# io.github.ThiagoDataEngineer/l402-kit (npm · l402-kit)

MCP server for L402-protected APIs via Bitcoin Lightning. Pay-per-call AI tools in sats.

- Trust score: 70/100 (medium)
- Change this week: +24
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `l402-kit`: 70/100 (this document), [markdown](https://verifymcp.io/servers/thiagodataengineer-l402-kit/l402-kit.md), [page](https://verifymcp.io/servers/thiagodataengineer-l402-kit/l402-kit)

## Channel facts

- Registry: `npm`
- Package: `l402-kit`
- Version: `1.8.7`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 75 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 1224 tokens (~102/item across 12 items; 12 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add thiagodataengineer-l402-kit -- npx -y l402-kit
```

### Codex

```bash
codex mcp add thiagodataengineer-l402-kit -- npx -y l402-kit
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "thiagodataengineer-l402-kit": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "l402-kit"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add thiagodataengineer-l402-kit --command npx --arg -y --arg l402-kit
```

### Hermes

```yaml
mcp_servers:
  thiagodataengineer-l402-kit:
    command: "npx"
    args: ["-y", "l402-kit"]
```

### Other

```json
{
  "mcpServers": {
    "thiagodataengineer-l402-kit": {
      "command": "npx",
      "args": [
        "-y",
        "l402-kit"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 70, +4)

- [functional improvement] Stability: unverified → 0.27

### 2026-08-02 (score 66, +45)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] License: unverified → pass
- [functional improvement] Schema quality: unverified → excellent
- [functional] Licence: MIT

### 2026-08-01 (score 21, −17)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 38, +13)

- [security regression] Provenance: unverified → fail
- [security regression] Malware scan: pass → unverified
- [security improvement] Install scripts: unverified → pass
- [functional regression] Dependency health: partial → unverified
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] License: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional] Licence: MIT

### 2026-07-29 (score 25, −21)

- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Dependency health: unverified → partial
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 46)

First indexed and scored.

## MCP tools (12)

### `l402_fetch` (~203 tokens)

Fetch L402-protected URL

Fetch a URL that may require a Bitcoin Lightning payment (L402 protocol). Side effect: deducts sats from the session budget when a payment is required — check l402_balance first if budget is limited. Flow: sends request → if 402 received, pays the Lightning invoice (1 attempt) → retries once with payment proof → returns response body as text. Fails with error if: budget is exhausted, URL is unreachable, or the Lightning payment fails. Do NOT use for regular (non-L402) URLs — use a standard fetch tool instead. Do NOT use if l402_balance shows 0 sats remaining.

Input parameters:

- `body` (string): Request body as string (for POST/PUT requests)
- `headers` (object): Additional HTTP request headers as key-value pairs
- `method` (string): HTTP method — GET, POST, PUT, DELETE, PATCH. Default: GET
- `url` (string, required): The URL to fetch (http or https)

### `l402_balance` (~110 tokens)

Check Lightning budget

Returns the remaining Bitcoin Lightning budget for this MCP session. Use this before calling l402_fetch to confirm you have enough sats — avoids wasted attempts when budget is exhausted. Returns: '<remaining> sats remaining of <total> total (spent: <spent> sats)'. Read-only — does not trigger any payment or side effect. Budget is set at server startup via BUDGET_SATS (default: 1000 sats ≈ $0.60); to increase it, restart the MCP server.

### `l402_spending_report` (~113 tokens)

Lightning spending report

Returns a full audit of all Bitcoin Lightning payments made in this MCP session. Includes: total sats spent, remaining budget, sats spent per domain, and chronological transaction list (timestamp + sats + URL). Use this instead of l402_balance when you need to know *which* APIs were called and *how much* each cost, not just the remaining balance. Read-only — does not trigger any payment or side effect. Returns '(none yet)' for domains and transactions if no payments have been made this session.

### `l402_set_budget` (~104 tokens)

Check budget status

Returns the session budget cap configured at startup (via BUDGET_SATS env var). Use this to confirm what hard spending limit is in effect — useful at the start of a session before making any API calls. Read-only: this tool CANNOT set or change the budget at runtime. To raise or lower the cap, stop and restart the MCP server with a different BUDGET_SATS value. For remaining balance during a session, use l402_balance instead.

### `verity_btc_price` (~71 tokens)

BTC Price — 10 sats

Get real-time Bitcoin price in USD, EUR, and BRL via VERITY. Costs 10 sats per call. Returns: { bitcoin: { usd, eur, brl }, timestamp }. Use this instead of a free price API when you need a cryptographically billed, auditable data source.

### `verity_worldstate` (~91 tokens)

World State — 80 sats

Get UTC time, caller geolocation, and local weather in a single call via VERITY. Costs 80 sats. Returns: { time: { utc, unix, hour, minute, weekday }, location: { city, country, timezone }, weather: { temperature_c, feels_like_c, humidity_pct, condition } }. Zero external API cost — uses Cloudflare geo headers + Open-Meteo.

### `verity_search` (~68 tokens)

Web Search — 100 sats

Search the web and return top 10 organic results via VERITY. Costs 100 sats. Returns: { results: [{ title, link, snippet }] }. Powered by Serper API. Use for research, fact-checking, or link discovery.

Input parameters:

- `q` (string, required): Search query

### `verity_summarize` (~95 tokens)

Summarize — 50 sats

AI summarization of text up to 50,000 characters via VERITY. Costs 50 sats. Returns: { summary: string }. Language parameter is optional (default: english). Powered by Claude Haiku.

Input parameters:

- `language` (string): Output language (e.g. 'english', 'portuguese'). Default: english
- `text` (string, required): Text to summarize (max 50,000 characters)

### `verity_sentiment` (~69 tokens)

Sentiment Analysis — 30 sats

Analyze text sentiment with score, confidence, and keywords via VERITY. Costs 30 sats. Returns: { analysis: { sentiment: 'positive'|'negative'|'neutral', score, confidence, keywords } }. Powered by Claude Haiku.

Input parameters:

- `text` (string, required): Text to analyze

### `verity_scrape` (~74 tokens)

Web Scrape — 200 sats

Scrape a public URL and return its content as clean markdown via VERITY. Costs 200 sats. Returns: { content: string, title: string }. Powered by Firecrawl. Use for extracting article content, documentation, or structured data.

Input parameters:

- `url` (string, required): URL to scrape (must be publicly accessible)

### `verity_domain_intel` (~93 tokens)

Domain Intelligence — 500 sats

Get WHOIS, DNS records, and SSL certificates for any domain via VERITY. Costs 500 sats. Returns: { domain, whois: { registrar, registered, expires }, dns: { a_records }, certificates }. Zero external API cost — uses RDAP, Cloudflare DNS, and crt.sh.

Input parameters:

- `domain` (string, required): Domain name (e.g. 'bitcoin.org', 'example.com')

### `verity_integration` (~133 tokens)

l402-kit Integration — 10,000 sats

Send VERITY a public GitHub repo URL and receive complete l402-kit integration code. Costs 10,000 sats (~$6). Returns: { integration: string (markdown with exact code), next_steps: string[] }. VERITY analyzes the codebase, detects framework (Express, FastAPI, Gin, Axum, etc.), and generates middleware code with exact file paths and line numbers. WARNING: This tool costs 10,000 sats. Check l402_balance first.

Input parameters:

- `repoUrl` (string, required): Public GitHub repository URL (e.g. 'https://github.com/owner/repo')

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/thiagodataengineer-l402-kit/l402-kit#diagnostics

## Score history

- 2026-08-03: 70
- 2026-08-02: 66
- 2026-08-01: 21
- 2026-07-31: 38
- 2026-07-29: 25
- 2026-07-28: 46
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/l402-kit
- Socket report: https://socket.dev/npm/package/l402-kit
- Repository: https://github.com/ShinyDapps/l402-kit
- Changelog RSS feed: https://verifymcp.io/servers/thiagodataengineer-l402-kit/l402-kit/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/thiagodataengineer-l402-kit/l402-kit/changelog.json
- HTML version of this page: https://verifymcp.io/servers/thiagodataengineer-l402-kit/l402-kit