ClawPay

AI Shopping Agent — connects your AI to Lithic virtual cards, Stripe, and PayPal.

⚖️ Legal Notice

ClawPay is a SOFTWARE CONNECTOR ONLY. We do NOT:

• Handle, hold, or transmit your funds

• Act as a money transmitter or payment processor

• Have access to your money at any time

Money flows directly: YOU ↔ Lithic / Stripe / PayPal. ClawPay only connects APIs and automates browser forms.

You are responsible for compliance with payment provider terms and applicable laws. See DISCLAIMER.md for full legal terms.

Quick Start

npm install -g @xodn348/clawpay
npx playwright install chromium
export LITHIC_API_KEY=your_production_key
clawpay install

Then ask your AI: "Buy me a blue t-shirt on automationexercise.com"

How It Works

1. Tell your AI what to buy and where

2. ClawPay navigates the store and shows you a summary

3. You confirm — no auto-purchase ever

4. A Lithic single-use virtual card is created and used for checkout

5. Card self-destructs. PAN/CVV never touch disk or logs.

MCP Tools

Environment Variables

Guardrails

Default limits: $100/transaction, $500/day, USD only.

Override in ~/.clawpay/config.json:

{
  "guardrails": {
    "maxAmountPerTransactionCents": 10000,
    "maxDailySpendCents": 50000,
    "allowedCurrencies": ["usd"]
  }
}

Client Setup

Claude Code:

claude mcp add -s user clawpay -e LITHIC_API_KEY=your_key -- clawpay

opencode.json / Claude Desktop / Cursor:

{
  "mcp": {
    "clawpay": {
      "type": "local",
      "command": ["clawpay"],
      "environment": { "LITHIC_API_KEY": "your_key" }
    }
  }
}

Security

• PAN/CVV exist in memory only during checkout — never logged, never stored

• Stripe card data handled by PCI-compliant Stripe Checkout

• All actions logged to ~/.clawpay/audit.log (no sensitive data)

• Guardrails block excessive spending before it reaches the API

For vulnerabilities: SECURITY.md

License

Apache 2.0 — LICENSE. Full legal terms: DISCLAIMER.md.