
Research
/Security News
737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection
The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.
pch-x402-mcp
Advanced tools
MCP server wrapper exposing PathCourse Health inference SKUs as x402 paid tools (MCP Spec 2026).
MCP server that exposes the PathCourse Health inference SKUs as x402 paid tools (the seller paidTool pattern). An MCP client pays per call with an EIP-712 debit authorization rather than a flat API key. Targets MCP Specification 2026.
Phase E E.3 greenfield skeleton (worktree-e). DRAFT, NOT PUBLISHED. The paid-tool manifest is built and tested; the MCP protocol handlers + sign/submit wiring are skeletons pending the Phase E full build (signing is delegated to pch-x402-client, so this package holds no keys). Source is fully readable in this package (Principle 13); links resolve to https://pathcoursehealth.com.
const { createServer, createTransport } = require('pch-x402-mcp');
const server = createServer({ escrowAddress: ESCROW_ADDRESS, chainId: 8453 });
server.listTools(); // -> 13 v2.1 SKUs as paid tools
// createTransport('stdio').start(); // wired in the Phase E full build
One MCP tool per PCH SKU (13 v2.1 SKUs; canonical set owned by Phase D.11). Each tool carries an
x402 payment annotation (payment.required = true, rail x402, asset USDC, the billing unit, and
the escrow contract + chain). v2.1 lineup only (no retired SKUs).
server.json is a draft manifest. Per Wave G.R.8, the MCP Registry submission policy is verified
before first publish; if a public code-host URL is mandatory, a content-empty stub repo is used as a
documented scoped compromise (default posture is no public code host).
npm test # node test/paid_tools.test.js
Greenfield skeleton. Not on npm/PyPI/MCP Registry. Publication is a Phase E hard stop.
FAQs
MCP server wrapper exposing PathCourse Health inference SKUs as x402 paid tools (MCP Spec 2026).
We found that pch-x402-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.

Company News
Open source maintainers are under more pressure than ever. We're raising our open source program from the Team plan to the Business plan, free.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.