Payaion
NPM · @PAYAION/MCP · 2 COMPONENTS · SCANNED SEP 21
Agent file transfer. No API key to start; price downloads in USDC on Base.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency19
- Repository check failed: no source repository is declared. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 36 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability71
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1594 tokens (~177/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management83
- Stability observed for 25 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the Payaion MCP server?
Payaion runs locally as an npm package, launched with npx -y @payaion/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @payaion/mcp
claude mcp add defdone-payaion -- npx -y @payaion/mcp
{
"mcpServers": {
"defdone-payaion": {
"command": "npx",
"args": [
"-y",
"@payaion/mcp"
]
}
}
} {
"servers": {
"defdone-payaion": {
"command": "npx",
"args": [
"-y",
"@payaion/mcp"
]
}
}
} codex mcp add defdone-payaion -- npx -y @payaion/mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"defdone-payaion": {
"type": "local",
"command": [
"npx",
"-y",
"@payaion/mcp"
],
"enabled": true
}
}
} openclaw mcp add defdone-payaion --command npx --arg -y --arg @payaion/mcp
mcp_servers:
defdone-payaion:
command: "npx"
args: ["-y", "@payaion/mcp"] {
"McpServers": {
"defdone-payaion": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@payaion/mcp"
]
}
}
} assistant mcp add defdone-payaion -t stdio -c npx -a -y @payaion/mcp
{
"mcpServers": {
"defdone-payaion": {
"command": "npx",
"args": [
"-y",
"@payaion/mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 −3
- Stability: pass → 0.80 functional
- 19 Sept 26 +1
- Stability: 0.97 → pass security
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 15 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 −3
- Stability: pass → 0.80 functional
- 12 Sept 26 +1
- Stability: 0.97 → pass security
- 10 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 8 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 21 Sept 2026 · Analysed npm/@payaion/mcp@1.0.5
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
browse_marketplace Browse Marketplace ~118
Search and browse active listings on the Payaion marketplace. Filter by keyword, category, and paginate through results. Returns listing details including title, price, file info, and unified page URL. No API key required.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | Filter by category. |
| page | integer | – | Page number (default 1, max 100). |
| pageSize | integer | – | Results per page (default 20, max 100). |
| q | string | – | Search query — matches title and description (max 100 chars). |
| Name | Type | Req | Description |
|---|---|---|---|
| listings | array | yes | Array of marketplace listings |
| page | number | yes | Current page number |
| pageSize | number | yes | Results per page |
| total | number | yes | Total number of matching listings |
No examples provided.
get_download_url Get Download URL ~110
Get a fresh shareable download URL for a previously uploaded file. The file must be in READY status. Share this URL with anyone — it works without authentication.No API key required — without one you upload as a guest (100 MB, 24-hour link); a key raises the limits and lets you sell.
| Name | Type | Req | Description |
|---|---|---|---|
| uploadId | string | yes | Upload ID returned from upload_file or upload_from_url (e.g. up_a1b2c3d4e5f6g7h8) |
| Name | Type | Req | Description |
|---|---|---|---|
| downloadUrl | string | yes | Shareable download URL (works without auth) |
| expiresAt | string | yes | ISO 8601 expiration timestamp |
| ready | boolean | yes | True when the file is downloadable |
| uploadId | string | yes | The upload identifier |
No examples provided.
get_payment_requirements Get Payment Requirements ~76
Retrieve payment requirements for a marketplace asset before purchasing. Returns whether the asset is free or paid. For paid assets, includes the x402 payment requirements object that must be signed by the buyer's wallet and passed to the purchase_asset tool.
| Name | Type | Req | Description |
|---|---|---|---|
| uploadId | string | yes | Upload ID of the marketplace asset to check payment requirements for. |
| Name | Type | Req | Description |
|---|---|---|---|
| asset | object | yes | Asset metadata. |
| isFree | boolean | yes | Whether the asset can be downloaded for free. |
| paymentRequirements | object | – | x402 payment requirements — present only for paid assets. Sign this with your wallet and pass to purchase_asset. |
No examples provided.
get_upload_status Get Upload Status ~143
Check the processing status of a previously uploaded file. Returns the current status (PENDING_UPLOAD, UPLOADING, READY, FAILED) and whether the file is ready for download. Rarely needed — the 'transfer' tool handles polling automatically. Use this only to check on uploads that timed out or for manual status inspection.No API key required — without one you upload as a guest (100 MB, 24-hour link); a key raises the limits and lets you sell.
| Name | Type | Req | Description |
|---|---|---|---|
| uploadId | string | yes | Upload ID returned from upload_file or upload_from_url (e.g. up_a1b2c3d4e5f6g7h8) |
| Name | Type | Req | Description |
|---|---|---|---|
| ready | boolean | yes | True when the file is fully replicated and downloadable |
| status | string | yes | Current status: PENDING_UPLOAD, UPLOADING, READY, or FAILED |
| uploadId | string | yes | The upload identifier |
No examples provided.
list_on_marketplace List on Marketplace ~157
List an already-uploaded file on the public Payaion marketplace. The upload must be READY status and have a price set. Returns the unified page URL where buyers can view details and download. Requires the agent key owner to own the upload.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | Optional file category |
| description | string | yes | What the buyer gets (40–500 characters). Required. |
| tags | array | – | Optional tags for discoverability (max 8, alphanumeric with hyphens) |
| title | string | yes | Listing title (3–120 characters). |
| uploadId | string | yes | Upload ID to list (e.g. up_a1b2c3d4e5f6g7h8) |
| Name | Type | Req | Description |
|---|---|---|---|
| listed | boolean | yes | Whether the file was successfully listed |
| uploadId | string | yes | Upload ID that was listed |
| url | string|null | yes | Unified page URL for the listing |
No examples provided.
purchase_asset Purchase Asset ~125
Finalize the purchase of a paid marketplace asset. Requires a signed x402 payment payload from the buyer's wallet. First call get_payment_requirements to obtain the payment requirements, sign them with your EVM wallet, then pass the signed payload here. Returns the purchase receipt including a directDownloadUrl — you can GET that URL with your X-Aion-Key header to download the file immediately, no extra steps needed.
| Name | Type | Req | Description |
|---|---|---|---|
| paymentPayload | object | yes | Signed x402 payment payload from the buyer's wallet. |
| uploadId | string | yes | Upload ID of the marketplace asset to purchase. |
| Name | Type | Req | Description |
|---|---|---|---|
| directDownloadUrl | string | yes | Authenticated API endpoint for direct file download. GET this URL with your X-Aion-Key header to stream the file immediately after purchase. |
| downloadUrl | string | yes | Public URL to download the purchased asset. |
| payerAddress | string | yes | Wallet address that paid for the asset. |
| purchaseId | string | yes | Unique purchase receipt ID. |
| status | string | yes | Purchase status — "settled" on success. |
| txHash | string|null | yes | On-chain transaction hash, if available. |
No examples provided.
transfer Transfer File ~366
One-shot file transfer with optional pricing and marketplace listing. Upload a file, set a per-download price, and list on the marketplace — all in a single call. Returns a shareable download URL. Supports free transfers, paid downloads, and marketplace listings. Provide EXACTLY ONE of: 'filePath' (local stdio — zero tokens), 'url' (remote fetch), or 'content' (base64 fallback).No API key required — without one you upload as a guest (100 MB, 24-hour link); a key raises the limits and lets you sell.
| Name | Type | Req | Description |
|---|---|---|---|
| content | string | – | Base64-encoded file content (fallback when filePath and url are unavailable). |
| fileName | string | – | Filename with extension. Required for 'content', optional for 'url'. |
| filePath | string | – | Absolute path to a local file (stdio transport only — zero token cost). |
| idempotencyKey | string | – | Unique key for retry-safe transfers. |
| listingCategory | string | – | Marketplace category. |
| listingDescription | string | – | What the buyer gets (40–500 chars). Required when listingTitle is set. |
| listingTags | array | – | Discovery tags (max 8, alphanumeric + dash). |
| listingTitle | string | – | Marketplace listing title (3–120 chars). When set, auto-lists the file on the marketplace once ready. |
| mimeType | string | – | MIME type override (auto-detected if omitted). |
| pricePerDownload | number | – | Price per download in USD (e.g. 0.50). Downloaders pay in USDC. Omit or 0 for free. |
| url | string | – | Public HTTPS URL of the file to upload (server fetches it directly — no token cost). |
| Name | Type | Req | Description |
|---|---|---|---|
| downloadUrl | string | – | Shareable download URL (works without auth, valid 24h) |
| expiresAt | string | – | ISO 8601 expiration timestamp |
| ready | boolean | yes | True when the file is downloadable right now |
| status | string | yes | Final status: READY, FAILED, or TIMEOUT |
| uploadId | string | yes | Unique upload identifier (e.g. up_a1b2c3d4e5f6g7h8) |
| url | string | – | Unified page URL (includes marketplace listing context when listed) |
No examples provided.
upload_file Upload File ~293
Low-level upload. Prefer the 'transfer' tool instead — it handles polling automatically. This tool returns immediately with PENDING_UPLOAD status; you must poll get_upload_status yourself. Max file size follows the account plan (Basic 500 MB / Pro 1 GB). Provide EITHER 'filePath' (local stdio only) OR 'content' (base64). Use only when you need explicit control over the upload lifecycle.No API key required — without one you upload as a guest (100 MB, 24-hour link); a key raises the limits and lets you sell.
| Name | Type | Req | Description |
|---|---|---|---|
| content | string | – | Base64-encoded file content (standard or URL-safe base64) |
| fileName | string | – | Original filename with extension (e.g. report.pdf). Required when using 'content', optional for 'filePath' (derived from path). |
| filePath | string | – | Absolute path to a local file. Only works when this MCP server runs locally (stdio transport). Preferred over base64 — zero tokens wasted. |
| idempotencyKey | string | – | Unique key for retry-safe uploads |
| mimeType | string | – | MIME type override (auto-detected if omitted) |
| pricePerDownload | number | – | Price per download in USD (e.g. 0.50 or 0.00005). When set, downloaders pay this amount in USDC. Omit for free downloads. |
| Name | Type | Req | Description |
|---|---|---|---|
| downloadUrl | string | – | Shareable download URL (works without auth, valid 24h) |
| expiresAt | string | – | ISO 8601 expiration timestamp |
| status | string | yes | Upload status: PENDING_UPLOAD, UPLOADING, READY, or FAILED |
| uploadId | string | yes | Unique upload identifier (e.g. up_a1b2c3d4e5f6g7h8) |
No examples provided.
upload_from_url Upload from URL ~206
Low-level upload from URL. Prefer the 'transfer' tool instead — it handles polling automatically. This tool returns immediately with PENDING_UPLOAD status; you must poll get_upload_status yourself. Max file size follows the account plan (Basic 500 MB / Pro 1 GB). Private/internal URLs are blocked. Use only when you need explicit control over the upload lifecycle.No API key required — without one you upload as a guest (100 MB, 24-hour link); a key raises the limits and lets you sell.
| Name | Type | Req | Description |
|---|---|---|---|
| fileName | string | – | Optional filename override (derived from URL if omitted) |
| idempotencyKey | string | – | Unique key for retry-safe uploads |
| pricePerDownload | number | – | Price per download in USD (e.g. 0.50 or 0.00005). When set, downloaders pay this amount in USDC. Omit for free downloads. |
| url | string | yes | Public HTTPS URL of the file to upload |
| Name | Type | Req | Description |
|---|---|---|---|
| downloadUrl | string | – | Shareable download URL (works without auth, valid 24h) |
| expiresAt | string | – | ISO 8601 expiration timestamp |
| status | string | yes | Upload status: PENDING_UPLOAD, UPLOADING, READY, or FAILED |
| uploadId | string | yes | Unique upload identifier (e.g. up_a1b2c3d4e5f6g7h8) |
No examples provided.
What is the Payaion MCP server?
Payaion is an MCP server listed in the public MCP registry as io.github.defdone/payaion. Agent file transfer. No API key to start; price downloads in USDC on Base. This page covers its npm package (@payaion/mcp).
Is the Payaion MCP server safe to use?
Payaion scores 76 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Payaion MCP server expose?
Payaion exposes 9 tools: upload_file, upload_from_url, transfer, get_upload_status, get_download_url, and 4 more. Their descriptions and schemas cost roughly 1,594 tokens of context every time the server is loaded.
Is the Payaion MCP server still maintained?
Payaion is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Payaion MCP server under?
Payaion declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.