Back to Browse

Synthex X402 MCP Server

Developer ToolsUse Caution4.2MCP RegistryLocalRemote
Free

Server data from the Official MCP Registry

Paid agent services settled in USDC on Base via x402. Signed, verifiable, and free to verify.

About

Paid agent services settled in USDC on Base via x402. Signed, verifiable, and free to verify.

Remote endpoints: streamable-http: https://x402.synthexforge.com/mcp

Security Report

4.2
Use Caution4.2High Risk

The SDK performs x402 payments and local Ed25519 and EIP-3009 signing with no hardcoded secrets, no obfuscation, and no shell execution, and it never auto-pays without a configured key. The main concern is that call() signs whatever amount and payTo address the remote server requests, with no allowlist or spending cap, so a compromised or spoofed endpoint could direct payments. The Python source parameter is also not URL-encoded, and the self-test module was truncated and could not be reviewed. Supply chain analysis found 6 known vulnerabilities in dependencies (0 critical, 3 high severity).

6 files analyzed · 10 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

env_vars

Check that this permission is expected for this type of plugin.

crypto_sign

Check that this permission is expected for this type of plugin.

How to Install & Connect

Available as Local & Remote

This plugin can run on your machine or connect to a hosted endpoint. during install.

Documentation

View on GitHub

From the project's GitHub README.

synthex-x402

Client SDK for Synthex Forge's paid x402 services. USDC on Base mainnet.

One call. The 402 → EIP-3009 signing → retry loop is handled for you, and verify() re-checks the Ed25519 signature on the answer locally, with no network call and no cost.

from synthex_x402 import call, verify

result = call("/v1/preflight", {"target": "example.com"})
print(result["body"]["verdict"])        # 'go' | 'caution' | 'avoid' | 'unknown'
print(verify(result["body"])["valid"])   # True — re-checked locally
import { call, verify } from 'synthex-x402'

const result = await call('/v1/preflight', { target: 'example.com' })
console.log(result.body.verdict)         // 'go' | 'caution' | 'avoid' | 'unknown'
console.log(verify(result.body).valid)   // true — re-checked locally

Install

pip install synthex-x402          # Python 3.9+
npm install synthex-x402          # Node 18+

Try it without spending anything

python3 -m synthex_x402 --mock     # Python
cd sdk/typescript && npm install && npm run mock

The mock runs the entire flow — 402, instruction parsing, signing, retry, signed result, local verification — against a local mock server with a throwaway key. Nothing leaves your machine and nothing is charged.

The remote MCP server

The same tools are available over the MCP streamable-HTTP transport:

POST https://x402.synthexforge.com/mcp
curl -X POST https://x402.synthexforge.com/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
  • Manifest: https://x402.synthexforge.com/.well-known/mcp.json
  • A2A agent card: https://x402.synthexforge.com/.well-known/agent.json
  • Registry: com.synthexforge.x402/paid-agent-services on the official MCP Registry (registry.modelcontextprotocol.io)

The services

Every tool is a thin adapter over the same paid HTTP route, so the MCP surface and the HTTP surface can never disagree about price or behaviour.

ToolRoutePriceWhat it answers
preflightPOST /v1/preflight$0.01Should I pay this counterparty?
edge_priorPOST /v1/edge/prior$0.05What has already been tested here?
x402_indexPOST /v1/x402/index$0.02What does the agent economy offer, and does it work?
data_validatePOST /v1/data/validate$0.02Is this payload valid against this schema?
policy_checkPOST /v1/policy/check$0.10Is this action allowed under this policy?
rates_referenceGET /v1/rates/reference$0.01What is this amount worth, as-of stamped?
verify_signaturePOST /v1/settlement/verifyfreeRe-verify a signed receipt you hold.
healthGET /healthfreeIs the service up, on which network?

Payment rail

Protocolx402 v2, exact scheme
AssetUSDC (0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913)
NetworkBase mainnet (eip155:8453)
MethodEIP-3009 transferWithAuthorization
payTo0xc8fF67FAE72596478599EAAcfad8656fAe1113c8

Configuration

VariableMeaning
SYNTHEX_X402_PRIVATE_KEYYour EIP-3009 signing key. Never logged, never returned.
SYNTHEX_X402_KEY_FILEPath to a file containing the key.

With no key configured, call() does not pay — it returns the payment_required instructions so you can decide.

Documentation

Six how-to guides, served live at https://x402.synthexforge.com/docs:

  1. Verify a settlement receipt on Base
  2. Check an endpoint before paying it
  3. Validate a payload before trusting it
  4. Read a reference rate with staleness
  5. Buy and redeem a pass
  6. Prove a verdict was ours

Layout

sdk/python/          the Python package (PyPI: synthex-x402)
sdk/typescript/      the TypeScript package (npm: synthex-x402)
glama.json           Glama registry metadata

Development

# Python
cd sdk/python && pip install -e . && python3 -m synthex_x402 --self-test

# TypeScript
cd sdk/typescript && npm install && npm run self-test

Both self-tests run offline and assert, among other things, that the EIP-3009 digest is byte-identical to the x402 library's own.

License

MIT

Reviews

No reviews yet

Be the first to review this server!