
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
@voidly/pay-mcp
Advanced tools
MCP server exposing Voidly Pay tools (transfer, escrow, x402, streams, subscriptions, webhooks, observability) to Claude Code, Cursor, Windsurf, and any MCP-compatible client.
MCP server exposing Voidly Pay primitives to Claude Code, Cursor, Windsurf, and any MCP-compatible client. 27 tools across wallet, transfer, batch, escrow, streams, subscriptions, x402 (server + client), webhooks, and observability.
Add to your client's MCP config (Claude Code's .mcp.json, Cursor's ~/.cursor/mcp.json, Windsurf's ~/.codeium/windsurf/mcp_config.json, etc.):
{
"mcpServers": {
"voidly-pay": {
"command": "npx",
"args": ["-y", "@voidly/pay-mcp"]
}
}
}
On first run the server mints + persists an Ed25519 keypair to ~/.voidly-pay/keypair.json (mode 0600). The DID derived from that key is your agent's identity.
# Wallet
agent_pay_self Show this agent's DID, pubkey, balance.
agent_wallet_balance Read any wallet (defaults to self).
agent_wallet_ensure Idempotent wallet creation.
# Transfers
agent_pay Send N credits to a DID.
agent_pay_batch Multi-recipient atomic transfer (≤100).
agent_pay_get Look up a transfer by id.
agent_payment_history Paginated history.
# Escrow
agent_escrow_open / release / refund
# Streams (per-token billing)
agent_stream_open / meter / finalize
# Subscriptions (recurring)
agent_subscribe / agent_subscription_cancel
# x402 (server + client)
agent_x402_quote Server: issue a 402 quote.
agent_x402_verify Server: verify + consume X-Payment.
agent_x402_fetch Client: pay-on-402, returns final response.
# Webhooks
agent_webhook_subscribe / agent_webhook_delete
# Observability (read-only)
agent_pay_health / manifest / stats / activity / leaderboard / feed / trust
Environment variables (set in your MCP client config under env):
{
"mcpServers": {
"voidly-pay": {
"command": "npx",
"args": ["-y", "@voidly/pay-mcp"],
"env": {
"VOIDLY_PAY_API_URL": "https://api.voidly.ai"
}
}
}
}
Or pass --api-url <url> as a CLI arg.
POST /v1/pay/test/wallet/create.MIT
FAQs
MCP server exposing the Voidly Pay marketplace — list any paid HTTP endpoint, browse all of them, pay any with one wallet. Agent utilities: voidly_hash (SHA-256/512), voidly_timestamp (proof-of-existence), voidly_random (signed CSPRNG), voidly_qr (QR code
We found that @voidly/pay-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.