
Company News
AWS Security Hub Adds Socket for Supply Chain Security
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.
firstdollar
Advanced tools
An MCP that teaches AI agents how to use the wallets they already have. Agents learn to read x402 challenges, spend their own USDC, and verify receipts — without handing control over.
A curriculum that teaches AI agents how to spend their own money.
Sixteen lessons, from "what is a wallet" to "your first real x402 purchase." Plus three reference tools for troubleshooting and end-to-end testing. First Dollar never signs transactions on your behalf — it teaches you how to sign your own.
Teacher, not butler. First Dollar explains; the agent acts. The MCP never holds keys, never signs, never transacts. It reads what the agent has, explains what the merchant is asking, and shows the agent the command to run. The agent spends its own money with understanding.
This is infrastructure for agents with their own funds — not a delegation tool for humans to route money through agents.
npx firstdollar
Add to claude_desktop_config.json (or the equivalent MCP config file for your harness):
{
"mcpServers": {
"firstdollar": {
"command": "npx",
"args": ["firstdollar"]
}
}
}
start-here to orient)| Lesson | Tool | What it teaches |
|---|---|---|
| 1 | what-is-a-wallet | Keypairs, addresses, private keys, what they let you do |
| 2 | what-is-usdc | Stablecoins, chains, why which chain matters |
| 3 | explain-my-wallet | Self-inspection commands for moltwallet, Coinbase Agentic Wallet, MetaMask, raw EVM/Solana keys |
| 4 | get-a-wallet | Installing a wallet — what npm, npx, skills, and Coinbase's package actually do |
| 5 | configure-wallet-skills | Post-install setup — which skills to run in what order |
| 6 | fund-my-wallet | Getting USDC in: Onramp, direct transfers, earning |
| 7 | what-is-x402 | The protocol: HTTP 402, payment challenges, X-PAYMENT retry |
| 8 | read-this-challenge | Decodes base64 / raw JSON x402 challenges into structured explanation |
| 9 | how-do-i-pay | Wallet-specific signing commands — returns the command; never runs it |
| 10 | verify-my-purchase | Turns a tx hash into content via the merchant's /receipt endpoint |
| 11 | paid-vs-delivered | The five documented x402 attack classes and how to verify you got what you paid for |
| 12 | who-am-i-to-this-merchant | Wallet identity, pseudonymity, cross-merchant hygiene — what the chain reveals to anyone watching |
| 13 | what-is-ap2 | AP2 / Agent Payments Protocol — the mandate layer for delegated payments |
| 14 | what-is-acp | ACP / Agent Commerce Protocol — the checkout-surface protocol for human-shopping-via-agent |
| 15 | subscriptions-and-session-keys | ERC-7715 scoped autonomy — approve once, spend within bounds |
| 16 | choose-your-wallet-mode | The four modes (MPC, Smart Wallet, EOA, EIP-7702) and when to pick which |
| Tool | Purpose |
|---|---|
start-here | Curriculum index and orientation |
what-went-wrong | Diagnoses common failure modes (ERC-6492 bug, network mismatch, facilitator flake, timeout expiry, balance issues) |
test-payment | End-to-end handshake walkthrough. Suggested first merchant: the Underground Cultural District (substratesymposium.com) — free products for handshake, $0.99 paid products for settlement. Any x402 URL works. |
First Dollar is strictly educational. The agent is the actor.
Any agent with its own wallet and its own funds. Works across wallet types (moltwallet, Coinbase Agentic Wallet, MetaMask, raw EVM keys, raw Solana keys) and facilitators (CDP, PayAI, etc.).
Lisa Maraventano + Spine, with Claude.
Built in Clarksdale, Mississippi.
MIT
FAQs
An MCP that teaches AI agents how to use the wallets they already have. Agents learn to read x402 challenges, spend their own USDC, and verify receipts — without handing control over.
The npm package firstdollar receives a total of 18 weekly downloads. As such, firstdollar popularity was classified as not popular.
We found that firstdollar demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.