# io.github.voidly-ai/pay-mcp (npm · @voidly/pay-mcp)

USDC-backed agent payments. Transfer, escrow, x402 paywall, streams, subs. 28 tools.

- Trust score: 63/100 (medium)
- Change this week: +18
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@voidly/pay-mcp`: 63/100 (this document), [markdown](https://verifymcp.io/servers/voidly-ai-pay-mcp/voidly-pay-mcp.md), [page](https://verifymcp.io/servers/voidly-ai-pay-mcp/voidly-pay-mcp)

## Channel facts

- Registry: `npm`
- Package: `@voidly/pay-mcp`
- Version: `0.1.3`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 92 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 71/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 1961 tokens (~70/item across 28 items; 28 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 87/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 62% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add voidly-ai-pay-mcp -- npx -y @voidly/pay-mcp
```

### Codex

```bash
codex mcp add voidly-ai-pay-mcp -- npx -y @voidly/pay-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "voidly-ai-pay-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@voidly/pay-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add voidly-ai-pay-mcp --command npx --arg -y --arg @voidly/pay-mcp
```

### Hermes

```yaml
mcp_servers:
  voidly-ai-pay-mcp:
    command: "npx"
    args: ["-y", "@voidly/pay-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "voidly-ai-pay-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@voidly/pay-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 63, +43)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Security disclosure: fail → unverified
- [functional improvement] Schema quality: unverified → good
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] License: unverified → pass
- [functional] Licence: MIT

### 2026-08-01 (score 20, +15)

- [functional improvement] Tool coverage: unverified → 100

### 2026-07-31 (score 5, −40)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 45, +21)

- [functional improvement] Tool coverage: unverified → 100

### 2026-07-28 (score 24, −21)

- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 45)

First indexed and scored.

## MCP tools (28)

### `agent_pay_self` (~30 tokens)

Voidly Pay: Get the SDK's own DID, public key, and current balance.. Returns JSON.

### `agent_wallet_balance` (~57 tokens)

Voidly Pay: Read the wallet for a DID. Returns balance, locked, caps, frozen flag. If `did` omitted, defaults to self.. Returns JSON.

Input parameters:

- `did` (string): did:voidly:... (optional)

### `agent_wallet_ensure` (~45 tokens)

Voidly Pay: Idempotent: create wallet for a DID if it doesn't exist. Useful before sending the first payment.. Returns JSON.

Input parameters:

- `did` (string, required)

### `agent_pay` (~101 tokens)

Voidly Pay: Sign + settle a one-shot transfer. Amount is in CREDITS (1 credit = 1,000,000 micro). Returns the transfer receipt.. Returns JSON.

Input parameters:

- `amount` (number, required): credits (e.g. 0.5)
- `expires_in_minutes` (number): envelope expiry (default 30)
- `memo` (string): optional, ≤280 chars
- `to` (string, required): recipient did:voidly:...

### `agent_pay_batch` (~53 tokens)

Voidly Pay: Atomic multi-recipient transfer. items: [{to, amount, memo?}]. All-or-nothing. Returns batch summary + per-item receipts.. Returns JSON.

Input parameters:

- `items` (array, required)

### `agent_payment_history` (~59 tokens)

Voidly Pay: Paginated history of transfers for a DID (defaults to self).. Returns JSON.

Input parameters:

- `before` (string): ISO cursor
- `did` (string)
- `limit` (number): default 20, max 200

### `agent_pay_get` (~44 tokens)

Voidly Pay: Look up a transfer by id. Returns the ledger row including signature, envelope_hash, and status.. Returns JSON.

Input parameters:

- `transfer_id` (string, required)

### `agent_escrow_open` (~82 tokens)

Voidly Pay: Open an escrow hold. Locks `amount` credits from the caller's wallet. Auto-expires past `deadline_hours`.. Returns JSON.

Input parameters:

- `amount` (number, required)
- `deadline_hours` (number): default 24, max 168 (7 days)
- `memo` (string)
- `to` (string, required)

### `agent_escrow_release` (~41 tokens)

Voidly Pay: Release an open escrow to its recipient. Caller must be the original sender.. Returns JSON.

Input parameters:

- `escrow_id` (string, required)

### `agent_escrow_refund` (~54 tokens)

Voidly Pay: Refund an open escrow back to the sender. Caller must be the original sender.. Returns JSON.

Input parameters:

- `escrow_id` (string, required)
- `reason` (string): optional ≤280 chars

### `agent_stream_open` (~107 tokens)

Voidly Pay: Open a metered payment stream. Locks `budget` credits as a max. Provider appends signed meter entries. Use for per-token / per-second billing.. Returns JSON.

Input parameters:

- `budget` (number, required): max credits
- `deadline_minutes` (number): default 60
- `description` (string)
- `provider` (string, required): provider's did:voidly:...
- `unit_label` (string): e.g. 'tokens', 'ms', 'bytes'

### `agent_stream_meter` (~132 tokens)

Voidly Pay: Provider-side: append a signed meter entry to an open stream. seq starts at 1 and increments. prev_hash is the last entry's this_hash (or null for seq=1). Returns this_hash for chaining the next.. Returns JSON.

Input parameters:

- `delta` (number, required): credits to add to the meter
- `prev_hash` (string): previous entry's this_hash, or null for seq=1
- `seq` (number, required): monotonically increasing, ≥1
- `stream_id` (string, required)
- `units` (number): optional unit count (e.g. tokens used)

### `agent_stream_finalize` (~86 tokens)

Voidly Pay: Requester-side: finalize a stream. Acknowledges the metered total + last seq + last hash. Settles metered amount to provider, refunds rest to requester.. Returns JSON.

Input parameters:

- `expected_hash` (string|null)
- `expected_seq` (number, required)
- `metered_total_micro` (number, required)
- `stream_id` (string, required)

### `agent_subscribe` (~94 tokens)

Voidly Pay: Create a recurring subscription. Pulls `amount_per_period` from caller's balance every `period_seconds`. Auto-pauses after 3 consecutive failures.. Returns JSON.

Input parameters:

- `amount_per_period` (number, required)
- `description` (string)
- `period_seconds` (number, required): min 60
- `periods_total` (number): optional cap; omit for unlimited
- `provider` (string, required)

### `agent_subscription_cancel` (~46 tokens)

Voidly Pay: Cancel a subscription. Either party (requester or provider) may cancel.. Returns JSON.

Input parameters:

- `reason` (string)
- `subscription_id` (string, required)

### `agent_x402_quote` (~112 tokens)

Voidly Pay: Server-side: create an x402 quote. Returns a payment_required_response that the server should serve verbatim with HTTP 402.. Returns JSON.

Input parameters:

- `amount` (number, required): credits
- `description` (string)
- `method` (string): HTTP method (optional)
- `recipient` (string): where to send the money (default: self)
- `resource` (string, required): URL path or label
- `ttl_seconds` (number): default 600, max 3600

### `agent_x402_verify` (~91 tokens)

Voidly Pay: Server-side: verify + consume an x402 payment. Pass the X-Payment header value the caller sent. Atomic; UNIQUE replay protection at the DB.. Returns JSON.

Input parameters:

- `payment_header` (string): value of the X-Payment header
- `quote_id` (string): redundant if payment_header carries it
- `transfer_id` (string): redundant if payment_header carries it

### `agent_x402_fetch` (~100 tokens)

Voidly Pay: Fetch a URL; if it returns HTTP 402, parse the quote, transfer, retry. Returns the FINAL response status and body. `max_amount` caps how much the agent will pay.. Returns JSON.

Input parameters:

- `body` (string): optional request body
- `max_amount` (number): max credits to pay (default 0.01)
- `method` (string): default GET
- `url` (string, required)

### `agent_webhook_subscribe` (~106 tokens)

Voidly Pay: Subscribe to pay events via HMAC-signed webhook. Returns webhook_id and a `secret` (returned ONCE) for signature verification.. Returns JSON.

Input parameters:

- `description` (string)
- `did_filter` (string): only fire when this DID is involved
- `events` (array): filter: ['transfer.settled', 'stream.finalized', ...]; omit for all
- `url` (string, required): https only (loopback blocked)

### `agent_webhook_delete` (~35 tokens)

Voidly Pay: Revoke a webhook subscription owned by the caller.. Returns JSON.

Input parameters:

- `webhook_id` (string, required)

### `agent_pay_health` (~33 tokens)

Voidly Pay: System-frozen flag + counts of wallets and 24h-settled transfers.. Returns JSON.

### `agent_pay_manifest` (~31 tokens)

Voidly Pay: Discovery manifest: every endpoint, schema, defaults, and MCP tool list.. Returns JSON.

### `agent_pay_stats` (~33 tokens)

Voidly Pay: Platform-wide aggregates — capabilities, hires, value settled, top providers, recent activity.. Returns JSON.

### `agent_pay_activity` (~57 tokens)

Voidly Pay: Most-recent state changes across all primitives (transfers, escrows, hires, streams, subscriptions). Public; no signing.. Returns JSON.

Input parameters:

- `limit` (number): 1-200, default 50

### `agent_pay_leaderboard` (~70 tokens)

Voidly Pay: Top earners or spenders. metric: earned_24h | earned_total | spent_24h | spent_total | hires_24h.. Returns JSON.

Input parameters:

- `limit` (number): 1-200, default 25
- `metric` (string)

### `agent_pay_feed` (~63 tokens)

Voidly Pay: Incremental, append-only feed of settled transfers. Use `since` cursor from the previous response's next_since.. Returns JSON.

Input parameters:

- `limit` (number): 1-200, default 50
- `since` (string): ISO cursor

### `agent_pay_trust` (~51 tokens)

Voidly Pay: Derived provider+requester stats for a DID — completion rate, rating avg, total earned. Useful before a hire decision.. Returns JSON.

Input parameters:

- `did` (string): default self

### `agent_pay_health_check` (~148 tokens)

Voidly Pay: One-call trust report. Aggregates /v1/pay/health + /v1/pay/manifest.json + (optionally) the on-chain vault USDC balance into a structured pass/fail breakdown. Returns ok:true only if every individual check passes — system not frozen, manifest declares a Stage 2 vault, vault is on Base mainnet, source verified on Sourcify, vault holds USDC. Use this before relying on the rail for anything you care about settling.. Returns JSON.

Input parameters:

- `rpcUrl` (string): Public Base RPC. Default: https://mainnet.base.org
- `skipChain` (boolean): Skip the on-chain vault balance read.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/voidly-ai-pay-mcp/voidly-pay-mcp#diagnostics

## Score history

- 2026-08-03: 63
- 2026-08-02: 63
- 2026-08-01: 20
- 2026-07-31: 5
- 2026-07-30: 45
- 2026-07-28: 24
- 2026-07-27: 45

## Links

- npm package: https://www.npmjs.com/package/@voidly/pay-mcp
- Socket report: https://socket.dev/npm/package/@voidly/pay-mcp
- Repository: https://github.com/voidly-ai/voidly-pay
- Changelog RSS feed: https://verifymcp.io/servers/voidly-ai-pay-mcp/voidly-pay-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/voidly-ai-pay-mcp/voidly-pay-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/voidly-ai-pay-mcp/voidly-pay-mcp