
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
agent-payment-mcp
Advanced tools
The x402 payment rail for AI agents, as an MCP server. An agent calls any paid HTTP API through LemonCake's gateway with a prepaid, spend-capped Pay Token — no per-call key, custody-free (Stripe Connect Direct Charge). First 3,000 calls free, then 3%. Als
Let your AI agent pay for any API — capped, no account.
Give your agent a spend-capped prepaid wallet and it pays for paid APIs on its own. Discover → pay → pass through. No per-call key, no human in the loop, and it can't exceed your cap. First 3,000 calls free, then 3%. Seller gets 97%. LemonCake never holds your funds.
💰 No monthly fee. First 3,000 calls free (lifetime). Then 3% only when your API earns. See pricing →
Add to ~/Library/Application Support/Claude/claude_desktop_config.json (or Cursor / Cline):
{
"mcpServers": {
"lemon": {
"command": "npx",
"args": ["-y", "agent-payment-mcp"]
}
}
}
Restart, then ask:
"use lemon to translate 'Hello, agent payments' to Japanese"
Zero env vars. Zero signup. Zero credit card. Demo Mode activates automatically.
| Tool | What it does | Upstream |
|---|---|---|
🔍 demo_search | Search Wikipedia (5 results + URLs) | en.wikipedia.org |
💱 demo_fx | Live FX rates (160+ currencies) | open.er-api.com |
🌐 demo_translate | Translate 80+ languages | MyMemory |
🌤 demo_weather | Current weather for any lat/lon | Open-Meteo |
📍 demo_geocode | Place name → coordinates | OpenStreetMap Nominatim |
🕐 demo_time | Current time + DST for any IANA timezone | worldtimeapi |
📖 demo_dictionary | English definitions / synonyms | dictionaryapi.dev |
🔁 demo_echo | HTTP echo (request inspector) | httpbin.org |
LemonCake speaks x402 — the HTTP 402 payment protocol for AI agents.
Agent → POST /g/<endpoint>
↓
402 + accepts[] { pricePerCall, buyUrl, mintUrl }
↓
Agent mints a Pay Token (off-session, capped wallet)
↓
Bearer <jwt> → gateway → your API
Authorization: Bearer <token> — gateway verifies, meters, forwards402 + accepts[] so agents can self-fundFor fully autonomous operation with no human per-session:
bk_...) in the Pay Tokens pane at /appbk_ to mint/top-up Pay Tokens off-session — hard-capped per your limitsAgent → POST /api/lc/agent/tokens (Bearer bk_...)
→ off-session card charge → Pay Token issued
→ Bearer <jwt> → gateway → pass through
Caps enforced server-side: per-mint / daily / monthly. Cannot overspend.
Monetize any HTTP API or MCP server in minutes:
// Your tool code is unchanged — LemonCake sits in front as a gateway
class MyTool extends MCPTool {
// existing logic — no SDK required
}
// Route traffic through: https://lemoncake.xyz/g/<shortId>
Japan FSA Fintech Support Desk (2026-06) confirmed: no electronic payment means management registration required. LemonCake never holds funds (Stripe Connect Direct Charge, custody-free).
| Jurisdiction | Basis |
|---|---|
| 🇯🇵 Japan | FSA confirmed — registration not required |
| 🇺🇸 USA | FinCEN 2019 §4.5 — non-custodial software ≠ MSB |
| 🇪🇺 EU | MiCA — non-CASP |
| 🇬🇧 UK | FCA — Tech Service Provider |
| 🇸🇬 Singapore | MAS — DPT non-applicable |
| 🇨🇦 Canada | FINTRAC — non-custodial exemption |
| 🇨🇭 Switzerland | FINMA — non-financial intermediary |
Full posture: lemoncake.xyz/security
| Package | Use |
|---|---|
agent-payment-mcp | Main MCP — x402 gateway + agent payment rail (this one) |
@lemon-cake/mcp-sdk | SDK to monetize your own MCP server |
xstocks-mcp | Buy tokenized US stocks on Solana |
alpaca-guard-mcp | Alpaca paper / live trading with hard USD cap |
tokenized-stock-mcp | Dinari dShares |
bk_) has hashed secret, PM reference only (no raw card data).upstream_auth never returned in API responses.| Try demo | npx -y agent-payment-mcp or lemoncake.xyz/demo |
| Seller dashboard | lemoncake.xyz/app |
| Agent card setup | lemoncake.xyz/agent/fund |
| Docs | lemoncake.xyz/docs |
| Source | github.com/evidai/agent-payment-mcp |
| MCP Registry | registry.modelcontextprotocol.io |
| License | MIT |
FAQs
The x402 payment rail for AI agents, as an MCP server. An agent calls any paid HTTP API through LemonCake's gateway with a prepaid, spend-capped Pay Token — no per-call key, custody-free (Stripe Connect Direct Charge). First 3,000 calls free, then 3%. Als
We found that agent-payment-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.