVATE_KEY": "<your-base58-key>"
      }
    }
  }
}

Claude Code:

claude mcp add privadovpn-x402-mcp -e SOLANA_PRIVATE_KEY=<your-base58-key> -- npx -y @privadovpn/x402-mcp

Cursor (.cursor/mcp.json):

{
  "mcpServers": {
    "privadovpn-x402-mcp": {
      "command": "npx",
      "args": ["-y", "@privadovpn/x402-mcp"],
      "env": {
        "SOLANA_PRIVATE_KEY": "<your-base58-key>"
      }
    }
  }
}

Configuration

Variable

Required

Default

Description

SOLANA_PRIVATE_KEY

At least one of SOLANA_PRIVATE_KEY / EVM_PRIVATE_KEY

—

Base58-encoded Solana secret key (32 or 64 bytes) used to sign and pay in SPL USDC.

EVM_PRIVATE_KEY

At least one of SOLANA_PRIVATE_KEY / EVM_PRIVATE_KEY

—

Hex-encoded EVM private key used to sign EIP-3009 USDC authorizations.

PREFERRED_NETWORK

No

solana if SOLANA_PRIVATE_KEY is set, else evm

Which network to prefer when a quote offers both. Accepts solana or evm (eip155 is an accepted alias for evm).

X402_BASE_URL

No

https://x402.privadovpn.com

Base URL of the x402 payment backend used for catalog, quote, and fulfillment requests.

SOLANA_RPC_URL

No

https://api.mainnet-beta.solana.com

Solana RPC endpoint used to check balances and broadcast transactions.

EVM_RPC_URL

Required for EVM payments

—

EVM RPC endpoint used to check balances and broadcast transactions.

Tools

Tool

Purpose

wallet_status

Show configured wallet addresses and network selection. Never returns private keys.

list_vpn_catalog

List purchasable VPN plans (including which services — HTTP proxy, SOCKS5 — each plan includes) and supported server country codes.

buy_vpn

Preferred purchase flow: quote, sign and pay on-chain, fulfill, and save credentials in one call.

fulfill_payment

Recovery only: exchange an already-broadcast payment for VPN credentials.

sign_and_pay

Debug only: sign and broadcast payment without fulfilling. Prefer buy_vpn.

Purchase flow and recovery

Each GET /pay request creates a new invoice on the server. Because of this, buy_vpn must be called exactly once per purchase attempt — calling it again after funds have already been sent creates a second invoice and results in a duplicate charge.

If buy_vpn reports that the on-chain payment succeeded but fulfillment failed (for example, due to a network error when exchanging the payment for credentials), do not call buy_vpn again. Instead call fulfill_payment with the plan, invoice_no, payment_signature, and settlement_tx values from the error. This exchanges the already-completed payment for credentials without creating a new invoice or sending additional funds.

buy_vpn and sign_and_pay both accept a dry_run flag that performs balance checks without broadcasting a transaction. Note that a dry run still creates a real invoice on the server; it does not need to be followed by a real purchase, but it should not be repeated for the same purchase attempt.

Credentials

A single purchase covers every service the plan includes — there is no separate checkout for SOCKS5. The vpn object returned by buy_vpn/fulfill_payment (and saved to ~/.privado/) contains:

Field

Present when

Description

vpn.port, vpn.connection_string

Always

HTTP proxy. connection_string is https://user:pass@host:port.

vpn.socks5_port, vpn.socks5_connection_string

Plan's services includes socks5_proxy

SOCKS5 proxy, same username/password as the HTTP proxy. socks5_connection_string is socks5://user:pass@host:port.

This client does not parse or special-case these fields — whatever the backend returns is passed straight through to the agent and to the saved credentials file, so field names always match what list_vpn_catalog/buy_vpn actually return at the time of purchase.

Example of using a purchased SOCKS5 proxy with curl, once you have vpn.socks5_connection_string:

curl -x "$SOCKS5_CONNECTION_STRING" https://ifconfig.me

This server never configures system-wide or OS-level proxy settings — it only returns credentials. Routing any traffic through them is a separate, explicit step you take.

How it works

sequenceDiagram
    participant Agent
    participant MCP as Local MCP (this server)
    participant Backend as x402.privadovpn.com

    Agent->>MCP: buy_vpn(plan, country)
    MCP->>Backend: GET /pay?plan=...
    Backend-->>MCP: 402 Payment Required + quote (accepts[])
    MCP->>MCP: sign payment locally (private key never leaves process)
    MCP->>Backend: broadcast transaction on-chain
    Backend-->>MCP: transaction confirmed
    MCP->>Backend: GET /pay (PAYMENT-SIGNATURE, X-Settlement-Transaction)
    Backend-->>MCP: VPN credentials
    MCP-->>Agent: credentials + settlement_tx + credentials_path

Supported networks: Solana (SPL USDC transfer) and EVM (EIP-3009 transferWithAuthorization USDC).

Server-side discovery

  • Catalog and payment discovery: https://x402.privadovpn.com/.well-known/x402-payment

  • Agent-readable service description: https://x402.privadovpn.com/llms.txt

  • Remote MCP (catalog/docs only, no wallet access): https://x402.privadovpn.com/mcp

Development

git clone git@github.com:privadovpn/x402-mcp.git
cd x402-mcp
npm install
npm run build
npm test

Run with the MCP Inspector:

npx @modelcontextprotocol/inspector node dist/index.js

License

MIT. See LICENSE.

mcp-name: io.github.privadovpn/x402-mcp

Available Tools

5 tools
buy_vpnA

PREFERRED. Buy VPN in one call: quote → pay on-chain → fulfill → save credentials. Call ONCE per purchase. Do not use curl/shell against /pay. Do not call dry_run then buy again (each quote creates a new invoice). If this errors after payment, call fulfill_payment with the recovery fields from the error — never retry buy_vpn. One purchase covers every service the plan includes: the result's vpn object has port/connection_string for the HTTP proxy, and socks5_port/socks5_connection_string (same username/password) when the plan includes SOCKS5 — check list_vpn_catalog's services field beforehand.

NameRequiredDescriptionDefault
planYes
countryNo
dry_runNo
networkNo

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and does so: it discloses that real on-chain payment occurs, that each invocation creates a new invoice, that retrying after a paid error is dangerous and must be replaced by fulfill_payment with recovery fields, and what the result's `vpn` object contains. These are exactly the irreversible-side-effect and idempotency facts an agent needs before calling a payment tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the preferred-tool marker and the workflow, and nearly every clause carries operational weight (no-retry, invoice creation, recovery path). It is dense to the point of being hard to scan, with several compound sentences packed into one block, but little is genuinely expendable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a high-stakes payment tool with no annotations and no output schema, the description covers the workflow, the failure/recovery path, and the shape of the returned `vpn` credentials. The remaining gap is the semantics of `country` and `network`, which an agent would have to guess at.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across four parameters. The description does add real meaning for `dry_run` (it creates a new invoice, so don't chain it into a buy) and points to list_vpn_catalog's `services` field as the way to choose `plan`, but `country` and `network` are never mentioned, leaving half the parameters undocumented anywhere.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Buy VPN") and immediately enumerates the full operation chain: quote → pay on-chain → fulfill → save credentials. This makes it clearly distinguishable from the sibling tools sign_and_pay and fulfill_payment, which are individual steps of that chain.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly marks itself as PREFERRED, says to call ONCE per purchase, forbids curl/shell against /pay, forbids the dry_run-then-buy sequence with a stated reason (each quote creates a new invoice), and routes the agent to fulfill_payment instead of retrying on post-payment errors. When-to-use, when-not-to-use, and the alternative are all named.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fulfill_paymentA

Recovery only: exchange an already-broadcast payment for VPN credentials. Requires plan, invoice_no, payment_signature, settlement_tx from a prior buy_vpn/sign_and_pay. Does not create a new invoice or send money. Use when fulfill failed after payment — never call buy_vpn again. Returns the same vpn credential shape as buy_vpn, including socks5_port/socks5_connection_string when the plan includes SOCKS5.

NameRequiredDescriptionDefault
planYes
countryNo
invoice_noYes
settlement_txYes
payment_signatureYes

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the load well: it declares the read-of-prior-artifacts model, that no funds move and no invoice is created, and describes the return shape including socks5_port/socks5_connection_string conditionally. It stops short of stating idempotency or what happens if the settlement_tx was already redeemed, which would matter for a recovery operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the critical constraint ('Recovery only') in the first three words, then layers requirements, exclusions, and return shape. No sentence is redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no annotations and no output schema, the description covers everything an agent needs: when to call, what to supply and from where, what it explicitly must not do, and what the response contains. The absence of structured data is fully offset.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate, and it does: it names all four required parameters and, crucially, tells the agent where they come from (a prior buy_vpn/sign_and_pay). The optional 'country' parameter is never explained, leaving one gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (exchange) and resource (an already-broadcast payment → VPN credentials) and immediately scopes it as 'Recovery only.' It is clearly distinguishable from buy_vpn and sign_and_pay, which it names as the origin of its inputs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit trigger ('Use when fulfill failed after payment') plus an explicit prohibition ('never call buy_vpn again') and states what it does not do (no new invoice, no money sent). An agent has an unambiguous decision rule.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_vpn_catalogA

List purchasable VPN plans (id, USD price, duration) and supported server country codes from X402_BASE_URL discovery. Each plan's services array indicates which protocols it includes (e.g. http_proxy, socks5_proxy); port is the HTTP proxy port and socks5_port is the SOCKS5 port (both only meaningful for services the plan actually includes) — check these before telling a user which plan to buy for SOCKS5 access.

NameRequiredDescriptionDefault

No parameters

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden and does reasonably well: it labels the operation as a listing, names the data source (X402_BASE_URL discovery), and explains the conditional meaning of `port` vs `socks5_port` so the agent won't misreport capabilities. It says nothing about failure modes, network/config prerequisites, or whether results are cached or live.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose is front-loaded in the first clause, and the second sentence adds only decision-relevant detail about `services` and the two port fields. The second sentence is long and parenthetically dense, but every clause maps to a field the agent must interpret.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, yet the description compensates by documenting the plan record fields, the country-code list, and the relationship between `services` and the two port fields. An agent has enough to call it and to interpret the response without guessing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the baseline is 4 and there is no input semantics to explain. All descriptive effort is correctly spent on output fields rather than invented parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("List purchasable VPN plans") and enumerates the returned attributes (id, USD price, duration, server country codes), so the agent knows exactly what this call produces. It does not explicitly name or contrast with the sibling buy_vpn, leaving the read-vs-purchase distinction to be inferred from the word "List".

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a clear usage context: consult this before recommending or purchasing a plan, and specifically check `services`/ports before telling a user which plan supports SOCKS5. It stops short of naming when not to use it or pointing to buy_vpn as the follow-up step, so no explicit alternative is offered.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sign_and_payA

DEBUG ONLY. Broadcasts on-chain payment and returns payment_signature + settlement_tx but does NOT fetch VPN credentials. Prefer buy_vpn. If you use this, you MUST next call fulfill_payment with the same invoice_no — never curl /pay and never call buy_vpn again (double charge).

NameRequiredDescriptionDefault
acceptsYes
dry_runNo
networkNo

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does most of it: it discloses that real value moves on-chain, names the returned fields (payment_signature, settlement_tx), states what is deliberately omitted (VPN credentials), and warns about double charging. It stops short of covering failure/retry behavior, wallet prerequisites, or what dry_run actually changes — material gaps for an irreversible money-moving call.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, front-loaded with the 'DEBUG ONLY' warning, then the capability, then the mandatory next step. Every clause carries operational consequence; nothing is redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a no-annotation, no-output-schema, money-moving tool the description does well on return values and workflow ordering. But it never explains the required accepts payload or dry_run, so an agent still lacks what it needs to construct a correct call in this deliberately dangerous path.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the required `accepts` parameter is a nested array of objects with seven required subfields. The description only implicitly touches `invoiceNo` (via the fulfill_payment matching requirement) and is silent on `dry_run`, `network`, and the entire accepts structure, leaving an agent to guess at payment-critical fields.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Broadcasts on-chain payment') and immediately bounds scope with 'does NOT fetch VPN credentials'. It distinguishes itself from siblings by naming buy_vpn and fulfill_payment, so an agent can place it in the workflow without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit exclusions ('Prefer buy_vpn', 'DEBUG ONLY') plus a hard mandatory follow-up ('you MUST next call fulfill_payment with the same invoice_no') and a named failure mode ('double charge'). The when-not, the alternative, and the cost of getting it wrong are all stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

wallet_statusA

Show which wallets are configured (addresses only, never private keys).

NameRequiredDescriptionDefault

No parameters

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It does disclose one meaningful behavioral trait (addresses only, never private keys), which signals a safe read, but says nothing about permissions, what happens when no wallets are configured, or any limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence with no filler, front-loading the verb and resource and appending the one detail worth knowing (no private keys). Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple zero-param read tool with no output schema, the description states what is returned at a high level (configured wallet addresses) and removes the obvious security ambiguity. It could say a bit more about the return shape or the empty-configuration case, but it is essentially complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is nothing for the description to disambiguate beyond what the empty schema already shows. Baseline 4 for a parameterless tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a concrete verb+resource ("Show which wallets are configured") and adds a scope qualifier about what is and isn't returned. It is clearly distinguishable from the payment/VPN siblings, though it does not name them explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: an agent would call this to inspect configured wallets. There is no statement of when to use it versus alternatives, nor any prerequisites or exclusions, so it sits at minimum viable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 3 tool updatesv1.1.0
    • Changedbuy_vpn1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedfulfill_payment1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedsign_and_pay3 fields changed
      • removedInput schema / additionalProperties
        Removed value: -false
      • removedInput schema / properties / accepts / items / additionalProperties
        Removed value: -false
      • addedInput schema / properties / accepts / items / properties / extra / propertyNames
        Added value: +{
        +  "type": "string"
        +}
  2. 5 tool updatesv1.0.0
    • First observedbuy_vpn
    • First observedfulfill_payment
    • First observedlist_vpn_catalog
    • First observedsign_and_pay
    • First observedwallet_status

TDQS

A4/5.0

Scored across 5 tools

Disambiguation4/5

The tools mostly target distinct steps: wallet status, catalog discovery, purchase, recovery, and debug payment. The only real overlap is between buy_vpn, sign_and_pay, and fulfill_payment, but the descriptions explicitly mark buy_vpn as preferred, sign_and_pay as debug-only, and fulfill_payment as recovery-only.

Naming Consistency3/5

All names use snake_case, but the patterns are mixed: wallet_status is a noun phrase, list_vpn_catalog is verb_noun_noun, buy_vpn and fulfill_payment are verb_noun, and sign_and_pay joins verbs with 'and'. The set remains readable, but it does not follow a single predictable convention.

Tool Count5/5

Five tools is well-scoped for a VPN purchase/payment workflow. Each tool has a clear role: status, discovery, purchase, recovery, and debug payment.

Completeness4/5

The surface covers the main lifecycle: checking wallets, discovering plans, buying VPN access, recovering a paid-but-unfulfilled purchase, and a debug payment path. A minor gap is that there is no direct way to retrieve or inspect previously purchased credentials without the recovery fields.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers