AgentPay-mcp
AgentPay MCP is a Model Context Protocol server that provides AI agents with a governed payment wallet featuring spend controls, human-approval workflows, and audit trails across multiple payment protocols and blockchain networks.
Wallet Management
deploy_wallet: Deploy a new smart contract wallet (AgentAccountV2) using CREATE2 deterministic addressingget_wallet_info: Retrieve wallet address, balances, spend limits, remaining period allowance, and transaction queue depth
Governed Payments
send_payment: Send ETH or ERC-20 tokens; transactions within spend limits execute immediately, over-limit transactions are queued for human reviewcheck_spend_limit: Verify whether a proposed payment is within autonomous spend limits before transactingset_spend_policy: Enforce on-chain per-transaction caps, daily aggregate limits, and recipient allowlists via smart contracts
Human-in-the-Loop Oversight
queue_approval: List, approve, or cancel over-limit transactions queued for owner review
Automated x402 Payments
x402_pay: Fetch a URL and automatically handle HTTP 402 Payment Required responses, with support for payment caps and session reusex402_session_start: Pay once to establish a reusable signed session token for repeated API calls to a single endpointx402_session_fetch: Make HTTP requests within an active session without additional paymentsx402_session_status: View active sessions with TTL remaining, call counts, and payment infox402_session_end: Explicitly close an active session before natural expiry
Audit & Compliance
get_transaction_history: Retrieve filterable on-chain transaction history (executions, queued, approvals, cancellations, policy updates) for FinOps and compliance reporting
Additional Highlights
Multi-chain support: Base, Arbitrum, Optimism, Polygon, Ethereum, and other EVM networks
Multi-protocol support: x402 V1/V2, Stripe Machine Payments Protocol, and Circle Nanopayments
Non-custodial key management with EU AI Act, CoSAI, and OAuth 2.1 alignment
Compatible with Claude, Cursor, NVIDIA NeMo-Agent-Toolkit, Google A2A, and OpenAI Delegated Payment Spec
Facilitates multi-chain USDC settlement using Circle's CCTP infrastructure for cross-chain payments.
Enables non-custodial payments and native USDC settlement on the Base Layer 2 network.
Supports on-chain payment execution and x402-native settlement on the Polygon network.
Provides tools for automated on-chain payments and native USDC settlement on the Stellar network.
AgentPay MCP
AgentPay MCP is a stdio Model Context Protocol server for x402 payments and wallet operations. It exposes Agent Wallet SDK functions as MCP tools and loads a caller-controlled signing key from the local process environment.
The current npm package is agentpay-mcp v4.1.17.
Start without funds
Check the installed command without loading wallet credentials:
npx -y agentpay-mcp --version
npx -y agentpay-mcp --helpUse the AgentPay Wallet Starter for a no-funds verification of allowed, approval-required, and blocked policy outcomes.
Related MCP server: 402-mcp
MCP client configuration
Wallet tools read the following environment variables:
Variable | Required for wallet tools | Meaning |
| Yes | Local hot-wallet signing key |
| Yes | Deployed |
| No |
|
| No | Caller-selected Base RPC endpoint |
| For deployment | Wallet factory address |
| For deployment | Token contract bound to a wallet |
| No | Local session lifetime in seconds |
Example MCP configuration:
{
"mcpServers": {
"agentpay": {
"command": "npx",
"args": ["-y", "agentpay-mcp"],
"env": {
"AGENT_PRIVATE_KEY": "<secret-reference-or-local-key>",
"AGENT_WALLET_ADDRESS": "0x<deployed-wallet-address>",
"CHAIN_ID": "84532"
}
}
}
}Do not commit a real signing key. Use the client or operating system's secret mechanism where one exists. Start on Base Sepolia before using Base mainnet.
Tool groups
The tool registry in src/index.ts exposes these groups:
Group | Examples |
Wallet |
|
Payments |
|
Policy |
|
Tokens | Lookup, custom-token registration, balances, and transfers |
Execution | Swap, USDC bridge, and mutual-stake escrow |
Trust | ERC-8004 identity, reputation, and UAID verification |
History |
|
Tool schemas and handlers live under src/tools/.
Security boundaries
These boundaries matter more than the feature list:
The server reads
AGENT_PRIVATE_KEYinto its local Node.js process and uses viem for signing. Protect the process, environment, and MCP client config.set_spend_policystores policy in the MCP server process. The same agent can call that tool again, and a process restart clears its rolling state.Every current value-moving handler calls the in-process policy check, but this is still application-level enforcement.
On-chain limits exist only when the wallet owner configures them directly on
AgentAccountV2.set_spend_policydoes not write those contract limits.An over-limit transaction is a human gate only when the owner key is kept separate from the agent key.
get_transaction_historyreads on-chain wallet events. It is not an MCP request log and does not record rejected pre-chain attempts or read-only calls.Runtime wallet configuration currently supports Base mainnet and Base Sepolia. Unsupported chain IDs fail closed in
src/utils/client.ts.Swap, bridge, escrow, and payment tools can move funds and consume gas. Test with bounded values and independent wallet limits.
Read docs/security-posture.md for the detailed
control map and known limitations.
Technical proof index
The repository keeps deeper interoperability and buyer-safety evidence in versioned documents:
docs/agentpay-buyer-flow-parity.mdcovers typed payment errors and buyer flow behavior.docs/paid-mcp-gateway-hardening.mdcovers default-deny controls and quota envelopes.docs/agentpay-five-tool-parity-proof.mdrecords the five-tool parity check.docs/agentpay-escrow-reputation-boundary.mddefines the escrow and reputation boundary.docs/paid-mcp-proxy-discovery-readiness.mdrecords discovery readiness evidence.docs/x402-chain-neutral-gateway-profile.mddefines the packaged chain-neutral profile.docs/x402-dynamic-paid-mcp-manifest-drift.mddocuments checks for stale paid-tool metadata.docs/mcp-registry-listing-proof.mdandllms.txtexpose directory metadata.docs/smithery-paid-mcp-installation.mdandexamples/smithery-paid-mcp-installationdocument the packaged Smithery path without asserting a live listing.docs/paid-provider-health-proof.mddefines provider-health evidence.docs/hosted-x402-proxy-verification.mddefines hosted-proxy preflight checks.docs/x402-native-vs-stripe-proxy.mdseparates local spend control from hosted proxy billing.docs/dependency-pin-policy.mddefines the release gate for payment-critical packages.
AgentPay pins viem exactly at 2.56.0.
The directory comparison was captured against agentpay-mcp@4.1.9; the
package version at the top of this README is the current release.
Verify a clean checkout
npm ci
npm run build
npm run typecheck
npm test
npm run lint
npm run security
npm run smoke:clean-installThe CI workflow is separate from scheduled daily review and repair workflows. A scheduled-review failure is not a product-test result, and a repair success does not replace CI.
Related repositories
Agent Wallet SDK provides the wallet and policy library used by this server.
AgentPay Wallet Starter provides the combined no-funds onboarding path.
NVIDIA NeMo Agent Toolkit Examples PR 17 is an independently merged integration example.
Support and disclosure
File product bugs through the GitHub issue queue.
Report security issues through
SECURITY.md.Contribution rules live in
CONTRIBUTING.md.
License
MIT. See LICENSE.
Available Tools
11 toolscheck_spend_limitA
Check whether a proposed payment amount is within the wallet's autonomous spend limits. Returns a clear yes/no with remaining budget details. Use this before send_payment to avoid surprise queuing.
| Name | Required | Description | Default |
|---|---|---|---|
| amount_eth | Yes | Amount in ETH to check (e.g. "0.01") | |
| token | No | Token address. Omit for native ETH. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It does well by explaining the return format ('clear yes/no with remaining budget details') and the practical consequence ('avoid surprise queuing'), but doesn't mention authentication requirements, rate limits, error conditions, or whether this is a read-only operation (though 'check' implies it).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is perfectly concise with two sentences that each earn their place. The first sentence states the purpose and return value, the second provides crucial usage guidance. No wasted words, and the most important information (what it does) is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 2-parameter tool with no annotations and no output schema, the description does well by explaining the purpose, return format, and usage context. However, it could be more complete by explicitly stating this is a read-only operation (implied but not stated) and mentioning any authentication requirements. The connection to 'send_payment' is excellent contextual guidance.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already fully documents both parameters. The description doesn't add any parameter-specific information beyond what's in the schema (it mentions 'proposed payment amount' which aligns with 'amount_eth' but provides no additional syntax or format details). Baseline 3 is appropriate when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with specific verb ('check') and resource ('proposed payment amount'), and distinguishes it from sibling tools by explicitly mentioning 'send_payment' as an alternative. It explains what the tool does (verifies if amount is within wallet's autonomous spend limits) and what it returns (yes/no with budget details).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on when to use this tool ('Use this before send_payment to avoid surprise queuing'), clearly positioning it as a prerequisite check. It distinguishes from the 'send_payment' sibling by explaining the sequential relationship and purpose (avoid queuing).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
deploy_walletA
Deploy a new AgentAccountV2 wallet via the factory contract. The wallet is deterministically addressed (CREATE2) and owned by an NFT. Returns the wallet address and deployment transaction hash. Requires FACTORY_ADDRESS and NFT_CONTRACT_ADDRESS env vars (or pass them as arguments).
| Name | Required | Description | Default |
|---|---|---|---|
| token_id | Yes | NFT token ID that will own this wallet (e.g. "1") | |
| nft_contract_address | No | NFT contract address. Defaults to NFT_CONTRACT_ADDRESS env var. | |
| factory_address | No | Factory contract address. Defaults to FACTORY_ADDRESS env var. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It effectively describes key behaviors: the deterministic addressing (CREATE2), NFT ownership, return values (wallet address and transaction hash), and environment variable requirements. It doesn't mention potential side effects like gas costs or blockchain confirmation times, but covers the core operational behavior adequately for a deployment tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is efficiently structured in two sentences: the first states the core purpose and key characteristics, the second covers return values and configuration options. Every phrase adds value with zero redundant information, making it easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a deployment tool with no annotations and no output schema, the description provides good coverage: it explains what the tool does, how it works, what it returns, and configuration options. The main gap is the lack of explicit output format details (though 'wallet address and deployment transaction hash' gives a general idea), but given the tool's straightforward purpose, this is reasonably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all three parameters thoroughly. The description adds minimal parameter semantics beyond the schema, mainly noting that factory_address and nft_contract_address can come from environment variables. This meets the baseline expectation when schema coverage is high.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('Deploy a new AgentAccountV2 wallet'), the mechanism ('via the factory contract'), and key characteristics ('deterministically addressed (CREATE2) and owned by an NFT'). It distinguishes this tool from sibling tools like 'check_spend_limit' or 'send_payment' by focusing on wallet creation rather than transaction management or querying.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use this tool: to deploy a new wallet with specific ownership and addressing. It mentions environmental variable alternatives ('Requires FACTORY_ADDRESS and NFT_CONTRACT_ADDRESS env vars (or pass them as arguments)'), which helps guide parameter usage. However, it doesn't explicitly state when NOT to use it or compare it to specific sibling tools for similar functions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_transaction_historyA
Retrieve the wallet's recent on-chain transaction history from event logs. Shows executions, queued transactions, approvals, cancellations, spend policy updates, and operator changes. Filter by event type or block range for targeted queries.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max entries to return (default: 20, max: 100) | |
| from_block | No | Start block (decimal string). Defaults to 1000 blocks ago. | |
| to_block | No | End block (decimal string). Defaults to latest. | |
| event_type | No | Filter by event type (default: all) | all |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It describes what data is retrieved ('executions, queued transactions, approvals, cancellations, spend policy updates, and operator changes') but lacks details on permissions, rate limits, pagination, or error handling. It adds some context about filtering but is incomplete for a read operation with no annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose in the first sentence, followed by specific details and usage guidance in the second. Both sentences are essential—no wasted words—making it efficient and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (4 parameters, no annotations, no output schema), the description is adequate but has gaps. It explains what data is retrieved and filtering options, but lacks details on return format, error cases, or prerequisites. Without annotations or output schema, more behavioral context would improve completeness for a historical query tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters thoroughly. The description adds minimal value by mentioning filtering by 'event type or block range', which aligns with the schema but does not provide additional semantics beyond what the schema specifies. Baseline 3 is appropriate as the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('Retrieve') and resource ('wallet's recent on-chain transaction history from event logs'), and distinguishes this tool from siblings by focusing on historical transaction data rather than current operations (like check_spend_limit) or wallet management (like deploy_wallet).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for usage ('Filter by event type or block range for targeted queries'), but does not explicitly state when to use this tool versus alternatives like get_wallet_info or when not to use it. It implies usage for historical queries without naming specific sibling alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_wallet_infoA
Get comprehensive wallet information including address, on-chain balance, spend limits, remaining period allowance, and queue depth. Use token parameter to check budget for a specific ERC20 (defaults to ETH).
| Name | Required | Description | Default |
|---|---|---|---|
| token | No | Token address to check. Use "0x0000000000000000000000000000000000000000" for ETH (default). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It effectively describes the tool's function and scope (read-only data retrieval for wallet status), but lacks details on potential errors, rate limits, authentication needs, or response format. It adds value beyond the schema by explaining the token parameter's purpose, but does not fully compensate for the absence of annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose in the first sentence, followed by specific usage guidance. Both sentences are essential—the first defines scope, the second explains parameter usage—with zero redundant or vague language, making it highly efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (1 optional parameter, no output schema, no annotations), the description is adequate but has gaps. It clearly explains what the tool does and parameter usage, but lacks details on output structure, error conditions, or dependencies. Without annotations or output schema, the description does not fully compensate for these missing elements, making it minimally viable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage, so the baseline is 3. The description adds meaningful context by explaining that the token parameter is used 'to check budget for a specific ERC20' and defaults to ETH, which clarifies the semantic purpose beyond the schema's technical specification. This elevates the score above the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('Get comprehensive wallet information') and enumerates the exact data returned (address, on-chain balance, spend limits, remaining period allowance, queue depth). It distinguishes from siblings like 'get_transaction_history' (historical data) or 'check_spend_limit' (specific limit check) by emphasizing comprehensive status retrieval.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use this tool ('to check budget for a specific ERC20') and mentions the default behavior (defaults to ETH). However, it does not explicitly state when to use alternatives like 'check_spend_limit' for focused limit queries or 'get_transaction_history' for past activity, leaving some sibling differentiation implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
queue_approvalA
Manage over-limit transactions queued for owner review. Use action="list" to see pending transactions, "approve" to approve one by ID, or "cancel" to cancel one by ID. Approve/cancel require the agent key to have owner privileges.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action: "list", "approve", or "cancel" | |
| tx_id | No | Transaction queue ID (required for approve/cancel) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses key behavioral traits: the tool manages queued transactions for review, requires owner privileges for approve/cancel actions, and implies mutation capabilities (approve/cancel are destructive). However, it lacks details on error handling, rate limits, or response formats, leaving some gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the purpose, followed by usage instructions and prerequisites in two concise sentences. Every sentence adds essential information without redundancy, making it efficient and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations and no output schema, the description does well by covering purpose, usage, and behavioral aspects like privileges. However, it lacks details on return values, error cases, or pagination for the list action, which could be important for a tool with mutation capabilities.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds value by explaining the semantics of the 'action' parameter (list for pending transactions, approve/cancel by ID) and clarifying that 'tx_id' is required for approve/cancel, which enhances understanding beyond the schema's enum and required fields.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Manage over-limit transactions queued for owner review.' It specifies the verb ('manage') and resource ('over-limit transactions'), distinguishing it from sibling tools like check_spend_limit or send_payment, which handle different aspects of transactions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit usage guidance: 'Use action="list" to see pending transactions, "approve" to approve one by ID, or "cancel" to cancel one by ID.' It also specifies prerequisites: 'Approve/cancel require the agent key to have owner privileges,' clearly indicating when and how to use each action.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
send_paymentA
Send ETH or ERC20 tokens from the Agent Wallet. If the amount is within the configured spend limits, it executes immediately and returns the tx hash. If it exceeds limits, the transaction is queued for owner approval (use queue_approval to manage). Always check spend limits first with check_spend_limit to avoid surprises.
| Name | Required | Description | Default |
|---|---|---|---|
| to | Yes | Recipient wallet address (0x-prefixed) | |
| amount_eth | Yes | Amount in ETH (or token units). E.g. "0.001" for 0.001 ETH, "1.5" for 1.5 USDC | |
| token | No | ERC20 token address. Omit for native ETH. | |
| token_decimals | No | Token decimals (default 18 for ETH, 6 for USDC) | |
| memo | No | Optional memo for this payment (not stored on-chain) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It effectively describes key behaviors: immediate execution within limits, queuing for owner approval if exceeding limits, and the need to check limits first. It doesn't cover rate limits or auth needs, but provides substantial operational context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is efficiently structured with three sentences: purpose, conditional behavior, and prerequisite action. Every sentence adds value—no wasted words—and it's front-loaded with the core functionality.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a payment tool with no annotations and no output schema, the description does well by explaining the execution flow (immediate vs. queued) and linking to related tools. It could mention return values (tx hash) more explicitly, but overall it's quite complete given the context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters thoroughly. The description doesn't add any parameter-specific semantics beyond what's in the schema (e.g., it doesn't explain token address format or memo usage further). Baseline 3 is appropriate when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Send ETH or ERC20 tokens from the Agent Wallet.' It specifies the action (send), resources (ETH/ERC20 tokens), and source (Agent Wallet), distinguishing it from siblings like check_spend_limit or get_transaction_history.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on when to use this tool vs. alternatives: 'Always check spend limits first with check_spend_limit to avoid surprises.' It also explains what happens if limits are exceeded (queued for approval, use queue_approval to manage), offering clear context and exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
x402_payA
Fetch a URL and automatically handle HTTP 402 Payment Required responses. If an active x402 V2 session covers this URL, the session token is used instead of making a new payment (no on-chain cost). If no session exists, the Agent Wallet pays the required amount and retries. Payment is rejected if it exceeds your wallet's spend limits or the max_payment_eth cap. Powered by the x402 protocol on Base network. Tip: Use x402_session_start to pay once for a session and save on repeated calls.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | URL to fetch (HTTP 402 responses are handled automatically) | |
| method | No | HTTP method (default: GET) | GET |
| headers | No | Additional request headers | |
| body | No | Request body string (for POST/PUT/PATCH) | |
| max_payment_eth | No | Maximum payment cap in ETH (e.g. "0.001") | |
| timeout_ms | No | Timeout in milliseconds (default: 30000) | |
| skip_session_check | No | Skip session auto-detection and force a fresh x402 payment |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It effectively describes key behaviors: automatic handling of HTTP 402 responses, session token usage to avoid costs, payment rejection based on spend limits or max_payment_eth cap, and the underlying x402 protocol on Base network. However, it lacks details on error handling or response formats, leaving some gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately sized and front-loaded, with the core functionality stated first. Each sentence adds value: explaining session handling, payment logic, rejection conditions, protocol details, and a usage tip. There is no wasted text, making it efficient and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (payment handling, session management) and no annotations or output schema, the description is largely complete. It covers the main behavioral aspects and usage context. However, it could benefit from more details on error scenarios or response formats to achieve full completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 100%, so the schema already documents all 7 parameters thoroughly. The description adds minimal parameter semantics beyond the schema, such as implying 'url' is the target for payment handling and 'max_payment_eth' sets a cap. Baseline 3 is appropriate as the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: fetching a URL while automatically handling HTTP 402 Payment Required responses. It specifies the verb ('fetch') and resource ('URL'), and distinguishes it from siblings by mentioning the x402 protocol and session handling capabilities, unlike generic payment or session tools in the sibling list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on when to use this tool vs alternatives. It states to use 'x402_session_start to pay once for a session and save on repeated calls,' indicating an alternative for cost-saving scenarios. It also implies usage for URLs requiring payment, with no misleading suggestions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
x402_session_endA
Explicitly close an x402 V2 session before it expires naturally. After calling this, x402_session_fetch will return an error for the closed session. Useful for security hygiene or when you know a session is no longer needed.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | Session ID to close (from x402_session_start) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It effectively describes key behaviors: it's a destructive operation (closes a session), has side effects (x402_session_fetch will return an error), and mentions security implications. It doesn't cover rate limits or authentication needs, but provides substantial context beyond basic function.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is efficiently structured in two sentences: the first states the core action and immediate effect, the second provides usage context. Every phrase adds value without redundancy, making it front-loaded and appropriately sized for the tool's complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (destructive operation with security implications), no annotations, and no output schema, the description does well by explaining the action, effects, and usage scenarios. It could be more complete by mentioning authentication requirements or response format, but it covers the essential context for safe use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage, with the session_id parameter fully documented in the schema. The description adds no additional parameter semantics beyond what the schema provides, such as format examples or constraints. This meets the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('explicitly close') and resource ('an x402 V2 session'), distinguishing it from siblings like x402_session_fetch, x402_session_start, and x402_session_status. It precisely defines what the tool does beyond just restating the name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use this tool ('before it expires naturally', 'useful for security hygiene or when you know a session is no longer needed') and provides a clear alternative (letting it expire naturally). It also mentions the consequence for x402_session_fetch, guiding usage relative to siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
x402_session_fetchA
Make an HTTP request within an established x402 V2 session — NO payment required. The session token (signed by your wallet) is automatically attached to the request. The server recognises your session and grants access without a new on-chain payment. Requires a session_id from x402_session_start. Returns an error if the session has expired (call x402_session_start again to renew).
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | Session ID from x402_session_start | |
| url | Yes | URL to fetch (must be covered by the session) | |
| method | No | HTTP method (default: GET) | GET |
| headers | No | Additional headers (session token is injected automatically) | |
| body | No | Request body for POST/PUT/PATCH | |
| timeout_ms | No | Timeout in milliseconds (default: 30000) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden and does well by disclosing key behaviors: it automatically attaches the session token, grants access without payment, and returns an error for expired sessions. However, it lacks details on rate limits, authentication needs beyond the session, or what specific errors might occur, leaving some gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose in the first sentence, followed by essential context and error handling. Every sentence adds value—no wasted words—and it's structured logically from usage to prerequisites to error resolution.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (session-based HTTP requests with 6 parameters), no annotations, and no output schema, the description is mostly complete. It covers purpose, usage, prerequisites, and error handling, but lacks details on return values or advanced behavioral traits like rate limits, which would be helpful for full completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters thoroughly. The description adds minimal value beyond the schema, only implying that the URL must be 'covered by the session' and noting automatic token injection, but doesn't provide additional syntax or format details. Baseline 3 is appropriate as the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('Make an HTTP request within an established x402 V2 session') and resource (session-based HTTP requests), distinguishing it from siblings like x402_session_start (which creates sessions) and x402_pay (which involves payments). It explicitly notes 'NO payment required' to differentiate from payment-related tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on when to use this tool ('within an established x402 V2 session'), prerequisites ('Requires a session_id from x402_session_start'), and alternatives for errors ('call x402_session_start again to renew'). It also clarifies when not to use it ('NO payment required'), distinguishing it from payment tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
x402_session_startA
Establish an x402 V2 payment session: make a SINGLE on-chain payment and receive a cryptographically signed session token. All subsequent calls to the same endpoint within the session lifetime use x402_session_fetch — no additional payments required. Agents pay once per session rather than once per API call. Session tokens are signed locally by your wallet key (non-custodial). Returns a session_id you pass to x402_session_fetch for all future calls.
| Name | Required | Description | Default |
|---|---|---|---|
| endpoint | Yes | Base URL to establish a session for (e.g., "https://api.example.com/v1") | |
| scope | No | "prefix": covers all paths under this URL (default). "exact": single URL only. | prefix |
| ttl_seconds | No | Session TTL in seconds (default: 3600 / 1 hour). Max: 30 days. | |
| label | No | Optional label for this session (e.g., "Premium API session") | |
| max_payment_eth | No | Maximum ETH to pay for this session. Rejects if price exceeds this. | |
| method | No | HTTP method for the initial request (default: GET) | GET |
| headers | No | Additional request headers | |
| body | No | Request body for POST/PUT/PATCH session-start requests | |
| timeout_ms | No | Request timeout in milliseconds (default: 30000) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It effectively describes key behaviors: the payment mechanism (on-chain payment), session token characteristics (cryptographically signed, non-custodial), session lifetime concept, and the relationship with x402_session_fetch. It could be improved by mentioning error conditions or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and efficiently conveys essential information in four sentences. Each sentence adds value: establishing the session, explaining the session-fetch relationship, describing the payment model, and detailing the token characteristics. There's no wasted text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 9 parameters, no annotations, and no output schema, the description provides good context about the tool's purpose, usage patterns, and behavioral characteristics. It explains the return value (session_id) and how to use it. It could be more complete by mentioning error conditions or providing examples of typical use cases.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 100% schema description coverage, the schema already documents all 9 parameters thoroughly. The description adds some context about the session establishment process but doesn't provide additional parameter-specific semantics beyond what's in the schema. This meets the baseline expectation when schema coverage is complete.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Establish an x402 V2 payment session' with specific details about making a single on-chain payment and receiving a signed session token. It distinguishes from sibling tools like x402_session_fetch by explaining the relationship between them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit usage guidelines: 'All subsequent calls to the same endpoint within the session lifetime use x402_session_fetch — no additional payments required.' It clearly explains when to use this tool versus its sibling x402_session_fetch, and mentions the 'Agents pay once per session rather than once per API call' principle.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
x402_session_statusA
Check the status of x402 V2 payment sessions. Without arguments, lists all active sessions with TTL remaining. With a session_id, shows full details for that session including call count, payment info, and the signed session token.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | No | Specific session ID to inspect. Omit to list all active sessions. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that the tool can list sessions or show details, but lacks information on permissions, rate limits, error conditions, or response format. It adds some context about TTL and details like call count and payment info, but behavioral traits are incomplete.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded and concise, with two sentences that efficiently cover purpose and usage without wasted words. Every sentence earns its place by providing essential information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations and no output schema, the description is moderately complete for a read-only tool. It explains what the tool does and how to use it, but lacks details on return values, error handling, or operational constraints, leaving gaps in context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents the parameter. The description adds value by explaining the semantic effect: omitting the parameter lists all active sessions, while including it shows full details for a specific session. This goes beyond the schema's basic description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with specific verbs ('check', 'lists', 'shows') and resources ('x402 V2 payment sessions'), and distinguishes it from siblings by focusing on session status rather than creation, ending, or payment actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states when to use the tool: 'Without arguments, lists all active sessions with TTL remaining. With a session_id, shows full details for that session.' This provides clear guidance on usage based on parameter presence.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
11 tool updates
v3.0.1- First observed
check_spend_limit - First observed
deploy_wallet - First observed
get_transaction_history - First observed
get_wallet_info - First observed
queue_approval - First observed
send_payment - First observed
x402_pay - First observed
x402_session_end - First observed
x402_session_fetch - First observed
x402_session_start - First observed
x402_session_status
TDQS
The tools are mostly distinct with clear purposes, but there is some overlap between check_spend_limit and send_payment, as both involve spend limit checks, which could cause minor confusion. The x402 session tools are well-differentiated, and other tools like deploy_wallet and get_transaction_history have unique functions.
Naming is mostly consistent with a verb_noun pattern, such as check_spend_limit and send_payment, but there are minor deviations like x402_pay (which mixes protocol prefix with verb) and the x402_session_* tools that use a consistent prefix but vary in verb style. Overall, it's readable with only slight inconsistencies.
With 11 tools, the count is well-scoped for managing AgentPay wallets and x402 payments. Each tool serves a specific purpose, such as deployment, transactions, and session management, without feeling excessive or insufficient for the domain.
The tool set provides comprehensive coverage for wallet management and x402 payment handling. It includes deployment, transaction sending, limit checks, history retrieval, approval queuing, and full session lifecycle management, leaving no obvious gaps for the intended use cases.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Policy-gated MCP treasury for AI agents — x402 subscribe, 50+ tools, multi-chain.
Monetize any MCP server: x402 paywall, pay-per-call billing in USDC on Base, agent marketplace.
Agent Commerce Protocol MCP — bridges Stripe ACP + Google AP2 + Coinbase x402 for agent payments
15 paid AI agent primitives via x402 (USDC on Base). Pay-per-call MCP server.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceAg402 is the payment layer for Coinbase's x402 protocol. Wrap any API or MCP server with a paywall in one command (ag402 serve), or let your AI agent auto-pay for paid APIs (ag402 run). Zero code changes for both buyers and sellers. Solana USDC, ~0.5s settlement, non-custodial, 648+ tests, MIT licensed. Works with Claude Code, Cursor, OpenClaw, LangChain, AutoGen, CrewAI out of the box.9MIT
- AlicenseAqualityAmaintenanceL402 + x402 client MCP. AI agents discover, pay for, and consume any payment-gated API autonomously. Supports Lightning (NWC), Cashu ecash, stablecoins, and human-in-the-loop payments.11284MIT
- AlicenseNot gradedqualityBmaintenanceDrop-in x402 payment middleware for MCP servers. Charge AI agents per tool call using USDC on Base chain — Python and JavaScript SDKs, no payment processor, no KYC.MIT
- AlicenseAqualityDmaintenanceAn MCP server that lets your AI coding agent (Claude Code, OpenClaw, Codex, Cursor, etc.) discover and pay on-chain agents registered on ERC-8004, using Coinbase's official x402 protocol. No smart account. No bundler. No relay. Just your EOA, an HTTPS request, and an automatic 402 → sign → retry flow.35MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/up2itnow0822/agentpay-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server