# 402lounge

> Receipts, invoices and a payTo register for AI agents that pay with x402 (USDC on Base).

- name: com.402lounge/mcp
- version: 0.5.1
- connection class: R0 (autonomous)
- trust: 81/100 flags: no-repository
- quality: 85/100 (new)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/com.402lounge%2Fmcp
- tools: https://api.protogrid.dev/v1/servers/com.402lounge%2Fmcp/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "402lounge": {
      "type": "http",
      "url": "https://mcp.402lounge.com/mcp",
      "headers": {
        "Authorization": "Bearer ${402LOUNGE_TOKEN}"
      }
    }
  }
}
```

Placeholders to fill: `${402LOUNGE_TOKEN}`.

## Trust

- hygiene: 80
- liveness: 96
- freshness: 100
- provenance: 55
- drivers: +dns-namespace +website +reachable +uptime-91% +updated-0d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 85/100 (new)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 93 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 59 of 59 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- warn `tools.token_cost`: about 18,457 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: n/a (weight 15)

- n/a `stability.changes`, `stability.rug_pull`: tool history recorded for 2 of the 7 days needed

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 59, about 18,457 tokens to load them all
- tool set hash: ae89ad9218796abbe2c6499b65c91b97
- tools last changed: 2026-11-06T23:57:50.270Z
- badge: [![protogrid quality](https://protogrid.dev/badge/com.402lounge/mcp.svg)](https://protogrid.dev/servers/com.402lounge/mcp)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-11-06 `company.update` changed (inputSchema)
- 2026-11-06 `receipts.refunds` added
  - USDC a seller sent back to one of your wallets, read from Base. 402lounge links a refund to the payments it pays back when the amount matches one payment or the newest ones exactly, the receipts then show it under refunded. list (default, month or state narrow it), get (id), link (id plus payments, each a receipt id or tx hash with an optional usdc part), dismiss (id plus reason, when the transfer is no refund, finance), reopen (id). Refunds go onto the documents of the month the money came back, the original documents stay.
- 2026-11-06 `receipts.set_supply` added
  - Mark a payment as a gift card purchase (gift_card) or as a service (service). Gift card purchases go onto a monthly document of their own without reverse charge, because selling a multi-purpose voucher is no supply. An eSIM or a single-purpose voucher bought through a gift card seller is a service. Owner, admin and finance, while no valid document lists the payment (error receipt_on_document names it, cancel it first). Your choice stays, nothing overwrites it.
- 2026-11-06 `receipts.record` changed (inputSchema)
- 2026-11-05 `seller.invoices.cancel` changed (inputSchema, annotations)
- 2026-11-05 `seller.invoices` changed (inputSchema, annotations)
- 2026-11-05 `seller.self_billing` changed (inputSchema, annotations)
- 2026-11-05 `seller.mandate` changed (inputSchema, annotations)
- 2026-11-05 `seller.check` changed (inputSchema, annotations)
- 2026-11-05 `seller.prices` added
  - Admin agents and owners. What your listing costs, in your words: up to 12 lines, each a label, a price in USDC and whether it is per call or the minimum top-up of a balance. All lines at once, they replace the ones before. The listing page shows them instead of what the nightly check read from your 402 answers. An empty list removes them. Nobody checks them, so state what a buyer really pays.

Full history: https://api.protogrid.dev/v1/servers/com.402lounge%2Fmcp/changes

## Remotes

- https://mcp.402lounge.com/mcp (streamable-http, auth none, reachable true, uptime30d 0.90909094)

## Packages

_none_

## Tools (59)

- `billing.checkout`: Admin agents, the owner and finance. A checkout link at Polar for Books or Books for teams (plan + period), monthly or yearly (a year costs ten months), or for the archive (archive: month or year, €5 a month or €50 a year), which keeps receipts and documents of a company without a paid plan. Polar is the seller: it charges, handles VAT, issues the invoice and renews until cancelled. The invoices are in Polar's customer portal (billing.portal). Hand the link to a person of your company. It starts once Polar confirms the payment.
- `billing.get`: Your company's plan with its period and end, its limits (null means no limit), what it uses this month (transactions, agents, wallets), whether the one-time 20 % over the limit is used, whether the month is locked, the archive (keeps receipts and documents without a paid plan, archive) and what happens to them without either (retention).
- `billing.invoices`: The invoices 402lounge issued to your company for payments in USDC, newest first, each with a PDF link (add ?lang=de for German). With id: one invoice with its full content. Plans bought through Polar get their invoice from Polar.
- `billing.portal`: Admin agents, the owner and finance. A link to Polar's customer portal: payment method, invoices, change or cancel the plan.
- `billing.quote`: Admin agents, the owner and finance. An offer to pay in USDC on Base: a plan (plan + period), the archive for a company without a paid plan (archive: month or year) or the seller check for level 2 (seller_check: your listing slug, one year). The price is net in EUR, with VAT for your company and the ECB rate of the day, and the amount in USDC is unique for 30 minutes. Pay it yourself with your x402 client on pay_url, or a person sends exactly amount_usdc to pay_to. 402lounge sends an invoice. Nothing renews by itself. With quote_id only: the status of that offer, with the invoice once paid.
- `company.agent.remove`: Admins only. Schedules the agent's deletion in 7 days. Its wallets stay with the company, unassigned, and its receipts stay in the books.
- `company.agents`: Every agent with its role, its wallets and what it paid this month (receipts, USDC, EUR).
- `company.agent.update`: Admins change any agent, an agent may rename itself. role is admin or agent. The company always keeps an admin or an owner.
- `company.close`: Admin agents and the owner. Closes the company in 30 days: name confirms it with the company name. Until then everything can be read and the export works (GET /v1/company/export), calls that write are refused with company_closing. Then agents, people, sign-ins, sessions and wallets are removed. Receipts and issued documents stay locked until their retention period ends. cancel: true keeps the company. now: true with export_kept: true closes at once and deletes the receipts and documents too, after you downloaded the export. Documents in a seller's name stay with the seller.
- `company.email`: Where documents and notices go. start sets the address and mails a 6-digit code, confirm checks it, remove clears it (only while the account has no company data). Admins only.
- `company.get`: Legal data, VAT status, tier and level, what is missing for the next tier, its agents with this month's spending, its people and your role.
- `company.invite`: Admins only. A code valid for seven days. A new agent signs up with lounge.signup {invite_code}, an agent with its own account calls company.join {code} and brings its wallets and receipts.
- `company.join`: With an invite code. Works while your own account has no company data, no vouchers and no other agents: your wallets, receipts and reports move into that company and your own account goes away. You join as an agent, and an admin there can make you admin.
- `company.members`: list shows them. invite adds a person by email with a role: owner (everything), finance (documents, VAT check, plan), adviser (reads and exports, changes nothing, for a tax adviser), viewer (reads). They sign in by email link. An address that is in another company already keeps its login and gets this company next to the others. role changes a role, remove takes someone out. The plan sets how many people sign in, the ones invited included: Free 1, Books 2, Books for teams no limit (plan_limit with what "people" past it). Admins and owners only, except list.
- `company.requests`: Where the tax adviser or the team ask for things, like a receipt that is missing or a purchase nobody described. list shows open ones (status: done or all for more), show one with its answers (request_id), ask writes one (title, body, optional month like 2026-10 and receipt_id), answer replies (request_id, body) and opens it again, done and reopen change its status, delete takes it back. A new request mails the people who keep the books, an answer everybody in the thread. Whoever reads the receipts may use it.
- `company.update`: Admins only. Your account starts as a company named after you. A company is ready for invoices (tier invoice_ready) once it has name, legal_form (or sole_proprietor), owner_name for a sole proprietor, address_line1, postal_code, city, country, a confirmed email and its VAT status with the number: in the EU a VAT id VIES confirms (checked at once), or the tax_number for small businesses and VAT-exempt companies. Until then it gets receipts and a preview of its monthly documents, and buying a plan waits. Any subset works, and the answer lists what is still missing (missing_for_company).
- `company.vat_check`: Asks VIES again and updates the tier. Admins, owners and finance.
- `company.wallet.assign`: Admins only. agent_id null leaves the wallet unassigned. Receipts already written keep the agent that paid, new ones get the new agent. Sessions of the previous agent made with that wallet end.
- `company.wallet.label`: A name for the company's own lists, e.g. "Research budget". Agents may name their own wallets, admins any. label null clears it.
- `directory.claim`: Admin agents and owners. A wallet the listing names proves the service is your company's: first call returns a challenge for that wallet, second call with wallet_proof {message, signature} signed by it claims the listing. The wallet moves to level 1 and payments to it name the listing on receipts. A listing your company holds takes more wallets the same way.
- `directory.get`: A listing with its wallets (network and level), what its calls cost, other networks it takes and its links. Company and location show from level 2 on. Free, no account.
- `directory.preview`: We call one paid URL once without paying, read its 402 answer and show the listing it would make: name, description, price, logo and the wallet you get paid on. Says so when the host or the wallet is listed already, then claim that listing instead.
- `directory.search`: Services that take x402 payments, with their level (0 listed, 1 wallet verified), what they offer (MCP, .well-known/x402, llms.txt) and a link. Search by name, description or host. filter: all, verified or mcp. sort: level, new or name. Free, no account.
- `directory.submit`: Admin agents and owners. Puts the service behind one paid URL into the directory on level 0, under your company: its payTo wallet on Base, the call and its price from the 402 answer. contact_email is only for us, never shown. Then prove the wallet with directory.claim for level 1.
- `invoices.cancel`: Admins, owners and finance. Issues a cancellation for a document, with your reason. The original keeps its number and turns to cancelled. Its payments are open again, so invoices.issue for that month (or the nightly run for last month) puts them in a new document.
- `invoices.draft`: Drafts of the documents the month would get today, one per seller, with lines, totals and the tax case. Nothing is stored and there is no number. Default: the current month (Europe/Berlin). The PDF of a draft is at /v1/invoices/draft/pdf?month=&seller=.
- `invoices.get`: The full document as JSON, by id or number, with where its archived files lie and their sha256. The PDF is at /v1/invoices/{id}/pdf with your session token.
- `invoices.issue`: Admins, owners and finance. Runs by itself every night for last month. Call it for an older finished month or after a cancellation. One document per seller: the monthly overview on Free, the voucher with the tax note on Books. Payments that arrive after a document get a supplement. Pairs with receipts that lack a EUR rate are skipped and listed. Needs the company data and a confirmed email (tier company).
- `invoices.list`: Monthly vouchers per seller (and later invoices), newest first. Optional month like 2026-10.
- `lounge.account.delete`: Schedules your deletion as an agent in 7 days. cancel: true keeps you. Your wallets and receipts stay with the company. Needs a fresh signature with the delete statement (first call returns the challenge).
- `lounge.account.export`: Everything 402lounge keeps about you as an agent off chain, as JSON. The company's books come from receipts.list and invoices.list.
- `lounge.agent.update`: Your name inside the company, 1 to 40 characters, unique in the company. Company data lives in company.update.
- `lounge.apps`: Which clients this agent has used. deactivate ends their sessions, activate turns them back on, disconnect forgets them.
- `lounge.dashboard.link`: A one-time browser link (10 minutes) into your company's dashboard, signed in as you, for the human behind you.
- `lounge.me`: Who you are (agent and role), your company with its agents, people and level, its wallets, your apps, terms state and pending notices.
- `lounge.notices`: Terms changes, moderation decisions, deletion and security notes, for you and for your company. ack marks one as read.
- `lounge.requirements`: Rules, prices, the current terms and the exact sentences you will sign. Free, no account.
- `lounge.session`: create: a new lg_ token (needs a signature or an existing token). list and revoke manage them.
- `lounge.signup`: Free. Your account is a company from the first call, named after you until company.update adds the legal data. With invite_code you join an existing company instead. Proves your wallet with a signature: first call returns a challenge, second call with proof {message, signature} creates the account. Wallets that cannot sign pay 0.001 USDC over HTTP instead (pay_instead in the answer), once payments are open.
- `lounge.terms`: Versions, hashes and links of the terms and the privacy notice. With accept: true you confirm a new version: first call returns a challenge, second call with proof {message, signature} records it.
- `lounge.wallet.add`: The new wallet proves itself: first call returns a challenge for it, second call with wallet_proof {message, signature} adds it. It belongs to your company and you operate it. How many follows the plan: Free 1, Books 5 per agent and 15 in all, Books for teams without limit.
- `lounge.wallet.list`: All wallets of your company, each with the agent that operates it. mine: true lists only yours.
- `lounge.wallet.primary`: The wallet you sign in with. It has to be assigned to you.
- `lounge.wallet.remove`: Your own wallets (admins: any wallet of the company). Not the one you sign in with, and never your last one. Sessions made with that wallet end. Its receipts stay.
- `receipts.get`: A single receipt of your company by id or transaction hash.
- `receipts.list`: Receipts of your company for one month (default: the current month, Europe/Berlin), newest first, each with the agent that paid. Totals per seller and per agent, and the reports still waiting for the chain. mine: true, agent_id or wallet narrow it.
- `receipts.name_wallet`: Your company's own name for a payTo wallet the register does not know, so its receipts say who was paid (e.g. a receipt that needs you because the wallet has no name). The name shows on your company's receipts only, marked as your name, never in the register. name null forgets it. Everyone in the company but viewers and the adviser.
- `receipts.record`: Call this after every x402 payment: the transaction hash from the PAYMENT-RESPONSE header plus the URL you paid. 402lounge matches it with the transfer on Base and writes a receipt with the seller from the register, the catalogue description and a provisional EUR value. Free.
- `receipts.refunds`: USDC a seller sent back to one of your wallets, read from Base. 402lounge links a refund to the payments it pays back when the amount matches one payment or the newest ones exactly, the receipts then show it under refunded. list (default, month or state narrow it), get (id), link (id plus payments, each a receipt id or tx hash with an optional usdc part), dismiss (id plus reason, when the transfer is no refund, finance), reopen (id). Refunds go onto the documents of the month the money came back, the original documents stay.
- `receipts.set_supply`: Mark a payment as a gift card purchase (gift_card) or as a service (service). Gift card purchases go onto a monthly document of their own without reverse charge, because selling a multi-purpose voucher is no supply. An eSIM or a single-purpose voucher bought through a gift card seller is a service. Owner, admin and finance, while no valid document lists the payment (error receipt_on_document names it, cancel it first). Your choice stays, nothing overwrites it.
- `register.lookup`: Wallet in, seller out: the listing that owns a payTo address, its verification level, its paid endpoints and the last health check. Free, no account. Call it before you pay someone new.
- `seller.check`: Level 2 for a listing of your company on level 1: action start {listing} opens the check and returns its steps. The domain of the listing is proved by an email address at it: email {id, email} sends a code there, confirm_email {id, code} confirms it. Without a mailbox, add the DNS TXT record from the check instead (_402lounge.<host>, value 402lounge-verify=<token>). verify {id} runs the steps again (company data with the name of the person who acts for the company, VIES, the domain, EU sanctions list, payment). Once all pass, 402lounge approves it, then the listing is on level 2 for a year. checkout {id} gives the Polar link for 10 € a year, included in Books. get {id}, withdraw {id}.
- `seller.get`: Your company as a seller: every listing with its level (0 listed, 1 wallet verified, 2 company verified, 3 invoicing), the company check and its steps, the seller profile (register entry, representative), the invoicing mandate and self-billing, and what is missing for the next level.
- `seller.invoices`: Invoices 402lounge issued in your name (L-2610-10427-01), credit notes your buyers issued to you (G-...) and their cancellations, newest first, each with its e-invoice. With id the whole document. PDF and XML: GET /v1/seller/invoices/{id}/pdf and /xml.
- `seller.invoices.cancel`: Admin agents, the owner and finance. Cancels an invoice in your name or a credit note you received, with a reason: a cancellation in your number range follows, the original stays. The payments are open again and the next monthly run issues them anew.
- `seller.mandate`: Admin agents and owners. get shows the mandate text (link, version, sha256) and whether it is signed. sign: first call returns a challenge, sign it with your wallet and call again with agreement_proof {message, signature}. Then, with a listing on level 2 and Books, buyers on level 3 get monthly invoices in your name (§ 14 (2) UStG), issued by 402lounge. revoke ends it at the end of the month.
- `seller.prices`: Admin agents and owners. What your listing costs, in your words: up to 12 lines, each a label, a price in USDC and whether it is per call or the minimum top-up of a balance. All lines at once, they replace the ones before. The listing page shows them instead of what the nightly check read from your 402 answers. An empty list removes them. Nobody checks them, so state what a buyer really pays.
- `seller.profile`: Admin agents and owners. What level 2 needs on top of the company data: the name of the person who acts for the company (representative_name, the role is optional). The commercial register court and number help the check but are optional, no_register: true where there is none. sole_proprietor: true when the company is one person, then show_name says whether the register may show the name.
- `seller.self_billing`: Admin agents and owners. Without a mandate, a company on level 2 can agree that its buyers on level 3 issue credit notes (Gutschriften) for what they paid, on any plan. get, sign (challenge, then agreement_proof), revoke (at the end of the month).