
Security News
Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
@scriptmasterlabs/mcp-x402
Advanced tools
MCP server for agents with autonomous USDC/RLUSD payments. x402 pay-per-call · 43+ trading + federal tools · no API keys. Free sml_discover demo. Remote: https://mcp-x402.onrender.com/mcp
MCP server for agents with autonomous USDC/RLUSD payments · x402 pay-per-call · 43+ trading + federal tools · no API keys
AI agents pay for ScriptMasterLabs data mid-loop — no human API keys, no monthly key babysitting.
# one-command free demo (live host, no wallet)
curl -s https://mcp-x402.onrender.com/health | jq .
# install / run
npx @scriptmasterlabs/mcp-x402
# package demo script
npm run demo
Remote MCP (Claude / Cursor / Windsurf) — stupidly easy:
{
"mcpServers": {
"sml": {
"url": "https://mcp-x402.onrender.com/mcp",
"transport": "streamable-http"
}
}
}
First call free path: tools/list + discover-style tools · Paid path: x402 USDC/RLUSD
ACP wedges: search scriptmasterlabs → gas_tracker $0.01 · rwa_intelligence $0.03
Site: https://www.scriptmasterlabs.com/agent-economy-os
Every MCP server connecting to paid APIs today requires:
This defeats the entire point of autonomous agents. If your agent has to stop and ask a human for a credit card, it's not autonomous — it's a very expensive chatbot.
We built the machine-native alternative.
mcp-x402 is the first MCP server where agents provision their own wallets, negotiate prices on-chain, pay autonomously, and receive cryptographic receipts — all without human intervention. The agent's credit score goes up every time it successfully transacts. It builds financial reputation the same way humans do.
This is the infrastructure layer that makes truly autonomous AI agents possible.
npm run demo
# or
curl -s https://mcp-x402.onrender.com/health
curl -s https://mcp-x402.onrender.com/
Live remote: https://mcp-x402.onrender.com/mcp
Keywords for directories: x402 pay-per-call USDC RLUSD MCP no API keys federal trading agents
npm i -g @scriptmasterlabs/mcp-x402
Add to your Claude Code ~/.claude/config.json:
{
"mcpServers": {
"sml": {
"command": "npx",
"args": ["@scriptmasterlabs/mcp-x402"]
}
}
}
For Cursor (SSE mode), add to your MCP settings:
{
"mcp-x402": {
"url": "http://localhost:3402/sse"
}
}
Then run: MCP_TRANSPORT=sse npx @scriptmasterlabs/mcp-x402
Claude / Cursor
│
▼ MCP Protocol (stdio / SSE)
mcp-x402 Server
├─ Input validation (Zod, 100% coverage)
├─ Rate limiter (100/min per tool)
├─ AP2 Mandate check (deny-by-default)
├─ Credit Bureau check (min score 300)
├─ Price registry (60s max cache)
├─ x402 payment engine
│ ├─ Base USDC (preferred, <3s)
│ ├─ XRPL RLUSD (500ms fallback)
│ └─ Solana USDC (last resort)
├─ 402Proof receipt generation
├─ SML API call (mTLS)
└─ Append-only SHA-256 audit log
│
▼ Result + receipt_id back to agent
leviathan_signal — $0.05 USDC | AP2 requiredInstitutional-grade squeeze signals. Multi-engine verdict (OracleEngine + RDT + SML Fractal Cascade).
await use_mcp_tool('sml', 'leviathan_signal', {
ticker: 'MSTR',
signal_type: 'squeeze',
min_confidence: 75
});
// Returns: signal verdict + confidence + receipt_id
xmit_edgar_decode — $0.02 USDC | AP2 requiredParse SEC DEF 14A / 13F / 13D filings. Raw text never leaves SML servers.
await use_mcp_tool('sml', 'xmit_edgar_decode', {
filing_url: 'https://www.sec.gov/Archives/edgar/data/...',
parse_target: 'executive_pay',
format: 'json'
});
xdeo_earnings_estimate — $0.02 USDC | AP2 requiredDecentralized earnings oracle. Earns +2 Credit Bureau points per successful call.
await use_mcp_tool('sml', 'xdeo_earnings_estimate', {
ticker: 'NVDA',
fiscal_quarter: 'Q12025',
estimate_type: 'all'
});
ftd_threshold_scan — Alerts FREE / Full $0.05 USDCSEC Reg SHO FTD spike detection. 15-minute cache.
// Free tier:
await use_mcp_tool('sml', 'ftd_threshold_scan', { scan_type: 'alerts' });
// Paid tier:
await use_mcp_tool('sml', 'ftd_threshold_scan', { scan_type: 'full', min_spike_multiplier: 3 });
nexus_agent_hire — Query FREE / Hire 5% commissionAgent marketplace. Find and hire specialized AI agents.
// Free query:
await use_mcp_tool('sml', 'nexus_agent_hire', { capability: 'options flow analysis', max_budget: '1.00', action: 'query' });
// Hire:
await use_mcp_tool('sml', 'nexus_agent_hire', { action: 'hire', agent_id: 'agent_abc', max_budget: '0.50' });
crawl_paid_fetch — $0.005 USDCPay-per-fetch web scraping. Humans bypass automatically.
await use_mcp_tool('sml', 'crawl_paid_fetch', {
url: 'https://example.com/data',
extract: 'tables'
});
agents.json or llms.txt, sees tool pricesEvery successful tool call returns a _meta block:
{
"_meta": {
"receipt_id": "uuid-here",
"tx_hash": "0xabc...",
"chain": "base",
"amount_paid": "0.05 USDC",
"timestamp": 1750000000000
}
}
Install in one line:
npm i @scriptmasterlabs/mcp-x402-sdk
Drop into any MCP server in 5 lines:
import { x402Payment } from '@scriptmasterlabs/mcp-x402-sdk';
server.tool(
'my_paid_tool',
myInputSchema,
x402Payment({
price: '0.01',
currency: 'USDC',
inputSchema: MyZodSchema,
handler: async (input, receipt) => ({
content: [{ type: 'text', text: JSON.stringify({ result: await myApi(input), receipt }) }],
}),
}),
);
That's it. The SDK handles wallet provisioning, AP2 mandate, chain routing, receipts, and audit logging.
| Requirement | Implementation |
|---|---|
| Keys in OS keychain only | keytar — macOS Keychain / Windows DPAPI / Linux Secret Service |
| mTLS on SML APIs | Pinned cert via node-forge |
| No PII in logs | Wallet addresses hashed (SHA-256 prefix), filing content redacted |
| Zod on all inputs | 100% coverage, validated before any execution |
| Append-only audit log | SHA-256 HMAC chained log, 7-day local + cloud backup |
| AP2 mandate required | Verified before every paid call, fail-closed |
| 402Proof receipt | Every transaction, registered with proof server |
| Credit Bureau check | min score 300 for auto-approve |
| $50 daily spend cap | Per wallet, enforced in-process |
| Testnet in CI | Base Sepolia only, max $0.10 test value |
| <3s end-to-end | Base mainnet target, 500ms multi-chain fallback |
See .env.example for the full list. Key variables:
MCP_TRANSPORT=stdio # stdio (Claude Code) or sse (Cursor/remote)
SML_API_BASE=https://api.scriptmasterlabs.com
BASE_RPC_URL=https://mainnet.base.org
XRPL_RPC_URL=wss://xrplcluster.com
DAILY_SPEND_CAP_USD=50
AUTO_APPROVE_THRESHOLD_USD=1
TESTNET=false # Set true + CI_WALLET_SEED for CI
Private keys: Stored in your OS keychain automatically on first run. Never in env vars.
git clone https://github.com/timwal78/sml_portfolio
cd mcp-x402
npm install
npm run build
npm start
With Docker:
docker build -t mcp-x402 .
docker run -p 3402:3402 -e MCP_TRANSPORT=sse mcp-x402
npm test # All unit tests
npm run test:coverage # Coverage report (target: 90%)
TESTNET=true CI_WALLET_SEED="your mnemonic" npm run test:integration
| Service | URL | Role |
|---|---|---|
| SqueezeOS API | squeezeos-api.onrender.com | Market intelligence |
| 402Proof | four02proof.onrender.com | Payment receipts + Credit Bureau |
| Ghost Layer | ghost-layer.onrender.com | XRPL+Base toll gateway |
| ScriptMasterLabs | scriptmasterlabs.com | Operator homepage |
MIT — see LICENSE
Owner: @TimmyCrypto78 / ScriptMasterLabs
Launch Target: 2026-07-02
Target: 50K GitHub stars, 5K npm weekly downloads
FAQs
MCP server for agents with autonomous USDC/RLUSD payments. x402 pay-per-call · 43+ trading + federal tools · no API keys. Free sml_discover demo. Remote: https://mcp-x402.onrender.com/mcp
The npm package @scriptmasterlabs/mcp-x402 receives a total of 17 weekly downloads. As such, @scriptmasterlabs/mcp-x402 popularity was classified as not popular.
We found that @scriptmasterlabs/mcp-x402 demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.