Search / io.github.quackai-org/q402-mcp
protogridL0· runs locallyQ402 - gasless payments, yield, escrow, bridge & NAV triggers on 12 EVM chains. Sandbox-default.
v0.11.23 · active · repository · descriptor JSON · versions
{
"mcpServers": {
"q402-mcp": {
"command": "npx",
"args": [
"-y",
"@quackai/[email protected]"
],
"env": {
"Q402_TRIAL_API_KEY": "${Q402_TRIAL_API_KEY}",
"Q402_MULTICHAIN_API_KEY": "${Q402_MULTICHAIN_API_KEY}",
"Q402_PRIVATE_KEY": "${Q402_PRIVATE_KEY}",
"Q402_AGENTIC_PRIVATE_KEY": "${Q402_AGENTIC_PRIVATE_KEY}",
"Q402_ENABLE_REAL_PAYMENTS": "1",
"Q402_MAX_AMOUNT_PER_CALL": "200",
"Q402_RELAY_BASE_URL": "https://q402.quackai.ai/api",
"Q402_API_KEY": "${Q402_API_KEY}"
}
}
}
}claude mcp add q402-mcp -e "Q402_TRIAL_API_KEY=${Q402_TRIAL_API_KEY}" -e "Q402_MULTICHAIN_API_KEY=${Q402_MULTICHAIN_API_KEY}" -e "Q402_PRIVATE_KEY=${Q402_PRIVATE_KEY}" -e "Q402_AGENTIC_PRIVATE_KEY=${Q402_AGENTIC_PRIVATE_KEY}" -e "Q402_ENABLE_REAL_PAYMENTS=1" -e "Q402_MAX_AMOUNT_PER_CALL=200" -e "Q402_RELAY_BASE_URL=https://q402.quackai.ai/api" -e "Q402_API_KEY=${Q402_API_KEY}" -- npx -y @quackai/[email protected][mcp_servers.q402-mcp]
command = "npx"
args = ["-y", "@quackai/[email protected]"]
env = { "Q402_TRIAL_API_KEY" = "${Q402_TRIAL_API_KEY}", "Q402_MULTICHAIN_API_KEY" = "${Q402_MULTICHAIN_API_KEY}", "Q402_PRIVATE_KEY" = "${Q402_PRIVATE_KEY}", "Q402_AGENTIC_PRIVATE_KEY" = "${Q402_AGENTIC_PRIVATE_KEY}", "Q402_ENABLE_REAL_PAYMENTS" = "1", "Q402_MAX_AMOUNT_PER_CALL" = "200", "Q402_RELAY_BASE_URL" = "https://q402.quackai.ai/api", "Q402_API_KEY" = "${Q402_API_KEY}" }
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"q402-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"@quackai/[email protected]"
],
"enabled": true,
"environment": {
"Q402_TRIAL_API_KEY": "{env:Q402_TRIAL_API_KEY}",
"Q402_MULTICHAIN_API_KEY": "{env:Q402_MULTICHAIN_API_KEY}",
"Q402_PRIVATE_KEY": "{env:Q402_PRIVATE_KEY}",
"Q402_AGENTIC_PRIVATE_KEY": "{env:Q402_AGENTIC_PRIVATE_KEY}",
"Q402_ENABLE_REAL_PAYMENTS": "1",
"Q402_MAX_AMOUNT_PER_CALL": "200",
"Q402_RELAY_BASE_URL": "https://q402.quackai.ai/api",
"Q402_API_KEY": "{env:Q402_API_KEY}"
}
}
}
}{
"mcpServers": {
"q402-mcp": {
"command": "npx",
"args": [
"-y",
"@quackai/[email protected]"
],
"env": {
"Q402_TRIAL_API_KEY": "${Q402_TRIAL_API_KEY}",
"Q402_MULTICHAIN_API_KEY": "${Q402_MULTICHAIN_API_KEY}",
"Q402_PRIVATE_KEY": "${Q402_PRIVATE_KEY}",
"Q402_AGENTIC_PRIVATE_KEY": "${Q402_AGENTIC_PRIVATE_KEY}",
"Q402_ENABLE_REAL_PAYMENTS": "1",
"Q402_MAX_AMOUNT_PER_CALL": "200",
"Q402_RELAY_BASE_URL": "https://q402.quackai.ai/api",
"Q402_API_KEY": "${Q402_API_KEY}"
}
}
},
"deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=q402-mcp&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIkBxdWFja2FpL3E0MDItbWNwQDAuMTEuMjMiXSwiZW52Ijp7IlE0MDJfVFJJQUxfQVBJX0tFWSI6IiR7UTQwMl9UUklBTF9BUElfS0VZfSIsIlE0MDJfTVVMVElDSEFJTl9BUElfS0VZIjoiJHtRNDAyX01VTFRJQ0hBSU5fQVBJX0tFWX0iLCJRNDAyX1BSSVZBVEVfS0VZIjoiJHtRNDAyX1BSSVZBVEVfS0VZfSIsIlE0MDJfQUdFTlRJQ19QUklWQVRFX0tFWSI6IiR7UTQwMl9BR0VOVElDX1BSSVZBVEVfS0VZfSIsIlE0MDJfRU5BQkxFX1JFQUxfUEFZTUVOVFMiOiIxIiwiUTQwMl9NQVhfQU1PVU5UX1BFUl9DQUxMIjoiMjAwIiwiUTQwMl9SRUxBWV9CQVNFX1VSTCI6Imh0dHBzOi8vcTQwMi5xdWFja2FpLmFpL2FwaSIsIlE0MDJfQVBJX0tFWSI6IiR7UTQwMl9BUElfS0VZfSJ9fQ%3D%3D"
}{
"servers": {
"q402-mcp": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@quackai/[email protected]"
],
"env": {
"Q402_TRIAL_API_KEY": "${Q402_TRIAL_API_KEY}",
"Q402_MULTICHAIN_API_KEY": "${Q402_MULTICHAIN_API_KEY}",
"Q402_PRIVATE_KEY": "${Q402_PRIVATE_KEY}",
"Q402_AGENTIC_PRIVATE_KEY": "${Q402_AGENTIC_PRIVATE_KEY}",
"Q402_ENABLE_REAL_PAYMENTS": "1",
"Q402_MAX_AMOUNT_PER_CALL": "200",
"Q402_RELAY_BASE_URL": "https://q402.quackai.ai/api",
"Q402_API_KEY": "${Q402_API_KEY}"
}
}
}
}{
"mcpServers": {
"q402-mcp": {
"command": "npx",
"args": [
"-y",
"@quackai/[email protected]"
],
"env": {
"Q402_TRIAL_API_KEY": "${Q402_TRIAL_API_KEY}",
"Q402_MULTICHAIN_API_KEY": "${Q402_MULTICHAIN_API_KEY}",
"Q402_PRIVATE_KEY": "${Q402_PRIVATE_KEY}",
"Q402_AGENTIC_PRIVATE_KEY": "${Q402_AGENTIC_PRIVATE_KEY}",
"Q402_ENABLE_REAL_PAYMENTS": "1",
"Q402_MAX_AMOUNT_PER_CALL": "200",
"Q402_RELAY_BASE_URL": "https://q402.quackai.ai/api",
"Q402_API_KEY": "${Q402_API_KEY}"
}
}
}
}extensions:
"q402-mcp":
enabled: true
name: "q402-mcp"
type: stdio
cmd: "npx"
args:
- "-y"
- "@quackai/[email protected]"
envs:
"Q402_TRIAL_API_KEY": "${Q402_TRIAL_API_KEY}"
"Q402_MULTICHAIN_API_KEY": "${Q402_MULTICHAIN_API_KEY}"
"Q402_PRIVATE_KEY": "${Q402_PRIVATE_KEY}"
"Q402_AGENTIC_PRIVATE_KEY": "${Q402_AGENTIC_PRIVATE_KEY}"
"Q402_ENABLE_REAL_PAYMENTS": "1"
"Q402_MAX_AMOUNT_PER_CALL": "200"
"Q402_RELAY_BASE_URL": "https://q402.quackai.ai/api"
"Q402_API_KEY": "${Q402_API_KEY}"
timeout: 300
Placeholders to fill from your own secret store: ${Q402_TRIAL_API_KEY}, ${Q402_MULTICHAIN_API_KEY}, ${Q402_PRIVATE_KEY}, ${Q402_AGENTIC_PRIVATE_KEY}, ${Q402_API_KEY}. The registry never accepts secret values.
This is a local package: the command runs on your machine.
Not scored: fewer than three checks apply, usually because no remote answered a credential-free probe or the server is a local package.
protocol.modern, protocol.stateless, protocol.transport, protocol.list_ttlno remote answered a protocol handshake (not probed yet, unreachable, or local-only)auth.prm, auth.as_metadata, auth.cimdno remote uses OAuthauth.secret_in_urlno templated URLtools.descriptions, tools.description_length, tools.schemas, tools.annotations, tools.directory_hints, tools.token_cost, tools.api_dumptool list unknown (behind auth, not probed, or empty)stability.changes, stability.rug_pulltool list unknowndeps.known_vulnsno known advisory in 107 resolved packagesdeps.mcp_sdk_version@modelcontextprotocol/sdk 1.30.1 has 1 known advisory (GHSA-6qxp-vccf-f47h); update @modelcontextprotocol/sdk to 1.31.0 or laterdeps.resolvable@quackai/[email protected] resolved: 107 packagesNo tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.
Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.
+repository +namespace-matches-repo ~liveness-unmeasured ~updated-62d-ago
Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.
@quackai/[email protected] npm106 dependencies, resolved · MCP SDK @modelcontextprotocol/sdk 1.30.1 · advisories checked 2026-10-19
| advisory | severity | package | fixed in |
|---|---|---|---|
| GHSA-6qxp-vccf-f47hMCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server | high | @modelcontextprotocol/[email protected]MCP SDK, direct | fixed in 1.31.0 |
Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0. The graph is what a clean install of this version resolves today; nothing was installed or run. How it is checked.
| package | registry | version | runtime | secrets |
|---|---|---|---|---|
@quackai/q402-mcp | npm | 0.11.23 | – | Q402_TRIAL_API_KEY, Q402_MULTICHAIN_API_KEY, Q402_PRIVATE_KEY, Q402_AGENTIC_PRIVATE_KEY, Q402_API_KEY |
No tools observed. Local packages are never executed by the registry.
Schemas: list_tools.
{
"name": "io.github.quackai-org/q402-mcp",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"version": "0.11.23",
"packages": [
{
"version": "0.11.23",
"transport": {
"type": "stdio"
},
"identifier": "@quackai/q402-mcp",
"registryType": "npm",
"environmentVariables": [
{
"name": "Q402_TRIAL_API_KEY",
"format": "string",
"isSecret": true,
"description": "Recommended path: skip this UI and run `q402_doctor` after install - it stores secrets in ~/.q402/mcp.env, which the server auto-loads. Fill this field directly ONLY if your MCP client manages secrets for you. Value is a Free Trial API key from https://q402.quackai.ai/event - BNB Chain (permanent) + Base (permanent) + Mantle limited-time (2026-08-21~08-28 UTC+9), 500 sponsored TXs, gas covered by Q402. Avalanche trial has ended. BNB and Base payments auto-route to this key when set (same rule for q402_pay and q402_batch_pay up to 5 recipients)."
},
{
"name": "Q402_MULTICHAIN_API_KEY",
"format": "string",
"isSecret": true,
"description": "Recommended path: skip this UI and run `q402_doctor` after install - it stores secrets in ~/.q402/mcp.env, which the server auto-loads. Fill this field directly ONLY if your MCP client manages secrets for you. Value is a Paid Multichain API key from https://q402.quackai.ai/payment - full 12-chain support with per-chain Gas Tank. Auto-routed for non-BNB payments and whenever keyScope='multichain' is chosen."
},
{
"name": "Q402_PRIVATE_KEY",
"format": "string",
"isSecret": true,
"description": "Mode A - real EOA signing. Hex-encoded EVM private key (0x + 64 hex chars) of YOUR MetaMask wallet, used to sign payment authorizations LOCALLY on your machine. After your first payment that wallet shows as 'Smart account' in MetaMask (EIP-7702 delegation, reversible via q402_clear_delegation). Use a fresh wallet, not your main one. Skip this and pick Mode B (Q402_AGENTIC_PRIVATE_KEY) or Mode C (server-managed Agent Wallet) if you'd rather keep your MetaMask untouched. Recommended path: run q402_doctor after install - it stores secrets in ~/.q402/mcp.env, which the server auto-loads."
},
{
"name": "Q402_AGENTIC_PRIVATE_KEY",
"format": "string",
"isSecret": true,
"description": "Mode B - local Agent Wallet signing. Hex-encoded EVM private key (0x + 64 hex chars) exported from your Agent Wallet at https://q402.quackai.ai/dashboard -> Agent tab -> Export. Signs LOCALLY just like Mode A, but the signer is your dedicated Agent Wallet - your MetaMask EOA is never touched. Pick this for AI-agent automation when you want a dedicated purse with per-tx + daily caps you set on the dashboard."
},
{
"name": "Q402_ENABLE_REAL_PAYMENTS",
"format": "string",
"default": "1",
"description": "Live-mode switch. 0 = sandbox (test mode, no funds move - every q402_pay returns a fake hash). 1 = real on-chain payments. Default 1 since v0.5.11: safe because mode only flips to live when a live API key (q402_live_*) is set AND one of (a) a valid 32-byte private key for local signing modes, OR (b) walletMode=\"agentic-server\" with Q402_MULTICHAIN_API_KEY for the server-managed Agent Wallet path. Without either combination, the server stays in sandbox regardless of this flag."
},
{
"name": "Q402_MAX_AMOUNT_PER_CALL",
"format": "string",
"default": "200",
"description": "Per-call USD-equivalent cap for USDC/USDT/RLUSD. Any such q402_pay request with amount above this is rejected before signing. Q (QuackAI) is exempt by design (your own token; recipient allowlist + confirmation still apply). Lower this for a tighter agent blast-radius; raise for treasury-grade transfers."
},
{
"name": "Q402_ALLOWED_RECIPIENTS",
"format": "string",
"description": "Optional comma-separated lowercase EVM addresses. When set, q402_pay rejects any recipient not on this allowlist."
},
{
"name": "Q402_RELAY_BASE_URL",
"format": "string",
"default": "https://q402.quackai.ai/api",
"description": "Override for the Q402 relay endpoint. Defaults to https://q402.quackai.ai/api. Set explicitly when running against a self-hosted Q402 deployment or a non-canonical environment."
},
{
"name": "Q402_AGENT_WALLET_ADDRESS",
"format": "string",
"description": "Server-managed Agent Wallet picker (walletMode='agentic-server' only). Lowercased agent wallet address (the hex 0x... shown on the Agent tab of your dashboard) selecting which of your Agent Wallets to spend from when you hold more than one (max 10 per owner). Omit to use the default wallet. Ignored for the local-signing modes that carry their own private key."
},
{
"name": "Q402_API_KEY",
"format": "string",
"isSecret": true,
"description": "DEPRECATED legacy single-key env from pre-v0.5.0 installs. The server still reads it as a silent fallback so existing setups keep working, but new users should pick a scoped variant instead. Q402_TRIAL_API_KEY (Free Trial, BNB Chain + Base) and Q402_MULTICHAIN_API_KEY (full 12-chain surface) are designed to coexist - BNB and Base payments auto-route to the trial key, other chains use multichain. Only set Q402_API_KEY if you are migrating an existing pre-v0.5.0 install; do NOT set it alongside the scoped variants on a fresh install."
},
{
"name": "Q402_WALLET_ID",
"format": "string",
"description": "DEPRECATED soft-migration alias for Q402_AGENT_WALLET_ADDRESS (one release of overlap from v0.6.0). The server still accepts it but logs a deprecation notice. New installs should set Q402_AGENT_WALLET_ADDRESS directly."
},
{
"name": "Q402_BUILDER_CODE",
"format": "string",
"description": "Optional Base Builder Code for onchain attribution (ERC-8021 / Base Builder Codes). When set, every q402_x402_fetch payment includes your code as the client/intermediary in the x402 payment extension so payments are attributed onchain. Format: 1-32 lowercase letters, numbers, or underscores. Leave unset to disable attribution."
}
]
}
],
"repository": {
"url": "https://github.com/quackai-org/q402-mcp",
"source": "github"
},
"description": "Q402 - gasless payments, yield, escrow, bridge & NAV triggers on 12 EVM chains. Sandbox-default."
}