genesispay-jsCAUTION
GenesisPay JavaScript SDKs and MCP server: x402 payments in USDC on Base for sellers and AI agents (@genesis-tech/genesispay-*)
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
JavaScript/TypeScript SDKs for GenesisPay — stablecoin payments over HTTP 402 (x402) that work for both humans and AI agents. USDC on Base; every amount is integer minor units, never floats.
Sell: gate an endpoint
import { createPaymentGate, genesisPaySettlement } from "@genesis-tech/genesispay-seller";
const gate = createPaymentGate({
amountUsdc: "0.10",
payTo: "0xYourWallet",
description: "Premium market data",
network: "base-sepolia",
});
export const GET = gate.wrap(async () => Response.json({ data: "..." }), {
verifySettlement: genesisPaySettlement({
facilitatorBaseUrl: "https://your-genesispay-instance.example",
apiKey: process.env.GENESISPAY_SELLER_KEY!, // gp_sk_...
}),
});Buy: pay from an agent
import { GenesisPayAgent } from "@genesis-tech/genesispay-agent";
const agent = new GenesisPayAgent(); // env: GENESISPAY_AGENT_KEY, GENESISPAY_BASE_URL
const [service] = await agent.discover("weather ap15b89d793a78OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add genesispay-mcp --env GENESISPAY_AGENT_KEY=${GENESISPAY_AGENT_KEY} -- npx -y @genesis-tech/[email protected]Exposed tools (23)
21 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
Roastery | read | Coffee roaster. |
genesispay_account | read | |
genesispay_catalog_reviews | read | |
genesispay_catalog_search | read | |
genesispay_catalog_shops | read | |
genesispay_catalog_trending | read | |
genesispay_describe_external_service | read | |
genesispay_describe_service | read | |
genesispay_discover | read | |
genesispay_discover_external | read | |
genesispay_pay | write | |
genesispay_payment_status | read | |
genesispay_purchase_key | read | |
genesispay_quote | read | |
genesispay_result | read | |
genesispay_review_prepare | read | |
genesispay_review_publish | write | |
genesispay_review_withdraw | read | |
genesispay_reviews | read | |
genesispay_shipping_profile | read | |
genesispay_shops | read | |
genesispay_trending | read | |
probe_auth | read |
Trust audit
CAUTIONgrade B · trust 81/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (17)
const target: ContractDeployment = { chainId: 84532, token: "0x1111111111111111111111111111111111111111",const secret = "gp_whsec_fuzz_secret";
const SECRET = "whsec_test_5f3c9a2b1d8e4c7a";
await expect(agent.describeService("../../agent/pay")).rejects.toMatchObject({ code: "invalid_request" });const loopback = "http://127.0.0.1:3000";
expect(isPayerRedirectUrl("http://127.0.0.1:3000/thanks")).toBe(true);expect(isPayerRedirectUrl("http://127.0.0.1.evil.com/thanks")).toBe(false);"http://127.0.0.1:3000/thanks",
"http://127.0.0.1.evil.com/thanks",
const binary = atob(capture.bodyBase64);
const binary = atob(encoded.trim());
expect(JSON.parse(atob(encoded))).toEqual(params);
@types/node, jsdom, typescript, vitest
zod, typescript
@modelcontextprotocol/sdk, @genesis-tech/genesispay-agent, zod, typescript
viem, typescript
@genesis-tech/genesispay-protocol, viem, typescript
Gates applied: no_behavioural_pass.
15b89d793a78full audit observations/trust-audit/mcp-server/genesistechat__genesispay-js.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 15b89d793a78 | CAUTION | B | 81 | first audit |
Questions
What is the genesispay-js MCP server?
GenesisPay JavaScript SDKs and MCP server: x402 payments in USDC on Base for sellers and AI agents (@genesis-tech/genesispay-*)
What tools does genesispay-js expose?
23 in total: 21 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is genesispay-js safe to connect to an agent?
With care. The audit graded it B (81/100) and found 17 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does genesispay-js need?
It reads GENESISPAY_AGENT_KEY and GENESISPAY_WEBHOOK_SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does genesispay-js run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @genesis-tech/genesispay-seller at 1.8.1.
How current is this page?
The grade is for one exact copy of the source (15b89d793a78), read on 2026-10-11. The repository is watched and re-audited when it changes.