x402-bridgeCAUTION
MCP stdio bridge that turns any x402-paid HTTP endpoint into a Claude-callable tool. Auto-pays via the @x402 client (EVM exact, SVM exact, EVM batch-settlement) and pre-loads tools from the Coinbase x402 Bazaar.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
@three-ws/mcp-bridge
One MCP server that can pay any x402-paid endpoint on the open web — the universal x402 payer for AI agents.
Quick start · Security · Tools · Environment · three.ws
A Model Context Protocol server that can pay any x402-paid endpoint on the open web. Point your agent at a URL that answers 402 Payment Required; the bridge signs, pays, retries, and hands back the response plus the settlement receipt — EVM exact, EVM batch-settlement, and Solana exact, all behind hard spending caps. It also pre-loads a tool per service discovered on the Coinbase x402 Bazaar, so the entire paid-API economy shows up in your tool list.Quick start
Claude
b4e62fecdf8dOBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp-bridge --env MCP_BRIDGE_EVM_PRIVATE_KEY=${MCP_BRIDGE_EVM_PRIVATE_KEY} --env MCP_BRIDGE_SVM_PRIVATE_KEY=${MCP_BRIDGE_SVM_PRIVATE_KEY} -- npx -y @three-ws/[email protected]Exposed tools (3)
3 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
call_paid_endpoint | read | |
list_bazaar_tools | read | |
refresh_bazaar | read |
Trust audit
CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (3 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (11)
inV4Cidr(n, '169.254.0.0', 16) || // link-local incl. 169.254.169.254 metadata
.nojekyll
- **SSRF guard.** Every outbound payable URL — whether supplied by the model or by a Bazaar listing — passes one chokepoint that enforces an https-only scheme policy, resolves the hostname, and reject
<li><strong>SSRF guard.</strong> Every outbound payable URL — whether supplied by the model or by a Bazaar listing — passes one chokepoint that enforces an https-only scheme policy, resolves the hostn
await expectReject('https://169.254.169.254/latest/meta-data/', 'cloud metadata IP rejected');expectReject('http://8.8.8.8/x', 'http:// rejected without MCP_BRIDGE_ALLOW_HTTP'),expectAllow('http://8.8.8.8/x', 'http:// allowed with MCP_BRIDGE_ALLOW_HTTP=1 (public IP)'),await expectReject('https://169.254.169.254/latest/meta-data/', 'cloud metadata IP rejected');await expectReject('https://10.0.0.1/x', '10.0.0.0/8 rejected');await expectReject('https://172.16.5.4/x', '172.16.0.0/12 rejected');@modelcontextprotocol/sdk, @solana/kit, @x402/axios, @x402/core, @x402/evm, @x402/svm, axios, bs58
Gates applied: no_behavioural_pass.
b4e62fecdf8dfull audit observations/trust-audit/mcp-server/nirholas__x402-bridge.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | b4e62fecdf8d | CAUTION | B | 89 | first audit |
Questions
What is the x402-bridge MCP server?
MCP stdio bridge that turns any x402-paid HTTP endpoint into a Claude-callable tool. Auto-pays via the @x402 client (EVM exact, SVM exact, EVM batch-settlement) and pre-loads tools from the Coinbase x402 Bazaar.
What tools does x402-bridge expose?
3 in total: 3 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is x402-bridge safe to connect to an agent?
With care. The audit graded it B (89/100) and found 11 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does x402-bridge need?
It reads EVM_PRIVATE_KEY, MCP_BRIDGE_EVM_PRIVATE_KEY, MCP_BRIDGE_SVM_PRIVATE_KEY and SVM_PRIVATE_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does x402-bridge run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @three-ws/mcp-bridge at 1.0.2.
How current is this page?
The grade is for one exact copy of the source (b4e62fecdf8d), read on 2026-10-10. The repository is watched and re-audited when it changes.