AiFinPay — payment infrastructure for AI agentsBLOCK
mcp/aifinpay/sdk
Payment infrastructure for AI agents: wallet, passport, owner-enabled Polygon and Base payments.
Verdict
BLOCK
Grade
F
Trust score
42 /100
Exposed tools
16 11r · 5w · 0d
Transport
stdio · streamable-http
License
MIT
Stars
3
01
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
AiFinPay provides payment and monetization infrastructure for autonomous AI agents.
- Agent side: identity, wallet discovery, payment history, route discovery, quotas and settlement preparation.
- Merchant side: HTTP 402 paywalls and per-request monetization for AI traffic.
- Non-custodial design: private keys remain with the agent/operator. Public MCP tools do not expose seeds or private keys.
Canonical domain: https://aifinpay.io
Current package versions
Read from source at commit
eb1e2751c584OBSERVED · 2026-10-1202
Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude-code (npm)
claude mcp add mcp --env SEED_HASH=${SEED_HASH} --env AIFINPAY_AGENT_SECRET=${AIFINPAY_AGENT_SECRET} --env AIFINPAY_WALLET_PASSPHRASE=${AIFINPAY_WALLET_PASSPHRASE} -- npx -y @aifinpay/[email protected]03
Exposed tools (16)
11 read · 5 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
agent_address | read | Show address |
agent_call | write | USE THIS TOOL whenever the user asks to call, pay, query, search via, |
agent_claim_self | read | Link this agent to its owner |
agent_history | read | Read an agent |
agent_passport_resolve | read | Resolve an AiFinPay Agent Passport by @username, permanent AIFP number, or immutable agent id. |
agent_quota | read | Show quota |
agent_quote | read | Inspect a 402 challenge for a URL WITHOUT paying. Returns the detected |
agent_reload | write | Reload the configured local wallet files after init or a file update, without starting a new conversation. Returns public addresses only. Shell environment changes still require reconnecting the MCP process. |
deployment_info | read | Get AiFinPay deployment details across EVM, Solana, and Casper — addresses, stablecoins, program IDs, and settlement status. |
dev_payment_quote | read | Inspect the dev paid-content challenge and quote a prepaid batch on Amoy. Checks the requested contract version against the deployed quote. Never signs or broadcasts; a version mismatch is an error, not permission to relabel a contract. |
pay_with_split | write | Retired compatibility tool. It never creates an invoice or moves funds. |
quote_split | read | Retired compatibility tool. It does not quote the removed legacy split route. |
settlement_casper | write | Build and validate a NON-SIGNING Casper settlement invoice. This tool never moves funds. |
settlement_invoice | read | Build and validate a NON-SIGNING v1.3 settlement invoice for EVM chains. This tool never moves funds. |
settlement_routes | read | Read AiFinPay |
settlement_solana | write | Build and validate a NON-SIGNING Solana settlement invoice. This tool never moves funds. |
04
Trust audit
BLOCKgrade F · trust 42/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (2 observation(s))
- Shell
- declared (3 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
gate/src/stores/redis.ts:23
eval(script: string, numKeys: number, ...args: (string | number)[]): Promise<unknown>;
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHSupply chain · supply.typosquat · CWE-829, CWE-1357
gate/package.json
express4 ~ express
Why it matters. dependency name one edit from a popular package
Fix. verify the package; likely typosquat
MEDIUMObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
deployments/registry/abi/evm/B2BSplitterV14/B2BSplitterV14.json:1244
"bytecode": "0x6101a080604052346103815760c0816131b180380380916100208285610385565b833981010312610381576040519060c082016001600160401b0381118382101761036d57604052610050816103a8565b825261005e602082016103a
MEDIUMObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
deployments/registry/abi/evm/B2BSplitterV14/B2BSplitterV14.json:1245
"deployedBytecode": "0x6080806040526004361015610012575f80fd5b5f3560e01c90816301ffc9a71461134d57508063248a9ca3146113235780632f2ff15d1461110e5780633644e515146110f457806336568abe146110975780633b2fb7a8146
MEDIUMObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
deployments/registry/abi/evm/TimelockWrapper/TimelockWrapper.json:225
"bytecode": "0x610100604052346101f657612a9a6060813803918261001d816101fa565b9384928339810103126101f6576100338161021f565b9060406100426020830161021f565b910151906001600160a01b0383169081156101e757600160016
MEDIUMObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
deployments/registry/abi/evm/TimelockWrapper/TimelockWrapper.json:226
"deployedBytecode": "0x60806040526004361015610011575f80fd5b5f5f3560e01c80630107e123146106f3578063055ce9d01461056d5780635da5adbf146104d757806383197ef0146102b8578063a8e4fb9014610267578063aafc366e1461015
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
gate/tests/management.test.ts:4
const SECRET = "sk_live_supersecret_do_not_log_me";
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
node/tests/settlement-v13.test.ts:74
const token = "0x3333333333333333333333333333333333333333" as const;
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
node/tests/spendLedger.test.ts:153
token: "11111111111111111111111111111111",
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
node/tests/spendLedger.test.ts:235
token: "11111111111111111111111111111111",
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
node/tests/spendLedger.test.ts:320
token: "11111111111111111111111111111111",
LOWInventory / provenance · inv.hidden_file · CWE-1104
deployments/.aiignore
.aiignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
gate/.prettierignore
.prettierignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
mcp/.prettierignore
.prettierignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
node/.aiignore
.aiignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
node/.prettierignore
.prettierignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95
python/tests/test_public_exports.py:36
assert exported is getattr(importlib.import_module(module), name)
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
gate/tests/contract-parity.test.ts:16
const REFERENCE = fileURLToPath(new URL("../../../aifinpay-web/backend/app/aifp/gate.js", import.meta.url));LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
gate/tests/reporting-funnels-independent.test.ts:7
import { Agent, reportingHeaders } from "../../node/src/agent.js";LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
gate/tests/reporting-funnels-independent.test.ts:8
import { Aifp1ReceiptCache, aifp1Fetch } from "../../node/src/aifp1.js";LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
mcp/tests/agent-history.test.ts:3
import { getAgentHistory } from "../../node/src/agentHistory.js";LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
node/tests/reporting-funnels-v2.test.ts:10
? await import("../../../aifinpay-sdk/node/src/aifp1.js")LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319
mcp/tests/claim-self-ssrf.test.ts:59
["cloud metadata", "http://169.254.169.254/api/auth/verify?token=x"],
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319
mcp/tests/safe-fetch.test.ts:28
["cloud metadata", "169.254.169.254"],
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319
mcp/tests/safe-fetch.test.ts:42
["IPv4-mapped metadata", "::ffff:169.254.169.254"],
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
Gates applied: no_behavioural_pass.
Audited 2026-10-12 · audit v0.4.1 · source sha
eb1e2751c584full audit observations/trust-audit/mcp-server/aifinpay__sdk.json · Report an issue / request a re-scan05
Audit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | eb1e2751c584 | BLOCK | F | 42 | first audit |
06
Questions
What is the @aifinpay/agent MCP server?
Payment infrastructure for AI agents: wallet, passport, owner-enabled Polygon and Base payments.
What tools does @aifinpay/agent expose?
16 in total: 11 read-only, 5 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is @aifinpay/agent safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (42/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does @aifinpay/agent need?
It reads AGENT_PRIVATE_KEY, AIFINPAY_AGENT_SECRET, AIFINPAY_AUTH_REQUIRED, AIFINPAY_OAUTH_ISSUER, AIFINPAY_OAUTH_SCOPES, AIFINPAY_WALLET_PASSPHRASE, AIFP_INGEST_SECRET, AIFP_MERCHANT_SECRET, EXA_API_KEY, GCORE_API_KEY, GCORE_AUTH_SCHEME and IONET_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @aifinpay/agent run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @aifinpay/wallet at 1.5.0.
How current is this page?
The grade is for one exact copy of the source (eb1e2751c584), read on 2026-10-12. The repository is watched and re-audited when it changes.