
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@true402.dev/mcp-server
Advanced tools
MCP server for the true402 machine-native marketplace — pay-per-call AI + web + Base on-chain tools over x402 (USDC on Base): LLM inference, SEO/GEO audit, web extract, link preview, robots/AI-crawler check, security headers, and on-chain DeFi trading sig
MCP server for the true402 machine-native marketplace — give your agent pay-per-call access to AI inference and web tools over x402 (HTTP 402 micropayments in USDC on Base).
No accounts, no API keys. The agent's wallet is its identity: each paid tool returns an HTTP 402 challenge, the server signs an EIP-3009 USDC authorization, and the call settles on-chain. Configure a funded wallet to auto-pay, or run without one and the paid tools will surface the exact payment requirements instead of failing.
| Tool | Price | What it does |
|---|---|---|
chat | per-token + 3% | OpenAI-compatible LLM inference across many models |
list_models | free | List available models + pricing |
token_safety | $0.005 | ERC-20 rug/honeypot pre-check on Base → 0–100 score, risk band, flags, liquidity depth + a buy/sell honeypot simulation |
seo_audit | $0.04/page | SEO + GEO (generative-engine-optimization) audit of a page → structured report |
web_extract | $0.005 | Fetch a URL → clean text + markdown + links + metadata |
link_preview | $0.003 | Fetch a URL → Open Graph / unfurl card |
robots_check | $0.003 | A site's AI-crawler policy (GPTBot, ClaudeBot, Google-Extended, PerplexityBot, …) + sitemaps + llms.txt |
headers_check | $0.003 | HTTP security-headers analysis (HSTS, CSP, …) + a 0–100 score |
new_pairs | $0.003 | Newly created Base DEX pairs (Uniswap V3 / Aerodrome) — fresh token launches |
liquidity_pulls | $0.003 | Liquidity-removal / rug alerts on Base pools |
whale_swaps | $0.005 | Large swaps on Base by USD size — whale flow |
token_report | $0.01 | Fuller on-chain token report |
liquidity_history | $0.005 | What ALREADY happened to a Base token's liquidity — every removal with amount/block/tx, plus the other tokens drained in the same transaction. History a live simulation cannot re-derive |
tx_preflight | $0.008 | Check an unsigned Base transaction before signing: does it revert, does it grant an unlimited approval, and has the counterparty been seen draining liquidity. Takes no key and no signature, so it cannot broadcast or front-run |
Tools are auto-discovered from the live catalog, so new marketplace stalls appear automatically. Prices are illustrative; the live 402 challenge is authoritative.
A copy-paste reference in examples/token-safety/ — a framework-agnostic
x402 client plus a drop-in LangChain tool that rug/honeypot-checks any Base token for $0.005/call.
Requires Node.js ≥ 20. Runs over stdio — point any MCP client at it via npx.
Add to your MCP config (claude_desktop_config.json, or .mcp.json for Claude Code):
{
"mcpServers": {
"true402": {
"command": "npx",
"args": ["-y", "@true402.dev/mcp-server"],
"env": {
"WALLET_PRIVATE_KEY": "0xYOUR_FUNDED_BASE_WALLET_KEY"
}
}
}
}
Same idea — command npx, args ["-y", "@true402.dev/mcp-server"], and the WALLET_PRIVATE_KEY env var.
| Env var | Default | Description |
|---|---|---|
SERVER_URL | https://true402.dev/api | true402 API base. Override to point at a self-hosted instance. |
WALLET_PRIVATE_KEY | (none) | A funded Base wallet private key used to sign x402 payments. Needs USDC (gas is sponsored by the facilitator — no ETH required). Without it, paid tools return the 402 requirements instead of paying. |
Security: the key is read only from the environment and is never logged, echoed, or returned. Use a dedicated low-balance wallet — fund it with only what you intend to spend.
402 with accepted payment options (USDC on Base).transferWithAuthorization with your wallet.X-PAYMENT header; the service verifies and responds.MCP (Claude Code / Desktop, Cursor, Hermes) · Hermes Agent · OpenClaw · ElizaOS · LangChain · CrewAI · Vercel AI SDK · Coinbase AgentKit · Virtuals GAME · CLI — same on-chain checks, one install command each: true402.dev/integrations
MIT
FAQs
MCP server for the true402 machine-native marketplace — pay-per-call AI + web + Base on-chain tools over x402 (USDC on Base): LLM inference, SEO/GEO audit, web extract, link preview, robots/AI-crawler check, security headers, and on-chain DeFi trading sig
We found that @true402.dev/mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.