PARANOID MCP
OfficialPARANOID MCP lets you privately query AI models and manage prepaid question credits through MCP tools.
ask— ask a model a question privately; optionalmodelandsystem; spends the model's question price.models— list available models and per-message question costs.balance— check how many questions remain and the last usable day.buy— buy a new membership via x402 USDC on Solana fromPARANOID_PAYER(minimum 250 questions, 0.002 USDC/question plus 0.30 USDC setup fee).
Supports x402 payments so agents can autonomously buy question memberships from a configured wallet.
Exposes an OpenAI-compatible local API endpoint, allowing apps that speak the OpenAI API to send questions through the private PARANOID connector.
Uses Solana for USDC payments and membership commitments, enabling wallet-based purchases of private question credits and on-chain member verification.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@PARANOID MCPask DeepSeek to explain zero-knowledge proofs simply"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
PARANOID MCP
Ask AI models in private from Claude Code, Cursor or any MCP client. Every question carries a fresh zero-knowledge proof made on your own computer, so the PARANOID gateway can check that it was paid for without learning which member asked or tying it to any other question. To keep your network address apart as well, see What stays visible.
PARANOID runs open models such as DeepSeek, Kimi, Qwen and GLM, including uncensored ones. Questions are bought once with USDC on Solana, and agents can buy them on their own with x402. The Solana program and the circuit behind every proof are open at paranoiddotred/paranoid, and that source builds to the exact bytes deployed on mainnet.
It is listed in the official MCP Registry
as io.github.paranoiddotred/paranoid-mcp, published straight from each release by CI, and on
Glama.
Install
The quick way
Claude Desktop. Download paranoid.mcpb from the latest release
and double-click it, or drag it into the Claude window. Paste the connector code from the Keys tab on
paranoid.red into its settings, or choose a Solana wallet file holding USDC so the buy
tool can get questions. Claude Desktop brings its own Node.js, so there is nothing else to install.
Cursor.
Claude Code.
claude mcp add paranoid -- npx -y github:paranoiddotred/paranoid-mcp#v1.4.1 mcpCursor and Claude Code run it straight from this repository with npx, pinned to the release tag so you get the
version whose hashes are published, and that needs Node.js and git. To use
questions you already bought, run it once in a terminal and paste the connector code when it asks, so the code
never lands in your shell history. It then serves the local endpoint until you stop it with Ctrl+C.
npx -y github:paranoiddotred/paranoid-mcp#v1.4.1You can also put the code in the client's settings as PARANOID_CODE, the way the Claude Desktop extension
does.
By hand
It is one file with no packages to install and needs Node.js 20.18, 22.8 or newer. Download it and check it against the current release in one go:
mkdir -p ~/paranoid && curl -o ~/paranoid/connect.mjs https://paranoid.red/connect.mjs \
&& echo "8f90ee28b74883a46dcf928efaecfcd452591753851283210edf2788cbdd73c1 $HOME/paranoid/connect.mjs" | shasum -a 256 -cThe file paranoid.red serves is byte for byte the connect.mjs in this repository, and every release lists its
SHA-256, so a copy that was changed anywhere on the way fails that check before it ever runs.
You can also build it yourself from src/ and the prover and circuit files where they are published (snarkjs
0.7.6 on npm, the circuit in paranoiddotred/paranoid). CI does the
same on every push and fails if a single byte differs.
bash scripts/fetch-zk.sh && node build.mjs && git diff --exit-code connect.mjsClaude Code
claude mcp add paranoid -e PARANOID_PAYER=$HOME/agent-wallet.json -- node $HOME/paranoid/connect.mjs mcpCursor (~/.cursor/mcp.json)
{
"mcpServers": {
"paranoid": {
"command": "node",
"args": ["/Users/you/paranoid/connect.mjs", "mcp"],
"env": { "PARANOID_PAYER": "/Users/you/agent-wallet.json" }
}
}
}PARANOID_PAYER points at a Solana keypair file (the JSON the Solana CLI writes) whose wallet holds USDC. It is needed only to buy questions. If you already have questions on paranoid.red, run node connect.mjs once and paste the connector code from the Keys tab instead.
Related MCP server: omnicall-mcp
Tools
Tool | What it does |
| Asks a model a question with a fresh key and returns the answer. Takes |
| Lists the models and how many questions one message to each costs. |
| Says how many questions are left and the last day they can be used. |
| Buys a new membership with x402 from the wallet in |
Questions cost 0.002 USDC each, 250 at least, plus a 0.30 USDC setup fee when an agent buys with x402. The gateway pays the Solana network fees.
How it stays private
When you buy questions, your computer makes a secret and sends only a commitment to it, which goes into a member list on Solana. For each question, the connector proves in zero knowledge that it holds the secret of some member with questions left, and marks one numbered question as spent with a nullifier that names no member. The gateway verifies the proof and forwards the question to the model, but it never learns which member asked, two questions cannot be tied together through their proofs, and each request travels on a connection of its own.
The gateway runs inside an Intel TDX chip. Before the first question, and every ten minutes after, the connector checks Intel's signature on that chip, a nonce it made itself, and the chip's build against the list of approved builds that PARANOID's 2-of-3 multisig keeps on Solana (p2UnUp...Sfw8), read from a public Solana RPC that PARANOID does not run. Then it seals every request to that chip with Oblivious HTTP and sends it through an independent relay. Nothing on the way, paranoid.red included, can read the question or the answer, and the gateway sees the relay's address instead of yours. If a check fails, nothing is sent. node connect.mjs check runs the checks and one sealed request without spending a question.
Spending the same numbered question twice reveals the secret. Anyone can then slash the membership and recompute every question it ever asked, so keep each membership in one place. The connector writes each number to disk before it is used and reads the public list of spent questions before every key, so this cannot happen by accident.
The design follows zkAPI by Vitalik Buterin and Davide Crapis, from the Ethereum Foundation and the Open Anonymity Project. PARANOID brings it to Solana.
Use a PARANOID key in any OpenAI app
The Keys tab on paranoid.red gives a key that starts with sk-paranoid-. It works like an OpenAI API key, so any app or SDK that lets you set the OpenAI base URL can run on PARANOID with two settings.
Base URL https://paranoid.red/api/v1
API key sk-paranoid-...With the OpenAI SDK for Node.js:
import OpenAI from "openai";
const client = new OpenAI({ baseURL: "https://paranoid.red/api/v1", apiKey: process.env.PARANOID_KEY });
const res = await client.chat.completions.create({
model: "default",
messages: [{ role: "user", content: "Explain zero-knowledge proofs in two lines." }],
});
console.log(res.choices[0].message.content);With the OpenAI SDK for Python:
import os
from openai import OpenAI
client = OpenAI(base_url="https://paranoid.red/api/v1", api_key=os.environ["PARANOID_KEY"])
res = client.chat.completions.create(model="default", messages=[{"role": "user", "content": "Hello"}])
print(res.choices[0].message.content)With curl:
curl https://paranoid.red/api/v1/chat/completions \
-H "Authorization: Bearer $PARANOID_KEY" \
-H "Content-Type: application/json" \
-d '{"model":"default","messages":[{"role":"user","content":"Hello"}]}'GET https://paranoid.red/api/v1/models lists the models and what one message to each costs. A model name the gateway does not know goes to the default model, so apps that insist on a name of their own still work.
The key is a bundle of proofs made on your device and stops working when the day ends. For an app or agent that stays on, run the connector instead: it makes a fresh key for every request, so nothing ever expires.
Other ways to run it
The same file serves the OpenAI API on your computer for any app that speaks it.
node connect.mjs # serves http://127.0.0.1:4141/v1, any API key works
PARANOID_PAYER=wallet.json node connect.mjs buy 500Full documentation is at paranoid.red/docs/agents and paranoid.red/docs/connector.
From the terminal
node connect.mjs ask "What does RFC 9458 change for a relay?"
git diff | node connect.mjs ask "Review this change"
node connect.mjs chat -m <model id>The answer goes to stdout and everything else to stderr, so it can be piped on.
Files it downloads
On its first question the connector downloads the prover and the circuit from paranoid.red and keeps them in ~/.paranoid/zk. With them comes Intel's quote verifier, @phala/dcap-qvl-web 0.3.3 exactly as published on npm. The prover is snarkjs 0.7.6 exactly as published on npm, and the circuit files are the ones published in paranoiddotred/paranoid, so anyone can compare them. Their SHA-256 hashes are written inside connect.mjs, it refuses to run anything that does not match, and the prover runs in a separate JavaScript realm with no network, files or process to reach, so the proof is the only thing that leaves it. SECURITY.md has the details.
License
MIT
Available Tools
4 toolsaskA
Ask one of PARANOID's AI models a question in private. The question goes with a fresh zero-knowledge key made on this computer, so the gateway cannot tell who asked or tie it to any other question. Spends the model's price in questions (see the models tool).
| Name | Required | Description | Default |
|---|---|---|---|
| model | No | A model id from the models tool. Leave it out for the default model. | |
| system | No | Optional instructions for the model. | |
| question | Yes | The question, as you would type it into a chat. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the disclosure burden and does well: it explains the privacy model (fresh zero-knowledge key, gateway cannot identify the asker) and the cost behavior (spends the model's price in questions). It omits error behavior, rate limits, and return details, but adds substantial behavioral context beyond the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the action and followed by the two decision-relevant traits: privacy and cost. Every sentence adds useful information without waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers the key considerations for this paid private query tool: privacy guarantees, question spending, and where to find model IDs. Since there is no output schema, it could explicitly state that the model's answer is returned or describe insufficient-balance behavior, but overall it is complete enough for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description reinforces that model IDs come from the models tool, but it does not add syntax or meaning beyond what the schema already provides for question, model, or system.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'Ask one of PARANOID's AI models a question,' with the additional qualifier 'in private.' This clearly distinguishes it from sibling tools like models, balance, and buy, which are listing/pricing/purchasing operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The primary use case is clear: ask a model a question privately. It also points to the models tool for model IDs/pricing, giving useful context. However, it does not explicitly name the buy or balance alternatives or state when not to use this tool, so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
balanceA
How many questions this membership has left and the last day they can be used.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It discloses that the result is membership-scoped and time-limited, but does not explicitly state that the operation is read-only, requires authentication, consumes no questions, or describes the response format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, efficient sentence that front-loads the key returned information. There is no wasted wording.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter query with no output schema and no annotations, the description sufficiently explains the return values: remaining questions and expiration date. Minor gap is lack of explicit authentication or current-membership context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so there is no parameter semantics to explain. Baseline score of 4 is appropriate for a no-parameter tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the resource and returned information: remaining question count and last usable day for this membership. It is specific enough to distinguish from siblings like ask, buy, and models, though it lacks an explicit verb such as 'returns'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied: check remaining question quota and expiration, likely before calling ask or buy. However, it does not explicitly say when to use this tool versus alternatives or mention prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
buyA
Buy a new membership with an x402 payment in USDC on Solana from the wallet in PARANOID_PAYER: 0.002 USDC a question plus a 0.30 USDC setup fee, 250 questions at least. A membership already here that still has questions is kept in a file beside the new one.
| Name | Required | Description | Default |
|---|---|---|---|
| questions | Yes | How many questions to buy. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does real work: it discloses that this is a real-money purchase, the exact unit price and setup fee, the chain and currency, and — importantly — that an existing membership with remaining questions is preserved rather than overwritten. It stops short of stating irreversibility, failure/refund behavior, or expected latency for an on-chain payment.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two dense sentences, front-loaded with the action and cost — the most decision-relevant facts come first. The closing clause 'kept in a file beside the new one' is vaguely worded and costs a re-read, which keeps it from a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an unannotated, irreversible spend operation with no output schema, the pricing and state-preservation details are valuable, but gaps remain: what a successful call returns (no output schema to fall back on), what happens if payment fails mid-transaction, and how the payer wallet is supplied. An agent could call this correctly but not predict the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter and schema coverage is 100%, so the schema already explains 'questions' fully. The description corroborates the minimum ('250 questions at least') and adds per-question pricing that lets an agent compute total cost, but adds no further semantics beyond that baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource — 'Buy a new membership' — and qualifies it with the payment rail (x402 in USDC on Solana). It is clearly distinguishable from ask/balance/models by implication, though it never names a sibling or states the boundary explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: an agent infers 'call this when you need questions' from the '250 questions at least' clause. There is no guidance on checking balance first, no prerequisites (e.g., needing SOL for fees or how PARANOID_PAYER is configured), and no statement of when not to buy.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
modelsA
List PARANOID's models and how many questions one message to each costs.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden, but the tool takes zero parameters and is an obvious read-only listing. The one genuinely useful behavioral disclosure is that cost is expressed per single message/question sent to each model. It does not state auth or quota requirements, pagination, or ordering of results.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with the verb first and no filler. Every clause carries information: what is listed and what extra attribute accompanies each item.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple no-parameter, no-output-schema listing tool, the description covers both the collection returned and the key per-item attribute (cost). Only minor gaps remain, such as the shape of the returned list or whether identifiers from it feed into 'ask'.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so there is no parameter semantics to explain; the baseline for a no-param tool applies. Nothing in the description contradicts or muddies the empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('List') and resource ('models') and adds the distinctive payload detail: the per-message question cost for each model. This is unmistakably different from the siblings ask/balance/buy, though it never explicitly names or rules out an alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use or when-not-to-use guidance. The mention of per-message cost implies the tool is a lookup to consult before choosing a model for 'ask', but the agent must infer that workflow rather than being told.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
4 tool updates
v1.1.0- First observed
ask - First observed
balance - First observed
buy - First observed
models
TDQS
Scored across 4 tools
Each tool has a clearly distinct role: buy is for purchasing a membership, ask for querying a model, balance for checking remaining questions, and models for listing prices. The only mild overlap is that buy and balance both deal with membership questions, but the descriptions keep them separable.
Names mix verb-style (buy, ask) with noun-style (balance, models), and one is plural while the rest are singular. They remain short and readable, but there is no predictable verb_noun pattern an agent could generalize from.
Four tools is a tight, well-scoped surface for a pay-per-question AI service, with each tool earning its place. It sits at the low end of the ideal range, but nothing feels redundant or missing at this scope.
The core lifecycle is covered: discover prices (models), purchase (buy), query (ask), and check remaining balance. Minor gaps exist around managing multiple memberships (e.g. listing or removing an existing membership kept beside a new one), but core workflows have no dead ends.
Maintenance
Related MCP Connectors
Pay-per-call MCP tools over x402 (USDC/Solana): LLM, utilities, x402 market and model prices.
Pay-per-call AI gateway: models, speech, web search, on-chain reads and NLP tools, via x402.
Paid MCP tools behind one endpoint. Agents pay per call in USDC on Base via x402.
Production-grade MCP gateway delivering 8 real-time AI tools with instant x402 micropayments settled in USDC on Base Mainnet or SPL-USDC on Solana. Features Basescan contract auditing, wallet analytics, headless browser scraping, and pre-scraped oracle data feeds.
Related MCP Servers
- AlicenseAqualityDmaintenanceDescription: Pay-per-request access to Claude and GPT models via Solana USDC using a Phantom wallet address. No accounts, no API keys — wallet-native authentication.410 npmMIT
- FlicenseNot gradedqualityCmaintenanceKeyless, pay-per-call AI gateway: 248 LLMs plus image/video/voice/music generation and live crypto, DeFi, markets, web-search and research tools through one MCP server. Pay per call in USDC via x402 on Base/Solana — no API key, no signup, free tier.-
- AlicenseAqualityFmaintenanceEnables MCP clients to access all endpoints of an x402 gateway by paying real-time microtransactions (USDC on Base) per API call, with automatic tool discovery and spend guardrails.2352 npmMIT
- AlicenseAqualityCmaintenanceConnects Claude Desktop, Cursor, or any MCP-compatible client to 36+ frontier LLMs with automatic per-token payments in USDC on Solana.514 npmMIT