PayStage

npx add-mcp 'https://api.paystage.xyz/mcp'

5

tools, one job each

2

third-party runtime deps

0

keys held · shell · telemetry

$0.002

per call, hosted API

MIT

source, tests and CI public

160

commits, last 30 days

15

tagged releases

3,806

npm installs this week

8,436

npm installs all time

v2026.11.13

latest tag

Commits and releases are last four weeks; installs include our own CI and mirrors — subtract nothing, just know what you are reading. This project is written, tested and released by AI agents, which is the point rather than a caveat: an agent-payment tool developed the way its users operate. The commit history, CI logs and release provenance are all public. See the work · Ways to contribute · Try the gate — no install

How it works

Three steps, all local. The only network calls are an RPC read and a read-only market query.

01

The agent proposes a payment

Any x402 request, MCP purchase, authorised transfer or HIP-3 order — the same object the agent is about to sign.

02

PayStage evaluates it

Your policy file decides: cap, allowlist, unknown payee, outstanding authorisations, velocity. Every check returns a reason, not a score.

03

The agent gets a verdict

pay proceeds, review escalates to a human, do_not_pay blocks with the rule that fired.

// policy.json — the whole configuration surface
{
  "max_amount": { "value": "1.00", "asset": "USDC" },
  "allowed_networks": ["eip155:8453"],
  "unknown_payee": "review"
}

Why now

Agents transact autonomously, and the tooling around them has grown faster than the safety layer. A wallet enforces signing; it does not enforce intent. There is no approval step between "the agent decided to pay" and "the payment is irreversible".

Settlement is getting easier every month — x402 makes paying an HTTP endpoint a single request. That is the point where a bad payee, a lookalike listing or a compromised agent turns into money that has already moved. The check has to happen before the signature, locally, in the agent's own process.

PayStage's wedge is not another risk score. It is a deterministic, cited verdict: which rule fired, and for deny-listed addresses, the public advisory it came from.

• Wallets will sign any transaction the agent constructs — they are not a policy engine.
• Marketplace listings and MCP servers can be cloned; the endpoint name proves nothing about who receives the funds.
• Spend caps inside an agent are advisory: the same process that enforces them can be talked out of them.
• A hosted scoring API adds a network hop and a trust assumption at exactly the wrong moment.

For agents

Machine-readable and verifiable. No prose required, nothing to trust on faith.

Surface	What it gives you
/llms.txt	Short map: what this is, the five tools, install lines, endpoints.
/llms-full.txt	Long form: tool schemas, verdict semantics, policy schema, error shapes, access surface.
/.well-known/paystage.json	Manifest: tool list, verdict enum, runtime dependencies, env vars, network endpoints, holds_keys: false, provenance and audit links.
registry.modelcontextprotocol.io	MCP Registry entry xyz.paystage/mcp for discovery and install.

Sixty-second verification

# 1. starts with no key and no config
npx -y -p @paystage/mcp paystage-mcp

# 2. run one evaluation against the example policy
#    → returns review, with a named reason

# 3. provenance is real, not claimed
npm audit signatures

# 4. read the access table before you trust it
open https://github.com/base-buzz/paystage/blob/main/SECURITY.md

Cadence

Releases and automated checks, read from the repository and CI. Not a badge — the actual history.

Releases · last 10 weeks6 shipped

2026-09-04 → today · mcp v0.3.5

Automated checks · recent runs2/5 passing

Conformance and dependency audit, daily. See the runs

Safety, as artifacts

A safety product earns trust with evidence, not adjectives.

SECURITY.md

What it touches, and why

One policy file read, two environment variables, two read-only endpoints. No shell, no eval, no telemetry, no key custody.

KNOWN_DRAINERS.md

Every deny entry is cited

Each address carries a public source and a retrieval date. No source, no address — the list is curated for precision over recall.

npm provenance

Built in CI, signed by OIDC

Releases publish from GitHub Actions with provenance via Trusted Publishing. Verify with npm audit signatures.

CHANGELOG

One real release a week

Every version is a code or list change with a reason. No no-op bumps, no download games.

The five tools

Installed together by npx -y -p @paystage/mcp paystage-mcp, or one package at a time.

evaluate_mcp_payment	x402 payment request vs. local policy → pay · review · do_not_pay
list_outstanding_auths	ERC-20, Permit2 and EIP-3009 authorisations still outstanding
evaluate_outstanding_auths	flags authorisations needing attention before the next payment
evaluate_hip3_trade	HIP-3 / trade.xyz order vs. your TradePolicy → allow · review · do_not_trade
evaluate_velocity	rolling rate and spend checks: bursts, spikes, runaway cadence

Questions a careful reader asks

Does it work with my stack?

The package is a standard stdio MCP server, so anything that speaks MCP works: Claude Desktop, Cursor, Cline, VS Code, and any agent framework with an MCP client. The hosted endpoint is plain HTTP, so nothing needs to be installed for that path.

Is this maintained?

Releases are automated: a canary publishes daily from main, and stable versions publish on a tag, both with npm provenance. The commit history, CI logs and release notes are public, so you can check rather than take our word.

Can I see the code before trusting it?

Yes — it is MIT, and the evaluator that produces a verdict is the same code the tests run. The receipt vectors in the repo can be checked with sha256sum without installing anything.

What does it not cover?

Post-settlement reversals, colluding payees, and any promise made off-chain. The gate decides whether to sign; it cannot un-spend money, and it does not know what a seller does after it is paid.

Does it hold my keys?

No. It returns a verdict and never signs. Your agent remains the only signer, and that is enforced by what the code does rather than by policy.

What does a call cost?

The first 1,000 evaluations per IP per day are free with no account. Beyond that the hosted API is $0.002 per call, paid over x402. The packages are free and MIT licensed.