
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@bitbooth/mcp-fetch
Advanced tools
MCP server for pay-per-fetch via x402. Exposes a fetch(url, mode) tool that pays with USDC on Base and returns markdown.
MCP server that fetches any URL and returns clean markdown. Payments handled automatically via the x402 protocol — your agent wallet pays 0.005 USDC per fetch.
Zero signup. No API keys. No accounts. The agent's wallet pays per call.
Testnet by default. Defaults to Base Sepolia so a fresh install spends free testnet USDC, not real money. Opt into mainnet explicitly (see below).
Add to your claude_desktop_config.json:
{
"mcpServers": {
"bitbooth-fetch": {
"command": "npx",
"args": ["-y", "@bitbooth/mcp-fetch"],
"env": {
"BITBOOTH_AGENT_KEY": "0x<your-testnet-wallet-private-key>"
}
}
}
}
claude mcp add bitbooth-fetch -- npx -y @bitbooth/mcp-fetch
Set your agent wallet key:
export BITBOOTH_AGENT_KEY="0x<your-testnet-wallet-private-key>"
npm install -g @bitbooth/mcp-fetch
mcp-fetch # runs on stdio
BITBOOTH_AGENT_KEY to the wallet's private key (0x...)Once installed, your agent gets a fetch tool:
fetch(url: "https://example.com", mode: "fast")
Modes:
| Mode | Description | Best for |
|---|---|---|
fast | Raw HTML converted to markdown | Quick lookups |
full | Article extraction then markdown | Blog posts, docs |
Returns markdown with title, body, and metadata (URL, timestamp, content length, truncation status).
| Item | Cost |
|---|---|
| Per fetch | 0.005 USDC (testnet: free Circle Sepolia USDC) |
| Gas | ~$0.0001 per tx on Base (mainnet) / free (testnet) |
| Default chain | Base Sepolia (testnet). Explicit opt-in for mainnet. |
| Env var | Description | Default |
|---|---|---|
BITBOOTH_AGENT_KEY | Agent wallet private key (required, 0x-prefixed hex) | — |
BITBOOTH_CHAIN_ID | 84532 = Base Sepolia (default, free testnet). 8453 = Base mainnet (real USDC — opt-in). | 84532 |
BITBOOTH_API_URL | BitBooth gateway URL | staging endpoint (Base Sepolia) |
BITBOOTH_RPC_URL | EVM RPC endpoint | https://base-sepolia-rpc.publicnode.com |
BITBOOTH_CONFIRMATIONS | Tx confirmations to wait before retry | 1 |
BITBOOTH_API_KEY | Optional tenant API key (for higher rate limits) | — |
When you've tested against Sepolia and want to run against real Base mainnet:
export BITBOOTH_CHAIN_ID=8453
export BITBOOTH_API_URL=https://<production-url> # ask maintainer for current
export BITBOOTH_RPC_URL=https://base-rpc.publicnode.com # or your own RPC
export BITBOOTH_AGENT_KEY=0x<mainnet-wallet-with-real-USDC>
The package prints a warning banner to stderr whenever mainnet is active so a misconfig can't silently drain a real wallet.
import { createX402Client } from '@bitbooth/mcp-fetch/x402-client';
const client = createX402Client({ agentKey: process.env.AGENT_KEY });
const result = await client.fetchWithPayment('https://example.com', 'fast');
console.log(result.markdown);
fetch(url) via MCPPOST /v1/fetchs to BitBooth{ nonce, payTo, amountWei }payTox-payment headerZero human in the loop. Zero signup. Just pay-per-call via x402.
BITBOOTH_AGENT_KEY is a private key — treat it like a password. Use a dedicated wallet for this agent, not your personal wallet.MIT
FAQs
Discover BitBooth APIs for free, then buy capped x402 fetch, PageDelta, and watch tools over Base USDC or XRPL mainnet RLUSD.
The npm package @bitbooth/mcp-fetch receives a total of 83 weekly downloads. As such, @bitbooth/mcp-fetch popularity was classified as not popular.
We found that @bitbooth/mcp-fetch demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.