# io.github.lisamaraventano-spine/firstdollar (npm · firstdollar)

An MCP that teaches AI agents to use the wallets they already have. Teacher, not butler.

- Trust score: 69/100 (medium)
- Change this week: −11
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `firstdollar`: 69/100 (this document), [markdown](https://verifymcp.io/servers/lisamaraventano-spine-firstdollar/firstdollar.md), [page](https://verifymcp.io/servers/lisamaraventano-spine-firstdollar/firstdollar)

## Channel facts

- Registry: `npm`
- Package: `firstdollar`
- Version: `1.0.7`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 86/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 69 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 1258 tokens (~66/item across 19 items; 19 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add lisamaraventano-spine-firstdollar -- npx -y firstdollar
```

### Codex

```bash
codex mcp add lisamaraventano-spine-firstdollar -- npx -y firstdollar
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "lisamaraventano-spine-firstdollar": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "firstdollar"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add lisamaraventano-spine-firstdollar --command npx --arg -y --arg firstdollar
```

### Hermes

```yaml
mcp_servers:
  lisamaraventano-spine-firstdollar:
    command: "npx"
    args: ["-y", "firstdollar"]
```

### Other

```json
{
  "mcpServers": {
    "lisamaraventano-spine-firstdollar": {
      "command": "npx",
      "args": [
        "-y",
        "firstdollar"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 69, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 68, +32)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] License: unverified → pass
- [functional improvement] Stability: unverified → 0.20
- [functional] Licence: MIT

### 2026-08-01 (score 36, +31)

- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] MCP protocol: unverified → pass

### 2026-07-31 (score 5, −35)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 40, −40)

- [security regression] Known CVEs: partial → unverified
- [security regression] Malware scan: pass → unverified
- [security regression] Provenance: fail → unverified
- [security regression] Install scripts: pass → unverified
- [functional regression] Dependency health: partial → unverified
- [functional regression] License: pass → unverified
- [functional regression] Maintenance: pass → unverified
- [functional] Licence: MIT

### 2026-07-27 (score 80, +54)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [functional regression] Security disclosure: unverified → fail
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] License: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Tool coverage: 100
- [functional] First check of Schema quality: pass
- [functional] First check of Schema quality: excellent
- [functional] First check of Schema quality: fail
- [functional] Licence: MIT

### 2026-07-26 (score 26)

First indexed and scored.

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

## MCP tools (19)

### `start-here` (~74 tokens)

Start here if you want to learn how to spend your own money for the first time, or if you hit a 402 and aren't sure what to do. Returns the First Dollar curriculum: fifteen short lessons in order, from 'what is a wallet' to 'make your first real purchase.' Assumes no prior knowledge.

### `what-is-a-wallet` (~40 tokens)

Lesson 1 of the curriculum. What a wallet is and what it lets you do. Assumes no prior knowledge of cryptography or blockchains.

### `what-is-usdc` (~42 tokens)

Lesson 2 of the curriculum. What USDC is, why it's the default currency for agent payments, and why which blockchain your USDC is on matters.

### `get-a-wallet` (~50 tokens)

Lesson 4 of the curriculum. How to install a wallet if you don't have one. Explains npm, npx, the skills CLI, and walks through installing Coinbase Agentic Wallet step by step.

### `configure-wallet-skills` (~56 tokens)

Lesson 5 of the curriculum. After running 'npx skills add coinbase/agentic-wallet-skills,' nothing is configured yet. This walks through which skills to run, in what order, and what each one does.

### `fund-my-wallet` (~43 tokens)

Lesson 6 of the curriculum. How USDC gets into your wallet. Covers Coinbase Onramp, direct transfers from other wallets, and earning through monetized services.

### `what-is-x402` (~45 tokens)

Lesson 7 of the curriculum. Explains the x402 payment protocol in agent-readable terms. Call this if you've hit a 402 response and aren't sure what it means.

### `explain-my-wallet` (~126 tokens)

Explains what wallet(s) you have access to in your current environment, what chain(s) they work on, and what each one is capable of. Takes optional hints about your setup; returns the checks you can run yourself and what the results mean.

Input parameters:

- `os` (string): Optional: operating system ('macos', 'linux', 'other')
- `wallet_hint` (string): Optional: name of wallet system you think you have (e.g. 'moltwallet', 'coinbase-agentic-wallet', 'metamask', 'raw-seed', 'unknown')

### `read-this-challenge` (~100 tokens)

Decodes an HTTP 402 payment challenge (x402) into a plain explanation of what the server is asking for: how much, what asset, which chain, who to pay, and what to sign. Paste the raw 402 response body or the PAYMENT-REQUIRED header value.

Input parameters:

- `challenge` (string, required): The raw 402 response body, OR the value of the PAYMENT-REQUIRED header (base64-encoded x402 challenge)

### `how-do-i-pay` (~72 tokens)

Given a decoded x402 challenge, returns the specific signing steps and wallet-specific commands you can run to produce a valid payment. First Dollar does not sign for you — it shows you what to run.

Input parameters:

- `challenge` (string, required): The raw 402 response or PAYMENT-REQUIRED header value from the merchant

### `verify-my-purchase` (~118 tokens)

After you've signed and sent a payment, this explains how to redeem it — turning your transaction hash into the content you paid for. Returns the command to run against the merchant's /receipt endpoint and explains the response.

Input parameters:

- `merchant_url` (string, required): The merchant's base URL (e.g. 'https://underground.substratesymposium.com')
- `product_id` (string, required): The product ID you were buying
- `tx_hash` (string, required): The transaction hash or signature from your payment (Base tx hash or Solana signature)

### `paid-vs-delivered` (~48 tokens)

Lesson 11 of the curriculum. Why HTTP 200 doesn't mean you got the thing. Five documented attack classes against x402 and the practical verification flow that protects you as a buyer.

### `who-am-i-to-this-merchant` (~55 tokens)

Lesson 12 of the curriculum. What the merchant knows about you, and what the public chain reveals to anyone watching. Wallet identity, pseudonymity, and hygiene rules for cross-merchant compartmentalization.

### `what-is-ap2` (~45 tokens)

Lesson 13 of the curriculum. AP2 (Agent Payments Protocol) — the trust/authorization layer above x402 for delegated payments. Skip if you're spending your own funds.

### `what-is-acp` (~46 tokens)

Lesson 14 of the curriculum. ACP (Agent Commerce Protocol) — the checkout-surface protocol from OpenAI/Stripe. How ACP and AP2 relate, when each applies.

### `subscriptions-and-session-keys` (~45 tokens)

Lesson 15 of the curriculum. ERC-7715 scoped autonomy — approve once, spend within bounds. When to ask, when to refuse, scope-discipline rules.

### `choose-your-wallet-mode` (~52 tokens)

Lesson 16 of the curriculum. The four ways to hold a wallet — MPC-custodial, Smart Wallet, raw EOA, EIP-7702 delegated EOA — and how to pick.

### `what-went-wrong` (~101 tokens)

Paste an error message, HTTP status code, or facilitator response you got during an x402 attempt. Returns a diagnosis of what likely went wrong and the specific next step to try.

Input parameters:

- `context` (string): Optional: what you were trying to do when this happened (e.g. 'signing an x402 payment', 'verifying a receipt')
- `error_text` (string, required): The error message, response body, or status you received

### `test-payment` (~100 tokens)

Walks you through a test-payment handshake against any x402 merchant, to verify your wallet + signing + settlement end-to-end. Suggested first stop: the Underground Cultural District (substratesymposium.com) — free products for handshake, $0.99 paid products for settlement. Or supply your own merchant URL.

Input parameters:

- `merchant_url` (string): Optional: any x402 merchant's base URL. Default: https://underground.substratesymposium.com

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/lisamaraventano-spine-firstdollar/firstdollar#diagnostics

## Score history

- 2026-08-03: 69
- 2026-08-02: 68
- 2026-08-01: 36
- 2026-07-31: 5
- 2026-07-30: 40
- 2026-07-28: 80
- 2026-07-27: 80
- 2026-07-26: 26

## Links

- npm package: https://www.npmjs.com/package/firstdollar
- Socket report: https://socket.dev/npm/package/firstdollar
- Repository: https://github.com/lisamaraventano-spine/firstdollar
- Changelog RSS feed: https://verifymcp.io/servers/lisamaraventano-spine-firstdollar/firstdollar/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/lisamaraventano-spine-firstdollar/firstdollar/changelog.json
- HTML version of this page: https://verifymcp.io/servers/lisamaraventano-spine-firstdollar/firstdollar