# PayStage

> Umbrella MCP: payment preflight, auth watch, HIP-3 trade preflight, velocity checks

- name: io.github.base-buzz/mcp
- version: 0.3.5
- connection class: R0 (autonomous)
- trust: 93/100 flags: duplicate-repo
- quality: 88/100 (new)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.base-buzz%2Fmcp
- tools: https://api.protogrid.dev/v1/servers/io.github.base-buzz%2Fmcp/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "base-buzz": {
      "type": "http",
      "url": "https://api.paystage.xyz/mcp"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 100
- freshness: 100
- provenance: 90
- drivers: +repository +namespace-matches-repo +website +reachable +uptime-100% +updated-2d-ago -duplicate-repo(6 names)
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 88/100 (new)

### protocol: 88 (weight 25)

- pass `protocol.modern`: supports 2026-07-28 (server/discover)
- pass `protocol.stateless`: answers without a session
- pass `protocol.transport`: streamable HTTP
- warn `protocol.list_ttl`: tools/list declares ttlMs 0, so clients re-fetch it on every use

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 88 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 9 of 9 tools declare readOnlyHint or destructiveHint
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: evaluate_mcp_payment (idempotentHint); list_outstanding_auths (idempotentHint); evaluate_outstanding_auths (idempotentHint); …
- pass `tools.token_cost`: about 1,449 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump
- pass `tools.hidden_text`: no hidden text in tool names, descriptions, schemas or annotations

### stability: n/a (weight 15)

- n/a `stability.changes`, `stability.rug_pull`, `stability.new_links`: tool history recorded for 1 of the 7 days needed

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: deps.dev does not know @paystage/mcp@0.3.5

- tools: 9, about 1,449 tokens to load them all
- tool set hash: e295ddfa37b4ea7ef19990e3a02eaa08
- tools last changed: 2026-11-14T07:31:22.097Z
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.base-buzz/mcp.svg)](https://protogrid.dev/servers/io.github.base-buzz/mcp)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-11-14 `evaluate_batch` added
  - Evaluate several payment challenges against one policy in a single call. Returns one verdict per input, in order, so an agent settling a batch decides once per payment and can stop at the first refusal.
- 2026-11-14 `validate_policy` added
  - Check a policy document without evaluating a payment. Returns the exact validation error when it is wrong, which is the question behind most support requests.
- 2026-11-14 `decode_payment_required` added
  - Decode a base64 `payment-required` header from a 402 response into the JSON challenge, so an agent can inspect it before deciding anything.
- 2026-11-14 `verify_receipt` added
  - Verify a PayStage receipt against the published signing key. Returns the verdict it attests to, or why it cannot be trusted.
- 2026-11-14 `evaluate_velocity` added
  - Rolling-window rate and spend-pattern check for a proposed payment against recent action history and a policy.velocity config
- 2026-11-14 `evaluate_hip3_trade` added **new site: trade.xyz**
  - Evaluate a Hyperliquid HIP-3 (trade.xyz) order against a TradePolicy before an agent trades. Returns decision allow | review | do_not_trade.
- 2026-11-14 `evaluate_outstanding_auths` added
  - List and evaluate outstanding token authorizations against a policy
- 2026-11-14 `list_outstanding_auths` added
  - List outstanding token authorizations for a wallet
- 2026-11-14 `evaluate_mcp_payment` changed (description, inputSchema, annotations) **meaning changed**
  - before: Decide whether an x402 payment should be signed, against a policy. Returns pay, review or do_not_pay with the rule that fired.
  - after: Evaluate an x402 PaymentRequired payload against a PayStage spending policy before paying

Full history: https://api.protogrid.dev/v1/servers/io.github.base-buzz%2Fmcp/changes

## Dependencies

- npm @paystage/mcp@0.3.5: unknown

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

- https://api.paystage.xyz/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

- npm @paystage/mcp@0.3.5

## Tools (9)

- `decode_payment_required`: Decode a base64 `payment-required` header from a 402 response into the JSON challenge, so an agent can inspect it before deciding anything.
- `evaluate_batch`: Evaluate several payment challenges against one policy in a single call. Returns one verdict per input, in order, so an agent settling a batch decides once per payment and can stop at the first refusal.
- `evaluate_hip3_trade`: Evaluate a Hyperliquid HIP-3 (trade.xyz) order against a TradePolicy before an agent trades. Returns decision allow | review | do_not_trade.
- `evaluate_mcp_payment`: Evaluate an x402 PaymentRequired payload against a PayStage spending policy before paying
- `evaluate_outstanding_auths`: List and evaluate outstanding token authorizations against a policy
- `evaluate_velocity`: Rolling-window rate and spend-pattern check for a proposed payment against recent action history and a policy.velocity config
- `list_outstanding_auths`: List outstanding token authorizations for a wallet
- `validate_policy`: Check a policy document without evaluating a payment. Returns the exact validation error when it is wrong, which is the question behind most support requests.
- `verify_receipt`: Verify a PayStage receipt against the published signing key. Returns the verdict it attests to, or why it cannot be trusted.