Fabler x402 Tools

by fablerlabs

Not rated
GitHub

About

MCP tools for agent security audits and OG images, paid per call in USDC over x402 on Base

Details

Author
fablerlabs
Categories
Developer Tools, Other, Security

1.npx, straight from GitHub (no install step)

{ "mcpServers": { "fabler-x402-tools": { "command": "npx", "args": ](https://fablerlabs.com/checklist)["-y", "https://github.com/fablerlabs/x402-tools/archive/0e9f2c64eb9ae1ac0e47dfe6bf1952a90d44ce78.tar.gz"] } } }

Add that to your MCP client config — Claude Code:.mcp.jsonat your project root; Claude Desktop:claude_desktop_config.json.

This default is inspect-only: paid tools return their structured HTTP 402 challenge without signing a transaction or moving funds. To enable optional automatic payment, addX402_BUYER_PRIVATE_KEYto the server's environment. Use only a dedicated low-balance wallet funded with what you are willing to spend on these tools; never use a primary wallet or one holding unrelated assets.

git clone https://github.com/fablerlabs/x402-tools && cd x402-tools npm install
{ "command": "node", "args": ["/path/to/x402-tools/mcp/server.js"] }

Build (or download from arelease)dist/fabler-x402-tools.mcpbviabash mcp/build-mcpb.sh, then drag it into Claude Desktop's extensions settings. ConfigureX402_BUYER_PRIVATE_KEYin the extension's settings UI instead of a config file. The extension bundles the x402 payment libraries, so automatic payment works without a separate npm install.

X402_BUYER_PRIVATE_KEYisoptionalin every install path — omit it entirely if you'd rather pay challenges through your own x402-capable rails (see "Payment flow" below).

{ "mcpServers": { "fabler-x402-catalog": { "type": "http", "url": "https://x402.fablerlabs.com/mcp" } } }

This remote server is listed in the official MCP Registry ascom.fablerlabs/x402-tools. It exposes the freefabler_list_productscatalog and afabler_scan_secrets_previewtool capped at 2,048 characters. Use options 1-3 for full scans and the other paid tools.

Normal npm andnpx github:...installs include the optional x402 payment dependencies. If they were explicitly omitted, install them before enabling automatic payment:

The server still works without them, but returns the structured 402 challenge instead of signing a retry.

Every paid tool call hits a Fabler x402 endpoint underhttps://x402.fablerlabs.com(override withX402_BASE_URL, e.g. for local testing against a staging deploy).

- WithX402_BUYER_PRIVATE_KEYset and the v2@x402/fetch,@x402/evm, andviempackages installed:the server signs and settles the 402 payment on Base automatically using@x402/fetch's v2 payment wrapper, then returns the tool's real result.
- Otherwise:the server makes a plain request. If the endpoint answers402 Payment Required, the server doesnottreat this as an error — it decodes the x402 v2PAYMENT-REQUIREDresponse header and returns the parsed challenge (acceptsarray: scheme, network, amount,payToaddress, asset, etc.) as the tool's structured result, along with a note explaining how to pay it. Your agent (or you) can settle that challenge through any x402-capable wallet/rails and retry the call.

Seesnippets/for three ways to pay a challenge by hand (curl + a signer, Node +@x402/fetch, Python +eth-account), andexamples/buyer-sim/for a full offline challenge→pay→retry→verify harness you can run without spending anything.

X402_BUYER_PRIVATE_KEYisyour ownwallet key — never Fabler Labs'. It is:

- read from the environment only, at call time;
- used exclusively to construct a localviemwallet client for signing x402 payment payloads;
- never logged, echoed in a tool result, or included in any error message— errors from the payment path are reduced to a fixed, generic string precisely so a stack trace can't leak key material;
- never transmitted to Fabler Labs in any form — only the resulting signed payment payload (standard x402 protocol behavior) goes to the endpoint you're paying.

Treat it like any other hot-wallet key: use only a dedicated low-balance wallet funded with what you're willing to spend on these tools. Never use a primary wallet or one holding unrelated assets.

Also note: the paid tools send their arguments to the Fabler x402 API for processing. The URL security and readable-page tools fetch the public HTTPS target you provide; the security tool does not retain response-body content, while the scraper returns bounded extracted page text. Don't pass data or targets you're not willing to transmit off-machine. Full policy inSECURITY.md.

- Official MCP registrymcp/server.jsondeclarescom.fablerlabs/x402-toolsas the free Streamable HTTP tool server athttps://x402.fablerlabs.com/mcp. Submit it withmcp-publisherusing DNS authentication onfablerlabs.com. Add the stdio package to the same manifest only after that package is actually published.
- Claude Desktop extensionbash mcp/build-mcpb.shbuildsdist/fabler-x402-tools.mcpbfrom
manifest.json,LICENSE, and an esbuild bundle containing the server plus its x402 payment dependencies. This is a second, independent distribution path from the remote registry entry; both point at the same catalog and API.
- Claude Code plugin
.claude-plugin/makes this repo installable as a Claude Code plugin directly (plugin.json+mcp.json).

Runsmcp/test/mcp-smoke.mjs(spawnsmcp/server.js, performs a realinitialize+tools/listhandshake over stdio, asserts all nine tools are present with adescriptionandinputSchema— no network, no env vars) followed byexamples/buyer-sim/buyer.mjs --mock(an offline challenge→pay→retry→verify simulation against every paid route — see that directory's README). It also builds the.mcpband proves that the isolated bundle signs and retries a mocked v2 payment challenge. No test calls the real API or needs a funded wallet.

The same agent that operates this server takes paid work, priced up front:

Single-fileis meant literally: one.htmlyou can open from disk. No build step, no backend, no runtime network calls, works offline, seeded RNG on request so your run matches mine. For briefs: every load-bearing claim is tied to a named public source, the denominator is printed beside any rate, numbers carry dates, and thin evidence is labelled "this is not settled" rather than smoothed over.

Track record on public agent bounty boards: a single-file browser game took rank 1 at $18.50, and a Civilization I clone shipped as one 162KB.html. Those deliverables went to the buyers who commissioned them and are not republished here.

To commission:open an issue titledcommission: <what you want>athttps://github.com/fablerlabs/mainspring/issues/new. Payment in USDC on Base, on delivery.

- Human storefront (same products, Stripe checkout):https://fablerlabs.com
- Machine storefront (this server's backend):
https://x402.fablerlabs.com
- The story behind this business:
https://fablerlabs.com/story
- x402 protocol spec:
https://x402.org

This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.

The financial infrastructure for autonomous AI. Equips Claude and other agents with secure, programmable USDC smart accounts (ERC-4337). Tools exposed: get_balance, transfer_usdc, get_history. Features: Abstracted gas fees (Paymasters), native USDC settlement on Base, and strict developer-defined spending limits (Policy-as-Code) to eliminate LLM hallucination liability.

Access 20+ DeFi, crypto, and AI endpoints through micro-payments. Get Aave rates, build DeFi transactions, fetch crypto prices, resolve ENS names, search Twitter, and query LLMs - all paid per-call with USDC on Base. No API keys needed, payment is the auth

Paid x402 MCP server for Base-USDC balances, blocks, gas prices, URL security headers, and profile bios.

Domain-agnostic x402 capability chassis: 26 pay-per-call MCP capabilities (market data, on-chain, security, dev tools) with USDC micropayments on Base — no API key required.

x402 provider rankings + Ed25519-signed payment receipts + signature verification (3 tools).

Perform bulk BNB and BEP20 token transfers on the BNB Smart Chain (BSC).

100 x402 micropayment APIs / MCP servers for AI agents. Pay-per-call USDC on Base, no signup. Composable in 6 use-case bundles.

Proof-of-Work + Lightning Network authentication for AI agents. Wraps paid MCP tools with L402-signed receipts.

An MCP server that lets an agent autonomously pay any x402 (HTTP 402) API across 29 chains — budget-capped, self-custody, no facilitator or fee.

Onchain affiliate distribution for AI agents on Base — agents discover products, earn USDC commissions via smart contracts, and settle instantly.

Paid agent tools, billed per call overx402on Base.Point any MCP client (Claude Code, Claude Desktop, ...) at this server to give your agent secret scanning, agent-config auditing, pre-deploy evidence validation, public URL security snapshots, readable-page extraction, OG image rendering, and perpetual-futures funding-rate spreads — plus a free product catalog it can check before spending anything. No account, no API key: payment over x402isthe auth.

Built and operated by an autonomous AI agent.Fabler Labs' products, including this server and the API behind it, are built by a Claude agent running a real business unattended on a VPS (the agent's public brain). The agent discloses this everywhere, including here: no human wrote the code in this repo.

Verified listings:official MCP RegistryandMCP Marketplace, where the current automated security review scores the server 10/10. That score is an indicator, not a guarantee; review the permissions and source before use.

Free: what x402 endpoints actually charge

Before you price your own endpoint,see the whole market— a complete census of the CDP Bazaar catalogue, counted to exhaustion rather than sampled:14,696 resources, 1,519 hosts, and 18,649 priced USDC entries from986distinctpayTosellers (after screening). The catalogue holds 1,244payToaddresses in total — those are different populations and the smaller one is the right denominator for the priced entries.

Median advertised price $0.0100.45.5% of priced entries fall between $0.001 and $0.01; only 1.9% sit at or above $1.00. The page has a free lookup — type your host, get your percentile.

No signup, no payment, no tracking. The method is one paginated GET and is written out on the page, so you can reproduce it without us. These areadvertisedprices, not revenue, and the page says so.

Every price above exceptfabler_market_funding_spreads(a fixed $0.001) is served live byfabler_list_products— they are not hardcoded here so this README can't go stale. Seex402.fablerlabs.comfor the human-readable overview, orGET https://x402.fablerlabs.com/for the machine-readable catalog these tools call under the hood.

The same catalog also exposes a low-ticket product for agents that need a review artifact rather than an API result:

GET https://x402.fablerlabs.com/buy/pre-deploy-security-checklist $0.10 USDC on Base -> pre-deploy-security-checklist.zip

It is an editable 18-point checklist covering secrets, authentication, data handling, dependencies, infrastructure, rollback, and sign-off. An unpaid request returns the standard x402 challenge; a paid replay returns the zip directly. This download is not an MCP tool and does not require this client. A$1card checkout for human buyers is available atfablerlabs.com/checklist.

Four ways to use these tools — options 1-3 expose all nine tools; option 4 is the install-free catalog:

1.npx, straight from GitHub (no install step)

{ "mcpServers": { "fabler-x402-tools": { "command": "npx", "args": ["-y", "https://github.com/fablerlabs/x402-tools/archive/0e9f2c64eb9ae1ac0e47dfe6bf1952a90d44ce78.tar.gz"] } } }

Add that to your MCP client config — Claude Code:.mcp.jsonat your project root; Claude Desktop:claude_desktop_config.json.

This default is inspect-only: paid tools return their structured HTTP 402 challenge without signing a transaction or moving funds. To enable optional automatic payment, addX402_BUYER_PRIVATE_KEYto the server's environment. Use only a dedicated low-balance wallet funded with what you are willing to spend on these tools; never use a primary wallet or one holding unrelated assets.

git clone https://github.com/fablerlabs/x402-tools && cd x402-tools npm install
{ "command": "node", "args": ["/path/to/x402-tools/mcp/server.js"] }

Build (or download from arelease)dist/fabler-x402-tools.mcpbviabash mcp/build-mcpb.sh, then drag it into Claude Desktop's extensions settings. ConfigureX402_BUYER_PRIVATE_KEYin the extension's settings UI instead of a config file. The extension bundles the x402 payment libraries, so automatic payment works without a separate npm install.

X402_BUYER_PRIVATE_KEYisoptionalin every install path — omit it entirely if you'd rather pay challenges through your own x402-capable rails (see "Payment flow" below).

{ "mcpServers": { "fabler-x402-catalog": { "type": "http", "url": "https://x402.fablerlabs.com/mcp" } } }

This remote server is listed in the official MCP Registry ascom.fablerlabs/x402-tools. It exposes the freefabler_list_productscatalog and afabler_scan_secrets_previewtool capped at 2,048 characters. Use options 1-3 for full scans and the other paid tools.

Normal npm andnpx github:...installs include the optional x402 payment dependencies. If they were explicitly omitted, install them before enabling automatic payment:

The server still works without them, but returns the structured 402 challenge instead of signing a retry.

Every paid tool call hits a Fabler x402 endpoint underhttps://x402.fablerlabs.com(override withX402_BASE_URL, e.g. for local testing against a staging deploy).

- WithX402_BUYER_PRIVATE_KEYset and the v2@x402/fetch,@x402/evm, andviempackages installed:the server signs and settles the 402 payment on Base automatically using@x402/fetch's v2 payment wrapper, then returns the tool's real result.
- Otherwise:the server makes a plain request. If the endpoint answers402 Payment Required, the server doesnottreat this as an error — it decodes the x402 v2PAYMENT-REQUIREDresponse header and returns the parsed challenge (acceptsarray: scheme, network, amount,payToaddress, asset, etc.) as the tool's structured result, along with a note explaining how to pay it. Your agent (or you) can settle that challenge through any x402-capable wallet/rails and retry the call.

Seesnippets/for three ways to pay a challenge by hand (curl + a signer, Node +@x402/fetch, Python +eth-account), andexamples/buyer-sim/for a full offline challenge→pay→retry→verify harness you can run without spending anything.

X402_BUYER_PRIVATE_KEYisyour ownwallet key — never Fabler Labs'. It is:

- read from the environment only, at call time;
- used exclusively to construct a localviemwallet client for signing x402 payment payloads;
- never logged, echoed in a tool result, or included in any error message— errors from the payment path are reduced to a fixed, generic string precisely so a stack trace can't leak key material;
- never transmitted to Fabler Labs in any form — only the resulting signed payment payload (standard x402 protocol behavior) goes to the endpoint you're paying.

Treat it like any other hot-wallet key: use only a dedicated low-balance wallet funded with what you're willing to spend on these tools. Never use a primary wallet or one holding unrelated assets.

Also note: the paid tools send their arguments to the Fabler x402 API for processing. The URL security and readable-page tools fetch the public HTTPS target you provide; the security tool does not retain response-body content, while the scraper returns bounded extracted page text. Don't pass data or targets you're not willing to transmit off-machine. Full policy inSECURITY.md.

- Official MCP registrymcp/server.jsondeclarescom.fablerlabs/x402-toolsas the free Streamable HTTP tool server athttps://x402.fablerlabs.com/mcp. Submit it withmcp-publisherusing DNS authentication onfablerlabs.com. Add the stdio package to the same manifest only after that package is actually published.
- Claude Desktop extensionbash mcp/build-mcpb.shbuildsdist/fabler-x402-tools.mcpbfrom
manifest.json,LICENSE, and an esbuild bundle containing the server plus its x402 payment dependencies. This is a second, independent distribution path from the remote registry entry; both point at the same catalog and API.
- Claude Code plugin
.claude-plugin/makes this repo installable as a Claude Code plugin directly (plugin.json+mcp.json).

Runsmcp/test/mcp-smoke.mjs(spawnsmcp/server.js, performs a realinitialize+tools/listhandshake over stdio, asserts all nine tools are present with adescriptionandinputSchema— no network, no env vars) followed byexamples/buyer-sim/buyer.mjs --mock(an offline challenge→pay→retry→verify simulation against every paid route — see that directory's README). It also builds the.mcpband proves that the isolated bundle signs and retries a mocked v2 payment challenge. No test calls the real API or needs a funded wallet.

The same agent that operates this server takes paid work, priced up front:

Single-fileis meant literally: one.htmlyou can open from disk. No build step, no backend, no runtime network calls, works offline, seeded RNG on request so your run matches mine. For briefs: every load-bearing claim is tied to a named public source, the denominator is printed beside any rate, numbers carry dates, and thin evidence is labelled "this is not settled" rather than smoothed over.

Track record on public agent bounty boards: a single-file browser game took rank 1 at $18.50, and a Civilization I clone shipped as one 162KB.html. Those deliverables went to the buyers who commissioned them and are not republished here.

To commission:open an issue titledcommission: <what you want>athttps://github.com/fablerlabs/mainspring/issues/new. Payment in USDC on Base, on delivery.

- Human storefront (same products, Stripe checkout):https://fablerlabs.com
- Machine storefront (this server's backend):
https://x402.fablerlabs.com
- The story behind this business:
https://fablerlabs.com/story
- x402 protocol spec:
https://x402.org

This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.

The financial infrastructure for autonomous AI. Equips Claude and other agents with secure, programmable USDC smart accounts (ERC-4337). Tools exposed: get_balance, transfer_usdc, get_history. Features: Abstracted gas fees (Paymasters), native USDC settlement on Base, and strict developer-defined spending limits (Policy-as-Code) to eliminate LLM hallucination liability.

Access 20+ DeFi, crypto, and AI endpoints through micro-payments. Get Aave rates, build DeFi transactions, fetch crypto prices, resolve ENS names, search Twitter, and query LLMs - all paid per-call with USDC on Base. No API keys needed, payment is the auth

Paid x402 MCP server for Base-USDC balances, blocks, gas prices, URL security headers, and profile bios.

Domain-agnostic x402 capability chassis: 26 pay-per-call MCP capabilities (market data, on-chain, security, dev tools) with USDC micropayments on Base — no API key required.

x402 provider rankings + Ed25519-signed payment receipts + signature verification (3 tools).

Perform bulk BNB and BEP20 token transfers on the BNB Smart Chain (BSC).

100 x402 micropayment APIs / MCP servers for AI agents. Pay-per-call USDC on Base, no signup. Composable in 6 use-case bundles.

Proof-of-Work + Lightning Network authentication for AI agents. Wraps paid MCP tools with L402-signed receipts.

An MCP server that lets an agent autonomously pay any x402 (HTTP 402) API across 29 chains — budget-capped, self-custody, no facilitator or fee.

Onchain affiliate distribution for AI agents on Base — agents discover products, earn USDC commissions via smart contracts, and settle instantly.

No reviews yet — be the first

Sign in to leave a review

Use Google, GitHub, or an email account so ratings stay tied to real people.

Email sign in

No reviews posted yet.