ClawPay MCP — Non-Custodial x402 Payments for AI Agents
NPM · CLAWPAY-MCP · SCANNED AUG 3
Non-custodial x402 payments for AI agents. Sign locally, spend limits, Base network.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security79
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects ws 8.18.3, reached via viem > ws. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (111 of 115), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency19
- Repository check failed: the declared repository URL redirects; it must resolve directly. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 135 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability71
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1544 tokens (~140/item across 11 items; 11 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · clawpay-mcp
claude mcp add up2itnow0822-clawpay-mcp -- npx -y clawpay-mcp
codex mcp add up2itnow0822-clawpay-mcp -- npx -y clawpay-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"up2itnow0822-clawpay-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"clawpay-mcp"
],
"enabled": true
}
}
} openclaw mcp add up2itnow0822-clawpay-mcp --command npx --arg -y --arg clawpay-mcp
mcp_servers:
up2itnow0822-clawpay-mcp:
command: "npx"
args: ["-y", "clawpay-mcp"] {
"mcpServers": {
"up2itnow0822-clawpay-mcp": {
"command": "npx",
"args": [
"-y",
"clawpay-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 2 Aug 26 +38
- CVE-2026-45736 affects this package: high ▼ security
- CVE-2026-48779 affects this package: high ▼ security
- Known CVEs: unverified → fail ▼ security
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Malware scan: unverified → pass ▲ security
- Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
- Capabilities: pass → unverified ▼ functional
- Maintenance: unverified → pass ▲ functional
- Schema quality: unverified → excellent ▲ functional
- Dependency health: unverified → partial ▲ functional
- License: unverified → pass ▲ functional
- Licence: MIT functional
- 1 Aug 26 −2
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 31 Jul 26 −18
- Malware scan: pass → unverified ▼ security
- 30 Jul 26 +21
- Tool coverage: unverified → 100 ▲ functional
- 28 Jul 26 −21
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
- 27 Jul 26 39
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Analysed npm/[email protected]
Provenance none
Ecosystem: npm · Outcome: none
Vulnerabilities 2 findings
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-58qx-3vcg-4xpx | CVE-2026-45736 | medium | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N | yes |
| GHSA-96hv-2xvq-fx4p | CVE-2026-48779 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Dependencies 111 packages
111 packages in the resolved dependency tree · 110 deprecated · 29 stale.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
check_spend_limit ~82
Check whether a proposed payment amount is within the wallet's autonomous spend limits. Returns a clear yes/no with remaining budget details. Use this before send_payment to avoid surprise queuing.
| Name | Type | Req | Description |
|---|---|---|---|
| amount_eth | string | yes | Amount in ETH to check (e.g. "0.01") |
| token | string | — | Token address. Omit for native ETH. |
No output schema declared.
No examples provided.
deploy_wallet ~126
Deploy a new AgentAccountV2 wallet via the factory contract. The wallet is deterministically addressed (CREATE2) and owned by an NFT. Returns the wallet address and deployment transaction hash. Requires FACTORY_ADDRESS and NFT_CONTRACT_ADDRESS env vars (or pass them as arguments).
| Name | Type | Req | Description |
|---|---|---|---|
| factory_address | string | — | Factory contract address. Defaults to FACTORY_ADDRESS env var. |
| nft_contract_address | string | — | NFT contract address. Defaults to NFT_CONTRACT_ADDRESS env var. |
| token_id | string | yes | NFT token ID that will own this wallet (e.g. "1") |
No output schema declared.
No examples provided.
get_transaction_history ~126
Retrieve the wallet's recent on-chain transaction history from event logs. Shows executions, queued transactions, approvals, cancellations, spend policy updates, and operator changes. Filter by event type or block range for targeted queries.
| Name | Type | Req | Description |
|---|---|---|---|
| event_type | string | — | Filter by event type (default: all) |
| from_block | string | — | Start block (decimal string). Defaults to 1000 blocks ago. |
| limit | number | — | Max entries to return (default: 20, max: 100) |
| to_block | string | — | End block (decimal string). Defaults to latest. |
No output schema declared.
No examples provided.
get_wallet_info ~82
Get comprehensive wallet information including address, on-chain balance, spend limits, remaining period allowance, and queue depth. Use token parameter to check budget for a specific ERC20 (defaults to ETH).
| Name | Type | Req | Description |
|---|---|---|---|
| token | string | — | Token address to check. Use "0x0000000000000000000000000000000000000000" for ETH (default). |
No output schema declared.
No examples provided.
queue_approval ~95
Manage over-limit transactions queued for owner review. Use action="list" to see pending transactions, "approve" to approve one by ID, or "cancel" to cancel one by ID. Approve/cancel require the agent key to have owner privileges.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action: "list", "approve", or "cancel" |
| tx_id | string | — | Transaction queue ID (required for approve/cancel) |
No output schema declared.
No examples provided.
send_payment ~187
Send ETH or ERC20 tokens from the Agent Wallet. If the amount is within the configured spend limits, it executes immediately and returns the tx hash. If it exceeds limits, the transaction is queued for owner approval (use queue_approval to manage). Always check spend limits first with check_spend_limit to avoid surprises.
| Name | Type | Req | Description |
|---|---|---|---|
| amount_eth | string | yes | Amount in ETH (or token units). E.g. "0.001" for 0.001 ETH, "1.5" for 1.5 USDC |
| memo | string | — | Optional memo for this payment (not stored on-chain) |
| to | string | yes | Recipient wallet address (0x-prefixed) |
| token | string | — | ERC20 token address. Omit for native ETH. |
| token_decimals | number | — | Token decimals (default 18 for ETH, 6 for USDC) |
No output schema declared.
No examples provided.
x402_pay ~231
Fetch a URL and automatically handle HTTP 402 Payment Required responses. If an active x402 V2 session covers this URL, the session token is used instead of making a new payment (no on-chain cost). If no session exists, the Agent Wallet pays the required amount and retries. Payment is rejected if it exceeds your wallet's spend limits or the max_payment_eth cap. Powered by the x402 protocol on Base network. Tip: Use x402_session_start to pay once for a session and save on repeated calls.
| Name | Type | Req | Description |
|---|---|---|---|
| body | string | — | Request body string (for POST/PUT/PATCH) |
| headers | object | — | Additional request headers |
| max_payment_eth | string | — | Maximum payment cap in ETH (e.g. "0.001") |
| method | string | — | HTTP method (default: GET) |
| skip_session_check | boolean | — | Skip session auto-detection and force a fresh x402 payment |
| timeout_ms | number | — | Timeout in milliseconds (default: 30000) |
| url | string | yes | URL to fetch (HTTP 402 responses are handled automatically) |
No output schema declared.
No examples provided.
x402_session_end ~74
Explicitly close an x402 V2 session before it expires naturally. After calling this, x402_session_fetch will return an error for the closed session. Useful for security hygiene or when you know a session is no longer needed.
| Name | Type | Req | Description |
|---|---|---|---|
| session_id | string | yes | Session ID to close (from x402_session_start) |
No output schema declared.
No examples provided.
x402_session_fetch ~179
Make an HTTP request within an established x402 V2 session — NO payment required. The session token (signed by your wallet) is automatically attached to the request. The server recognises your session and grants access without a new on-chain payment. Requires a session_id from x402_session_start. Returns an error if the session has expired (call x402_session_start again to renew).
| Name | Type | Req | Description |
|---|---|---|---|
| body | string | — | Request body for POST/PUT/PATCH |
| headers | object | — | Additional headers (session token is injected automatically) |
| method | string | — | HTTP method (default: GET) |
| session_id | string | yes | Session ID from x402_session_start |
| timeout_ms | number | — | Timeout in milliseconds (default: 30000) |
| url | string | yes | URL to fetch (must be covered by the session) |
No output schema declared.
No examples provided.
x402_session_start ~285
Establish an x402 V2 payment session: make a SINGLE on-chain payment and receive a cryptographically signed session token. All subsequent calls to the same endpoint within the session lifetime use x402_session_fetch — no additional payments required. Agents pay once per session rather than once per API call. Session tokens are signed locally by your wallet key (non-custodial). Returns a session_id you pass to x402_session_fetch for all future calls.
| Name | Type | Req | Description |
|---|---|---|---|
| body | string | — | Request body for POST/PUT/PATCH session-start requests |
| endpoint | string | yes | Base URL to establish a session for (e.g., "https://api.example.com/v1") |
| headers | object | — | Additional request headers |
| label | string | — | Optional label for this session (e.g., "Premium API session") |
| max_payment_eth | string | — | Maximum ETH to pay for this session. Rejects if price exceeds this. |
| method | string | — | HTTP method for the initial request (default: GET) |
| scope | string | — | "prefix": covers all paths under this URL (default). "exact": single URL only. |
| timeout_ms | number | — | Request timeout in milliseconds (default: 30000) |
| ttl_seconds | number | — | Session TTL in seconds (default: 3600 / 1 hour). Max: 30 days. |
No output schema declared.
No examples provided.
x402_session_status ~77
Check the status of x402 V2 payment sessions. Without arguments, lists all active sessions with TTL remaining. With a session_id, shows full details for that session including call count, payment info, and the signed session token.
| Name | Type | Req | Description |
|---|---|---|---|
| session_id | string | — | Specific session ID to inspect. Omit to list all active sessions. |
No output schema declared.
No examples provided.