io.github.xenarch-ai/xenarch-mcp
NPM · @XENARCH/AGENT-MCP · SCANNED SEP 20
Xenarch — x402 MCP server for AI agent payments. Non-custodial, USDC on Base L2.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security88
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects uuid 8.3.2, reached via @xenarch/core > x402-fetch > x402 > wagmi > @wagmi/connectors > @metamask/sdk > uuid. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- Dependency health was assessed across the 400 of 527 dependencies we could resolve, so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 74 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability87
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 7663 tokens (~73/item across 104 items; 103 tools + 1 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management83
- Stability observed for 25 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage99
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 97% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 14 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 104 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.xenarch-ai/xenarch-mcp server?
io.github.xenarch-ai/xenarch-mcp runs locally as an npm package, launched with npx -y @xenarch/agent-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @xenarch/agent-mcp
claude mcp add xenarch-ai-xenarch-mcp -- npx -y @xenarch/agent-mcp
{
"mcpServers": {
"xenarch-ai-xenarch-mcp": {
"command": "npx",
"args": [
"-y",
"@xenarch/agent-mcp"
]
}
}
} {
"servers": {
"xenarch-ai-xenarch-mcp": {
"command": "npx",
"args": [
"-y",
"@xenarch/agent-mcp"
]
}
}
} codex mcp add xenarch-ai-xenarch-mcp -- npx -y @xenarch/agent-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"xenarch-ai-xenarch-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"@xenarch/agent-mcp"
],
"enabled": true
}
}
} openclaw mcp add xenarch-ai-xenarch-mcp --command npx --arg -y --arg @xenarch/agent-mcp
mcp_servers:
xenarch-ai-xenarch-mcp:
command: "npx"
args: ["-y", "@xenarch/agent-mcp"] {
"McpServers": {
"xenarch-ai-xenarch-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@xenarch/agent-mcp"
]
}
}
} assistant mcp add xenarch-ai-xenarch-mcp -t stdio -c npx -a -y @xenarch/agent-mcp
{
"mcpServers": {
"xenarch-ai-xenarch-mcp": {
"command": "npx",
"args": [
"-y",
"@xenarch/agent-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 −2
- Stability: pass → 0.83 functional
- 19 Sept 26 0
- Stability: 0.97 → pass security
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 0
- Tool safety: pass → unverified ▼ security
- Stability: 0.90 → unverified ▼ security
- Tool coverage: 100 → unverified ▼ functional
- Capabilities: pass → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- 16 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 15 Sept 26 0
- CVE-2026-67316 no longer affects this package ▲ security
- CVE-2026-67313 no longer affects this package ▲ security
- CVE-2026-67312 no longer affects this package ▲ security
- CVE-2026-67321 no longer affects this package ▲ security
- CVE-2026-67315 no longer affects this package ▲ security
- CVE-2026-67320 no longer affects this package ▲ security
- CVE-2026-67317 no longer affects this package ▲ security
- CVE-2026-67318 no longer affects this package ▲ security
- CVE-2026-67319 no longer affects this package ▲ security
- CVE-2026-67314 no longer affects this package ▲ security
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 −3
- Stability: pass → 0.80 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/@xenarch/agent-mcp@1.3.1
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 4 findings
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-vcc3-ghjq-m6fr | CVE-2026-45822 | medium | yes | |
| GHSA-w5hq-g745-h8pq | CVE-2026-41907 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | yes |
| GHSA-58qx-3vcg-4xpx | CVE-2026-45736 | medium | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N | yes |
| GHSA-96hv-2xvq-fx4p | CVE-2026-48779 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 400 packages
| Packages resolved | 400 |
|---|---|
| Deprecated | 13 |
| Stale | 102 |
| No linked repository | 2 |
| Tree resolution | Partial |
The dependency tree was only partially resolved, so these counts may be incomplete.
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
xenarch_get_subscriber_charges ~82
Read a metered subscriber's immutable charge ledger (booked + settled charges, totals, outstanding). Read-only, cursor over charge_seq.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Page size (default 100). |
| starting_after | integer | – | Cursor: last charge_seq of the previous page. |
| subscription_id | string | yes | The subscription id. |
No output schema declared.
No examples provided.
xenarch_get_subscriber_rollup ~34
Subscriber KPIs: active count, MRR (USDC), 30-day churn. Read-only.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
xenarch_link_wallet ~71
Link the agent's LOCAL wallet to your account as a co-wallet (key-held SIWE — signs with the local key). Requires confirm: true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Required true: attaches the LOCAL wallet to your account. |
| label | string | – | Optional nickname for the wallet being linked. |
No output schema declared.
No examples provided.
xenarch_list_groups ~24
List pay-link groups (name, accent, members). Read-only.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
xenarch_list_invites ~23
List outstanding (unredeemed) invites. Read-only.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
xenarch_list_links ~71
List the merchant's pay-links (newest first), with cursor pagination. Read-only. Needs a SIWE session from `xenarch agent login`.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Page size (default 25) |
| starting_after | string | – | Cursor: last link_id of the previous page |
No output schema declared.
No examples provided.
xenarch_list_merchant_keys ~29
List the merchant's xm_live_ API keys (never returns plaintext). Read-only.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
xenarch_list_metered_collectable ~47
List metered subscriptions with booked charges awaiting on-chain settlement (the collectable bag). Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| link_id | string | – | Filter to one subscription pay-link. |
No output schema declared.
No examples provided.
xenarch_list_orders ~112
List paid orders across pay-links (buyer, shipping, status, tracking) with filters + cursor. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Page size (default 25). |
| link_id | string | – | Filter to one pay-link. |
| search | string | – | Free-text search over buyer/product fields. |
| starting_after | string | – | Cursor: last order_id of the previous page. |
| status | string | – | Filter by order status, e.g. 'paid' | 'shipped'. |
No output schema declared.
No examples provided.
xenarch_list_payments ~63
List payments RECEIVED across the merchant's pay-links (newest first), with cursor pagination. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Page size (default 25) |
| starting_after | string | – | Cursor: last payment id of the previous page |
No output schema declared.
No examples provided.
xenarch_list_permit_collectable ~56
List permit subscriptions with a cycle due now (the collectable bag): amount, owner→spender transferFrom params, permit status. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| link_id | string | – | Filter to one subscription pay-link. |
No output schema declared.
No examples provided.
xenarch_list_sites ~38
List the signed-in identity's sites (domain, price, gating, integration). Empty if the identity isn't a publisher yet. Read-only.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
xenarch_list_subscribers ~109
List subscribers across the merchant's subscription pay-links, with optional filters (link_id, status, mode). Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Page size (default 50) |
| link_id | string | – | Filter by a subscription link |
| mode | string | – | reminder | permit | stream |
| starting_after | string | – | Cursor: last subscription_id of the previous page |
| status | string | – | active | cancelled | pending_email_verification | failed | exhausted |
No output schema declared.
No examples provided.
xenarch_list_wallets ~29
List the account's linked wallets (owner/default flags, labels, eligibility). Read-only.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
xenarch_metered_collect ~163
Settle a metered subscriber's booked charges on-chain: preflight, broadcast USDC.transferFrom from the LOCAL seller wallet, book. MOVES REAL MONEY — requires confirm: true PLUS expected_amount_usdc pinned from the needs_confirmation payload. If transferred-but-not-booked, use xenarch_record_collect; NEVER re-run this tool for the same charges.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Required true: broadcasts an on-chain transferFrom (moves real money). |
| expected_amount_usdc | string | – | The exact amount (USDC, e.g. '0.10') from the needs_confirmation payload. REQUIRED with confirm:true — the transfer aborts if the due amount changed. |
| subscription_id | string | yes | Subscription id from the collectable bag. |
No output schema declared.
No examples provided.
xenarch_mint_manage_link ~89
Mint a short-lived manage URL + token for a subscriber (hosted manage page). Anyone holding it can manage that subscription until expiry. Requires confirm: true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Required true: mints a live manage capability URL. |
| subscription_id | string | yes | The subscription id. |
| ttl_seconds | integer | – | Link lifetime in seconds (server default if omitted). |
No output schema declared.
No examples provided.
xenarch_pay ~191
Pay an x402-gated URL with USDC on Base L2 and return the gated content. Signs an EIP-3009 transferWithAuthorization, settles on-chain, then re-fetches the resource with proof of payment. Returns the on-chain tx_hash, seller wallet, and the response body. Settles directly to the seller wallet — no Xenarch contract in the money flow, no custodial balance. The agent wallet only ever holds USDC; no ETH or other gas coin is required. Use after xenarch_check_gate confirms a gate exists, or when the user asks to pay for or unlock gated content.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | The URL or domain to pay for. Must have an active x402 payment gate. Payment settles in USDC on Base L2, agent wallet to seller wallet direct. The agent wallet only ever holds USDC; no ETH or other g… |
No output schema declared.
No examples provided.
xenarch_pay_link ~131
Pay a Xenarch pay-link by id (wrapped x402): fetches the link's payment envelope, settles EIP-3009 USDC on Base, and confirms the payment with the link. Use this for pay.xenarch.com/l/<id> links; use xenarch_pay for arbitrary x402-gated URLs. Pays from the agent wallet (USDC only, no gas needed).
| Name | Type | Req | Description |
|---|---|---|---|
| link_id | string | yes | The Xenarch pay-link id to pay |
| max_price_usd | number | – | Refuse to pay if the price exceeds this (default 1.00) |
No output schema declared.
No examples provided.
xenarch_permit_collect ~178
Collect one due permit cycle: preflights allowance/balance/simulation, broadcasts USDC.transferFrom from the LOCAL seller wallet (must be the permit spender, needs Base ETH gas), then books it. MOVES REAL MONEY — requires confirm: true PLUS expected_amount_usdc pinned from the needs_confirmation payload. If it reports transferred-but-not-booked, use xenarch_record_collect; NEVER re-run this tool for the same cycle.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Required true: broadcasts an on-chain transferFrom (moves real money). |
| expected_amount_usdc | string | – | The exact amount (USDC, e.g. '0.10') from the needs_confirmation payload. REQUIRED with confirm:true — the transfer aborts if the due amount changed. |
| subscription_id | string | yes | Subscription id from the collectable bag. |
No output schema declared.
No examples provided.
xenarch_permit_submit ~156
Broadcast the buyer's signed USDC.permit on-chain to set the allowance (moves NO funds; wallet pays gas). Needs the LOCAL seller wallet key + Base ETH. Broadcasting requires confirm: true. Pass tx_hash alone to record an already-broadcast permit (recovery, record-only, no confirm needed).
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Required true to BROADCAST the buyer's signed USDC.permit on-chain (gas only, moves no funds). |
| subscription_id | string | yes | Subscription id from the permit collectable bag. |
| tx_hash | string | – | Recovery only: an ALREADY-broadcast permit tx hash to record — skips any broadcast (and needs no confirm; the record is idempotent). |
No output schema declared.
No examples provided.
xenarch_preview_invite ~44
Preview a join link: which account it joins, role, expiry. Anonymous. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| token | string | yes | The invite token from the join link. |
No output schema declared.
No examples provided.
xenarch_record_collect ~85
Recovery: book an ALREADY-broadcast transferFrom by tx hash. Never transfers — the backend dedups on tx_hash, so it is always safe to re-run.
| Name | Type | Req | Description |
|---|---|---|---|
| mode | string | yes | Which collect flow the tx belongs to. |
| subscription_id | string | yes | The subscription id. |
| tx_hash | string | yes | The already-broadcast transferFrom tx hash. |
No output schema declared.
No examples provided.
xenarch_redeem_invite ~76
Join another Xenarch account by invite token — the agent's LOCAL wallet signs SIWE and attaches to the inviter's identity. Requires confirm: true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Required true: joins the inviter's account with the LOCAL wallet. |
| token | string | yes | The invite token from the join link. |
No output schema declared.
No examples provided.
xenarch_retry_agent_webhook_delivery ~58
Re-send one failed agent webhook delivery. Requires confirm: true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Required true: re-sends the event to the webhook URL. |
| delivery_id | string | yes | The delivery id to retry. |
No output schema declared.
No examples provided.
xenarch_retry_link_webhook_delivery ~71
Re-send one failed pay-link webhook delivery. Requires confirm: true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Required true: re-sends the event to the webhook URL. |
| delivery_id | string | yes | The delivery id to retry. |
| link_id | string | yes | The pay-link id. |
No output schema declared.
No examples provided.
xenarch_revoke_invite ~58
Revoke a live invite before it's redeemed. Requires confirm: true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Required true: kills the join link. |
| invite_id | string | yes | The invite id (from xenarch_list_invites). |
No output schema declared.
No examples provided.
xenarch_revoke_link ~60
Revoke a pay-link by id so it can no longer be paid. Requires confirm: true (returns needs_confirmation otherwise).
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Required to revoke |
| link_id | string | yes | The pay-link id to revoke |
No output schema declared.
No examples provided.
xenarch_revoke_merchant_key ~58
Permanently revoke a merchant API key. Requires confirm: true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Required true: permanently disables the key. |
| key_id | string | yes | Key id (full UUID or unambiguous prefix). |
No output schema declared.
No examples provided.
xenarch_rotate_agent_webhook_secret ~42
Rotate the agent webhook's signing secret. Requires confirm: true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Required true: invalidates the current signing secret. |
No output schema declared.
No examples provided.
xenarch_rotate_link_webhook_secret ~60
Rotate a pay-link's webhook signing secret (old secret stops verifying). Requires confirm: true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Required true: invalidates the current signing secret. |
| link_id | string | yes | The pay-link id. |
No output schema declared.
No examples provided.
xenarch_rotate_merchant_key ~68
Rotate a merchant API key — invalidates the old secret, returns a new one once. Requires confirm: true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Required true: invalidates the current secret. |
| key_id | string | yes | Key id (full UUID or unambiguous prefix). |
No output schema declared.
No examples provided.
xenarch_rotate_site_token ~58
Rotate a site's token — the integration must be updated or gating stops. Requires confirm: true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Required true: the old site token stops working immediately. |
| site_id | string | yes | The site id. |
No output schema declared.
No examples provided.
xenarch_set_account_email ~66
Set the account email and send it a verification code (finish with xenarch_verify_account_email). Requires confirm: true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Required true: sends a verification code to that address. |
| string | yes | Email address to attach to the account. |
No output schema declared.
No examples provided.
xenarch_set_agent_webhook ~112
Set the agent's webhook URL / event types / enabled. Requires confirm: true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Required true: changes where the agent's events are sent. |
| enabled | boolean | yes | Whether deliveries are active. REQUIRED — this is a whole-state PUT; read the current config first to preserve the existing enabled state. |
| event_types | – | – | Event types to deliver; null/omitted = all available types. |
| url | string | yes | HTTPS endpoint to deliver agent events to. |
No output schema declared.
No examples provided.
xenarch_set_link_webhook ~122
Set a pay-link's webhook URL / event types / enabled. Requires confirm: true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Required true: changes where payment events are sent. |
| enabled | boolean | yes | Whether deliveries are active. REQUIRED — this is a whole-state PUT; read the current config first to preserve the existing enabled state. |
| event_types | – | – | Event types to deliver; null/omitted = all available types. |
| link_id | string | yes | The pay-link id. |
| url | string | yes | HTTPS endpoint to deliver events to. |
No output schema declared.
No examples provided.
xenarch_set_period_cap ~108
Set/raise a metered-per-period subscriber's budget (new_cap_usdc). Mints the manage token behind the scenes. Requires confirm: true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Required true: raises what may be charged per period. |
| new_cap_usdc | string | yes | New per-period budget in USDC, e.g. '0.50'. Can only be set or raised. |
| subscription_id | string | yes | The subscription id (metered-per-period mode). |
No output schema declared.
No examples provided.
xenarch_set_publisher_gating ~104
Replace the publisher-level gating defaults — affects every site set to follow them. Requires confirm: true.
| Name | Type | Req | Description |
|---|---|---|---|
| bot_overrides | object | – | Per-bot overrides (signature→policy). Omit to keep the current map. |
| confirm | boolean | – | Required true: changes defaults for ALL sites. |
| gated_categories | object | yes | Full category→gated map (whole-state replace). |
| gating_enabled | boolean | yes | Publisher-wide gating master switch. |
No output schema declared.
No examples provided.
xenarch_set_site_gating ~148
Replace a site's gating config (master switch + category map, whole-state). Changes which bot traffic is charged/blocked. Requires confirm: true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Required true: changes who gets charged/blocked. |
| gated_categories | object | yes | Full category→gated map (whole-state replace), e.g. {"AI Search": true, "Agents": false}. Read the current map with xenarch_get_site first. |
| gating_enabled | boolean | yes | Master switch for gating on this site. |
| site_id | string | yes | The site id. |
| use_publisher_defaults | boolean | – | true = follow the publisher-level defaults instead of per-site settings. |
No output schema declared.
No examples provided.
xenarch_set_site_pricing ~110
Replace a site's pricing (default price/scope + per-path rules, whole-state). Requires confirm: true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Required true: changes what bots are charged. |
| default_billing_scope | string | – | – |
| default_price_usd | string | yes | Default per-crawl price in USD, e.g. '0.01'. |
| rules | array | – | Per-path price rules (whole-state replace). |
| site_id | string | yes | The site id. |
No output schema declared.
No examples provided.
xenarch_set_wallet_label ~63
Set/clear a linked wallet's nickname. Requires confirm: true.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | The linked wallet address. |
| confirm | boolean | – | Required true to change the label. |
| label | string|null | yes | New nickname; null clears it. |
No output schema declared.
No examples provided.
xenarch_ship_order ~82
Mark an order shipped with a tracking number — emails the buyer. Requires confirm: true.
| Name | Type | Req | Description |
|---|---|---|---|
| carrier | string | – | Carrier name, e.g. 'DHL'. |
| confirm | boolean | – | Required true: marks shipped and emails the buyer the tracking. |
| order_id | string | yes | The order id. |
| tracking | string | yes | Tracking number. |
No output schema declared.
No examples provided.
xenarch_suspend_subscriber ~66
Suspend a subscription: collection attempts and dunning stop. Any mode, idempotent, no on-chain effect. Requires confirm: true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Required true: stops billing/dunning. |
| subscription_id | string | yes | The subscription id to suspend. |
No output schema declared.
No examples provided.
xenarch_test_agent_webhook ~47
Send a test event to the agent's webhook URL. Requires confirm: true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Required true: fires a real test delivery at the configured URL. |
No output schema declared.
No examples provided.
xenarch_test_link_webhook ~60
Send a test event to a pay-link's webhook URL. Requires confirm: true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Required true: fires a real test delivery at the configured URL. |
| link_id | string | yes | The pay-link id. |
No output schema declared.
No examples provided.
xenarch_transfer_owner ~61
Transfer account OWNERSHIP to another linked wallet. Hard to reverse. Requires confirm: true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Required true: hands account ownership to another wallet. |
| new_owner | string | yes | Linked wallet address to become the owner anchor. |
No output schema declared.
No examples provided.
xenarch_unlink_wallet ~60
Unlink a wallet from the account — it loses sign-in access. Requires confirm: true.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | The linked wallet address to remove. |
| confirm | boolean | – | Required true: the wallet loses access to the account. |
No output schema declared.
No examples provided.
xenarch_update_agent_profile ~87
Update the agent's display profile (display_name, label; null clears). Requires confirm: true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Required true to update the profile. |
| display_name | string|null | – | Agent display name; null clears it. Omit to leave unchanged. |
| label | string|null | – | Short label/tag; null clears it. Omit to leave unchanged. |
No output schema declared.
No examples provided.
xenarch_update_group ~82
Rename / re-accent / re-position a pay-link group. Requires confirm: true.
| Name | Type | Req | Description |
|---|---|---|---|
| accent_kind | string | – | New accent kind. |
| confirm | boolean | – | Required true to update the group. |
| group_id | string | yes | The group id. |
| name | string | – | New name. |
| position | integer | – | New sort position. |
No output schema declared.
No examples provided.
xenarch_update_merchant_profile ~177
Update the merchant profile (issuer name, site, email, address, tax id, brand color, logo, payout rhythm). Only the fields you pass change; the rest are preserved (whole-state upsert). Rewrites customer-facing identity — requires confirm: true.
| Name | Type | Req | Description |
|---|---|---|---|
| brand_color | string | – | Accent color, e.g. #5a9fd4 |
| collection_rhythm | string | – | – |
| confirm | boolean | – | Required true: rewrites customer-facing merchant identity fields. |
| issuer_address | string | – | – |
| issuer_email | string | – | – |
| issuer_logo_url | string | – | HTTPS logo URL (must match your domain) |
| issuer_name | string | – | – |
| issuer_tax_id | string | – | – |
| merchant_site | string | – | Your domain, e.g. example.com |
No output schema declared.
No examples provided.
xenarch_upload_asset ~152
Upload an image (URL or base64, max 5 MB) to Xenarch's public CDN — for logos/branding. Returns the cdn.xenarch.dev URL. Requires confirm: true.
| Name | Type | Req | Description |
|---|---|---|---|
| base64 | string | – | Base64-encoded image bytes (no data: prefix needed). |
| confirm | boolean | – | Required true: stores the image publicly on cdn.xenarch.dev. |
| content_type | string | – | MIME type, e.g. 'image/png' | 'image/jpeg' | 'image/svg+xml'. |
| filename | string | – | Filename hint, e.g. 'logo.png'. |
| url | string | – | HTTPS URL of the image to fetch and upload. |
No output schema declared.
No examples provided.
What is the io.github.xenarch-ai/xenarch-mcp server?
io.github.xenarch-ai/xenarch-mcp is listed in the public MCP registry as io.github.xenarch-ai/xenarch-mcp. Xenarch, x402 MCP server for AI agent payments. Non-custodial, USDC on Base L2. This page covers its npm package (@xenarch/agent-mcp).
Is the io.github.xenarch-ai/xenarch-mcp server safe to use?
io.github.xenarch-ai/xenarch-mcp scores 81 out of 100 on VerifyMCP. We recorded 4 known advisories against it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.xenarch-ai/xenarch-mcp server expose?
io.github.xenarch-ai/xenarch-mcp exposes 103 tools: xenarch_check_gate, xenarch_pay, xenarch_wallet_status, xenarch_get_history, xenarch_agent_login, and 98 more. Their descriptions and schemas cost roughly 7,640 tokens of context every time the server is loaded.
Is the io.github.xenarch-ai/xenarch-mcp server still maintained?
io.github.xenarch-ai/xenarch-mcp is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.xenarch-ai/xenarch-mcp server under?
io.github.xenarch-ai/xenarch-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.