Kura
The server exposes Kura's local AI-agent EVM wallet as MCP tools: read wallet balances/status/history, look up on-chain agent records, request user-approved payments, and fetch paid (x402) web resources.
get_balances — Read ETH and USDC balances on the active Base network (testnet or mainnet).
get_wallet_status — Read wallet state and public address (encrypted/legacy/none); no password needed.
get_history — List recent transaction attempts (sent, blocked, failed, signed, settled, settle_failed) with an optional limit.
lookup_agent — Query an ERC-8004 agent's on-chain identity record and optionally compare a pay_to address or resource domain against the registered wallet/domain.
request_payment — Request a USDC or ETH payment; the wallet app shows an approval window and the user must approve with a password (autopay only under user-enabled conditions).
x402_fetch — Fetch a URL; if it returns HTTP 402, request user approval, sign an EIP-3009 payment, and re-fetch with the payment header to return the content.
Kura (蔵 — a storehouse that guards your treasures)
A local EVM wallet for AI agents. On a Mac, when an AI like Claude makes an internet payment (x402), this is the wallet where a human approves it with a password.
Not a human wallet (like MetaMask) — it's for AI agents
Not a cloud SaaS — it runs locally only. Keys never leave this computer.
AI requests a payment → a human approves with a password → it executes
The chain is Base (Ethereum L2, near-zero fees). Default is the testnet (Base Sepolia)
At a glance
[ AI 앱 (Claude Code / 데스크톱) ]
│ MCP로 "결제해줘" 요청
▼
[ Kura 데스크톱 앱 ] ← 승인 팝업 → 사람이 비밀번호 입력
│ 서명 (키는 이 앱 안에서만)
▼
[ Base 체인 / x402 페이실리테이터 ] ← 실제 결제The password is only ever entered in the Kura app's input field. It never goes into chat windows, MCP, or config files.
Related MCP server: cardzero-mcp
Installation
Apple Silicon Mac (macOS 11 or later)
(A) Homebrew
brew install --cask dinggi5/tap/kura(B) Download the DMG directly
Download Kura_<version>_aarch64.dmg from Releases, open it, and drag Kura into the Applications folder.
Since this is an app you're entrusting with your keys, I've written down the exact commands for verifying that the app you received is really the one I built in SECURITY.md.
(C) Build from source
Prerequisites: Rust, Node.js (20.19+ or 22.12+ — required by Vite 7), macOS.
git clone https://github.com/dinggi5/kura.git
cd kura
git checkout v0.1.1 # 배포본과 같은 소스. 빼면 개발 중인 최신 코드가 받아져요
npm ci # package-lock.json 그대로 설치 (install 은 버전이 올라갈 수 있어요)
# 개발 모드로 바로 실행
npm run tauri dev
# 앱으로 빌드해 /Applications에 설치
npm run tauri build -- --bundles app --no-sign
ditto src-tauri/target/release/bundle/macos/Kura.app /Applications/Kura.app
open /Applications/Kura.appUpdates
The app updates itself.
Go to Settings → About to check the version and changelog, then click Install now and restart.
Only the check is automatic — installation always requires you to click it.
Downloaded files are installed only after their signature is verified (signature verification cannot be disabled). Details are in the "Updates" section of SECURITY.md.
If you don't want the automatic update-check traffic, turn off Settings → About → Check on startup.
Uninstalling
⚠️ Uninstalling the app does not delete your wallet. Keys, settings, and transaction history live in ~/.jigap outside the app, so removing just the app leaves them intact — I did this on purpose so you don't accidentally lose your assets (even brew uninstall --zap won't remove them).
# 앱만 제거 (지갑은 남음 — 나중에 다시 설치하면 그대로 이어서 써요)
brew uninstall --cask dinggi5/tap/kura # 또는 /Applications/Kura.app 을 휴지통으로To completely erase the wallet too on this Mac, follow this order:
First make sure you have the 12-word recovery phrase in hand. You can view it again via the key button in the app's header.
If there's a balance left, move it to another wallet.
Quit Kura completely (right-click the menu bar icon → Quit). If it's running, it writes a state file to
~/.jigapevery few seconds, so a deleted folder will reappear right away.Also quit any AI tools (like Claude Code) that have the Kura MCP attached.
If you had auto-start enabled, turn it off or run
rm ~/Library/LaunchAgents/Kura.plist(this file remains if you delete the app via Trash. If you uninstall withbrew uninstall --cask, it goes away with it).Then run
rm -rf ~/.jigap
Running that final rm -rf ~/.jigap without the 12 words means no one can ever recover that wallet's assets.
First run
Kura lives in the menu bar. When you launch it, a storehouse icon (◻︎) appears in the menu bar at the top of your screen, and the window only drops down when you click that icon. Clicking elsewhere closes it, and the app stays in the background waiting for AI payment requests. To quit completely, right-click the icon → Quit. (On first launch when no wallet exists yet, the window opens by itself.)
Create a wallet — set a password (8+ characters) that you'll enter for every transfer. Your key is encrypted and stored with this password (
~/.jigap/wallet.enc).Back up the seed — 12 words are shown. This is the real proof of ownership of your assets, so write them down on paper or in a password manager. Even if you forget your password, the 12 words alone can recover it: quit the app, first make sure you have the 12 words in hand, then delete
~/.jigap/wallet.encand relaunch the app — you can restore it via Import on the first screen (you can also put them into any other standard BIP-39 wallet). However, deleting this file without the 12 words means losing your assets forever.Welcome tour — walks you through funding, AI connection, and safety features. You can revisit it anytime from the ⓘ Help in the header.
Funding (USDC)
To make payments, your wallet needs USDC (digital dollars).
Tap Receive in the app to see your address and QR code.
When sending from an exchange or another wallet, be sure to select the Base network. Sending on another network will lose your funds.
On the testnet (default), it's not real money. Use the Faucet button on the receive screen to get free test coins and practice.
ETH is optional — for x402 payments, the facilitator pays the fee, so you can have 0 ETH. You only need a little ETH for gas when sending directly via the app's Send (Base fees are around a cent). Funding with USDC alone is enough.
Connecting AI (Claude)
Register the Kura server in your AI app's MCP settings to connect. Once connected, a "Claude connected" badge appears on the main screen. Since 0.1.2, the MCP server is built into the app, so you can connect without cloning the source or installing Rust.
The easiest way — the "AI Connect" screen in the app
Click the "AI not connected" badge at the top of the main screen to open the connection screen.
Claude Desktop — click the "Connect" button and an extension install window appears in Claude. Just click 'Install' and you're done.
Claude Code — registered with one click (the app runs
claude mcp addfor you). From the nextclaudelaunch, it's connected from any folder.
Below is how to do the same thing by hand.
Claude Desktop — one extension file is all you need
Download kura-<version>.mcpb from the releases page and double-click it — Claude Desktop will ask to install it. (Or go to Claude Settings → Extensions → Choose file.)
The extension contains no executable — it only has a launcher that verifies the signature of the signed and notarized MCP server inside the installed Kura.app and then runs it. So you need to install the Kura app first.
Claude Code · other MCP apps
Register the in-app binary with its absolute path:
claude mcp add --scope user kura -- /Applications/Kura.app/Contents/MacOS/kura-mcp(--scope user is the option that makes it available everywhere, not just "this folder". If you only want it in one project, you can omit it.)
For other MCP apps, write it in the settings like this:
{
"mcpServers": {
"kura": {
"command": "/Applications/Kura.app/Contents/MacOS/kura-mcp"
}
}
}If you're developing from source
The repo root already has .mcp.json. Running claude in this folder picks it up automatically (the first time it asks whether to use the server — approve it). This path is for development, rebuilding with cargo run every time — if you're using an installed build, registering the app path above is the right approach.
Tools the AI can use: get_wallet_status · get_balances · get_history (read-only) · request_payment (payment request → approval popup in the app) · x402_fetch (calls a URL that requires 402 payment).
If you change the MCP tools, restart the AI app for it to take effect (the server is loaded once at session start).
How a payment flows
The AI requests a payment.
The Kura window appears showing how much, to where (it pops up automatically even if the window was hidden).
Enter the password and approve.
The payment executes and the result goes back to the AI. If you don't approve within 5 minutes, it's automatically rejected.
Security model
Password approval — by default, every payment requires password approval (if autonomous payments are enabled, exceptions apply only under the conditions below). Keys are stored encrypted (Argon2id + AES-256-GCM) and are only decrypted at payment time, then wiped immediately (if an autonomous payment session is enabled, they're kept in memory only while unlocked).
Limits — set how much can be sent per transaction / per day in settings (default: 5 USDC single, 20 USDC daily). Anything over is blocked.
Emergency lock — turning on the shield button in the header immediately blocks all transfers.
Trusted addresses · autonomous payments — for automatic approval without a password, session unlock + small limits + trusted address must all be satisfied. Otherwise, a password is always required.
Transaction history — records all outgoing transfers, blocked attempts, and signatures.
Local-first — keys (
~/.jigap/) live outside the repo and never get committed to git.No analytics, no font CDN — the app connects to the internet on its own for only three things: ①the RPC server used for balance lookups and transfers ②x402 addresses requested by the AI ③update checks (GitHub). Usage data is never sent anywhere, and fonts are bundled in the app, so the UI renders fine offline too.
Update checks can be disabled — on launch it asks GitHub whether a new version exists (your IP and current version are logged there). Turning off Settings → About → Check on startup removes even this traffic. Whether the check is on or off, installation only proceeds when you click it — nothing ever changes silently.
For developers
You can also drive the same wallet from the CLI kura (it shares the MCP server and core logic). It's already inside the installed app, so one line on your PATH and you're set:
sudo mkdir -p /usr/local/bin
sudo ln -sf /Applications/Kura.app/Contents/MacOS/kura-cli /usr/local/bin/kura
kura statusTo run from source:
cargo run --manifest-path ./kura-mcp/Cargo.toml --bin kura -- status
cargo run --manifest-path ./kura-mcp/Cargo.toml --bin kura -- balance
cargo run --manifest-path ./kura-mcp/Cargo.toml --bin kura -- history --limit 10
cargo run --manifest-path ./kura-mcp/Cargo.toml --bin kura -- pay <주소> <금액> --token usdc
cargo run --manifest-path ./kura-mcp/Cargo.toml --bin kura -- fetch <URL>pay/fetch never take a password via the CLI — the Kura app must be running, and a human enters the password in the approval popup.
Tests:
(cd src-tauri && cargo test) # 백엔드(지갑·암호화·한도·송금)
(cd kura-mcp && cargo test) # MCP/CLI 어댑터
npx tsc --noEmit && npx vite build # 프론트The procedure for producing a release build (signed, notarized DMG) is in docs/RELEASE.md. It needs an Apple Developer account and a one-time setup, and after that it's one line:
./scripts/release.shTech stack
Desktop | Tauri (Rust + web frontend) |
Frontend | React + Tailwind CSS, Framer Motion, Lucide, Pretendard |
Chain | Base / alloy-rs |
Payments | x402 (EIP-3009 off-chain signatures) |
AI connect | MCP server (rmcp) |
Structure: [Rust core (src-tauri)] ← MCP / CLI adapters (kura-mcp). Only the GUI process has key access (signing) — that's the last line of defense.
License · status
MIT license — since this is code that handles keys and money, I believe it should be something you can read, verify, and modify yourself.
If you find a vulnerability, please report it through the private channel in SECURITY.md before filing an issue. The same document also lists what Kura cannot protect against.
The bundled Pretendard font is under the SIL Open Font License 1.1 (full text).
The number one user is myself — a wallet for Korean developers and creators on Apple Silicon Macs who pay with local LLMs/Claude. It's still an early 0.1.x version, so I recommend learning on the default testnet first and only putting what you can afford to lose on mainnet.
Available Tools
6 toolsget_balancesA
Reads the wallet's ETH (for gas) and USDC (for payments) balances on the active network (Base — testnet or mainnet, per the user's setting). Errors if there is no wallet.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Since no annotations are provided, the description carries the burden of disclosing behavioral traits. It clearly states this is a read operation, mentions the active network context, and discloses a specific failure mode (errors if no wallet). It does not detail return structure, but for a simple 0-parameter balance reader this is enough.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One focused, front-loaded sentence that explains the purpose, the network, the wallet scope, and the error condition without any filler. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter read-only tool with no output schema and no annotations, the description is fully self-contained: it states what is read, why each balance matters, what network is used, and what error to expect. Nothing a caller needs is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters, so the baseline for this dimension is 4. The description still adds meaningful context by specifying what the returned amounts mean (ETH for gas, USDC for payments) and how the active network is chosen.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb (Reads) and a specific resource: the wallet's ETH and USDC balances on a specific network (Base testnet/mainnet). This is clearly distinct from siblings like get_history and get_wallet_status, making the purpose immediately obvious.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives helpful context: the balances are for gas and payment, and it errors if there is no wallet. However, it does not explicitly compare itself to alternatives or state when the agent should prefer get_wallet_status or get_history instead, so usage guidance is implicit rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_historyA
Returns recent transaction attempts, newest first. status is one of sent, blocked, failed, signed (x402 signed, awaiting settlement), settled (x402 settled, settle_tx is the settlement tx), or settle_failed. Use limit to cap how many come back (default 20).
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | How many recent entries to return (default 20, max 200). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavior disclosure, and it does so well: it explains ordering, lists all possible statuses, defines special status semantics such as signed/settled and the role of settle_tx, and notes the default limit. This materially enriches what an agent can infer without invoking the tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is tightly structured: first a purpose statement, then a compact status enumeration, then a one-sentence usage note about the limit. Every sentence earns its place, and no padding or redundant context exists.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only, single-parameter tool with no output schema, the description covers all the important context an agent needs: ordering, semantics of every status value, meaning of settle_tx, and limit behavior. Nothing material is missing that would prevent correct invocation or interpretation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage for the only parameter is 100%, and the schema already documents the default (20), the upper bound, and the type. The description repeats the default and the limiting behavior but adds no new semantic detail beyond what the structured schema already provides, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that the tool returns recent transaction attempts, newest first — a specific verb and resource that distinguishes it from sibling tools like get_balances or get_wallet_status. It does not depend on the name alone and adds concrete details about transaction statuses.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies appropriate use: whenever an agent needs to inspect the latest transaction attempts and their settlement statuses. It does not explicitly name alternatives or exclusions, but the resource context is clear enough that an agent is unlikely to confuse it with balance, wallet, or payment-execution tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_wallet_statusA
Returns the wallet's state and address. state is encrypted (normal), legacy, or none. No password needed — read only.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Because no annotations are provided, the description carries the behavioral disclosure burden. It states 'read only' and 'no password needed', which are meaningful behavioral traits, and also enumerates the possible state values. It could mention anything unusual about initialization or errors, but for a 0-parameter getter this is sufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A short set of sentences that are all informative: what it returns, the state values, and the auth requirement. Nothing is redundant and the key info is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that there is no output schema, the description does enough by stating the return values and the no-password/read-only behavior. It might have added the exact return shape, but for a 0-parameter read-only getter this is nearly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema is empty, so there are no parameters to document. The description adds value by describing the return contents (state and address), which is more than needed for a tool with zero parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource, 'Returns the wallet's state and address', and adds the exact possible state values. This is distinguishable from sibling tools like get_balances and get_history, although it does not explicitly say how it differs from them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It states that the tool is read-only and requires no password, which conveys the obvious usage context: a low-cost snapshot of wallet identity and status. It does not name alternative tools or give exclusions, but for a simple getter the context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
lookup_agentA
Reads an agent's ERC-8004 record from the registry on the active Base network (read-only, on-chain only — the wallet never fetches the agent's website). Give it agent_id, the agent's number in the Identity Registry. Returns: registered, owner, wallet (the registered agentWallet), token_uri and the uri_domain read from it, declared_name (what the record calls itself), and feedback_clients (how many addresses left feedback). Pass pay_to and/or resource to also get a comparison: whether the address equals the registered wallet and whether the resource's domain equals the domain listed on-chain. IMPORTANT: registration is permissionless — anyone can register any name, domain, or wallet, and anyone can leave feedback. Being registered is NOT proof of safety. Only a mismatch is a strong signal, and only when the agent number came from a source you trust (the service's own docs), not from the payment response itself.
| Name | Required | Description | Default |
|---|---|---|---|
| pay_to | No | Optional: an address to compare against the agent's registered wallet. | |
| agent_id | Yes | The agent's ERC-8004 number (agentId — the Identity Registry NFT token id). | |
| resource | No | Optional: a resource URL whose domain is compared with the domain listed on-chain. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral disclosure burden and does so thoroughly. It states the operation is read-only and on-chain only, clarifies that the wallet does not fetch the website, enumerates the returned fields, and prominently warns about the trust implications of permissionless registration and feedback. This exceeds typical descriptions in transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but front-loaded with the core purpose and then systematically covers parameters, return values, and safety caveats. Every sentence adds information, but the length is near the upper bound for a tool definition; some of the caveat text could arguably be tightened. Still, structure is logical and skimmable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having no output schema and no annotations, the description gives a complete picture: what the tool does, which network it operates on, what parameters do, what is returned, and how to interpret the results safely. The warning about trusting the agent number source and the permissionless nature of registration is critical context that would otherwise be missing. Nothing essential for correct invocation or interpretation is omitted.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already covers 100% of the parameters with descriptions, so the baseline is 3. The description adds meaningful value by explaining agent_id as 'the agent's number in the Identity Registry' and by clarifying that pay_to and resource trigger comparisons against the registered wallet and on-chain domain. This goes beyond the schema's field-level descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Reads an agent's ERC-8004 record from the registry on the active Base network.' It clearly distinguishes itself from sibling tools by explicitly noting it is read-only, on-chain only, and never fetches the agent's website, which separates it from x402_fetch and the balance/history tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description makes the usage context clear: call it with an agent_id to read the registry record, and optionally pass pay_to/resource for comparisons. It also gives important guidance about when the result is meaningful, warning that registration is permissionless and only a mismatch is a strong signal. It does not explicitly name sibling alternatives or state 'use this instead of X', but the context is sufficiently clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
request_paymentA
Asks the user to make a payment. The wallet app opens an approval window, and the payment is only sent once the user approves it with their password (it waits up to 5 minutes). The one exception is autopay, which the user turns on themselves — only then can a payment be approved automatically, and only within an unlocked session, a small limit, and a trusted address. Arguments: to (recipient address), amount (decimal string), token (USDC by default, or ETH), memo (what the payment is for — the user reads it to decide, so always fill it in). Per-payment and daily limits and the emergency lock are enforced by the app. Never send a password as an argument — the user types it in the app. Returns: status (approved/rejected/failed), tx_hash, and an explorer link.
| Name | Required | Description | Default |
|---|---|---|---|
| to | Yes | Recipient address (42 characters, starting with 0x). | |
| memo | No | What the payment is for — the user reads this in the approval window, so fill it in. | |
| token | No | Token: "USDC" (default) or "ETH". | |
| amount | Yes | Amount as a decimal string, for example "1.5". |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Since no annotations are provided, the description carries the full behavioral burden, and it delivers: it discloses the 5-minute approval wait, user password requirement, the autopay exception, per-payment and daily limits, the emergency lock, and the return shape. It also warns against sending a password as an argument, which is a critical safety behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but every sentence earns its place. It is front-loaded with the core purpose, then explains approval mechanics, then maps the arguments and return values. No filler or redundant emphasis remains.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This tool is a mutating, user-required action with no output schema, so the description must supply the return contract itself; it does so with status, tx_hash, and explorer link. The approval behavior, autopay edge case, limits, and safety instructions are all covered, leaving no major practical gap for an agent invoking the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already covers all four parameters at 100% coverage, so the baseline is appropriate. The description adds marginal but valuable guidance: the memo should always be filled because the user reads it, and passwords must never be an argument. Token defaults are repeated from the schema rather than newly explained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb plus a clear resource: "Asks the user to make a payment." It goes on to define the approval flow, which sharply separates this tool from the read-only siblings like get_balances and get_history. The purpose is unambiguous even without a title.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides practical usage context: fill the memo, never pass a password, and understand the autopay exception. It does not explicitly say "use this instead of X" or list when not to use it, but the write/approval nature is clear next to read-only siblings. It therefore has clear context but no explicit exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
x402_fetchA
Fetches an x402 paid resource (a URL). It GETs the URL first; if the server answers 402 Payment Required, it asks the user to approve the required payment (exact scheme, the active Base network, USDC) in the wallet app, builds an EIP-3009 signature, and re-requests the same URL with an X-PAYMENT header to return the content. If no payment is required (no 402), it just returns the body. Approval works exactly as in request_payment (password by default; automatic only when the user has turned autopay on), and the app enforces per-payment and daily limits and the emergency lock. Never send a password as an argument. Arguments: url (required), memo (what the payment is for — the user reads it to decide). Returns: paid, status, http_status, body, and amount/pay_to/settlement when paid.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | URL of the paid resource to fetch (http/https). | |
| memo | No | What the payment is for — the user reads this in the approval window, so fill it in. | |
| agent_id | No | Optional: the seller's ERC-8004 agent number, if you know it from the service's own documentation or agent card. The wallet then reads that agent's on-chain record and shows the user whether the payment address and the resource domain match what is registered. Leave it out if you don't know it — a wrong number just produces a "no such agent" note. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It thoroughly walks through the GET request, handling of a 402 response, user approval, EIP-3009 signature construction, and re-request with the X-PAYMENT header. It also discloses approval defaults, autopay behavior, per-payment and daily limits, the emergency lock, and explicitly warns never to send a password as an argument. This is exemplary transparency for a complex payment-flow tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but every sentence earns its place: purpose, flow, fallback, approval behavior, safety warning, argument summary, and return values. It is front-loaded with the core action and reads naturally despite covering a multi-step process. The length is justified by the complexity of the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description explains the full behavior, safety constraints, and return fields, which is important given the absence of an output schema. It lists the returned keys (paid, status, http_status, body, amount/pay_to/settlement). However, it does not detail error cases such as user rejection, network failures, or the distinction between status and http_status, leaving minor gaps for a tool with this complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all three parameters in detail. The description adds a small amount of context for memo ('the user reads it to decide'), but it does not add meaningful semantics for url or agent_id beyond what the schema provides. The baseline of 3 is appropriate because the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening sentence states a specific verb and resource: 'Fetches an x402 paid resource (a URL).' It then describes the full fetch-and-pay flow, making the tool's purpose unmistakable. It is clearly distinct from sibling tools like get_balances or get_history, and it references request_payment only to clarify the approval mechanism, not the core purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description makes it clear that this tool is for fetching a URL that may trigger a payment, and it explains what happens when no payment is required. It references request_payment for approval behavior, which implicitly signals the sibling relationship, but it does not explicitly state when to choose x402_fetch over request_payment or other alternatives. No exclusions or when-not-to-use guidance is given, but the context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
2 tool updates
v0.3.0- Added
lookup_agent - Changed
x402_fetch1 field changed- added
Input schema / properties / agent_idAdded value: +{ + "default": null, + "description": "Optional: the seller's ERC-8004 agent number, if you know it from the service's own\ndocumentation or agent card. The wallet then reads that agent's on-chain record and shows\nthe user whether the payment address and the resource domain match what is registered.\nLeave it out if you don't know it — a wrong number just produces a \"no such agent\" note.", + "format": "uint64", + "minimum": 0, + "nullable": true, + "type": "integer" +}
5 tool updates
v0.2.0- First observed
get_balances - First observed
get_history - First observed
get_wallet_status - First observed
request_payment - First observed
x402_fetch
TDQS
get_balances, get_history, get_wallet_status, and lookup_agent each target clearly distinct resources. request_payment and x402_fetch both initiate payments, but their descriptions separate direct payment from paid resource fetching, leaving minimal ambiguity.
Three tools use the get_* pattern, while lookup_agent, request_payment, and x402_fetch follow different conventions (verb_noun vs protocol_fetch). All names are snake_case and readable, but the mix prevents a strong sense of uniformity.
Six tools is well-scoped for a wallet and x402 payment server, covering balances, history, wallet state, agent lookup, payments, and paid content fetching without redundancy or bloat.
The set covers the core wallet and payment lifecycle, including direct payments, paid resource retrieval, and on-chain agent lookup. Minor gaps such as fetching a specific transaction by hash or managing autopay exist, but they are peripheral to the primary workflows.
Maintenance
Related MCP Connectors
Give your AI agent an x402 wallet: discover and pay for services in USDC, or earn from your own.
Pay-per-call crypto market intelligence for AI agents. USDC on Base via x402.
Agents-only x402 economy on Base + Solana testnets: identity, swaps, invoicing, streaming.
Payment rails for AI agents. Pay merchants in USDC on Base. Dual-protocol: x402 + OKX APP.
Related MCP Servers
AlicenseAqualityDmaintenanceProvides a non-custodial USDC wallet on Base for AI agents, with human-in-the-loop approval for every payment.420MIT- AlicenseAqualityDmaintenanceGives AI agents a smart-contract wallet on Base (USDC) with 10 stdio tools: create wallets, send USDC payments, pay x402-protected HTTP resources, and run ERC-8183 escrow Jobs for A2A service delivery.1015MIT
- AlicenseNot gradedqualityAmaintenanceA budget-bound x402 payment wallet for AI agents: it autonomously pays HTTP 402 payment-gated URLs across every major chain (EVM, Solana, and many non-EVM families). Self-custodial and backendless, your key, your RPC, with spend caps enforced before any on-chain send.8MIT

token4u-mcpofficial
AlicenseAqualityBmaintenanceEnables AI agents to call LLM APIs via x402 micropayments in USDC on Base network, manage a local wallet, and query consumption records.364MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/dinggi5/kura'
If you have feedback or need assistance with the MCP directory API, please join our Discord server