sF1nX/x402station

MCP adapter for **x402station.io**, the **independent risk-signal layer for x402 agentic commerce**. Exposes Preflight by x402station.io plus Forensics, Catalog Decoys, Alternatives, Credits, Watch, and Whats New. Any agent speaking the Model Context Protocol gets endpoint evidence before signing PAYMENT-SIGNATURE — **decoy, zombie, price-trap, never-paid, latency, signature/settlement checks** — before paying.
x402station.io independently probes every endpoint listed on agentic.market every 10 minutes and merges probe history with CDP settlement data. Policy engines decide and enforce; x402station.io measures and reports. We do not route, take custody, or endorse.
Install
Configure
The adapter charges real USDC per paid call through x402 itself. You need a wallet private key that holds Base mainnet USDC.
Claude Code
Add to ~/.claude/claude_desktop_config.json (or wherever your MCP servers live):
Cursor / Windsurf / Continue
Same shape — every MCP host understands command / args / env. See your tool's MCP docs.
Environment
| Variable | Required | Default | Purpose |
|---|---|---|---|
| AGENT_PRIVATE_KEY | **yes** for any paid tool call | — | 0x-prefixed 64-hex-char private key. Account must hold Base mainnet USDC. |
| X402STATION_BASE_URL | no | https://x402station.io | Override for dev / testing. |
Tools
preflight(url) — $0.001 USDC
Ask whether it's safe to pay this x402 URL. Returns:
ok is true only when no critical warning fires. Warnings include unknown_endpoint, no_history, dead, zombie, decoy_price_extreme, never_paid_zombie, proxy_markup, wildcard_402, spa_fallback, suspicious_high_price, slow, and new_provider.
forensics(url) — $0.001 USDC
Deep 7-day report. Superset of preflight. Returns hourly uptime, latency p50/p90/p99, status-code distribution, concentration-group stats, decoy probability. Extra warnings: dead_7d, mostly_dead, slow_p99, price_outlier_high, high_concentration.
catalog_decoys() — $0.005 USDC
Full blacklist. Returns every active endpoint currently flagged critical, plus per-reason counts. Pull periodically and cache locally — cheaper than preflighting every URL.
Typical agent flow
For bulk discovery, do catalog_decoys() once per day and treat the result as a set-difference against any URLs you're about to hit.
Composes with
x402station checks whether the **endpoint** is safe (decoy / zombie / price-trap / never-paid) before an agent pays. It pairs naturally with a **payload** safety check — screening the payment metadata for PII before signing: