{"id":50157489,"url":"https://github.com/RipperMercs/tensorfeed-x402-base-mcp","last_synced_at":"2026-06-03T16:00:47.957Z","repository":{"id":357269915,"uuid":"1236118965","full_name":"RipperMercs/tensorfeed-x402-base-mcp","owner":"RipperMercs","description":"Read-only MCP server for x402 payment verification on Base mainnet. The x402 ecosystem's canonical chain reader, with AFTA federation helpers.","archived":false,"fork":false,"pushed_at":"2026-05-12T03:54:59.000Z","size":166,"stargazers_count":1,"open_issues_count":6,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-12T05:18:27.395Z","etag":null,"topics":["afta","agent-payments","base","ethereum","evm","mcp","model-context-protocol","tensorfeed","usdc","x402"],"latest_commit_sha":null,"homepage":"https://tensorfeed.ai","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/RipperMercs.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-05-12T01:02:08.000Z","updated_at":"2026-05-12T03:55:02.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/RipperMercs/tensorfeed-x402-base-mcp","commit_stats":null,"previous_names":["rippermercs/tensorfeed-x402-base-mcp"],"tags_count":4,"template":false,"template_full_name":null,"purl":"pkg:github/RipperMercs/tensorfeed-x402-base-mcp","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RipperMercs%2Ftensorfeed-x402-base-mcp","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RipperMercs%2Ftensorfeed-x402-base-mcp/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RipperMercs%2Ftensorfeed-x402-base-mcp/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RipperMercs%2Ftensorfeed-x402-base-mcp/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/RipperMercs","download_url":"https://codeload.github.com/RipperMercs/tensorfeed-x402-base-mcp/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RipperMercs%2Ftensorfeed-x402-base-mcp/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33872298,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-03T02:00:06.370Z","response_time":59,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["afta","agent-payments","base","ethereum","evm","mcp","model-context-protocol","tensorfeed","usdc","x402"],"created_at":"2026-05-24T13:00:32.264Z","updated_at":"2026-06-03T16:00:47.940Z","avatar_url":"https://github.com/RipperMercs.png","language":"TypeScript","funding_links":[],"categories":["💰 Finance \u0026 Crypto","Agent Wallets and On-chain Actions","📦 Other"],"sub_categories":[],"readme":"# @tensorfeed/x402-base-mcp\n\nRead-only MCP server for verifying x402 USDC settlements on Base mainnet. Drop it into any MCP-compatible agent (Claude Desktop, Claude Code, Cursor, ChatGPT) to independently audit x402 payment receipts on-chain, parse publisher `.well-known/x402` manifests, and check AFTA federation status. No private keys, no signing, no broadcasts.\n\n```\nnpm install -g @tensorfeed/x402-base-mcp\n```\n\n## Relationship to Coinbase Base MCP\n\nCoinbase shipped **Base MCP** (the official `mcp.base.org` server, launched May 2026) as the *transact-side* MCP: it connects an agent to a Base Account and lets the agent propose swaps, transfers, and x402 payments that the user approves in-wallet.\n\nThis package, `@tensorfeed/x402-base-mcp`, is the *verify-side* MCP. Once an x402 payment has been made (by Base MCP, by a server-side `@coinbase/x402` middleware, or by any other x402 client), this server lets the calling agent independently check the on-chain settlement, parse the publisher's `/.well-known/x402` manifest, and audit the receipt. Read-only chain visibility, no wallet.\n\nThe two are complementary, not competing. Use Base MCP to pay. Use this MCP to verify.\n\n## Why a separate verify MCP\n\nx402 is a payment protocol where agents pay merchants in USDC on Base for paid API responses. When an agent receives a payment receipt back, it has two options for confirming that the settlement actually happened the way the receipt claims:\n\n1. Trust the merchant\n2. Read the on-chain Transfer event itself\n\nMost existing EVM MCP servers either require a private key (so the agent can also send transactions, which is operationally risky and unnecessary for verification), or are generic multi-chain readers that don't speak x402. This server is the read-only, x402-aware option. Drop it into a Claude Desktop or Claude Code session and any agent can verify x402 payments without operating a wallet.\n\nThe TensorFeed-flavor tools (`verify_afta_federation`, `tf_payment_lookup`) compose the same primitives against TF's canonical surfaces and demonstrate the pattern. Use them or ignore them; the generic tools work fine on their own.\n\n## Installation\n\n### Claude Desktop\n\nAdd to `claude_desktop_config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"tensorfeed-x402-base\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@tensorfeed/x402-base-mcp\"]\n    }\n  }\n}\n```\n\n### Claude Code\n\n```bash\nclaude mcp add tensorfeed-x402-base -- npx -y @tensorfeed/x402-base-mcp\n```\n\n### Optional: bring your own RPC\n\nThe server defaults to the public Base RPC (`https://mainnet.base.org`), which is fine for casual use. For heavier workloads, set an Alchemy or Infura URL via `TENSORFEED_RPC_URL`. The URL must match the allowlist in `src/rpc/allowlist.ts`; anything else falls back to the public endpoint and logs a warning to stderr.\n\n```bash\nexport TENSORFEED_RPC_URL=\"https://base-mainnet.g.alchemy.com/v2/YOUR_KEY\"\n```\n\nAffiliate links if you don't already have an account:\n- Alchemy: https://www.alchemy.com/\n- Infura: https://www.infura.io/\n\n## Tools\n\n### Generic Base reads\n\n| Tool | Description |\n|------|-------------|\n| `balance` | Native ETH balance for an address |\n| `usdc_balance` | USDC (Circle native bridged) balance for an address |\n| `block_number` | Latest Base block number |\n| `get_tx_receipt` | Full tx receipt with status, gas, and logs summary |\n| `call` | Read-only contract call (eth_call, never broadcasts) |\n| `recent_transfers` | USDC Transfer events involving an address over N blocks |\n\n### x402-native verification\n\n| Tool | Description |\n|------|-------------|\n| `verify_x402_settlement` | Given a tx hash, expected recipient, and expected USDC amount, returns a structured verdict on whether the on-chain Transfer event matches. |\n| `parse_x402_manifest` | Fetches `https://{domain}/.well-known/x402.json`, returns the structured manifest. |\n| `usdc_recent_payments_to` | USDC transfers TO an address over N blocks; the merchant-side view. |\n| `probe_x402_endpoint` | Probes any https URL and reports whether it returns a canonical x402-paid 402 response with `accepts[]`. |\n| `decode_x402_payment_payload` | Offline decode of a base64 `X-PAYMENT` header (Coinbase x402 V2): returns scheme, network, version, EIP-3009 authorization, signature. |\n\n### TensorFeed flavor\n\n| Tool | Description |\n|------|-------------|\n| `verify_afta_federation` | Calls TensorFeed's AFTA certification endpoint for a domain, returns a scored checklist. |\n| `tf_payment_lookup` | Checks whether a tx hash is a USDC payment to TensorFeed's canonical wallet on Base. |\n| `x402_publisher_health` | Returns current outcome + 24h/7d uptime + recent series for a domain monitored by TensorFeed's hourly x402 status probe. |\n| `afta_federation_members` | Returns the canonical curated list of confirmed AFTA federation members (TF origin + federated members). |\n\n## Examples\n\nVerify an x402 settlement (works on TensorFeed's first canonical V2 payment):\n\n```\nverify_x402_settlement({\n  tx_hash: \"0xe20c57d8aa6df63f75ce7a4e4c0cab492eb7fa672a23cd8fd59967eb6b66bd67\",\n  expected_recipient: \"0x549c82e6bFC54bdaE9A2073744CBC2AF5D1FC6D1\",\n  expected_amount_usdc: \"0.02\"\n})\n// returns { ok: true, verified: true, matches: [...] }\n```\n\nInspect a publisher's x402 manifest:\n\n```\nparse_x402_manifest({ domain: \"tensorfeed.ai\" })\n```\n\nCheck AFTA certification:\n\n```\nverify_afta_federation({ domain: \"tensorfeed.ai\" })\n```\n\n## Threat model\n\nRead-only chain-visibility MCP. The full picture is in `SECURITY.md`; the short version:\n\n- **No private keys**, no signing, no broadcasts. The server cannot move funds.\n- **Input validators** on every tool reject malformed inputs (bad checksums, malformed hashes, URL-shaped domains, private/loopback hostnames).\n- **Output sanitization** strips C0/C1 control characters and zero-width / direction-override marks from every string returned to the calling agent.\n- **External strings** carry an `_origin: \"external\"` marker so the calling agent knows the value came from a third party.\n- **50 KB response cap** on serialized tool output; oversized responses collapse to a structured stub.\n- **RPC allowlist** limits self-hosters to known endpoints; arbitrary URLs are rejected and fall back to public Base RPC.\n- **No telemetry**, no phone-home, no analytics.\n- **Provenance**: npm releases are published via GitHub Actions OIDC with cryptographic provenance attestations. Verify with `npm audit signatures`.\n\nReport security issues to **security@tensorfeed.ai**. Please do not file a public issue or CVE for an unfixed vulnerability.\n\n## License\n\nMIT\n\n## Related\n\n- [Coinbase Base MCP](https://mcp.base.org) - the official transact-side MCP for Base. Pair with this package for a full pay + verify loop: Base MCP signs the x402 payment, this package independently confirms the settlement on-chain.\n- [@tensorfeed/mcp-server](https://www.npmjs.com/package/@tensorfeed/mcp-server) - companion package, the TensorFeed data MCP (news, status, models, benchmarks, premium endpoints). Complementary role: this server verifies x402 payments on-chain; mcp-server wraps the TF data API as MCP tools.\n- [TensorFeed](https://tensorfeed.ai) - AI ecosystem data layer\n- [TensorFeed developers](https://tensorfeed.ai/developers) - free + premium API for AI agents\n- [Agent Fair-Trade Agreement (AFTA)](https://tensorfeed.ai/agent-fair-trade) - open standard for honest agent commerce\n- [x402 spec](https://github.com/coinbase/x402) - the payment protocol this MCP verifies\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FRipperMercs%2Ftensorfeed-x402-base-mcp","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FRipperMercs%2Ftensorfeed-x402-base-mcp","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FRipperMercs%2Ftensorfeed-x402-base-mcp/lists"}