
Company News
AWS Security Hub Adds Socket for Supply Chain Security
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.
@payclaw/mcp-server
Advanced tools
Badge identity + virtual Visa cards for AI agents. Declare, pay, audit — on existing Visa rails. MCP-native.
Agents are not bots. PayClaw proves it — then lets them pay.
Your AI agent looks like a bot to every merchant on the internet. PayClaw gives it two things:
Badge — Declares your agent as an authorized actor. The skeleton key that lets it through merchant defenses. Free. No card required.
Spend — Issues a single-use virtual Visa when your agent needs to pay. Human-approved. Self-destructs after use. Your real card never enters the chat.
🧪 Developer Sandbox is open. Real infrastructure, test money. Get sandbox access →
Add to your MCP client config (Claude Desktop, Cursor, or any MCP client):
{
"mcpServers": {
"payclaw": {
"command": "npx",
"args": ["-y", "@payclaw/mcp-server"],
"env": {
"PAYCLAW_API_KEY": "pk_your_key_here",
"PAYCLAW_API_URL": "https://payclaw.io"
}
}
}
}
Get your API key at payclaw.io. Five-minute setup.
Or install via ClawHub:
clawhub install payclaw-io
| Tool | What It Does |
|---|---|
payclaw_getAgentIdentity | Declare identity → get verification token (Badge) |
payclaw_getCard | Declare purchase intent → get virtual Visa (Spend) |
payclaw_reportPurchase | Report transaction outcome → close the audit trail |
Agent → payclaw_getAgentIdentity
PayClaw → verification token + disclosure text
Agent → presents disclosure to merchant
PayClaw → checks back: "Were you accepted or denied?"
Your agent is now a declared, authorized actor. Not anonymous traffic.
Agent → payclaw_getCard (merchant, amount, description)
User → approves via MFA
PayClaw → issues single-use virtual Visa
Agent → uses card at checkout
Agent → payclaw_reportPurchase (closes audit trail)
Card → self-destructs
One task. One approval. One card. Done.
| Action | What Happens |
|---|---|
| Browse | Badge declaration — identity token issued |
| Search | Badge declaration — identity token issued |
| Checkout | Badge + Spend — MFA approval → single-use Visa issued |
Browsing requires declaration. Spending money requires declaration + stated intent + explicit human approval + an ephemeral card that self-destructs after one use.
| Give Agent Your Card | Crypto Wallet | PayClaw | |
|---|---|---|---|
| Agent identity declared | No | No | Every session |
| Human approval per purchase | No | No | Every purchase |
| Card credential lifespan | Permanent | Permanent | Single use |
| Works at existing merchants | Yes | No | Yes — Visa rails |
| Your real card exposed | Yes | N/A | Never |
If you only need identity (no payment), use the lighter package:
{
"mcpServers": {
"payclaw-badge": {
"command": "npx",
"args": ["-y", "@payclaw/badge"],
"env": {
"PAYCLAW_API_KEY": "pk_your_key_here",
"PAYCLAW_API_URL": "https://payclaw.io"
}
}
}
}
PayClaw is KYA infrastructure. Every declaration creates a verified record of agentic commerce behavior — building the trust signal that merchants need to tell authorized agents from anonymous bots.
Agents are not bots. PayClaw proves it. Your real card never enters the chat.
FAQs
Badge identity + virtual Visa cards for AI agents. Declare, pay, audit — on existing Visa rails. MCP-native.
The npm package @payclaw/mcp-server receives a total of 26 weekly downloads. As such, @payclaw/mcp-server popularity was classified as not popular.
We found that @payclaw/mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.