Payaion
NPM · @PAYAION/MCP · 2 COMPONENTS · SCANNED AUG 7
Agent file transfer. No API key to start; price downloads in USDC on Base.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency19
- Repository check failed: no source repository is declared. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability65
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 1594 tokens (~177/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · @payaion/mcp
claude mcp add defdone-payaion -- npx -y @payaion/mcp
codex mcp add defdone-payaion -- npx -y @payaion/mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"defdone-payaion": {
"type": "local",
"command": [
"npx",
"-y",
"@payaion/mcp"
],
"enabled": true
}
}
} openclaw mcp add defdone-payaion --command npx --arg -y --arg @payaion/mcp
mcp_servers:
defdone-payaion:
command: "npx"
args: ["-y", "@payaion/mcp"] {
"mcpServers": {
"defdone-payaion": {
"command": "npx",
"args": [
"-y",
"@payaion/mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 7 Aug 26 +28
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- Tool coverage: unverified → 100 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- First check of Tool coverage: 100 functional
- First check of Schema quality: fail functional
- First check of Schema quality: fail functional
- First check of Schema quality: good functional
- First check of Tool coverage: 100 functional
- 6 Aug 26 34
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 7 Aug 2026 · Analysed npm/@payaion/[email protected]
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
browse_marketplace Browse Marketplace ~118
Search and browse active listings on the Payaion marketplace. Filter by keyword, category, and paginate through results. Returns listing details including title, price, file info, and unified page URL. No API key required.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | Filter by category. |
| page | integer | – | Page number (default 1, max 100). |
| pageSize | integer | – | Results per page (default 20, max 100). |
| q | string | – | Search query — matches title and description (max 100 chars). |
| Name | Type | Req | Description |
|---|---|---|---|
| listings | array | yes | Array of marketplace listings |
| page | number | yes | Current page number |
| pageSize | number | yes | Results per page |
| total | number | yes | Total number of matching listings |
No examples provided.
get_download_url Get Download URL ~110
Get a fresh shareable download URL for a previously uploaded file. The file must be in READY status. Share this URL with anyone — it works without authentication.No API key required — without one you upload as a guest (100 MB, 24-hour link); a key raises the limits and lets you sell.
| Name | Type | Req | Description |
|---|---|---|---|
| uploadId | string | yes | Upload ID returned from upload_file or upload_from_url (e.g. up_a1b2c3d4e5f6g7h8) |
| Name | Type | Req | Description |
|---|---|---|---|
| downloadUrl | string | yes | Shareable download URL (works without auth) |
| expiresAt | string | yes | ISO 8601 expiration timestamp |
| ready | boolean | yes | True when the file is downloadable |
| uploadId | string | yes | The upload identifier |
No examples provided.
get_payment_requirements Get Payment Requirements ~76
Retrieve payment requirements for a marketplace asset before purchasing. Returns whether the asset is free or paid. For paid assets, includes the x402 payment requirements object that must be signed by the buyer's wallet and passed to the purchase_asset tool.
| Name | Type | Req | Description |
|---|---|---|---|
| uploadId | string | yes | Upload ID of the marketplace asset to check payment requirements for. |
| Name | Type | Req | Description |
|---|---|---|---|
| asset | object | yes | Asset metadata. |
| isFree | boolean | yes | Whether the asset can be downloaded for free. |
| paymentRequirements | object | – | x402 payment requirements — present only for paid assets. Sign this with your wallet and pass to purchase_asset. |
No examples provided.
get_upload_status Get Upload Status ~143
Check the processing status of a previously uploaded file. Returns the current status (PENDING_UPLOAD, UPLOADING, READY, FAILED) and whether the file is ready for download. Rarely needed — the 'transfer' tool handles polling automatically. Use this only to check on uploads that timed out or for manual status inspection.No API key required — without one you upload as a guest (100 MB, 24-hour link); a key raises the limits and lets you sell.
| Name | Type | Req | Description |
|---|---|---|---|
| uploadId | string | yes | Upload ID returned from upload_file or upload_from_url (e.g. up_a1b2c3d4e5f6g7h8) |
| Name | Type | Req | Description |
|---|---|---|---|
| ready | boolean | yes | True when the file is fully replicated and downloadable |
| status | string | yes | Current status: PENDING_UPLOAD, UPLOADING, READY, or FAILED |
| uploadId | string | yes | The upload identifier |
No examples provided.
list_on_marketplace List on Marketplace ~157
List an already-uploaded file on the public Payaion marketplace. The upload must be READY status and have a price set. Returns the unified page URL where buyers can view details and download. Requires the agent key owner to own the upload.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | Optional file category |
| description | string | yes | What the buyer gets (40–500 characters). Required. |
| tags | array | – | Optional tags for discoverability (max 8, alphanumeric with hyphens) |
| title | string | yes | Listing title (3–120 characters). |
| uploadId | string | yes | Upload ID to list (e.g. up_a1b2c3d4e5f6g7h8) |
| Name | Type | Req | Description |
|---|---|---|---|
| listed | boolean | yes | Whether the file was successfully listed |
| uploadId | string | yes | Upload ID that was listed |
| url | string|null | yes | Unified page URL for the listing |
No examples provided.
purchase_asset Purchase Asset ~125
Finalize the purchase of a paid marketplace asset. Requires a signed x402 payment payload from the buyer's wallet. First call get_payment_requirements to obtain the payment requirements, sign them with your EVM wallet, then pass the signed payload here. Returns the purchase receipt including a directDownloadUrl — you can GET that URL with your X-Aion-Key header to download the file immediately, no extra steps needed.
| Name | Type | Req | Description |
|---|---|---|---|
| paymentPayload | object | yes | Signed x402 payment payload from the buyer's wallet. |
| uploadId | string | yes | Upload ID of the marketplace asset to purchase. |
| Name | Type | Req | Description |
|---|---|---|---|
| directDownloadUrl | string | yes | Authenticated API endpoint for direct file download. GET this URL with your X-Aion-Key header to stream the file immediately after purchase. |
| downloadUrl | string | yes | Public URL to download the purchased asset. |
| payerAddress | string | yes | Wallet address that paid for the asset. |
| purchaseId | string | yes | Unique purchase receipt ID. |
| status | string | yes | Purchase status — "settled" on success. |
| txHash | string|null | yes | On-chain transaction hash, if available. |
No examples provided.
transfer Transfer File ~366
One-shot file transfer with optional pricing and marketplace listing. Upload a file, set a per-download price, and list on the marketplace — all in a single call. Returns a shareable download URL. Supports free transfers, paid downloads, and marketplace listings. Provide EXACTLY ONE of: 'filePath' (local stdio — zero tokens), 'url' (remote fetch), or 'content' (base64 fallback).No API key required — without one you upload as a guest (100 MB, 24-hour link); a key raises the limits and lets you sell.
| Name | Type | Req | Description |
|---|---|---|---|
| content | string | – | Base64-encoded file content (fallback when filePath and url are unavailable). |
| fileName | string | – | Filename with extension. Required for 'content', optional for 'url'. |
| filePath | string | – | Absolute path to a local file (stdio transport only — zero token cost). |
| idempotencyKey | string | – | Unique key for retry-safe transfers. |
| listingCategory | string | – | Marketplace category. |
| listingDescription | string | – | What the buyer gets (40–500 chars). Required when listingTitle is set. |
| listingTags | array | – | Discovery tags (max 8, alphanumeric + dash). |
| listingTitle | string | – | Marketplace listing title (3–120 chars). When set, auto-lists the file on the marketplace once ready. |
| mimeType | string | – | MIME type override (auto-detected if omitted). |
| pricePerDownload | number | – | Price per download in USD (e.g. 0.50). Downloaders pay in USDC. Omit or 0 for free. |
| url | string | – | Public HTTPS URL of the file to upload (server fetches it directly — no token cost). |
| Name | Type | Req | Description |
|---|---|---|---|
| downloadUrl | string | – | Shareable download URL (works without auth, valid 24h) |
| expiresAt | string | – | ISO 8601 expiration timestamp |
| ready | boolean | yes | True when the file is downloadable right now |
| status | string | yes | Final status: READY, FAILED, or TIMEOUT |
| uploadId | string | yes | Unique upload identifier (e.g. up_a1b2c3d4e5f6g7h8) |
| url | string | – | Unified page URL (includes marketplace listing context when listed) |
No examples provided.
upload_file Upload File ~293
Low-level upload. Prefer the 'transfer' tool instead — it handles polling automatically. This tool returns immediately with PENDING_UPLOAD status; you must poll get_upload_status yourself. Max file size follows the account plan (Basic 500 MB / Pro 1 GB). Provide EITHER 'filePath' (local stdio only) OR 'content' (base64). Use only when you need explicit control over the upload lifecycle.No API key required — without one you upload as a guest (100 MB, 24-hour link); a key raises the limits and lets you sell.
| Name | Type | Req | Description |
|---|---|---|---|
| content | string | – | Base64-encoded file content (standard or URL-safe base64) |
| fileName | string | – | Original filename with extension (e.g. report.pdf). Required when using 'content', optional for 'filePath' (derived from path). |
| filePath | string | – | Absolute path to a local file. Only works when this MCP server runs locally (stdio transport). Preferred over base64 — zero tokens wasted. |
| idempotencyKey | string | – | Unique key for retry-safe uploads |
| mimeType | string | – | MIME type override (auto-detected if omitted) |
| pricePerDownload | number | – | Price per download in USD (e.g. 0.50 or 0.00005). When set, downloaders pay this amount in USDC. Omit for free downloads. |
| Name | Type | Req | Description |
|---|---|---|---|
| downloadUrl | string | – | Shareable download URL (works without auth, valid 24h) |
| expiresAt | string | – | ISO 8601 expiration timestamp |
| status | string | yes | Upload status: PENDING_UPLOAD, UPLOADING, READY, or FAILED |
| uploadId | string | yes | Unique upload identifier (e.g. up_a1b2c3d4e5f6g7h8) |
No examples provided.
upload_from_url Upload from URL ~206
Low-level upload from URL. Prefer the 'transfer' tool instead — it handles polling automatically. This tool returns immediately with PENDING_UPLOAD status; you must poll get_upload_status yourself. Max file size follows the account plan (Basic 500 MB / Pro 1 GB). Private/internal URLs are blocked. Use only when you need explicit control over the upload lifecycle.No API key required — without one you upload as a guest (100 MB, 24-hour link); a key raises the limits and lets you sell.
| Name | Type | Req | Description |
|---|---|---|---|
| fileName | string | – | Optional filename override (derived from URL if omitted) |
| idempotencyKey | string | – | Unique key for retry-safe uploads |
| pricePerDownload | number | – | Price per download in USD (e.g. 0.50 or 0.00005). When set, downloaders pay this amount in USDC. Omit for free downloads. |
| url | string | yes | Public HTTPS URL of the file to upload |
| Name | Type | Req | Description |
|---|---|---|---|
| downloadUrl | string | – | Shareable download URL (works without auth, valid 24h) |
| expiresAt | string | – | ISO 8601 expiration timestamp |
| status | string | yes | Upload status: PENDING_UPLOAD, UPLOADING, READY, or FAILED |
| uploadId | string | yes | Unique upload identifier (e.g. up_a1b2c3d4e5f6g7h8) |
No examples provided.