io.github.ThiagoDataEngineer/l402-kit
NPM · L402-KIT · SCANNED AUG 3
MCP server for L402-protected APIs via Bitcoin Lightning. Pay-per-call AI tools in sats.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security87
- No malware found by supply-chain analysis.Pass
- Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.Partial
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 75 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability77
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 1224 tokens (~102/item across 12 items; 12 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
- Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · l402-kit
claude mcp add thiagodataengineer-l402-kit -- npx -y l402-kit
codex mcp add thiagodataengineer-l402-kit -- npx -y l402-kit
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"thiagodataengineer-l402-kit": {
"type": "local",
"command": [
"npx",
"-y",
"l402-kit"
],
"enabled": true
}
}
} openclaw mcp add thiagodataengineer-l402-kit --command npx --arg -y --arg l402-kit
mcp_servers:
thiagodataengineer-l402-kit:
command: "npx"
args: ["-y", "l402-kit"] {
"mcpServers": {
"thiagodataengineer-l402-kit": {
"command": "npx",
"args": [
"-y",
"l402-kit"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Aug 26 +4
- Stability: unverified → 0.27 ▲ functional
- 2 Aug 26 +45
- Provenance: unverified → fail ▼ security
- Known CVEs: unverified → partial ▲ security
- Install scripts: unverified → pass ▲ security
- Malware scan: unverified → pass ▲ security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- Tool coverage: 100 → unverified ▼ functional
- MCP protocol: unverified → pass ▲ functional
- Maintenance: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- License: unverified → pass ▲ functional
- Schema quality: unverified → excellent ▲ functional
- Licence: MIT functional
- 1 Aug 26 −17
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 31 Jul 26 +13
- Provenance: unverified → fail ▼ security
- Malware scan: pass → unverified ▼ security
- Install scripts: unverified → pass ▲ security
- Dependency health: partial → unverified ▼ functional
- Maintenance: unverified → pass ▲ functional
- License: unverified → pass ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- Licence: MIT functional
- 29 Jul 26 −21
- Tool coverage: 100 → unverified ▼ functional
- Dependency health: unverified → partial ▲ functional
- First check of Schema quality: unverified functional
- 27 Jul 26 46
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Analysed npm/[email protected]
Provenance none
Ecosystem: npm · Outcome: none
Dependencies 95 packages
95 packages in the resolved dependency tree · 95 deprecated · 29 stale.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
l402_balance Check Lightning budget ~110
Returns the remaining Bitcoin Lightning budget for this MCP session. Use this before calling l402_fetch to confirm you have enough sats — avoids wasted attempts when budget is exhausted. Returns: '<remaining> sats remaining of <total> total (spent: <spent> sats)'. Read-only — does not trigger any payment or side effect. Budget is set at server startup via BUDGET_SATS (default: 1000 sats ≈ $0.60); to increase it, restart the MCP server.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
l402_fetch Fetch L402-protected URL ~203
Fetch a URL that may require a Bitcoin Lightning payment (L402 protocol). Side effect: deducts sats from the session budget when a payment is required — check l402_balance first if budget is limited. Flow: sends request → if 402 received, pays the Lightning invoice (1 attempt) → retries once with payment proof → returns response body as text. Fails with error if: budget is exhausted, URL is unreachable, or the Lightning payment fails. Do NOT use for regular (non-L402) URLs — use a standard fetch tool instead. Do NOT use if l402_balance shows 0 sats remaining.
| Name | Type | Req | Description |
|---|---|---|---|
| body | string | — | Request body as string (for POST/PUT requests) |
| headers | object | — | Additional HTTP request headers as key-value pairs |
| method | string | — | HTTP method — GET, POST, PUT, DELETE, PATCH. Default: GET |
| url | string | yes | The URL to fetch (http or https) |
No output schema declared.
No examples provided.
l402_set_budget Check budget status ~104
Returns the session budget cap configured at startup (via BUDGET_SATS env var). Use this to confirm what hard spending limit is in effect — useful at the start of a session before making any API calls. Read-only: this tool CANNOT set or change the budget at runtime. To raise or lower the cap, stop and restart the MCP server with a different BUDGET_SATS value. For remaining balance during a session, use l402_balance instead.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
l402_spending_report Lightning spending report ~113
Returns a full audit of all Bitcoin Lightning payments made in this MCP session. Includes: total sats spent, remaining budget, sats spent per domain, and chronological transaction list (timestamp + sats + URL). Use this instead of l402_balance when you need to know *which* APIs were called and *how much* each cost, not just the remaining balance. Read-only — does not trigger any payment or side effect. Returns '(none yet)' for domains and transactions if no payments have been made this session.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
verity_btc_price BTC Price — 10 sats ~71
Get real-time Bitcoin price in USD, EUR, and BRL via VERITY. Costs 10 sats per call. Returns: { bitcoin: { usd, eur, brl }, timestamp }. Use this instead of a free price API when you need a cryptographically billed, auditable data source.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
verity_domain_intel Domain Intelligence — 500 sats ~93
Get WHOIS, DNS records, and SSL certificates for any domain via VERITY. Costs 500 sats. Returns: { domain, whois: { registrar, registered, expires }, dns: { a_records }, certificates }. Zero external API cost — uses RDAP, Cloudflare DNS, and crt.sh.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | Domain name (e.g. 'bitcoin.org', 'example.com') |
No output schema declared.
No examples provided.
verity_integration l402-kit Integration — 10,000 sats ~133
Send VERITY a public GitHub repo URL and receive complete l402-kit integration code. Costs 10,000 sats (~$6). Returns: { integration: string (markdown with exact code), next_steps: string[] }. VERITY analyzes the codebase, detects framework (Express, FastAPI, Gin, Axum, etc.), and generates middleware code with exact file paths and line numbers. WARNING: This tool costs 10,000 sats. Check l402_balance first.
| Name | Type | Req | Description |
|---|---|---|---|
| repoUrl | string | yes | Public GitHub repository URL (e.g. 'https://github.com/owner/repo') |
No output schema declared.
No examples provided.
verity_scrape Web Scrape — 200 sats ~74
Scrape a public URL and return its content as clean markdown via VERITY. Costs 200 sats. Returns: { content: string, title: string }. Powered by Firecrawl. Use for extracting article content, documentation, or structured data.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | URL to scrape (must be publicly accessible) |
No output schema declared.
No examples provided.
verity_search Web Search — 100 sats ~68
Search the web and return top 10 organic results via VERITY. Costs 100 sats. Returns: { results: [{ title, link, snippet }] }. Powered by Serper API. Use for research, fact-checking, or link discovery.
| Name | Type | Req | Description |
|---|---|---|---|
| q | string | yes | Search query |
No output schema declared.
No examples provided.
verity_sentiment Sentiment Analysis — 30 sats ~69
Analyze text sentiment with score, confidence, and keywords via VERITY. Costs 30 sats. Returns: { analysis: { sentiment: 'positive'|'negative'|'neutral', score, confidence, keywords } }. Powered by Claude Haiku.
| Name | Type | Req | Description |
|---|---|---|---|
| text | string | yes | Text to analyze |
No output schema declared.
No examples provided.
verity_summarize Summarize — 50 sats ~95
AI summarization of text up to 50,000 characters via VERITY. Costs 50 sats. Returns: { summary: string }. Language parameter is optional (default: english). Powered by Claude Haiku.
| Name | Type | Req | Description |
|---|---|---|---|
| language | string | — | Output language (e.g. 'english', 'portuguese'). Default: english |
| text | string | yes | Text to summarize (max 50,000 characters) |
No output schema declared.
No examples provided.
verity_worldstate World State — 80 sats ~91
Get UTC time, caller geolocation, and local weather in a single call via VERITY. Costs 80 sats. Returns: { time: { utc, unix, hour, minute, weekday }, location: { city, country, timezone }, weather: { temperature_c, feels_like_c, humidity_pct, condition } }. Zero external API cost — uses Cloudflare geo headers + Open-Meteo.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.