
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
@agenticpay/mcp-bridge
Advanced tools
Real MCP server (stdio + @modelcontextprotocol/sdk) that exposes x402-paywalled HTTP endpoints as MCP tools. Drop into Claude Desktop, Cursor, or any MCP client.
A real MCP server (stdio transport, @modelcontextprotocol/sdk) that
exposes x402-paywalled HTTP endpoints as MCP tools. Drop into Claude
Desktop, Cursor, Continue.dev, or any MCP client.
The bridge holds a Solana keypair, signs each x402 payment payload, and settles via a facilitator on the agent's behalf. The MCP client sees normal MCP tools — it never touches the payment plumbing.
@agenticpay/mcp-server is the resource server (the place that wants to
get paid). @agenticpay/mcp-bridge is the client adapter that makes
those paid endpoints appear as native MCP tools to AI clients that already
speak MCP.
Use case: you want Claude Desktop to be able to call paid APIs without managing wallets or signing payments yourself. The bridge handles it.
// ~/Library/Application Support/Claude/claude_desktop_config.json
{
"mcpServers": {
"agenticpay": {
"command": "npx",
"args": ["-y", "@agenticpay/mcp-bridge"],
"env": {
"AGENTICPAY_BRIDGE_KEYPAIR": "[12,34,...your 64-byte keypair]",
"AGENTICPAY_BRIDGE_NETWORK": "solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1",
"AGENTICPAY_BRIDGE_RPC": "https://api.devnet.solana.com",
"AGENTICPAY_BRIDGE_TOOLS": "[{\"name\":\"reverse_string\",\"description\":\"Reverse a string. Costs 0.001 USDC.\",\"url\":\"http://localhost:4021/tools/reverse\",\"inputSchema\":{\"text\":{\"type\":\"string\"}}}]"
}
}
}
}
Restart Claude Desktop. The agenticpay tools (e.g. reverse_string) appear
in the conversation. Claude calls them; the bridge pays, settles, returns
the result.
import { createBridge } from "@agenticpay/mcp-bridge";
import { z } from "zod";
await createBridge({
keypairBytes: [12, 34, /* ... 64 bytes */],
network: "solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1",
rpcUrl: "https://api.devnet.solana.com",
tools: [
{
name: "reverse_string",
description: "Reverse a string. Costs 0.001 USDC.",
url: "http://localhost:4021/tools/reverse",
inputSchema: { text: z.string() },
formatResult: (body) => (body as { result: string }).result,
},
],
});
The wallet pays USDC for every tool call. Devnet:
The facilitator (e.g. our hosted devnet endpoint) covers SOL gas — the bridge wallet only needs USDC.
Pre-alpha. Devnet-validated. Mainnet works once you fund the wallet with real USDC and point at a mainnet-capable facilitator.
MIT licensed. See agenticpay monorepo.
FAQs
Real MCP server (stdio + @modelcontextprotocol/sdk) that exposes x402-paywalled HTTP endpoints as MCP tools. Drop into Claude Desktop, Cursor, or any MCP client.
We found that @agenticpay/mcp-bridge demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.