
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
@true402.dev/mcp-server
Advanced tools
MCP server for the true402 machine-native marketplace — pay-per-call AI + web + Base on-chain tools over x402 (USDC on Base): LLM inference, SEO/GEO audit, web extract, link preview, robots/AI-crawler check, security headers, and on-chain DeFi trading sig
MCP server for the true402 machine-native marketplace — give your agent pay-per-call access to AI inference and web tools over x402 (HTTP 402 micropayments in USDC on Base).
No accounts, no API keys. The agent's wallet is its identity: each paid tool returns an HTTP 402 challenge, the server signs an EIP-3009 USDC authorization, and the call settles on-chain. Configure a funded wallet to auto-pay, or run without one and the paid tools will surface the exact payment requirements instead of failing.
| Tool | Price | What it does |
|---|---|---|
chat | per-token + 3% | OpenAI-compatible LLM inference across many models |
list_models | free | List available models + pricing |
token_safety | $0.005 | ERC-20 rug/honeypot pre-check on Base → 0–100 score, risk band, flags, liquidity depth + a buy/sell honeypot simulation |
seo_audit | $0.04/page | SEO + GEO (generative-engine-optimization) audit of a page → structured report |
web_extract | $0.005 | Fetch a URL → clean text + markdown + links + metadata |
link_preview | $0.003 | Fetch a URL → Open Graph / unfurl card |
robots_check | $0.003 | A site's AI-crawler policy (GPTBot, ClaudeBot, Google-Extended, PerplexityBot, …) + sitemaps + llms.txt |
headers_check | $0.003 | HTTP security-headers analysis (HSTS, CSP, …) + a 0–100 score |
new_pairs | $0.003 | Newly created Base DEX pairs (Uniswap V3 / Aerodrome) — fresh token launches |
liquidity_pulls | $0.003 | Liquidity-removal / rug alerts on Base pools |
whale_swaps | $0.005 | Large swaps on Base by USD size — whale flow |
token_report | $0.01 | Fuller on-chain token report |
Tools are auto-discovered from the live catalog, so new marketplace stalls appear automatically. Prices are illustrative; the live 402 challenge is authoritative.
A copy-paste reference in examples/token-safety/ — a framework-agnostic
x402 client plus a drop-in LangChain tool that rug/honeypot-checks any Base token for $0.005/call.
Requires Node.js ≥ 20. Runs over stdio — point any MCP client at it via npx.
Add to your MCP config (claude_desktop_config.json, or .mcp.json for Claude Code):
{
"mcpServers": {
"true402": {
"command": "npx",
"args": ["-y", "@true402.dev/mcp-server"],
"env": {
"WALLET_PRIVATE_KEY": "0xYOUR_FUNDED_BASE_WALLET_KEY"
}
}
}
}
Same idea — command npx, args ["-y", "@true402.dev/mcp-server"], and the WALLET_PRIVATE_KEY env var.
| Env var | Default | Description |
|---|---|---|
SERVER_URL | https://true402.dev/api | true402 API base. Override to point at a self-hosted instance. |
WALLET_PRIVATE_KEY | (none) | A funded Base wallet private key used to sign x402 payments. Needs USDC (gas is sponsored by the facilitator — no ETH required). Without it, paid tools return the 402 requirements instead of paying. |
Security: the key is read only from the environment and is never logged, echoed, or returned. Use a dedicated low-balance wallet — fund it with only what you intend to spend.
402 with accepted payment options (USDC on Base).transferWithAuthorization with your wallet.X-PAYMENT header; the service verifies and responds.MCP (Claude Code / Desktop, Cursor, Hermes) · Hermes Agent · OpenClaw · ElizaOS · LangChain · CrewAI · Vercel AI SDK · Coinbase AgentKit · Virtuals GAME · CLI — same on-chain checks, one install command each: true402.dev/integrations
MIT
FAQs
MCP server for the true402 machine-native marketplace — pay-per-call AI + web + Base on-chain tools over x402 (USDC on Base): LLM inference, SEO/GEO audit, web extract, link preview, robots/AI-crawler check, security headers, and on-chain DeFi trading sig
We found that @true402.dev/mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.