
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
mcp-ucash
Advanced tools
Merchant-side MCP server for U.CASH Pay: create checkouts, verify webhooks, read settings/integrations. Non-custodial.
A merchant-side MCP server for U.CASH Pay. Let Claude Desktop, Cursor, or any MCP client manage a merchant's pay.u.cash: create checkouts, verify settlement webhooks, and read settings + integration credentials.
create_checkout(amount, currency, title, external_reference) → hosted checkout URL + transaction idverify_webhook(raw_body, signature_header) → HMAC verify an X-Webhook-Signatureget_integrations() → Discord/Telegram/BigCommerce/Ecwid/Wix credentials (from /v1/integrations)get_settings() → safe agent settings (from /v1/settings)# one-liner: uv installs an isolated Python 3.10+ and the deps for you
uvx --from mcp-ucash python -m mcp_ucash
Or from source:
pip install "mcp[cli]"
export UXC_API_KEY=uxc_... # agent API key, for /v1/* reads
export UCASH_CLOUD_TOKEN=st_... # store cloud token, for create_checkout
export UCASH_WEBHOOK_SECRET=... # for verify_webhook
python mcp_ucash.py
{
"mcpServers": {
"ucash": {
"command": "uvx",
"args": ["--from", "mcp-ucash", "python", "-m", "mcp_ucash"],
"env": {
"UXC_API_KEY": "uxc_...",
"UCASH_CLOUD_TOKEN": "st_...",
"UCASH_WEBHOOK_SECRET": "..."
}
}
}
}
This repo ships the manifests the MCP directories read:
mcp.json - client/registry descriptor (Glama, MCP Registry).smithery.yaml - build + start spec for Smithery.MIT.
FAQs
Merchant-side MCP server for U.CASH Pay: create checkouts, verify webhooks, read settings/integrations. Non-custodial.
We found that mcp-ucash demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.