
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
apifare-mcp
Advanced tools
Give your AI agent a prepaid balance for API calls: search the web, fetch a URL, and pay for APIs mid-conversation.
apifare — "API fare: the fare an agent pays." One key, every API your agent needs, under hard caps and a kill switch. There is no separate provider account or provider API key for eligible capabilities; one apifare account gives your agent a capped, auditable budget. The agent discovers APIs, calls them, and pays per call from the balance — mid-conversation.
Human home: apifare.com / apifare.ai.
Live gateway until DNS cutover: https://apipay.fly.dev.
Legacy install ids (not the product name): env APIPAY_TOKEN, token
prefix apipay_, npm id apipay-mcp, and MCP server name apipay still
work. New installs should use apifare-mcp + APIPAY_TOKEN.
Five tools: search_apis, call_api, check_balance, get_vault_link, topup.
When the balance runs out, the agent receives a machine-readable payment
link to hand to you.
curl -X POST https://apipay.fly.dev/v1/signup \
-H "content-type: application/json" \
-d '{"email":"you@example.com"}'
New accounts start with 500 trial credits (1 credit = $0.01).
Claude Code
claude mcp add apifare -e APIPAY_TOKEN=<your-token> -- npx -y apifare-mcp
Claude Desktop (claude_desktop_config.json)
{
"mcpServers": {
"apifare": {
"command": "npx",
"args": ["-y", "apifare-mcp"],
"env": { "APIPAY_TOKEN": "<your-token>" }
}
}
}
Cursor (~/.cursor/mcp.json)
{
"mcpServers": {
"apifare": {
"command": "npx",
"args": ["-y", "apifare-mcp"],
"env": { "APIPAY_TOKEN": "<your-token>" }
}
}
}
First ask (no user key):
search the web for X
The agent will search_apis, then call_api with slug dataforseo and
{q} (count/country/language optional). That path is resold —
live Google via DataForSEO SERP, 0.3 credits, no user search key. Do not
ask for a Brave key unless the user wants the BYOK web-search slug.
Second no-key: fetch a URL. slug scrape with {url} (0.3 credits) —
DataForSEO On-Page markdown, no user scrape key. Do not ask for a
ScrapingBee key unless the user wants the BYOK scrapingbee slug.
Weather is the cheap third no-key demo: slug open-meteo (0.1 credits).
Ask "what's the weather in London" ({lat, lon, forecast?}, London is
~51.51, -0.13). Do not ask for an Open-Meteo or OpenWeather key unless
the user wants the BYOK weather slug. Open-Meteo results include
attribution (CC BY 4.0);
keep Weather data by Open-Meteo.com next to any
weather you display.
The per-call cost and remaining balance come back with every result. Top up
any time at the link check_balance returns. For BYOK catalog APIs, use
get_vault_link so the key never transits chat.
Env vars: APIPAY_TOKEN (required; legacy name), APIPAY_BASE_URL (optional override,
defaults to the hosted gateway).
Rotate it immediately — the old token stops working the instant the new one is issued; your balance, account id, and vaulted keys are untouched:
curl -X POST https://apipay.fly.dev/v1/token/rotate \
-H "Authorization: Bearer <your-current-token>"
The response contains your new token (shown once). Update APIPAY_TOKEN in
your MCP config afterwards. You can also remove a vaulted provider key at any
time with DELETE /v1/keys/<provider-slug> using the same auth header.
Your agent can also skip the catalog schema entirely and call supported providers in their native API language through the apifare proxy — one bearer token, provider docs apply verbatim, native error codes come back untouched:
POST https://apipay.fly.dev/proxy/dataforseo/v3/serp/google/organic/live/advanced
Authorization: Bearer <APIPAY_TOKEN>
Content-Type: application/json
[{"keyword":"apifare prepaid balance","location_code":2840}]
apifare injects the provider credential (its own for dataforseo /
open-meteo / apify; your vaulted key for brave / scrapingbee /
openweather / fal), enforces your per-agent caps before forwarding, and
meters the prepaid balance (x-apipay-credits-charged /
x-apipay-balance response headers). The proxy_call MCP tool wraps
exactly this.
FAQs
Give your AI agent a prepaid balance for API calls: search the web, fetch a URL, and pay for APIs mid-conversation.
The npm package apifare-mcp receives a total of 25 weekly downloads. As such, apifare-mcp popularity was classified as not popular.
We found that apifare-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.