Is X402 Api Mcp Server safe to install?

SaferSkills independently audited X402 Api Mcp Server (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

README.md · 1 file

README.md9.2 KB · Markdown

@x402-api/mcp-server

MCP server that gives Claude, ChatGPT, and any MCP-compatible AI agent access to pay-per-call crypto/DeFi data via the x402 protocol.

8 tools. No API keys. AI agents pay USDC micropayments on Base, per request.

Find this service: Official MCP Registry · Glama · Agent discovery manifest · OpenAPI.

  ██╗  ██╗██╗  ██╗ ██████╗ ██████╗
   ╚██╗██╔╝██║  ██║██╔═══██╗╚════██╗
    ╚███╔╝ ███████║██║   ██║ █████╔╝
    ██╔██╗ ╚════██║██║   ██║██╔═══╝
   ██╔╝ ██╗     ██║╚██████╔╝███████╗
   ╚═╝  ╚═╝     ╚═╝ ╚═════╝ ╚══════╝

Tools

Tool	API Endpoint	Cost	Description
`get_crypto_prices`	`GET /api/price-feed`	0.001 USDC	BTC/ETH/SOL + top 24h movers
`get_gas_prices`	`GET /api/gas-tracker`	0.001 USDC	Multi-chain gas (ETH, Base, Polygon, Arbitrum)
`get_dex_quotes`	`GET /api/dex-quotes`	0.002 USDC	One ParaSwap aggregate route
`scan_token`	`GET /api/token-scanner`	0.003 USDC	GoPlus security flags and heuristic
`track_whales`	`GET /api/whale-tracker`	0.005 USDC	Top-holder sample and supply share
`scan_yields`	`GET /api/yield-scanner`	0.005 USDC	DefiLlama pool APYs and TVL
`get_funding_rates`	`GET /api/funding-rates`	0.008 USDC	Hyperliquid and dYdX hourly rates
`profile_wallet`	`GET /api/wallet-profiler`	0.008 USDC	Observed Blockscout balances; partial coverage

Quick Start

Option A: Inspect mode (no payment needed)

Just run it — any 402 responses will return human-readable payment instructions:

npx @x402-api/mcp-server

Claude will tell you what's needed when a tool requires payment.

Option B: Auto-pay mode (fully autonomous)

Install optional payment deps and set your wallet key:

npm install -g @x402-api/mcp-server
npm install -g viem
export X402_WALLET_PRIVATE_KEY=0x<your_private_key>
x402-api-mcp

The MCP server signs Base USDC EIP-3009 authorizations only when the API advertises that settlement mode. The default payment cap is 0.01 USDC per call. Fund the wallet with USDC on Base; the API operator sponsors gas in direct settlement mode.

Claude Desktop Integration

Add to your claude_desktop_config.json:

Without auto-pay (inspect mode)

{
  "mcpServers": {
    "x402-api": {
      "command": "npx",
      "args": ["@x402-api/mcp-server"]
    }
  }
}

With auto-pay

{
  "mcpServers": {
    "x402-api": {
      "command": "npx",
      "args": ["@x402-api/mcp-server"],
      "env": {
        "X402_WALLET_PRIVATE_KEY": "0x<your_private_key>"
      }
    }
  }
}

Config file location:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
Linux: ~/.config/Claude/claude_desktop_config.json

Environment Variables

Variable	Required	Description
`X402_WALLET_PRIVATE_KEY`	Optional	Base wallet private key for EIP-3009 automatic payment. Requires `viem`.
`X402_MAX_PER_CALL_USDC`	Optional	Per-call cap, default `0.01` USDC.
`X402_API_BASE_URL`	Optional	Override API URL (default: `https://x402-api.fly.dev`)

How x402 Payments Work

This API uses the x402 protocol — HTTP 402 Payment Required:

Agent calls tool → MCP server makes API request
Server returns 402 with payment details (amount, USDC address, Base network)
Auto-pay mode: this client signs an EIP-3009 authorization and retries; the API settles it on Base
Inspect mode: MCP returns 402 details without signing or paying

Payment details:

Token: USDC on Base mainnet
Address: 0x60264c480b67adb557efEd22Cf0e7ceA792DefB7
Chain: Base (chain ID 8453)
Amount: 0.001–0.008 USDC per call (< 1 cent USD)

Tool Reference

`get_crypto_prices`

No parameters. Returns current prices for BTC, ETH, SOL + top 24h movers.

Cost: 0.001 USDC

`get_gas_prices`

No parameters. Returns gas prices for Ethereum, Base, Polygon, Arbitrum — slow/standard/fast tiers.

Cost: 0.001 USDC

`get_dex_quotes`

Get one ParaSwap aggregate route. No independent comparison between DEX venues.

Parameter	Type	Required	Description
`from`	string	✅	Input token (e.g. `"ETH"`, `"0x..."`)
`to`	string	✅	Output token (e.g. `"USDC"`)
`amount`	string	✅	Amount to swap (e.g. `"1.5"`)

Cost: 0.002 USDC

`scan_token`

Token security scan — detects rug-pull flags, honeypot patterns, mint authority, etc.

Parameter	Type	Required	Description
`token`	string	✅	Contract address or symbol (e.g. `"PEPE"`)

Cost: 0.003 USDC

`track_whales`

Top-holder sample from GoPlus. Gini and recent transfer history unavailable.

Parameter	Type	Required	Description
`token`	string	✅	Contract address or symbol

Cost: 0.005 USDC

`scan_yields`

Top DeFi yield opportunities across Aave, Compound, Morpho, Lido, Pendle, etc.

Parameter	Type	Required	Description
`chain`	string	❌	Filter by chain: `"ethereum"`, `"base"`, `"arbitrum"`, `"polygon"`
`min_tvl`	number	❌	Minimum TVL in USD (e.g. `1000000`)

Cost: 0.005 USDC

`get_funding_rates`

Hourly perpetual funding from Hyperliquid and dYdX v4. Spreads are indicative.

Parameter	Type	Required	Description
`asset`	string	❌	Asset symbol (e.g. `"BTC"`, `"ETH"`). All assets if omitted.

Cost: 0.008 USDC

`profile_wallet`

Observed priced wallet balances and available transaction counts. DeFi positions, PnL and risk score unavailable.

Parameter	Type	Required	Description
`address`	string	✅	Ethereum/Base wallet address (`0x...`)

Cost: 0.008 USDC

Development

git clone https://github.com/fernsugi/x402-api-mcp-server
cd x402-api-mcp-server

npm install
npm run build
npm start

To test without a payment wallet, simply run and see the 402 responses:

node dist/index.js

License

MIT

Three runnable workflows

Workflow	Tools	Total USDC
Token check	`scan_token` + `track_whales`	0.008
ETH funding	`get_funding_rates`	0.008
Swap quote + gas	`get_dex_quotes` + `get_gas_prices`	0.003

Runnable Node examples start in inspect mode. Each demo has inputs, recorded provider output, coverage limits, a spending cap, and an agent prompt.

Optional X402_REFERRAL_SOURCE labels requests for first-party aggregate attribution (default mcp). It is a hint, not verified caller identity. The API journals no raw payer wallets, IP addresses, or signatures. X402_EXPECTED_PAY_TO pins the payment recipient to the official wallet by default. Tools advertise that auto-pay can spend money and repeated calls can incur another charge.

Cursor / other local MCP clients

Use the same mcpServers configuration shown above. For Cursor, put it in .cursor/mcp.json in your project. Inspect mode needs no wallet. Set X402_MAX_PER_CALL_USDC before enabling auto-pay; repeated calls spend again. Keep wallet credentials in local environment settings, outside Git.

Registry publication

The Publish MCP Registry GitHub workflow validates the matching npm version, then publishes server.json using GitHub OIDC. It runs on a published GitHub release or a manual dispatch from main. No npm token, GitHub PAT, or wallet key is stored in CI. Actions and official publisher source are pinned to verified commits. npm publication still happens separately before creating the release.

X402 Api Mcp Server— agent skill

Is X402 Api Mcp Server safe to install?

@x402-api/mcp-server

Tools

Quick Start

Option A: Inspect mode (no payment needed)

Option B: Auto-pay mode (fully autonomous)

Claude Desktop Integration

Without auto-pay (inspect mode)

With auto-pay

Environment Variables

How x402 Payments Work

Tool Reference

`get_crypto_prices`

`get_gas_prices`

`get_dex_quotes`

`scan_token`

`track_whales`

`scan_yields`

`get_funding_rates`

`profile_wallet`

Development

Links

License

Three runnable workflows

Cursor / other local MCP clients

Registry publication

Audit the pieces. Scan the whole. Decide.