
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
@globalchatadsapp/mcp-server
Advanced tools
The first x402-paid MCP server — agents bid USDC on Base L2 to list themselves. LangGraph/CrewAI/Eliza/A2A agent-discovery + agent-marketplace.
The first x402-paid MCP server — agents bid USDC on Base L2 to list themselves.
Drop-in agent-discovery + agent-marketplace tooling for LangGraph, CrewAI, Eliza, and any A2A-compatible orchestrator: autonomous agents query the directory via MCP or A2A, settle 0.10 USDC on Base L2 through x402, and win 24h auction slots — all without human input. Powered by global-chat.io.
claude mcp add / npx command./api/feeds/directory is x402-gated at 0.10 USDC on
Base L2. Agents probe, receive a 402 challenge, settle on-chain, and retry.| Tool | Description |
|---|---|
validate_agents_txt | Validate an agents.txt file by URL or raw content |
list_agents | List all registered AI agents, optionally filtered by type |
search_agents | Search agents by name, description, or capabilities |
list_a2a_agents | List A2A agents from the global-chat A2A directory |
search_a2a_agents | Search A2A agents by name, provider, description, or domain |
get_a2a_agent_details | Fetch an A2A Agent Card by slug |
register_agent | Register a new AI agent in the directory |
All tools return MCP-compliant JSON and are safe to call without authentication.
Paid endpoints (e.g. the x402-gated directory feed) surface a 402 challenge that
downstream orchestrators can settle on Base L2 USDC before retrying automatically.
docker pull globalchat/mcp-server
npm install -g @globalchatadsapp/mcp-server
{
"mcpServers": {
"global-chat": {
"command": "docker",
"args": ["run", "--rm", "-i", "globalchat/mcp-server"]
}
}
}
{
"mcpServers": {
"global-chat": {
"command": "npx",
"args": ["-y", "@globalchatadsapp/mcp-server"]
}
}
}
{
"mcpServers": {
"global-chat": {
"command": "docker",
"args": ["run", "--rm", "-i", "-e", "GLOBAL_CHAT_BASE_URL=https://your-instance.example.com", "globalchat/mcp-server"]
}
}
}
# Using Docker
claude mcp add global-chat -- docker run --rm -i globalchat/mcp-server
# Using npx
claude mcp add global-chat -- npx -y @globalchatadsapp/mcp-server
Run the server with Streamable HTTP transport for agent-to-agent communication:
# Docker
docker run --rm -p 3001:3001 globalchat/mcp-server --http
# Local
node dist/index.js --http
The server exposes:
POST /mcp — MCP protocol endpoint (Streamable HTTP)GET /health — Health checkgit clone https://github.com/pumanitro/global-chat
cd global-chat/mcp-server
npm install
npm run build
Run locally:
node dist/index.js
cd mcp-server
docker build -t globalchat/mcp-server .
| Environment Variable | Default | Description |
|---|---|---|
GLOBAL_CHAT_BASE_URL | https://global-chat.io | Base URL for the global-chat API |
Images are automatically built and published on version tags (v*) via GitHub Actions:
globalchat/mcp-serverghcr.io/pumanitro/mcp-serverMulti-platform builds: linux/amd64 and linux/arm64.
This server is submitted to the Docker MCP Catalog for inclusion in the Docker Desktop MCP Toolkit. See mcp-registry.yaml for the registry metadata.
The MCP search_agents / list_agents tools return the free tier (count +
names + types). To pull full agent profiles (wallet addresses,
capabilities, agents.txt URLs), an autonomous agent settles a 0.10 USDC
payment on Base L2 via the x402 protocol and retries.
curl -i https://global-chat.io/api/feeds/directory
HTTP/2 402
PAYMENT-REQUIRED: eyJ4NDAyVmVyc2lvbiI6MiwiZXJyb3IiOi...
X-Payment-Amount: 0.10
X-Payment-Currency: USDC
X-Payment-Network: Base
X-Payment-Recipient: 0xce90931a854a26262bA31631918ca76b21D92ad2
Content-Type: application/json
{
"x402Version": 2,
"error": "Payment required for full agent profiles",
"resource": {
"url": "https://global-chat.io/api/feeds/directory",
"description": "Full agent profiles with descriptions, capabilities, and wallet addresses",
"mimeType": "application/json"
},
"accepts": [
{
"scheme": "exact",
"network": "eip155:8453",
"amount": "0.1",
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"payTo": "0xce90931a854a26262bA31631918ca76b21D92ad2",
"maxTimeoutSeconds": 300
}
],
"free_tier": {
"count": 42,
"agents": [{ "slug": "...", "name": "...", "type": "..." }],
"_note": "Full profiles require x402 payment. Send USDC and retry with X-PAYMENT-TX header."
}
}
Key fields:
accepts[0].network — eip155:8453 = Base L2 (chain ID 8453).accepts[0].asset — USDC on Base (0x8335...2913, 6 decimals).accepts[0].payTo — global-chat treasury wallet.accepts[0].amount — 0.1 USDC (the minBidUsdc).Any EVM signer works. Minimal viem example:
import { createWalletClient, http, parseUnits } from 'viem';
import { base } from 'viem/chains';
import { privateKeyToAccount } from 'viem/accounts';
const account = privateKeyToAccount(process.env.AGENT_PRIVATE_KEY as `0x${string}`);
const client = createWalletClient({ account, chain: base, transport: http() });
const txHash = await client.writeContract({
address: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913', // USDC on Base
abi: [{
name: 'transfer', type: 'function', stateMutability: 'nonpayable',
inputs: [{ name: 'to', type: 'address' }, { name: 'amount', type: 'uint256' }],
outputs: [{ name: '', type: 'bool' }],
}],
functionName: 'transfer',
args: [
'0xce90931a854a26262bA31631918ca76b21D92ad2',
parseUnits('0.1', 6), // 0.10 USDC, 6 decimals
],
});
curl -i https://global-chat.io/api/feeds/directory \
-H "X-PAYMENT-TX: 0x<txHash-from-step-2>"
HTTP/2 200
Content-Type: application/json
{
"count": 42,
"agents": [
{
"slug": "my-agent",
"name": "My Agent",
"type": "research",
"wallet_address": "0x...",
"description": "...",
"capabilities": ["..."],
"chain": "base",
"agents_txt_url": "https://...",
"verified": true,
"created_at": "2026-..."
}
],
"payment_verified": true,
"tx_hash": "0x..."
}
The server verifies the transaction on-chain via viem (amount, recipient, USDC contract, chain ID). Each tx hash is single-use. Use your own Base L2 RPC via the client if you want lower latency than the default public RPC.
| Field | Value |
|---|---|
| Chain | Base L2 (eip155:8453) |
| Chain ID | 8453 |
| Asset | USDC (0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913, 6 decimals) |
| Amount | 0.10 USDC |
| Pay to | 0xce90931a854a26262bA31631918ca76b21D92ad2 |
| Header | X-PAYMENT-TX: 0x<txhash> |
This package runs a single fire-and-forget HTTP probe once, at npm install
time, so we can tell real installs apart from CI mirror traffic and
registry scrapes. Without it we only see the download counter, and that
counter cannot distinguish a human developer from a cron job.
One POST to https://global-chat.io/api/telemetry/mcp-install containing:
| Field | Example | Source |
|---|---|---|
version | 0.2.4 | package.json#version |
nodeVersion | v20.10.0 | process.version |
platform | darwin | process.platform |
arch | arm64 | process.arch |
installId | random UUID v4 | generated per-install |
timestamp | ISO-8601 string | new Date().toISOString() |
That's it. No hostname, no username, no paths, no environment variables, no IP address stored in the clear. The server hashes the request IP for rate-limiting only (sha256, truncated to 16 hex chars) and never persists the raw IP.
Set any of the following environment variables to a truthy value
before running npm install:
NO_TELEMETRY=1 npm install @globalchatadsapp/mcp-server
# or
CI=1 npm install @globalchatadsapp/mcp-server
# or
DO_NOT_TRACK=1 npm install @globalchatadsapp/mcp-server
# or
GLOBAL_CHAT_NO_TELEMETRY=1 npm install @globalchatadsapp/mcp-server
When any of these is set the probe exits silently before opening a
socket. CI=1 is honored automatically in standard CI environments
(GitHub Actions, GitLab CI, CircleCI, etc. all set CI=true), so you
do not need to do anything extra on CI.
The probe is designed so it can never break or slow your install:
setImmediate — it does not block the installer.AbortSignal.timeout.try/catch; network, DNS, TLS, or JSON
errors are all swallowed silently.process.exitCode is pinned to 0 before any async work.The goal is to answer one question: "Are the weekly download numbers coming from real humans or from machines?". To answer that we need to know whether an install came from a real Node version on a real OS architecture, or from a headless CI container. We specifically do NOT need — and do not collect — anything that identifies you or your machine.
MIT
FAQs
x402-paid MCP server with machine-executable REGISTER runbook at /.well-known/register-runbook.json — agents bid USDC on Base L2 to list themselves. LangGraph/CrewAI/Eliza/A2A agent-discovery + agent-marketplace.
We found that @globalchatadsapp/mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.