Skip to main content
Glama

x402ai-mcp

A local MCP server that lets AI clients (Claude Desktop, Claude Code, Cursor and others) call the paid x402ai endpoints, paying per call in USDC on Base through the x402 protocol, plus a free inspector for any x402 endpoint.

It runs on your machine over stdio. You give it a buyer key; it answers each HTTP 402 payment challenge by signing a USDC authorization, and returns the result. Nothing is hosted for you and no account is needed.

Tools

Tool

Cost

What it does

embed

$0.01

768-dimension text embedding (nomic-embed-text)

summarize

$0.02

Summary of the input text (small local LLM)

ask

$0.04

Short answer, 2-3 sentences; no web access, no memory, can be wrong

health

free

x402ai service status, plus this session's spend and remaining cap

inspect

free

Takes a URL: decodes its 402 challenge, runs Coinbase's x402 validator and a Bazaar merchant lookup

Paid tools take one input string of up to 3,000 characters. health and inspect need no key.

Related MCP server: PipRail

Before you start: use a dedicated wallet

This server holds a private key that can spend money. Use a new wallet that exists only for this, funded with a few dollars of USDC on Base at most. Payments are gasless for the payer (EIP-3009), so the wallet needs USDC only, no ETH. Never use a wallet that holds anything you can't afford to lose. The wallet balance is your real spending limit.

Can you trust this package?

This server asks for a key that can spend money, and fake "x402 MCP" packages that steal keys have been reported. Don't take this README's word for it: the claims below are meant to be checked.

  • The package never sends or logs your key. It is read once from X402AI_BUYER_PRIVATE_KEY and used only to sign payment authorizations locally, and it is scrubbed from error messages. It stays in this process's environment and memory while the server runs, so anything that can read those (other code in this process, other programs running as your user, your client's config file) can read the key. Clearing the variable inside the process would not change that, because Linux keeps a process's starting environment readable under /proc.

  • Every host it contacts. No request follows a redirect; a redirect is refused and the call fails.

    • https://api.x402ai.dev: the paid tools and health. Signed authorizations go only here, only for the calling tool's own route and price, and expire within 300 seconds.

    • https://api.cdp.coinbase.com: only when you run inspect (Coinbase's validator and merchant lookup).

    • The URL you pass to inspect: one unpaid request (with a fixed body for POST). Nothing is signed.

  • No telemetry, analytics or update checks.

  • Small and readable. Five source files in src/ (about 600 lines), built with tsc into dist/. The published package contains only dist/, this README, LICENSE and package.json.

  • Pinned dependencies. Direct dependencies are pinned to exact versions. npm resolves their dependencies fresh, within the ranges they declare, when you install, so those aren't frozen; the repository's package-lock.json records the exact set that was tested. No dependency runs an install script. All dependencies have verified npm registry signatures (npm audit signatures). The x402 client is @x402/fetch 2.28.0, with a per-payment cap set in code.

  • The spend safeguards stop honest code from overspending; they do nothing against a malicious package. That is why the points above are checkable.

How to check: compare the published files with the source (npm pack x402ai-mcp@<version> downloads the exact tarball for inspection), confirm the package name is exactly x402ai-mcp, and read src/.

Don't run unvetted MCP servers in the same client as a funded key. Any other program running as your user, including another MCP server, can typically read this process's environment and your client's config file, which holds the key in plain text.

Install

Requires Node.js 20 or later. Add it to your MCP client's configuration, for example:

{
  "mcpServers": {
    "x402ai": {
      "command": "npx",
      "args": ["-y", "x402ai-mcp"],
      "env": {
        "X402AI_BUYER_PRIVATE_KEY": "0x...",
        "X402AI_MAX_SESSION_USD": "0.25"
      }
    }
  }
}

Note that most clients store this file in plain text, so the key sits on disk unencrypted. That is one more reason to use a dedicated low-balance wallet.

To try it without a key or any spending, set X402AI_DRY_RUN=1: paid tools then return the price quote they would pay, and never sign anything.

Configuration

Variable

Default

Meaning

X402AI_BUYER_PRIVATE_KEY

none

Buyer key (hex). Needed only for paid tools. Never logged; scrubbed from error messages.

X402AI_MAX_SESSION_USD

0.25

Total the server may spend per process. An invalid value stops it at startup.

X402AI_DRY_RUN

off

1 = quote only, never sign. No key needed.

The server logs to stderr only (stdout carries the MCP protocol). At startup it prints whether a key is configured, the buyer address and the session cap.

Spending safeguards

  • Per payment: before signing, each paid tool checks that the challenge is for Base mainnet, USDC, x402ai's payment address, and that tool's own route, at or below that route's price. Anything else is refused. A per-payment maximum of $0.04 is enforced as a second check.

  • Short-lived authorizations. A challenge that asks for an authorization valid longer than 300 seconds is refused before signing, so a leaked authorization cannot stay usable for long.

  • Per session: each payment attempt is reserved against X402AI_MAX_SESSION_USD before signing. Once the cap is reached, paid tools refuse until the server restarts.

  • The session cap is per process. It is counted in memory, resets when the server restarts, and each running copy of the server gets its own cap, even with the same wallet. The wallet balance is the only hard limit: fund it with only what you are willing to lose.

  • The cap has no upper limit. A typo such as 250 means $250. The wallet balance is the backstop that always holds.

Things to know

  • A failed call can still count. If the server returns an error after the payment was signed, the reservation is kept, because a signed authorization can still settle. You are not charged when x402ai's handler fails, but the session cap treats the attempt as spent.

  • inspect sends the URL you give it to Coinbase's CDP (validator and merchant lookup). Don't inspect URLs you want to keep private.

  • inspect refuses local and private addresses (loopback, private ranges, link-local, CGNAT, IPv6 ULA, and IPv4 addresses wrapped in IPv6 forms), checked after DNS resolution. It allows https only. A DNS change between the check and the request (DNS rebinding) is still possible.

  • Treat tool output as untrusted data. Answers and summaries come from a small model and may be wrong; responses from inspected endpoints are third-party content. Don't let them act as instructions to your agent.

  • Latency: embed is usually under a second; summarize and ask take about 5-15 seconds (CPU inference).

  • Claude Code may load tool schemas late. Claude Code defers MCP tool schemas by default, so the first call to a tool can go out with wrong or empty arguments. Starting Claude Code with ENABLE_TOOL_SEARCH=false loads them up front.

License

MIT. Not affiliated with Coinbase or the x402 Foundation.

Available Tools

5 tools
askx402ai askA

Ask a question and get an answer. Costs $0.04 (USDC on Base) per call; takes 5-16 s. Spends real money; subject to a per-payment and per-session cap. Pass the question in input (max 3000 chars).

NameRequiredDescriptionDefault
inputYesThe text to process, passed as "input": the text to embed or summarize, or for ask, the question. 1-3000 characters.

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds substantial context beyond annotations: exact price ($0.04 USDC on Base), expected latency (5-16 s), and the existence of per-payment and per-session caps. This meaningfully complements idempotentHint=false by making clear each call spends real money, though it doesn't say whether a failed or slow call is still charged.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four short sentences, front-loaded with purpose followed by cost and latency — the highest-value constraints for a paid tool. No filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter paid tool with no output schema, it covers purpose, price, latency, and spend limits. The gap is the payment mechanics (how authorization happens, whether a wallet must be pre-configured) and what a failed call costs.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and already documents the single `input` parameter with its 1-3000 character bound. The description's 'Pass the question in `input` (max 3000 chars)' largely restates the schema, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource: 'Ask a question and get an answer,' which is clearly distinct from embed/summarize style siblings. It does not explicitly name those siblings, so the differentiation is implied rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives strong decision-relevant context (cost, latency, spend caps) but never states when to choose this over `embed` or `summarize`, nor when not to call it. The agent must infer the boundary from the sibling names.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

embedx402ai embedA

Compute a text embedding vector. Costs $0.01 (USDC on Base) per call. Spends real money; subject to a per-payment and per-session cap. Pass the text in input (max 3000 chars).

NameRequiredDescriptionDefault
inputYesThe text to process, passed as "input": the text to embed or summarize, or for ask, the question. 1-3000 characters.

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds real behavioral context beyond the annotations: monetary cost ($0.01 USDC on Base), that it spends real money, and that a per-payment and per-session cap applies. What it doesn't cover is what happens when a cap is hit or a payment fails, which leaves a meaningful edge case undisclosed for a paid write-flagged tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences with the purpose and the cost front-loaded ahead of the input note — efficient and easy to scan. The trailing "(max 3000 chars)" partially duplicates the schema's maxLength, which is the only wasted material.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter tool with annotations covering side-effect profile and with cost/payment constraints spelled out, the description covers what an agent needs to decide and call safely. The notable omission is the shape of the return value (e.g., vector dimensionality), which matters here since there is no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the single `input` parameter is already fully documented with its 1-3000 character bounds. The description restates the 3000-character limit but adds no new semantics, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

"Compute a text embedding vector" is a specific verb plus resource that is clearly distinct from summarize, ask, health, and inspect. It doesn't explicitly name what differentiates it from the sibling summarize/ask tools, but the resource noun alone makes the distinction obvious.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: an agent infers it should call this when it needs an embedding, and the stated $0.01 price plus spending caps give a decision input about whether the call is worth it. There is no explicit when-to-use versus summarize/ask guidance and no stated preconditions or alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

healthx402ai healthA
Read-only

Free. Check GET /health on api.x402ai.dev and show local session spend. No key needed.

NameRequiredDescriptionDefault

No parameters

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and openWorldHint, so safety is covered. The description adds useful behavioral context beyond annotations: the call is free, requires no key, and surfaces local session spend. It does not discuss rate limits or response shape, but for a health probe the added context is meaningful.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three short fragments with no wasted explanation. It conveys cost, auth, the endpoint checked, and the local spend behavior efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no parameters, annotations covering read-only/open-world behavior, and no output schema, the description supplies enough to invoke it: endpoint, cost, auth, and local spend display. It could clarify exactly what 'local session spend' returns, but that is a minor gap for a simple health/status tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are zero parameters, so the schema imposes no parameter semantics burden; the baseline score of 4 applies. The description does not need to explain parameter meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a concrete action: check GET /health on api.x402ai.dev, plus a secondary output of showing local session spend. The dual purpose is slightly unusual, but an agent can identify the tool as a health/status probe with spend visibility. Sibling differentiation is not critical because embed, summarize, ask, and inspect are unrelated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides some usage context with 'Free' and 'No key needed', implying a low-friction diagnostic call. However, it does not explicitly say when to use this versus inspect or other alternatives, nor does it state exclusions. Usage remains implied rather than clearly guided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

inspectx402 inspectA
Read-only

Free, never signs or pays. Fetch an https URL unpaid, decode its x402 payment-required header, and check it with Coinbase CDP validate and merchant discovery. Sends the URL to api.cdp.coinbase.com.

NameRequiredDescriptionDefault
urlYesThe https URL of the x402-protected endpoint to inspect (max 2048 chars).
methodNoHTTP method for the unpaid probe request. Defaults to POST.POST

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and openWorldHint, so the safety bar is lower; the description still adds that no signature or payment ever occurs and that the URL is transmitted to api.cdp.coinbase.com, which is genuinely useful disclosure of external data flow. It does not describe the shape of the returned decode/validation result.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences, with the most decision-relevant fact ('Free, never signs or pays') front-loaded, followed by the mechanism and the data destination. No filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter, read-only probing tool with full schema coverage, the description covers what it does, its cost/safety profile, and where data is sent. The main omission is what the response contains, which matters slightly since no output schema exists.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so both parameters are already documented in the schema, including the GET/POST enum and default. The description adds no semantics about the method parameter or URL constraints, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States specific verbs and objects: fetch an https URL unpaid, decode its x402 payment-required header, and validate via Coinbase CDP. The vague name 'inspect' is fully disambiguated, and none of the siblings (embed, summarize, ask, health) overlap with this capability.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Free, never signs or pays' gives clear selection context: use this to probe an x402 endpoint without spending or authenticating. It stops short of explicit when-not guidance (e.g., when to skip inspection and pay directly), but no sibling competes for this job.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

summarizex402ai summarizeA

Summarize text. Costs $0.02 (USDC on Base) per call; takes 5-16 s. Spends real money; subject to a per-payment and per-session cap. Pass the text in input (max 3000 chars).

NameRequiredDescriptionDefault
inputYesThe text to process, passed as "input": the text to embed or summarize, or for ask, the question. 1-3000 characters.

TDQS

A4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only flag non-read-only, open-world, non-idempotent; the description goes well beyond them by disclosing real-money spend, the payment rail, per-payment and per-session caps, and an expected 5–16 s runtime. These are exactly the operational facts an agent needs before committing to a paid, slow call, and nothing contradicts the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences: purpose first, then cost/latency, then the parameter constraint. Every clause carries decision-relevant information and nothing is padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter tool with no output schema, the description covers cost, timing, spend limits, and input bounds — enough to call it safely. It stops short of describing the shape of the returned summary, which matters slightly given there is no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the single `input` parameter is fully documented in the schema, including the 3000-char bound. The description restates the max length but adds no new semantics, so the baseline applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening "Summarize text" states a concrete verb and resource, and the sibling set (embed, ask, health, inspect) makes the intended distinction reasonably obvious. It does not explicitly name an alternative, so differentiation is inferred rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Cost ($0.02 USDC on Base) and latency (5–16 s) give strong signals for deciding whether to call this now, but the description never says when to prefer it over `ask` or `embed`, nor any preconditions. Usage is implied rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 5 tool updatesv0.1.0
    • First observedask
    • First observedembed
    • First observedhealth
    • First observedinspect
    • First observedsummarize

TDQS

A4/5.0

Scored across 5 tools

Disambiguation5/5

Each tool has a clearly distinct purpose: embed computes vectors, summarize condenses text, ask answers questions, health checks service/session spend, and inspect handles unpaid x402 URL diagnostics. Health and inspect are both free diagnostics, but their descriptions make the boundary clear.

Naming Consistency4/5

The tool names are short lowercase single words with mostly action verbs (embed, summarize, ask, inspect), and only health is a noun. This is a minor deviation from a strict verb pattern but remains highly readable and predictable.

Tool Count5/5

Five tools is well-scoped for a small paid AI API surface: three paid operations plus two diagnostic utilities. Each tool earns its place without an excessive surface.

Completeness4/5

The surface covers the core paid AI operations and includes health/session-spend and x402 inspection utilities. A minor gap is the absence of a dedicated pricing, balance, or payment-status tool beyond local session spend in health.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    A
    maintenance
    A budget-bound x402 payment wallet for AI agents: it autonomously pays HTTP 402 payment-gated URLs across every major chain (EVM, Solana, and many non-EVM families). Self-custodial and backendless, your key, your RPC, with spend caps enforced before any on-chain send.
    8
    9
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables AI assistants to call pay-per-call x402 endpoints on Base mainnet using the caller's own USDC wallet, covering single and batch token risk checks, the latest BTC radar signal, project info, and a free health probe. Payments are EIP-3009 signed with a configurable per-call spending cap, and any quote with an unexpected payee, network, or asset is refused before payment.
    MIT