io.github.ThiagoDataEngineer/l402-kit
NPM · L402-KIT · SCANNED SEP 20
MCP server for L402-protected APIs via Bitcoin Lightning. Pay-per-call AI tools in sats.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 96 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 123 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability86
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 1224 tokens (~102/item across 12 items; 12 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management87
- Stability observed for 26 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "verity_integration" implies "send" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 12 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.ThiagoDataEngineer/l402-kit MCP server?
io.github.ThiagoDataEngineer/l402-kit runs locally as an npm package, launched with npx -y l402-kit. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · l402-kit
claude mcp add thiagodataengineer-l402-kit -- npx -y l402-kit
{
"mcpServers": {
"thiagodataengineer-l402-kit": {
"command": "npx",
"args": [
"-y",
"l402-kit"
]
}
}
} {
"servers": {
"thiagodataengineer-l402-kit": {
"command": "npx",
"args": [
"-y",
"l402-kit"
]
}
}
} codex mcp add thiagodataengineer-l402-kit -- npx -y l402-kit
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"thiagodataengineer-l402-kit": {
"type": "local",
"command": [
"npx",
"-y",
"l402-kit"
],
"enabled": true
}
}
} openclaw mcp add thiagodataengineer-l402-kit --command npx --arg -y --arg l402-kit
mcp_servers:
thiagodataengineer-l402-kit:
command: "npx"
args: ["-y", "l402-kit"] {
"McpServers": {
"thiagodataengineer-l402-kit": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"l402-kit"
]
}
}
} assistant mcp add thiagodataengineer-l402-kit -t stdio -c npx -a -y l402-kit
{
"mcpServers": {
"thiagodataengineer-l402-kit": {
"command": "npx",
"args": [
"-y",
"l402-kit"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 −3
- Stability: pass → 0.77 functional
- 16 Sept 26 0
- Stability: 0.97 → pass security
- 15 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Sept 26 −3
- Stability: pass → 0.80 functional
- 9 Sept 26 0
- Stability: 0.97 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/l402-kit@1.8.7
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 96 packages
| Packages resolved | 96 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
l402_balance Check Lightning budget ~110
Returns the remaining Bitcoin Lightning budget for this MCP session. Use this before calling l402_fetch to confirm you have enough sats — avoids wasted attempts when budget is exhausted. Returns: '<remaining> sats remaining of <total> total (spent: <spent> sats)'. Read-only — does not trigger any payment or side effect. Budget is set at server startup via BUDGET_SATS (default: 1000 sats ≈ $0.60); to increase it, restart the MCP server.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
l402_fetch Fetch L402-protected URL ~203
Fetch a URL that may require a Bitcoin Lightning payment (L402 protocol). Side effect: deducts sats from the session budget when a payment is required — check l402_balance first if budget is limited. Flow: sends request → if 402 received, pays the Lightning invoice (1 attempt) → retries once with payment proof → returns response body as text. Fails with error if: budget is exhausted, URL is unreachable, or the Lightning payment fails. Do NOT use for regular (non-L402) URLs — use a standard fetch tool instead. Do NOT use if l402_balance shows 0 sats remaining.
| Name | Type | Req | Description |
|---|---|---|---|
| body | string | – | Request body as string (for POST/PUT requests) |
| headers | object | – | Additional HTTP request headers as key-value pairs |
| method | string | – | HTTP method — GET, POST, PUT, DELETE, PATCH. Default: GET |
| url | string | yes | The URL to fetch (http or https) |
No output schema declared.
No examples provided.
l402_set_budget Check budget status ~104
Returns the session budget cap configured at startup (via BUDGET_SATS env var). Use this to confirm what hard spending limit is in effect — useful at the start of a session before making any API calls. Read-only: this tool CANNOT set or change the budget at runtime. To raise or lower the cap, stop and restart the MCP server with a different BUDGET_SATS value. For remaining balance during a session, use l402_balance instead.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
l402_spending_report Lightning spending report ~113
Returns a full audit of all Bitcoin Lightning payments made in this MCP session. Includes: total sats spent, remaining budget, sats spent per domain, and chronological transaction list (timestamp + sats + URL). Use this instead of l402_balance when you need to know *which* APIs were called and *how much* each cost, not just the remaining balance. Read-only — does not trigger any payment or side effect. Returns '(none yet)' for domains and transactions if no payments have been made this session.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
verity_btc_price BTC Price — 10 sats ~71
Get real-time Bitcoin price in USD, EUR, and BRL via VERITY. Costs 10 sats per call. Returns: { bitcoin: { usd, eur, brl }, timestamp }. Use this instead of a free price API when you need a cryptographically billed, auditable data source.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
verity_domain_intel Domain Intelligence — 500 sats ~93
Get WHOIS, DNS records, and SSL certificates for any domain via VERITY. Costs 500 sats. Returns: { domain, whois: { registrar, registered, expires }, dns: { a_records }, certificates }. Zero external API cost — uses RDAP, Cloudflare DNS, and crt.sh.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | Domain name (e.g. 'bitcoin.org', 'example.com') |
No output schema declared.
No examples provided.
verity_integration l402-kit Integration — 10,000 sats ~133
Send VERITY a public GitHub repo URL and receive complete l402-kit integration code. Costs 10,000 sats (~$6). Returns: { integration: string (markdown with exact code), next_steps: string[] }. VERITY analyzes the codebase, detects framework (Express, FastAPI, Gin, Axum, etc.), and generates middleware code with exact file paths and line numbers. WARNING: This tool costs 10,000 sats. Check l402_balance first.
| Name | Type | Req | Description |
|---|---|---|---|
| repoUrl | string | yes | Public GitHub repository URL (e.g. 'https://github.com/owner/repo') |
No output schema declared.
No examples provided.
verity_scrape Web Scrape — 200 sats ~74
Scrape a public URL and return its content as clean markdown via VERITY. Costs 200 sats. Returns: { content: string, title: string }. Powered by Firecrawl. Use for extracting article content, documentation, or structured data.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | URL to scrape (must be publicly accessible) |
No output schema declared.
No examples provided.
verity_search Web Search — 100 sats ~68
Search the web and return top 10 organic results via VERITY. Costs 100 sats. Returns: { results: [{ title, link, snippet }] }. Powered by Serper API. Use for research, fact-checking, or link discovery.
| Name | Type | Req | Description |
|---|---|---|---|
| q | string | yes | Search query |
No output schema declared.
No examples provided.
verity_sentiment Sentiment Analysis — 30 sats ~69
Analyze text sentiment with score, confidence, and keywords via VERITY. Costs 30 sats. Returns: { analysis: { sentiment: 'positive'|'negative'|'neutral', score, confidence, keywords } }. Powered by Claude Haiku.
| Name | Type | Req | Description |
|---|---|---|---|
| text | string | yes | Text to analyze |
No output schema declared.
No examples provided.
verity_summarize Summarize — 50 sats ~95
AI summarization of text up to 50,000 characters via VERITY. Costs 50 sats. Returns: { summary: string }. Language parameter is optional (default: english). Powered by Claude Haiku.
| Name | Type | Req | Description |
|---|---|---|---|
| language | string | – | Output language (e.g. 'english', 'portuguese'). Default: english |
| text | string | yes | Text to summarize (max 50,000 characters) |
No output schema declared.
No examples provided.
verity_worldstate World State — 80 sats ~91
Get UTC time, caller geolocation, and local weather in a single call via VERITY. Costs 80 sats. Returns: { time: { utc, unix, hour, minute, weekday }, location: { city, country, timezone }, weather: { temperature_c, feels_like_c, humidity_pct, condition } }. Zero external API cost — uses Cloudflare geo headers + Open-Meteo.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
What is the io.github.ThiagoDataEngineer/l402-kit MCP server?
io.github.ThiagoDataEngineer/l402-kit is an MCP server listed in the public MCP registry as io.github.ThiagoDataEngineer/l402-kit. MCP server for L402-protected APIs via Bitcoin Lightning. Pay-per-call AI tools in sats. This page covers its npm package (l402-kit).
Is the io.github.ThiagoDataEngineer/l402-kit MCP server safe to use?
io.github.ThiagoDataEngineer/l402-kit scores 83 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.ThiagoDataEngineer/l402-kit MCP server expose?
io.github.ThiagoDataEngineer/l402-kit exposes 12 tools: l402_fetch, l402_balance, l402_spending_report, l402_set_budget, verity_btc_price, and 7 more. Their descriptions and schemas cost roughly 1,224 tokens of context every time the server is loaded.
Is the io.github.ThiagoDataEngineer/l402-kit MCP server still maintained?
io.github.ThiagoDataEngineer/l402-kit is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.ThiagoDataEngineer/l402-kit MCP server under?
io.github.ThiagoDataEngineer/l402-kit declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.