@cryptoapis-io/mcp-x402-pay 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Crypto APIs, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,49 @@
+# @cryptoapis-io/mcp-x402-pay
+
+> **This is the BUYER side of x402** — the tool an agent uses to *spend* (pay for a resource). Merchants
+> who want to *charge* for an API use the middleware SDK (`@cryptoapis-io/x402-merchant-sdk`), not an MCP tool.
+
+An MCP server that lets an AI agent **pay x402-gated HTTP endpoints**. One tool, `x402_pay`: it fetches a
+URL and, if the server returns `402 Payment Required`, it authorizes the payment via the CryptoAPIs buyer
+service, **signs locally**, retries, and returns the paid response.
+
+**Non-custodial:** the private key is passed per request and never leaves the process (no HTTP server —
+stdio only).
+
+**Supported today:** EVM (`eip712`, e.g. Base USDC) and Solana. Tron, Bitcoin/UTXO, XRP and Kaspa are
+**upcoming** — wired but not yet enabled; paying on them returns a clear `family_not_yet_supported`
+("coming soon") result.
+
+## Run
+
+```bash
+node dist/cli.js            # stdio MCP server (no --api-key at startup; keys are per-tool-call)
+```
+
+## Tool: `x402_pay`
+
+| Input | Required | Description |
+|---|---|---|
+| `url` | ✓ | the (possibly paywalled) resource |
+| `apiKey` | ✓ | your CryptoAPIs key (X402_BUYER feature) — only used to call the buyer `/authorize` |
+| `walletId` | ✓ | the agent wallet the buyer service pays from |
+| `privateKey` | ✓ | the wallet's EVM key — **signs locally, never sent anywhere** |
+| `method`/`body`/`headers` | | the request to make |
+| `allowedNetworks` | | restrict which CAIP-2 networks to pay on |
+| `maxAmount` | | safety cap — refuse if the required atomic-unit amount exceeds it |
+
+Returns `{ status, paid, body, settlement? }`. On a 402 with no acceptable option (or over `maxAmount`),
+`paid:false` with a `reason` — nothing is signed or paid.
+
+## Flow
+
+1. `fetch(url)`. Not 402 → return it.
+2. 402 → pick an `accepts` entry (allowlist-aware), authorize via buyer `/authorize` → the signing artifact.
+3. Sign locally (`@cryptoapis-io/mcp-signer` `evm_sign` typed-data) → build the x402 `PaymentPayload`
+   (**wire scheme is always `exact`**; the family is in `network`).
+4. Retry with the base64 `X-PAYMENT` header; return the paid response + the `X-PAYMENT-RESPONSE` settlement.
+
+## Security
+
+The private key is a tool parameter and **may be logged by MCP clients or stored in conversation
+history** — use only in trusted local environments. This mirrors `@cryptoapis-io/mcp-signer`.

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,9 @@
+import { startX402Server } from "./server.js";
+async function main() {
+    await startX402Server();
+}
+main().catch((err) => {
+    console.error(err);
+    process.exit(1);
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,KAAK,UAAU,IAAI;IACf,MAAM,eAAe,EAAE,CAAC;AAC5B,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACjB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { startX402Server } from "./server.js";
+export { tools } from "./tools/index.js";
+export { x402Pay } from "./tools/x402-pay/index.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/index.js

@@ -0,0 +1,4 @@
+export { startX402Server } from "./server.js";
+export { tools } from "./tools/index.js";
+export { x402Pay } from "./tools/x402-pay/index.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Build and run the x402 MCP server. Stdio-only (no HTTP) for security: the buyer's
+ * private key is passed per request and no network server is exposed.
+ */
+export declare function startX402Server(): Promise<void>;
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAgBA;;;GAGG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAuBrD"}

package/dist/server.js

@@ -0,0 +1,37 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { McpLogger } from "@cryptoapis-io/mcp-shared";
+import { tools } from "./tools/index.js";
+const CRYPTOAPIS_SERVER_INFO = {
+    name: "mcp-x402-pay",
+    version: "0.1.0",
+    title: "MCP x402 — pay paywalled HTTP endpoints",
+    websiteUrl: "https://developers.cryptoapis.io",
+    icons: [
+        { src: "https://cryptoapis.io/cryptoapis/images/logo.svg", mimeType: "image/svg+xml", sizes: ["any"], theme: "light" },
+        { src: "https://cryptoapis.io/cryptoapis/images/logo-black.svg", mimeType: "image/svg+xml", sizes: ["any"], theme: "dark" },
+    ],
+};
+/**
+ * Build and run the x402 MCP server. Stdio-only (no HTTP) for security: the buyer's
+ * private key is passed per request and no network server is exposed.
+ */
+export async function startX402Server() {
+    const server = new McpServer(CRYPTOAPIS_SERVER_INFO);
+    const logger = new McpLogger((params) => server.sendLoggingMessage(params), CRYPTOAPIS_SERVER_INFO.name);
+    for (const t of tools) {
+        server.registerTool(t.name, { description: t.description, inputSchema: t.inputSchema }, async (input) => {
+            logger.logDebug({ tool: t.name, event: "tool_call" });
+            const result = await t.handler(input)
+                .catch((err) => {
+                logger.logError(err instanceof Error ? err.message : String(err), { tool: t.name });
+                throw err;
+            });
+            logger.logInfo({ tool: t.name });
+            return result;
+        });
+    }
+    await server.connect(new StdioServerTransport());
+    logger.logInfo("mcp-x402-pay running (stdio only, no HTTP)");
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAEzC,MAAM,sBAAsB,GAAG;IAC3B,IAAI,EAAE,cAAc;IACpB,OAAO,EAAE,OAAO;IAChB,KAAK,EAAE,yCAAyC;IAChD,UAAU,EAAE,kCAAkC;IAC9C,KAAK,EAAE;QACH,EAAE,GAAG,EAAE,kDAAkD,EAAE,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,OAAgB,EAAE;QAC/H,EAAE,GAAG,EAAE,wDAAwD,EAAE,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,MAAe,EAAE;KACvI;CACJ,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACjC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,sBAAsB,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAEzG,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACpB,MAAM,CAAC,YAAY,CACf,CAAC,CAAC,IAAI,EACN,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,EAC1D,KAAK,EAAE,KAAc,EAAE,EAAE;YACrB,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACtD,MAAM,MAAM,GAAG,MAAO,CAAC,CAAC,OAAsF,CAAC,KAAK,CAAC;iBAChH,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACpB,MAAM,CAAC,QAAQ,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACpF,MAAM,GAAG,CAAC;YACd,CAAC,CAAC,CAAC;YACP,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACjC,OAAO,MAAM,CAAC;QAClB,CAAC,CACJ,CAAC;IACN,CAAC;IAED,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;IACjD,MAAM,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC;AACjE,CAAC"}

package/dist/tools/index.d.ts

@@ -0,0 +1,50 @@
+export declare const tools: readonly [import("./types.js").McpX402ToolDef<import("zod").ZodObject<{
+    url: import("zod").ZodString;
+    method: import("zod").ZodOptional<import("zod").ZodEnum<["GET", "POST", "PUT", "PATCH", "DELETE"]>>;
+    body: import("zod").ZodOptional<import("zod").ZodString>;
+    headers: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodString>>;
+    apiKey: import("zod").ZodOptional<import("zod").ZodString>;
+    walletId: import("zod").ZodOptional<import("zod").ZodString>;
+    privateKey: import("zod").ZodOptional<import("zod").ZodString>;
+    tronKey: import("zod").ZodOptional<import("zod").ZodString>;
+    svmSecret: import("zod").ZodOptional<import("zod").ZodString>;
+    utxoWif: import("zod").ZodOptional<import("zod").ZodString>;
+    kaspaKey: import("zod").ZodOptional<import("zod").ZodString>;
+    xrpSeed: import("zod").ZodOptional<import("zod").ZodString>;
+    allowedNetworks: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString, "many">>;
+    buyerBaseUrl: import("zod").ZodOptional<import("zod").ZodString>;
+    maxAmount: import("zod").ZodOptional<import("zod").ZodString>;
+}, "strip", import("zod").ZodTypeAny, {
+    url: string;
+    method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | undefined;
+    body?: string | undefined;
+    headers?: Record<string, string> | undefined;
+    apiKey?: string | undefined;
+    walletId?: string | undefined;
+    privateKey?: string | undefined;
+    tronKey?: string | undefined;
+    svmSecret?: string | undefined;
+    utxoWif?: string | undefined;
+    kaspaKey?: string | undefined;
+    xrpSeed?: string | undefined;
+    allowedNetworks?: string[] | undefined;
+    buyerBaseUrl?: string | undefined;
+    maxAmount?: string | undefined;
+}, {
+    url: string;
+    method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | undefined;
+    body?: string | undefined;
+    headers?: Record<string, string> | undefined;
+    apiKey?: string | undefined;
+    walletId?: string | undefined;
+    privateKey?: string | undefined;
+    tronKey?: string | undefined;
+    svmSecret?: string | undefined;
+    utxoWif?: string | undefined;
+    kaspaKey?: string | undefined;
+    xrpSeed?: string | undefined;
+    allowedNetworks?: string[] | undefined;
+    buyerBaseUrl?: string | undefined;
+    maxAmount?: string | undefined;
+}>>];
+//# sourceMappingURL=index.d.ts.map

package/dist/tools/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAAyB,CAAC"}

package/dist/tools/index.js

@@ -0,0 +1,3 @@
+import { x402PayTool } from "./x402-pay/index.js";
+export const tools = [x402PayTool];
+//# sourceMappingURL=index.js.map

package/dist/tools/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,WAAW,CAAU,CAAC"}

package/dist/tools/types.d.ts

@@ -0,0 +1,14 @@
+import type * as z from "zod";
+/** Tool definition for the x402 MCP (local orchestration; no shared HTTP client). */
+export type McpX402ToolDef<TSchema extends z.ZodTypeAny> = {
+    name: string;
+    description: string;
+    inputSchema: TSchema;
+    handler: (input: z.infer<TSchema>) => Promise<{
+        content: {
+            type: "text";
+            text: string;
+        }[];
+    }>;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/tools/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/tools/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,CAAC,MAAM,KAAK,CAAC;AAE9B,qFAAqF;AACrF,MAAM,MAAM,cAAc,CAAC,OAAO,SAAS,CAAC,CAAC,UAAU,IAAI;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC,CAAC;CAChG,CAAC"}

package/dist/tools/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/tools/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/tools/types.ts"],"names":[],"mappings":""}

package/dist/tools/x402-pay/index.d.ts

@@ -0,0 +1,18 @@
+import type { X402PayInput } from "./schema.js";
+import { X402PaySchema } from "./schema.js";
+import type { McpX402ToolDef } from "../types.js";
+/**
+ * Fetch a URL and auto-pay a 402 with x402 (EVM eip712 path).
+ *
+ * @param input the tool input
+ * @return the final (paid) response summary
+ */
+export declare function x402Pay(input: X402PayInput): Promise<{
+    status: number;
+    paid: boolean;
+    body: string;
+    settlement?: unknown;
+    reason?: string;
+}>;
+export declare const x402PayTool: McpX402ToolDef<typeof X402PaySchema>;
+//# sourceMappingURL=index.d.ts.map

package/dist/tools/x402-pay/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/x402-pay/index.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AA+ClD;;;;;GAKG;AACH,wBAAsB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC;IACxD,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CACtF,CAAC,CA4KD;AAED,eAAO,MAAM,WAAW,EAAE,cAAc,CAAC,OAAO,aAAa,CAS5D,CAAC"}

package/dist/tools/x402-pay/index.js

@@ -0,0 +1,228 @@
+import { evmSignTypedData, svmPartialSign, tronSignFromDetails, utxoSignFromDetails, kaspaSignFromDetails, xrpSignFromDetails, } from "@cryptoapis-io/mcp-signer";
+import { X402PaySchema } from "./schema.js";
+const DEFAULT_BUYER_BASE_URL = "https://ai.cryptoapis.io/x402/buyer";
+const X402_VERSION = 2;
+/** The WIRE payment scheme is ALWAYS "exact" — the facilitator's parseEnvelope rejects
+ *  anything else and derives the family from `network`. The buyer /authorize "scheme"
+ *  (eip712/…) is the ARTIFACT type (how to sign), NOT this. */
+const SCHEME_EXACT = "exact";
+/** Artifact schemes that are LIVE-VERIFIED end-to-end and enabled today. EVM (eip712) and
+ *  Solana (svm-transaction) are supported; Tron/UTXO/XRP/Kaspa are wired but not yet
+ *  live-verified, so they are gated OFF ("coming soon") until each is exercised in prod.
+ *  Enabling a family once verified = add its scheme here. */
+const SUPPORTED_SCHEMES = new Set(["eip712", "svm-transaction"]);
+/** UTXO CAIP-2 network id → the {blockchain, network} the mcp-signer utxo-sign needs
+ *  (a bare CAIP-2 doesn't carry the chain name). Only UTXO signing needs this pair. */
+const UTXO_CAIP2 = {
+    "bip122:000000000019d6689c085ae165831e93": { blockchain: "bitcoin", network: "mainnet" },
+    "bip122:000000000933ea01ad0ee984209779ba": { blockchain: "bitcoin", network: "testnet" },
+    "bip122:12a765e31ffd4059bada1e25190f6e98": { blockchain: "litecoin", network: "mainnet" },
+    "bip122:4966625a4b2851d9fdee139e56211a0d": { blockchain: "litecoin", network: "testnet" },
+    "bip122:1a91e3dace36e2be3bf030a65679fe82": { blockchain: "dogecoin", network: "mainnet" },
+    "bip122:bb0a78264637406b6360aad926284d54": { blockchain: "dogecoin", network: "testnet" },
+    "bip122:00000ffd590b1485b3caadc19b22e637": { blockchain: "dash", network: "mainnet" },
+    "bip122:00000bafbc94add76cb75e2ec92894837": { blockchain: "dash", network: "testnet" },
+    "bip122:000000000000000000651ef99cb9fcbe": { blockchain: "bitcoin-cash", network: "mainnet" },
+    "bip122:00000000dfd5d65c9d8561b4b8f60a63": { blockchain: "bitcoin-cash", network: "testnet" },
+    "bip122:0007104ccda289427919efc39dc9e4d4": { blockchain: "zcash", network: "mainnet" },
+    "bip122:05a60a92d99d85997cce3b87616c089f": { blockchain: "zcash", network: "testnet" },
+};
+/** Pick which offered requirement to pay (allowlist-aware; else the first). */
+function selectRequirements(accepts, allowed) {
+    if (accepts.length === 0)
+        return null;
+    if (Array.isArray(allowed) && allowed.length > 0) {
+        return accepts.find((r) => allowed.includes(r.network)) ?? null;
+    }
+    return accepts[0] ?? null;
+}
+/**
+ * Fetch a URL and auto-pay a 402 with x402 (EVM eip712 path).
+ *
+ * @param input the tool input
+ * @return the final (paid) response summary
+ */
+export async function x402Pay(input) {
+    // Credentials: prefer the per-call params, else fall back to env (set once in the
+    // MCP config so the agent only ever passes `url` — and the key stays out of logs).
+    // apiKey + walletId are always needed (to call /authorize); the SIGNING key is
+    // resolved per-family at the dispatch below (each chain uses its own key form).
+    const apiKey = input.apiKey ?? process.env.CRYPTOAPIS_API_KEY;
+    const walletId = input.walletId ?? process.env.X402_WALLET_ID;
+    if (!apiKey || !walletId) {
+        const missing = [!apiKey && "apiKey/CRYPTOAPIS_API_KEY", !walletId && "walletId/X402_WALLET_ID"].filter(Boolean).join(", ");
+        return { status: 0, paid: false, reason: `missing credentials: ${missing} (pass as params or set the env vars)`, body: "" };
+    }
+    // Per-family signing keys (param → family env → EVM fallback where the curve allows).
+    const evmKey = input.privateKey ?? process.env.X402_PRIVATE_KEY;
+    const keys = {
+        evm: evmKey,
+        tron: input.tronKey ?? process.env.X402_TRON_KEY ?? evmKey,
+        svm: input.svmSecret ?? process.env.X402_SVM_SECRET,
+        utxo: input.utxoWif ?? process.env.X402_UTXO_WIF,
+        kaspa: input.kaspaKey ?? process.env.X402_KASPA_KEY,
+        xrp: input.xrpSeed ?? process.env.X402_XRP_SEED,
+    };
+    const method = input.method ?? "GET";
+    const baseInit = {
+        method,
+        headers: { ...(input.headers ?? {}) },
+        ...(input.body != null ? { body: input.body } : {}),
+    };
+    const first = await fetch(input.url, baseInit);
+    if (first.status !== 402) {
+        return { status: first.status, paid: false, body: await first.text() };
+    }
+    const body402 = await first.json().catch(() => null);
+    const accepts = Array.isArray(body402?.accepts) ? body402.accepts : [];
+    const requirements = selectRequirements(accepts, input.allowedNetworks);
+    if (!requirements) {
+        return { status: 402, paid: false, reason: "no acceptable payment option", body: JSON.stringify(body402) };
+    }
+    if (input.maxAmount != null && BigInt(requirements.amount) > BigInt(input.maxAmount)) {
+        return { status: 402, paid: false, reason: `required amount ${requirements.amount} exceeds maxAmount ${input.maxAmount}`, body: "" };
+    }
+    // 1. Authorize via the buyer service → the artifact to sign.
+    const root = (input.buyerBaseUrl ?? DEFAULT_BUYER_BASE_URL).replace(/\/$/, "");
+    const authRes = await fetch(`${root}/authorize`, {
+        method: "POST",
+        headers: { "content-type": "application/json", "x-api-key": apiKey },
+        body: JSON.stringify({ paymentRequirements: requirements, walletId: walletId }),
+    });
+    if (!authRes.ok) {
+        return { status: 402, paid: false, reason: `buyer /authorize failed: ${authRes.status} ${await authRes.text()}`.trim(), body: "" };
+    }
+    const auth = await authRes.json();
+    if (auth.authorized === false) {
+        return { status: 402, paid: false, reason: `authorize refused: ${auth.reason ?? "unknown"}`, body: "" };
+    }
+    // 2. Sign LOCALLY + build the PaymentPayload. The WIRE scheme is ALWAYS "exact"
+    //    (family carried by `network`); the /authorize `scheme` says HOW to sign. Every
+    //    family's facilitator parsePayload reads `payload.transaction` first — so the
+    //    non-EVM families use a uniform `payload:{transaction}` wrapper, with the
+    //    per-family value the facilitator expects (SVM base64, UTXO/XRP hex, Kaspa JSON,
+    //    Tron the structured {txID, raw_data_hex, raw_data, signature[]} object).
+    const network = requirements.network;
+    // Gate off families that are wired but not yet live-verified (Tron/UTXO/XRP/Kaspa).
+    // EVM + Solana are supported today; the rest are on the roadmap ("coming soon").
+    if (!auth.scheme || !SUPPORTED_SCHEMES.has(auth.scheme)) {
+        return {
+            status: 402,
+            paid: false,
+            reason: `family_not_yet_supported: the "${auth.scheme}" family is coming soon — only EVM (eip712) and Solana (svm-transaction) are supported today`,
+            body: "",
+        };
+    }
+    const sp = auth.signingPayload ?? {};
+    let payload;
+    /** Guard: a family whose signing key wasn't configured errors cleanly (never mis-signs). */
+    const needKey = (key, envName) => (key ? null : `no signing key for ${auth.scheme} — set ${envName} (or the matching param)`);
+    if (auth.scheme === "eip712") {
+        const missing = needKey(keys.evm, "X402_PRIVATE_KEY");
+        if (missing)
+            return { status: 402, paid: false, reason: missing, body: "" };
+        const td = sp;
+        const { signature } = await evmSignTypedData({
+            action: "sign-typed-data",
+            privateKey: keys.evm,
+            domain: td.domain,
+            types: td.types,
+            primaryType: td.primaryType,
+            message: td.message,
+        });
+        payload = { signature, authorization: td.message };
+    }
+    else if (auth.scheme === "svm-transaction") {
+        const missing = needKey(keys.svm, "X402_SVM_SECRET");
+        if (missing)
+            return { status: 402, paid: false, reason: missing, body: "" };
+        const { transaction } = svmPartialSign({
+            action: "partial-sign",
+            secretKeyBase58: keys.svm,
+            transaction: sp.transaction,
+        });
+        payload = { transaction };
+    }
+    else if (auth.scheme === "tron-transaction") {
+        const missing = needKey(keys.tron, "X402_TRON_KEY");
+        if (missing)
+            return { status: 402, paid: false, reason: missing, body: "" };
+        const { signedTransaction } = tronSignFromDetails({
+            action: "sign-from-details",
+            privateKey: keys.tron,
+            transaction: sp.transaction,
+        });
+        // Tron's facilitator wants the structured {txID, raw_data_hex, raw_data, signature[]}.
+        payload = { transaction: signedTransaction };
+    }
+    else if (auth.scheme === "utxo-transaction") {
+        const missing = needKey(keys.utxo, "X402_UTXO_WIF");
+        if (missing)
+            return { status: 402, paid: false, reason: missing, body: "" };
+        const chain = UTXO_CAIP2[network];
+        if (!chain)
+            return { status: 402, paid: false, reason: `unknown UTXO network ${network}`, body: "" };
+        const { signedTransactionHex } = utxoSignFromDetails({
+            action: "sign-from-details",
+            blockchain: chain.blockchain,
+            network: chain.network,
+            privateKeys: [keys.utxo],
+            preparedTransaction: sp.preparedTransaction,
+        });
+        payload = { transaction: signedTransactionHex };
+    }
+    else if (auth.scheme === "kaspa-transaction") {
+        const missing = needKey(keys.kaspa, "X402_KASPA_KEY");
+        if (missing)
+            return { status: 402, paid: false, reason: missing, body: "" };
+        const { signedTransaction } = kaspaSignFromDetails({
+            action: "sign-from-details",
+            privateKeys: [keys.kaspa],
+            preparedTransaction: sp.preparedTransaction,
+        });
+        payload = { transaction: signedTransaction };
+    }
+    else if (auth.scheme === "xrp-transaction") {
+        const missing = needKey(keys.xrp, "X402_XRP_SEED");
+        if (missing)
+            return { status: 402, paid: false, reason: missing, body: "" };
+        const { signedTransactionHex } = await xrpSignFromDetails({
+            action: "sign-from-details",
+            secret: keys.xrp,
+            transaction: sp.transaction,
+        });
+        payload = { transaction: signedTransactionHex };
+    }
+    else {
+        return { status: 402, paid: false, reason: `unsupported_scheme: ${auth.scheme}`, body: "" };
+    }
+    const paymentPayload = {
+        x402Version: X402_VERSION,
+        scheme: SCHEME_EXACT,
+        network: network,
+        payload: payload,
+    };
+    // 3. Retry the ORIGINAL request with the X-PAYMENT header.
+    const xPayment = Buffer.from(JSON.stringify(paymentPayload), "utf8").toString("base64");
+    const paid = await fetch(input.url, {
+        ...baseInit,
+        headers: { ...baseInit.headers, "x-payment": xPayment },
+    });
+    const paymentResponse = paid.headers.get("x-payment-response");
+    return {
+        status: paid.status,
+        paid: paid.status >= 200 && paid.status < 300,
+        body: await paid.text(),
+        settlement: paymentResponse ? JSON.parse(Buffer.from(paymentResponse, "base64").toString("utf8")) : undefined,
+    };
+}
+export const x402PayTool = {
+    name: "x402_pay",
+    description: "Fetch an HTTP resource and, if it returns 402 Payment Required, pay it automatically with x402 and return the paid response. On a 402 it: parses the merchant's price, authorizes via the CryptoAPIs buyer /authorize, signs the payment LOCALLY (non-custodial — the key never leaves this process), and retries with the X-PAYMENT header. Returns { status, paid, body, settlement? }. Supported today: EVM (eip712, e.g. Base USDC) and Solana. Tron, UTXO (bitcoin/ltc/doge/dash/bch/zcash), Kaspa and XRP are UPCOMING — wired but not yet enabled, and paying on them returns a clear coming-soon (family_not_yet_supported) result. Set CRYPTOAPIS_API_KEY + X402_WALLET_ID once, plus the signing key(s) for the chain(s) you pay on: X402_PRIVATE_KEY (EVM hex), X402_SVM_SECRET (base58). A scheme with no configured key errors cleanly (never mis-signs). Env vars keep keys OUT of tool-call logs. Use allowedNetworks to restrict, maxAmount as a safety cap. SECURITY: use only in trusted local environments.",
+    inputSchema: X402PaySchema,
+    handler: async (input) => {
+        const result = await x402Pay(input);
+        return { content: [{ type: "text", text: JSON.stringify(result) }] };
+    },
+};
+//# sourceMappingURL=index.js.map

package/dist/tools/x402-pay/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/x402-pay/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,GACrB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG5C,MAAM,sBAAsB,GAAG,qCAAqC,CAAC;AACrE,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB;;+DAE+D;AAC/D,MAAM,YAAY,GAAG,OAAO,CAAC;AAE7B;;;6DAG6D;AAC7D,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAEjE;uFACuF;AACvF,MAAM,UAAU,GAA4D;IACxE,yCAAyC,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE;IACxF,yCAAyC,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE;IACxF,yCAAyC,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE;IACzF,yCAAyC,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE;IACzF,yCAAyC,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE;IACzF,yCAAyC,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE;IACzF,yCAAyC,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE;IACrF,0CAA0C,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE;IACtF,yCAAyC,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE;IAC7F,yCAAyC,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE;IAC7F,yCAAyC,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE;IACtF,yCAAyC,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE;CACzF,CAAC;AAQF,+EAA+E;AAC/E,SAAS,kBAAkB,CAAC,OAA8B,EAAE,OAAkB;IAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC;IACpE,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAmB;IAG7C,kFAAkF;IAClF,mFAAmF;IACnF,+EAA+E;IAC/E,gFAAgF;IAChF,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC9D,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC9D,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,IAAI,2BAA2B,EAAE,CAAC,QAAQ,IAAI,yBAAyB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5H,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,OAAO,uCAAuC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAChI,CAAC;IACD,sFAAsF;IACtF,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAChE,MAAM,IAAI,GAAG;QACT,GAAG,EAAE,MAAM;QACX,IAAI,EAAE,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,MAAM;QAC1D,GAAG,EAAE,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe;QACnD,IAAI,EAAE,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa;QAChD,KAAK,EAAE,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;QACnD,GAAG,EAAE,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa;KAClD,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC;IACrC,MAAM,QAAQ,GAAgB;QAC1B,MAAM;QACN,OAAO,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE;QACrC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;IAEF,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAA+C,CAAC;IACnG,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IACxE,IAAI,CAAC,YAAY,EAAE,CAAC;QAChB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/G,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,YAAY,CAAC,MAAM,sBAAsB,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACzI,CAAC;IAED,6DAA6D;IAC7D,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,sBAAsB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,YAAY,EAAE;QAC7C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,EAAE;QACpE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,mBAAmB,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;KAClF,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,OAAO,CAAC,MAAM,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACvI,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAA0G,CAAC;IAC1I,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC5G,CAAC;IAED,gFAAgF;IAChF,oFAAoF;IACpF,kFAAkF;IAClF,8EAA8E;IAC9E,qFAAqF;IACrF,8EAA8E;IAC9E,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC;IAErC,oFAAoF;IACpF,iFAAiF;IACjF,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,OAAO;YACH,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,kCAAkC,IAAI,CAAC,MAAM,8FAA8F;YACnJ,IAAI,EAAE,EAAE;SACX,CAAC;IACN,CAAC;IAED,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;IACrC,IAAI,OAAgC,CAAC;IAErC,4FAA4F;IAC5F,MAAM,OAAO,GAAG,CAAC,GAAuB,EAAE,OAAe,EAAiB,EAAE,CACxE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,sBAAsB,IAAI,CAAC,MAAM,UAAU,OAAO,0BAA0B,CAAC,CAAC;IAEhG,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACtD,IAAI,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC5E,MAAM,EAAE,GAAG,EAAyJ,CAAC;QACrK,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,gBAAgB,CAAC;YACzC,MAAM,EAAE,iBAAiB;YACzB,UAAU,EAAE,IAAI,CAAC,GAAa;YAC9B,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,WAAW,EAAE,EAAE,CAAC,WAAW;YAC3B,OAAO,EAAE,EAAE,CAAC,OAAO;SACtB,CAAC,CAAC;QACH,OAAO,GAAG,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC;IACvD,CAAC;SAAM,IAAI,IAAI,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACrD,IAAI,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC5E,MAAM,EAAE,WAAW,EAAE,GAAG,cAAc,CAAC;YACnC,MAAM,EAAE,cAAc;YACtB,eAAe,EAAE,IAAI,CAAC,GAAa;YACnC,WAAW,EAAE,EAAE,CAAC,WAAqB;SACxC,CAAC,CAAC;QACH,OAAO,GAAG,EAAE,WAAW,EAAE,CAAC;IAC9B,CAAC;SAAM,IAAI,IAAI,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QACpD,IAAI,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC5E,MAAM,EAAE,iBAAiB,EAAE,GAAG,mBAAmB,CAAC;YAC9C,MAAM,EAAE,mBAAmB;YAC3B,UAAU,EAAE,IAAI,CAAC,IAAc;YAC/B,WAAW,EAAE,EAAE,CAAC,WAAsC;SACzD,CAAC,CAAC;QACH,uFAAuF;QACvF,OAAO,GAAG,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACjD,CAAC;SAAM,IAAI,IAAI,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QACpD,IAAI,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC5E,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACrG,MAAM,EAAE,oBAAoB,EAAE,GAAG,mBAAmB,CAAC;YACjD,MAAM,EAAE,mBAAmB;YAC3B,UAAU,EAAE,KAAK,CAAC,UAAmB;YACrC,OAAO,EAAE,KAAK,CAAC,OAAgB;YAC/B,WAAW,EAAE,CAAC,IAAI,CAAC,IAAc,CAAC;YAClC,mBAAmB,EAAE,EAAE,CAAC,mBAA8C;SACzE,CAAC,CAAC;QACH,OAAO,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACpD,CAAC;SAAM,IAAI,IAAI,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QACtD,IAAI,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC5E,MAAM,EAAE,iBAAiB,EAAE,GAAG,oBAAoB,CAAC;YAC/C,MAAM,EAAE,mBAAmB;YAC3B,WAAW,EAAE,CAAC,IAAI,CAAC,KAAe,CAAC;YACnC,mBAAmB,EAAE,EAAE,CAAC,mBAA8C;SACzE,CAAC,CAAC;QACH,OAAO,GAAG,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACjD,CAAC;SAAM,IAAI,IAAI,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QACnD,IAAI,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC5E,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,kBAAkB,CAAC;YACtD,MAAM,EAAE,mBAAmB;YAC3B,MAAM,EAAE,IAAI,CAAC,GAAa;YAC1B,WAAW,EAAE,EAAE,CAAC,WAAsC;SACzD,CAAC,CAAC;QACH,OAAO,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACpD,CAAC;SAAM,CAAC;QACJ,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAChG,CAAC;IAED,MAAM,cAAc,GAA4B;QAC5C,WAAW,EAAE,YAAY;QACzB,MAAM,EAAE,YAAY;QACpB,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,OAAO;KACnB,CAAC;IAEF,2DAA2D;IAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE;QAChC,GAAG,QAAQ;QACX,OAAO,EAAE,EAAE,GAAI,QAAQ,CAAC,OAAkC,EAAE,WAAW,EAAE,QAAQ,EAAE;KACtF,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC/D,OAAO;QACH,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAC7C,IAAI,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE;QACvB,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;KAChH,CAAC;AACN,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAyC;IAC7D,IAAI,EAAE,UAAU;IAChB,WAAW,EACP,g+BAAg+B;IACp+B,WAAW,EAAE,aAAa;IAC1B,OAAO,EAAE,KAAK,EAAE,KAAmB,EAAE,EAAE;QACnC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;IACzE,CAAC;CACJ,CAAC"}

package/dist/tools/x402-pay/schema.d.ts

@@ -0,0 +1,63 @@
+import * as z from "zod";
+/**
+ * Fetch an HTTP resource and, if it responds 402 Payment Required, pay it with x402:
+ * authorize via the CryptoAPIs buyer service, sign LOCALLY, retry. Non-custodial —
+ * the private key is passed per request and never leaves this process.
+ *
+ * Supports all six x402 families. Each family signs with ITS OWN key form — a
+ * single hex key can't sign a Solana (base58), UTXO (WIF) or XRP (seed) payment,
+ * so those take their own optional key/env. An agent only sets the key(s) for the
+ * chain(s) it actually pays on; a scheme with no configured key errors cleanly
+ * rather than mis-signing.
+ */
+export declare const X402PaySchema: z.ZodObject<{
+    url: z.ZodString;
+    method: z.ZodOptional<z.ZodEnum<["GET", "POST", "PUT", "PATCH", "DELETE"]>>;
+    body: z.ZodOptional<z.ZodString>;
+    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    apiKey: z.ZodOptional<z.ZodString>;
+    walletId: z.ZodOptional<z.ZodString>;
+    privateKey: z.ZodOptional<z.ZodString>;
+    tronKey: z.ZodOptional<z.ZodString>;
+    svmSecret: z.ZodOptional<z.ZodString>;
+    utxoWif: z.ZodOptional<z.ZodString>;
+    kaspaKey: z.ZodOptional<z.ZodString>;
+    xrpSeed: z.ZodOptional<z.ZodString>;
+    allowedNetworks: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    buyerBaseUrl: z.ZodOptional<z.ZodString>;
+    maxAmount: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    url: string;
+    method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | undefined;
+    body?: string | undefined;
+    headers?: Record<string, string> | undefined;
+    apiKey?: string | undefined;
+    walletId?: string | undefined;
+    privateKey?: string | undefined;
+    tronKey?: string | undefined;
+    svmSecret?: string | undefined;
+    utxoWif?: string | undefined;
+    kaspaKey?: string | undefined;
+    xrpSeed?: string | undefined;
+    allowedNetworks?: string[] | undefined;
+    buyerBaseUrl?: string | undefined;
+    maxAmount?: string | undefined;
+}, {
+    url: string;
+    method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | undefined;
+    body?: string | undefined;
+    headers?: Record<string, string> | undefined;
+    apiKey?: string | undefined;
+    walletId?: string | undefined;
+    privateKey?: string | undefined;
+    tronKey?: string | undefined;
+    svmSecret?: string | undefined;
+    utxoWif?: string | undefined;
+    kaspaKey?: string | undefined;
+    xrpSeed?: string | undefined;
+    allowedNetworks?: string[] | undefined;
+    buyerBaseUrl?: string | undefined;
+    maxAmount?: string | undefined;
+}>;
+export type X402PayInput = z.infer<typeof X402PaySchema>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/tools/x402-pay/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/tools/x402-pay/schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAEzB;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBxB,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC"}

package/dist/tools/x402-pay/schema.js

@@ -0,0 +1,33 @@
+import * as z from "zod";
+/**
+ * Fetch an HTTP resource and, if it responds 402 Payment Required, pay it with x402:
+ * authorize via the CryptoAPIs buyer service, sign LOCALLY, retry. Non-custodial —
+ * the private key is passed per request and never leaves this process.
+ *
+ * Supports all six x402 families. Each family signs with ITS OWN key form — a
+ * single hex key can't sign a Solana (base58), UTXO (WIF) or XRP (seed) payment,
+ * so those take their own optional key/env. An agent only sets the key(s) for the
+ * chain(s) it actually pays on; a scheme with no configured key errors cleanly
+ * rather than mis-signing.
+ */
+export const X402PaySchema = z.object({
+    url: z.string().url().describe("The (possibly paywalled) resource URL to fetch"),
+    method: z.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]).optional().describe("HTTP method (default GET)"),
+    body: z.string().optional().describe("Request body (string; set content-type via headers if needed)"),
+    headers: z.record(z.string(), z.string()).optional().describe("Extra request headers"),
+    apiKey: z.string().optional().describe("Your CryptoAPIs API key with the X402_BUYER feature (used only to call the buyer /authorize). Falls back to the CRYPTOAPIS_API_KEY env var — set it once and omit this."),
+    walletId: z.string().optional().describe("The CryptoAPIs agent wallet id to pay from. Falls back to the X402_WALLET_ID env var."),
+    // Per-family signing keys — pass only the one(s) for the chain(s) you pay on.
+    // All SIGN LOCALLY and are never sent anywhere; each falls back to its env var
+    // (PREFERRED — keeps the key out of tool-call logs).
+    privateKey: z.string().optional().describe("EVM private key (hex, 0x optional) — signs the eip712 (EVM) payment, and Tron by default. Falls back to X402_PRIVATE_KEY. SECURITY: trusted local environments only."),
+    tronKey: z.string().optional().describe("Tron private key (hex). Falls back to X402_TRON_KEY, then to privateKey/X402_PRIVATE_KEY (same secp256k1 curve)."),
+    svmSecret: z.string().optional().describe("Solana secret key, base58-encoded (64-byte keypair secret) — signs svm-transaction payments. Falls back to X402_SVM_SECRET."),
+    utxoWif: z.string().optional().describe("UTXO private key in WIF format — signs utxo-transaction payments (bitcoin/ltc/doge/dash/bch/zcash). Falls back to X402_UTXO_WIF."),
+    kaspaKey: z.string().optional().describe("Kaspa private key (hex, 32 bytes) — signs kaspa-transaction payments. Falls back to X402_KASPA_KEY."),
+    xrpSeed: z.string().optional().describe("XRP secret/seed (base58, e.g. s...) — signs xrp-transaction payments. Falls back to X402_XRP_SEED."),
+    allowedNetworks: z.array(z.string()).optional().describe("Restrict which CAIP-2 networks to pay on (e.g. [\"eip155:8453\"])"),
+    buyerBaseUrl: z.string().url().optional().describe("Override the buyer service base URL (default https://ai.cryptoapis.io/x402/buyer)"),
+    maxAmount: z.string().optional().describe("Optional safety cap: refuse to pay if the required atomic-unit amount exceeds this"),
+});
+//# sourceMappingURL=schema.js.map

package/dist/tools/x402-pay/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/tools/x402-pay/schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAEzB;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,gDAAgD,CAAC;IAChF,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2BAA2B,CAAC;IAC1G,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+DAA+D,CAAC;IACrG,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IAEtF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yKAAyK,CAAC;IACjN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uFAAuF,CAAC;IAEjI,8EAA8E;IAC9E,+EAA+E;IAC/E,qDAAqD;IACrD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sKAAsK,CAAC;IAClN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kHAAkH,CAAC;IAC3J,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6HAA6H,CAAC;IACxK,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kIAAkI,CAAC;IAC3K,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qGAAqG,CAAC;IAC/I,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oGAAoG,CAAC;IAE7I,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mEAAmE,CAAC;IAC7H,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mFAAmF,CAAC;IACvI,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oFAAoF,CAAC;CAClI,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@cryptoapis-io/mcp-x402-pay",
+  "mcpName": "io.github.CryptoAPIs-io/mcp-x402-pay",
+  "version": "0.1.0",
+  "description": "MCP server that pays x402-gated HTTP endpoints — one x402_pay tool that fetches, and on a 402 authorizes via the CryptoAPIs buyer service, signs LOCALLY, and retries.",
+  "license": "MIT",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "bin": {
+    "cryptoapis-mcp-x402-pay": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "server.json",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.27.1",
+    "ethers": "^6.13.0",
+    "zod": "^3.25.0",
+    "@cryptoapis-io/mcp-shared": "0.3.0",
+    "@cryptoapis-io/mcp-signer": "0.4.0"
+  },
+  "devDependencies": {
+    "rimraf": "^5.0.0",
+    "tsx": "^4.0.0"
+  },
+  "scripts": {
+    "dev": "tsc -w",
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "lint": "node -e \"console.log('lint: add eslint if you want')\"",
+    "test": "node -e \"console.log('test: add later')\"",
+    "test:x402-pay": "tsx scripts/test-x402-pay.ts",
+    "clean": "rimraf dist",
+    "test:x402-pay-families": "tsx scripts/test-x402-pay-families.ts"
+  }
+}

package/server.json

@@ -0,0 +1,20 @@
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
+  "name": "io.github.CryptoAPIs-io/mcp-x402-pay",
+  "description": "MCP server that pays x402-gated HTTP endpoints — fetch, and on a 402 authorize, sign, retry",
+  "repository": {
+    "url": "https://github.com/CryptoAPIs-io/cryptoapis-mcp-x402-pay",
+    "source": "github"
+  },
+  "version": "0.1.0",
+  "packages": [
+    {
+      "registryType": "npm",
+      "identifier": "@cryptoapis-io/mcp-x402-pay",
+      "version": "0.1.0",
+      "transport": {
+        "type": "stdio"
+      }
+    }
+  ]
+}