
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
@codespar/mcp-coinbase-commerce
Advanced tools
MCP server for Coinbase Commerce — global crypto merchant payments. Accept BTC, ETH, USDC and more at checkout with hosted charges, checkouts, and invoices.
MCP server for Coinbase Commerce — global crypto merchant payments.
Coinbase Commerce is the merchant-accept side of crypto. Your store prices an order in local fiat (USD, BRL, EUR, MXN, ...), the buyer settles in BTC / ETH / USDC / and other supported assets, and Coinbase settles to you in the crypto or fiat of your choice.
| Server | Use case | Direction |
|---|---|---|
@codespar/mcp-coinbase-commerce | Merchants accept crypto at checkout | Buyer pays merchant |
@codespar/mcp-unblockpay | BRL / MXN <-> USDC corridor | Value transfer |
@codespar/mcp-moonpay | End-user fiat <-> crypto (100+ assets) | Onramp / offramp |
@codespar/mcp-transak | End-user fiat <-> crypto (broad geo) | Onramp / offramp |
Use Coinbase Commerce when an agent needs to bill a buyer in crypto — hosted charge page, reusable checkout, or directed invoice.
| Tool | Purpose |
|---|---|
create_charge | Create a crypto charge — a one-time merchant invoice priced in local fiat that a buyer can settle in BTC, E... |
retrieve_charge | Retrieve a charge by its Coinbase Commerce id OR its short code (the 8-character code embedded in the hoste... |
list_charges | List charges, newest first. |
cancel_charge | Cancel a charge that has not yet been paid. |
resolve_charge | Manually resolve a charge as paid. |
create_checkout | Create a reusable hosted checkout — think product-page-style link that can be paid multiple times. |
retrieve_checkout | Retrieve a checkout by id. |
list_checkouts | List reusable hosted checkouts, newest first. |
update_checkout | Update an existing reusable checkout. |
delete_checkout | Delete a reusable checkout. |
list_events | List events — the lifecycle signals (charge:created, charge:confirmed, charge:failed, charge:delayed, charg... |
retrieve_event | Retrieve a single event by id. |
create_invoice | Create an invoice — a directed bill sent to a specific named recipient. |
retrieve_invoice | Retrieve an invoice by code. |
list_invoices | List invoices, newest first. |
void_invoice | Void an unpaid invoice. |
list_exchange_rates | Fetch current Coinbase exchange rates for a base asset (e.g. |
verify_webhook_signature | Local helper — verify a Coinbase Commerce webhook payload using HMAC-SHA256. |
npm install @codespar/mcp-coinbase-commerce
COINBASE_COMMERCE_API_KEY="..." # API key (required, secret)
COINBASE_COMMERCE_API_VERSION="..." # Optional. Defaults to 2018-03-22.
Create an API key at https://beta.commerce.coinbase.com/settings/security.
Every request carries two headers:
X-CC-Api-Key: <COINBASE_COMMERCE_API_KEY>
X-CC-Version: 2018-03-22
The version header is required. Pin it so future API changes don't silently break your integration.
# stdio (default — for Claude Desktop, Cursor, etc)
npx @codespar/mcp-coinbase-commerce
# HTTP (for server-to-server testing)
MCP_HTTP=true MCP_PORT=3000 npx @codespar/mcp-coinbase-commerce
Need governance, budget limits, and audit trails for agent payments? CodeSpar Enterprise adds policy engine, payment routing, and compliance templates on top of these MCP servers.
MIT
FAQs
MCP server for Coinbase Commerce — global crypto merchant payments. Accept BTC, ETH, USDC and more at checkout with hosted charges, checkouts, and invoices.
We found that @codespar/mcp-coinbase-commerce demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.