Is X402 Mcp safe to install?

SaferSkills independently audited X402 Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

README.md · 1 file

README.md1.8 KB · Markdown

x402-mcp

MCP server bringing 100+ x402-paid APIs to AI agents (Claude, Cursor, MCP-aware clients). Auto-discovers tools from CDP Bazaar; handles USDC micropayments on Base.

Features

Auto-discovers x402 endpoints from CDP Bazaar (no hard-coded list)
Reads metadata directly from Bazaar (description, schema, pricing)
Refreshes every 5 min — new endpoints appear without restart
Handles HTTP 402 + USDC payment automatically
Multi-chain ready via x402 protocol (Base today; Solana, Polygon, BNB, EVM expansion)

Install (Claude Desktop)

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "x402-mcp": {
      "command": "npx",
      "args": ["-y", "x402node-mcp"],
      "env": { "X402_PRIVATE_KEY": "0xYOUR_BASE_PRIVATE_KEY" }
    }
  }
}

Set X402_PRIVATE_KEY to a Base EOA private key (hex, 0x-prefixed) with USDC on Base mainnet. Restart Claude Desktop. The server auto-discovers ~117 tools on first run.

Cost Safety

Each tool call costs $0.0001-$0.10 USDC depending on endpoint
Hard cap: MAX_PRICE_USD env var (default $0.10/call); calls above are blocked
Use a fresh burner wallet, not your main wallet

How it works

Agent calls tool -> HTTP 402 -> x402-fetch signs EIP-3009 -> CDP Facilitator settles on Base -> response returned. Buyer pays no gas.

Development

git clone https://github.com/x402node/x402-mcp
cd x402-mcp
npm install
cp .env.example .env  # edit X402_PRIVATE_KEY
node mcp-server.js

License

MIT

X402 Mcp— agent skill

Is X402 Mcp safe to install?

x402-mcp

Features

Install (Claude Desktop)

Cost Safety

How it works

Development

Links

License

Audit the pieces. Scan the whole. Decide.