Server data from the Official MCP Registry
Payment rails for AI agents. Pay merchants in USDC on Base. Dual-protocol: x402 + OKX APP.
Payment rails for AI agents. Pay merchants in USDC on Base. Dual-protocol: x402 + OKX APP.
Remote endpoints: streamable-http: https://mcp.usecoal.xyz/api/mcp
Coal is a production payment infrastructure platform with significant legitimate functionality but moderate security concerns. The codebase demonstrates reasonable auth patterns (API keys and Bearer tokens) and proper separation of concerns, but several issues warrant attention: hardcoded private key exposure in environment configuration examples, missing input validation in critical payment paths, insufficient rate limiting scope, overly broad error responses that leak system details, and inadequate logging of security-critical events. Permissions are appropriate for a payment processor integrating with blockchain networks, but implementation gaps reduce defense against common payment system attacks. Supply chain analysis found 5 known vulnerabilities in dependencies (0 critical, 2 high severity).
4 files analyzed · 15 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
This plugin requests these system permissions. Most are normal for its category.
Unverified package source
We couldn't verify that the installable package matches the reviewed source code. Proceed with caution.
Available as Local & Remote
This plugin can run on your machine or connect to a hosted endpoint. during install.
From the project's GitHub README.
0G APAC Hackathon 2026 — Track 3: Agentic Economy
Payments for humans and AI agents — one checkout, real USDC on Base, verifiable receipts on 0G.
| Surface | URL |
|---|---|
| Marketing site | usecoal.xyz |
| Public API | api.usecoal.xyz |
| Hosted checkout | usecoal.xyz/pay/... |
| Live AI-agent demo (Claude buying ebooks) | agent.usecoal.xyz |
| Demo merchant store (with download flow) | store.usecoal.xyz |
| MCP server (multi-tenant) | mcp.usecoal.xyz/api/mcp |
| x402 oracle paywall demo | oracle.usecoal.xyz/api/price/ETH |
| Live 0G health (all 5 components) | api.usecoal.xyz/api/0g/health |
| Docs site | usecoal.xyz/docs |
| React SDK on npm | coal-react v0.4.1 |
| Video | Length | Link |
|---|---|---|
| Pitch video (for judges) | ~5 min | https://youtu.be/FOieBgJ3j4A |
| Launch / demo video (for users) | ~2 min | https://youtu.be/fnlcOIcK-yk |
| Pitch deck (PDF) | 12 slides | https://www.usecoal.xyz/coal-pitch-deck.pdf |
Coal is a programmable commerce platform for hosted checkout, merchant APIs, payment links, paywalls, recurring billing, and agentic commerce flows.
Coal is built around a simple split:
Coal handles checkout orchestration, merchant operations, payer-info capture, recurring billing, and dual-protocol agent settlement flows on Base.0G adds the sidecar layer for artifact storage, receipt proof anchoring, merchant memory, and AI commerce endpoints.This repo is an active product branch, not a tiny demo. The current codebase includes:
/verify endpointcoal-react SDK on npmCoal uses five 0G network components. All live on 0G mainnet. Full setup walkthrough lives on the docs site at usecoal.xyz/docs.
Every payment receipt, merchant profile, and encrypted memory snapshot is published to 0G Storage as an immutable, content-addressed artifact. AI agents and apps can discover merchants and verify payments by reading these artifacts directly from the decentralized storage network.
After publishing a receipt to 0G Storage, Coal anchors a SHA-256 hash of the receipt payload on-chain via the CoalReceiptAnchor V2 smart contract. Creates a tamper-proof, independently verifiable proof that a specific payment happened at a specific time. V2 calls the DASigners precompile (epochNumber()) and embeds the current DA epoch into every anchor event.
0x24a80A3Bb16d26D4063Ecd4B2fD64C6856E25E8bCoal's agent-facing APIs use 0G Compute for AI inference on the decentralized GPU network:
broker.inference.verifyService(). Responses from sealed queries carry a verification signature from the Intel TDX + NVIDIA H100/H200 enclave they ran inside.KV writes keep merchant profiles, memory pointers, and paywall manifests always-current on top of the 0G log layer, so agent discovery returns fresh data without walking the full log history.
merchant:profile:latest — merchant profile bundlemerchant:memory:latest — memory pointer (storage URI + root hash + timestamp)paywall:{id}:manifest:latest — x402 paywall manifestEvery confirmed payment, subscription lifecycle event, and webhook delivery is posted as a DA blob to the 0G Data Availability layer via a gRPC sidecar. External systems monitoring the DA stream see events in real time.
payment_confirmed, subscription_created, subscription_renewed, webhook_delivered, paywall_access_granted, receipt_anchoredflowchart TB
subgraph Actors
M["Merchant<br/><small>Console Dashboard</small>"]
C["Customer<br/><small>Browser / Wallet</small>"]
AG["AI Agent<br/><small>AgentKit / x402</small>"]
end
subgraph Coal["Coal Platform"]
direction TB
API["Console API<br/><small>Products, Links, Keys, Settings</small>"]
CHK["Checkout Engine<br/><small>Sessions, Payments, Verification</small>"]
PW["Paywall Gateway<br/><small>x402, Access Control, Manifests</small>"]
RP["Receipt Publisher<br/><small>Proof Generation, Anchoring</small>"]
ACI["Agent Commerce API<br/><small>Memory, Routing, Policy Eval</small>"]
SUB["Subscription Engine<br/><small>Recurring Billing, Renewals</small>"]
WH["Webhook Delivery<br/><small>Events, Retries, HMAC Signing</small>"]
DB[("Neon Postgres")]
AUTH["Privy Auth"]
end
subgraph ZG["0G Network — 5 Components Live on Mainnet"]
direction TB
ZGS["<b>1. 0G Storage</b><br/><small>Immutable receipt logs<br/>Merchant profiles<br/>Encrypted memory snapshots</small>"]
ZGC["<b>2. 0G Chain</b><br/><small>CoalReceiptAnchor V2<br/>Calls DASigners precompile<br/>SHA-256 proof anchors</small>"]
ZGX["<b>3. 0G Compute</b><br/><small>AI commerce inference<br/>Sealed Inference with TEE<br/>Per-response attestation</small>"]
ZGK["<b>4. 0G KV</b><br/><small>Mutable merchant mirror<br/>Per-merchant stream IDs<br/>Live agent discovery</small>"]
ZGD["<b>5. 0G DA</b><br/><small>Payment event streaming<br/>gRPC sidecar<br/>6 event types</small>"]
end
BASE["<b>Base (Coinbase L2)</b><br/><small>USDC settlement<br/>RPC fallback: Alchemy → mainnet.base.org</small>"]
M -->|API| API
C -->|Checkout| CHK
AG -->|x402 / API| PW
AG -->|Commerce| ACI
RP -->|publish| ZGS
RP -->|anchor| ZGC
ACI -->|infer| ZGX
API -->|mirror| ZGK
RP -->|DA events| ZGD
CHK --> BASE
API --> DB
API --> AUTH
style Coal fill:#1a1a2e,stroke:#334155,color:#e2e8f0
style ZG fill:#115e59,stroke:#2dd4bf,color:#ccfbf1
style BASE fill:#1d4ed8,stroke:#60a5fa,color:#bfdbfe
style Actors fill:#f8fafc,stroke:#cbd5e1,color:#1e293b
Coal's paywall /verify endpoint accepts both payment envelopes on the same URL — Coinbase's x402 (v1) and OKX's APP (v2). The dispatch picks the right settlement path based on the header version:
transferWithAuthorization on Base USDC. Gasless for the agent.Implementation:
backend/lib/x402-settle.ts — x402 v1 settlementbackend/lib/app-settle.ts — OKX APP v2 settlementbackend/app/api/paywalls/[id]/verify/route.ts — version dispatchTry the live x402 paywall on the oracle demo:
curl -i https://oracle.usecoal.xyz/api/price/ETH
# returns 402 Payment Required with the X-PAYMENT challenge
Coal ships a multi-tenant MCP server at mcp.usecoal.xyz/api/mcp. 13 tools cover the full agent-commerce loop:
discover_merchants, search_products, get_merchant_profilequery_merchant_memory (TEE-backed natural-language Q&A)check_paywall, create_checkout, get_checkout_statusverify_receipt (3-step proof trail: Base TX → 0G Storage → 0G Chain)get_0g_health, agent_wallet_statuspay_merchant (USDC on Base via EIP-3009, gasless)download_product (verifies on-chain payment, returns signed download URL)setup_instructionsThe server holds no long-lived secrets — every user passes their own wallet key via X-Coal-Agent-Key and their own Coal API key via X-Coal-Api-Key on each request.
// Claude Desktop config
{
"mcpServers": {
"coal": {
"command": "npx",
"args": [
"mcp-remote",
"https://mcp.usecoal.xyz/api/mcp",
"--header",
"X-Coal-Agent-Key:0xYOUR_WALLET_PRIVATE_KEY"
]
}
}
}
Source: examples/coal-mcp-server/. Docs: frontend/app/docs/sdk/mcp/.
/pay/[slug] and /pay/checkout/[id]/console/0gDistribution:
coal-react v0.4.1 shipped on npmEngagement beyond code:
Inbound signal:
"x402 + APP wire compat actually working is a real one… happy to point the mapper crawler at agent.usecoal.xyz for endpoint stability data in our public catalog." — CDP-verified Coinbase Developer Platform builder
Live proof anyone can check right now:
0x24a80A3Bb16d26D4063Ecd4B2fD64C6856E25E8b| Metric | Value |
|---|---|
| Test suite | 500+ tests across 35 files |
| 0G components live on mainnet | 5 — Storage, Chain, Compute, KV, DA |
| 0G receipt anchor (mainnet) | 0x24a80A3Bb16d26D4063Ecd4B2fD64C6856E25E8b |
| Base USDC (mainnet) | 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 |
| Networks | Base mainnet (USDC) + 0G mainnet (chain ID 16661) |
| Agent-payment protocols supported | Coinbase x402 (v1) + OKX APP (v2) |
| MCP tools | 13 |
| React SDK | coal-react v0.4.1 |
| Live demo (Claude buying ebooks) | agent.usecoal.xyz |
| Live 0G health | api.usecoal.xyz/api/0g/health |
curl -s https://api.usecoal.xyz/api/0g/health | python3 -m json.tool
Expect status: "ok" with storage, chain, compute, kv, and da all ok: true./verify/[session-id] on any paid checkout — shows Base TX → 0G Storage root → 0G Chain anchor with explorer links to each.curl -i https://oracle.usecoal.xyz/api/price/ETH returns a 402 with the X-PAYMENT challenge, then resubmit with an x402 v1 OR an OKX APP v2 payment header and the same endpoint settles it.cd examples/coal-react-checkout, cp .env.example .env.local, fill in your API key, npm install && npm run dev. See also examples/demo-store/ for the merchant-side flow with verified downloads.Coal is not being replaced by 0G.
Coal is the payment execution and merchant operations layer.0G is the storage, proof, memory, and AI layer around it.That is the correct mental model for the repo.
coal/
├── backend/ # Next.js API app, Prisma, on-chain verification, 0G logic
│ └── lib/0g/ # All 5 0G component implementations (Storage, Chain, Compute, KV, DA)
├── frontend/ # Next.js UI app, docs site, dashboard, checkout surfaces
├── contracts/ # CoalReceiptAnchor V2 Solidity contract + Foundry project
├── coal-mini-app/ # World App mini-app frontend (separate deploy)
├── packages/ # JS + React SDK surfaces
├── examples/ # Runnable integrations:
│ ├── coal-react-checkout/ # React checkout demo
│ ├── coal-agent/ # Live AI-agent demo (Claude → Coal merchants)
│ ├── coal-mcp-server/ # Multi-tenant MCP server
│ ├── coal-oracle-agent/ # x402 oracle paywall demo
│ ├── demo-store/ # Storefront with verified-payment download flow
│ └── agentkit-action/ # AgentKit action provider
├── scripts/ # Deploy + sync scripts
└── README.md # You are here
Two separate Next.js apps are deployed from the same repo:
The repo also includes runnable integration examples under examples:
@coal/react, including hosted checkout launch, success handling, receipt verification, and an agent-style simulation flow.If you want the quickest demo path, start with coal-react-checkout and examples/coal-react-checkout/README.md.
Coal has three auth surfaces:
x-api-key with coal_live_* keys/api/console/* routes use Privy Bearer JWTsX-Coal-Agent-Key (wallet private key, used by pay_merchant / agent_wallet_status) and X-Coal-Api-Key (Coal API key, used by create_checkout / query_merchant_memory). The server holds no long-lived secrets.Legacy Better Auth has been retired from runtime use.
Coal settles to the configured Base settlement token.
USDC is the fallback defaultMNEE_* environment aliases remain only as compatibility helpers24+cd backend && npm install
cd ../frontend && npm install
cd ..
cp backend/.env.example backend/.env
cp frontend/.env.example frontend/.env
Then fill in the required values in:
Important backend values:
DATABASE_URLALCHEMY_API_KEY (optional — see RPC fallback note below)BASE_RPC_FALLBACK_URL (optional — second-tier RPC, e.g. Coinbase Developer Platform or QuickNode)PRIVY_APP_IDPRIVY_APP_SECRETNEXT_PUBLIC_FRONTEND_URLNEXT_PUBLIC_API_URLCRON_SECRETBase RPC fallback chain. Coal wraps the Base RPC in a viem fallback() transport so a single provider outage cannot stop payments. Priority order: ALCHEMY_API_KEY (if set) → BASE_RPC_FALLBACK_URL (if set) → https://mainnet.base.org (always). The local public node is the floor so the app boots even without an Alchemy key. See backend/lib/chain.ts.
Important frontend values:
NEXT_PUBLIC_API_URLNEXT_PUBLIC_PRIVY_APP_IDNEXT_PUBLIC_CHAIN_ENVNEXT_PUBLIC_COINBASE_BUNDLER_KEYcd backend
npx prisma db push
Open two terminals:
# Terminal 1
cd backend
npm run dev
# Terminal 2
cd frontend
npm run dev
Default local URLs:
http://localhost:3000http://localhost:3001cd backend
npm run typecheck
npm test
npm run build
cd frontend
npm run typecheck
npm run build
cd backend
npm run 0g:storage:benchmark
0G is opt-in. Coal still works without it.
For complete setup instructions for all 5 components (Storage, Chain, Compute, KV, DA), see the docs site at usecoal.xyz/docs.
Minimum environment variables to enable 0G:
# Storage + Chain
ZERO_G_ENABLED=true
ZERO_G_CHAIN_RPC_URL=https://evmrpc.0g.ai
ZERO_G_CHAIN_PRIVATE_KEY=0x...
ZERO_G_RECEIPT_ANCHOR_ADDRESS=0x24a80A3Bb16d26D4063Ecd4B2fD64C6856E25E8b
ZERO_G_STORAGE_INDEXER_URL=https://indexer-storage-turbo.0g.ai
ZERO_G_STORAGE_ENCRYPTION_KEY=<32-byte hex>
# Compute
ZERO_G_COMPUTE_ENABLED=true
ZERO_G_COMPUTE_PROVIDER=<provider_address>
ZERO_G_COMPUTE_BASE_URL=<provider_base_url>
ZERO_G_COMPUTE_API_KEY=<api_key>
ZERO_G_COMPUTE_MODEL=<model_name>
ZERO_G_SEALED_INFERENCE_ENABLED=true
# KV
ZERO_G_STORAGE_STREAM_ID=0x<64-hex-chars>
# DA (requires running a sidecar — see 0G-SETUP.md)
ZERO_G_DA_ENABLED=true
ZERO_G_DA_GRPC_URL=<sidecar_host>:51001
ZERO_G_DA_GRPC_TLS=false
The main implementation lives in:
backend/lib/0g/storage.ts — Storage + KVbackend/lib/0g/chain.ts — Chain anchor writesbackend/lib/0g/compute.ts — AI inference + TEE attestationbackend/lib/0g/da.ts — DA event streaming via gRPCbackend/lib/0g/merchant.ts — merchant profile + memory publishingbackend/lib/receipts/proof.ts — receipt proof pipelinecontracts/0g-receipt-anchor/src/CoalReceiptAnchor.sol — V2 contract with DASigners precompile callCanonical package surfaces:
Coal ships a docs site and a live docs playground:
http://localhost:3000/docshttp://localhost:3001/api/docs/uiKey files:
Coal deploys as six Vercel projects from the same monorepo, each with its own rootDirectory:
| Vercel project | Domain | Root |
|---|---|---|
coal | www.usecoal.xyz | frontend/ |
coal-backend | api.usecoal.xyz | backend/ |
coal-agent | agent.usecoal.xyz | examples/coal-agent/ |
coal-mcp-server | mcp.usecoal.xyz | examples/coal-mcp-server/ |
coal-oracle-agent | oracle.usecoal.xyz | examples/coal-oracle-agent/ |
coal-demo-store | store.usecoal.xyz | examples/demo-store/ |
Helper scripts:
scripts/check-all.sh — backend + frontend typecheck + tests + build sweep.scripts/deploy.sh — local prebuild + push to Vercel for any subset of the six projects.main is the only branch on the public repo. Vercel production targets main.main (PRs merge there).Three co-founders, friends for years. Shipping consumer products, payments, and AI tools together.
| Role | Name | |
|---|---|---|
| Co-founder · Engineering | Emmanuel Haankwenda | linkedin.com/in/emmanuelhaankwenda |
| Co-founder · Engineering | Bernard Namangala | linkedin.com/in/bernard-namangala |
| Co-founder · Product & Design | Andre Haankwenda | linkedin.com/in/andrehaankwenda |
Coal went from zero to mainnet in six weeks. None of that happens without this team.
MIT — Copyright (c) 2026 Coal.
Be the first to review this server!
by Modelcontextprotocol · Developer Tools
Web content fetching and conversion for efficient LLM usage
by Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
by mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.