← Back to search

@ic402/mcp

GitHub Actions Scanned 21d ago

MCP server for ic402 — exposes x402 charges and streaming sessions as tools

npm
B
76.2 / 100

Versions

2.11.0latest
Jul 31, 2026
2.10.0
Jul 17, 2026
2.9.1
Jul 15, 2026
2.9.0
Jul 10, 2026
2.8.0
Jul 6, 2026
+ show 7 moreshow less
2.7.0
Jul 3, 2026
2.6.1
Jul 3, 2026
2.6.0
Jul 3, 2026
2.5.5
Jul 3, 2026
2.5.4
Jul 3, 2026
2.5.3
Jul 2, 2026
2.5.2
Jul 2, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 16

configure
annotations: none low

Connect to an ic402-enabled ICP canister and optionally load a signing identity. MUST be

search
annotations: none low

Probe the canister\

query string
request_session
annotations: none low

Fetch the session intent from the canister — pricing such as suggestedDeposit and

open_session
annotations: none low

Open a streaming micropayment session by escrowing a deposit — this MOVES FUNDS. Two-phase:

v number to string from string
session_query
annotations: none low

Send a query through an already-open session. Auto-signs a micropayment voucher; each call

question string
get_session
annotations: none low

Read the state of an active session: deposited, consumed, and remaining atomic amounts.

sessionId string
close_session
annotations: none low

Close an active session — SETTLES VALUE on-chain: the consumed amount is paid out and the

list_sessions
annotations: none low

List all sessions currently held by this MCP server process (sessionId, deposited,

fetch_content
annotations: none low

Retrieve content described by a ContentDelivery JSON payload previously returned by a

fetch_x402
annotations: none low

Fetch an x402 (HTTP 402) payment-gated URL, optionally paying from the canister

register_agent
annotations: none low

Register the canister as an ERC-8004 agent on an EVM chain: fetch nonce+gas, canister signs

list_services
annotations: none low

List the paid services registered on the canister. Read-only; no funds moved. Use this

submit_request
annotations: none low

Submit a marketplace service request; MOVES FUNDS when the service is paid. Flow: the price

serviceId string
get_job_result
annotations: none low

Poll the canister for a job result until it completes or the attempt limit is reached.

jobId string
dispute_job
annotations: none low

Dispute a job result on the canister (only meaningful for services using BuyerConfirm

jobId string
call
annotations: none low

Escape hatch: invoke a READ-ONLY query method on the canister. Allowed: a curated getter

Permissions 4

network medium
Server uses network capabilities via: fetch()
filesystem low
Server uses filesystem capabilities via: fs, fs sync ops
shell high
Server uses shell capabilities via: child_process, execSync()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 58

low
Tool 'list_sessions' has no annotations annotation_checker · 100%
low
Tool 'configure' has no annotations annotation_checker · 100%
low
Tool 'search' has no annotations annotation_checker · 100%
low
Tool 'request_session' has no annotations annotation_checker · 100%
low
Tool 'open_session' has no annotations annotation_checker · 100%
low
Tool 'session_query' has no annotations annotation_checker · 100%
low
Tool 'get_session' has no annotations annotation_checker · 100%
low
Tool 'close_session' has no annotations annotation_checker · 100%
low
Tool 'fetch_content' has no annotations annotation_checker · 100%
low
Tool 'fetch_x402' has no annotations annotation_checker · 100%
low
Tool 'register_agent' has no annotations annotation_checker · 100%
low
Tool 'list_services' has no annotations annotation_checker · 100%
low
Tool 'submit_request' has no annotations annotation_checker · 100%
low
Tool 'get_job_result' has no annotations annotation_checker · 100%
low
Tool 'dispute_job' has no annotations annotation_checker · 100%
low
Tool 'call' has no annotations annotation_checker · 100%
medium
OAuth implementation without PKCE auth_checker · 75%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Buffer.from base64 in vhew-ic402-3fd9923/test/x402-conformance.test.ts:60 entropy_analyzer · 75%
medium
Hex string literal (>50 chars) in vhew-ic402-3fd9923/test/x402-conformance.test.ts:34 entropy_analyzer · 70%
medium
Buffer.from base64 in vhew-ic402-3fd9923/test/helpers.ts:23 entropy_analyzer · 75%
medium
Buffer.from base64 in vhew-ic402-3fd9923/test/integration.test.ts:843 entropy_analyzer · 75%
medium
Buffer.from base64 in vhew-ic402-3fd9923/test/integration.test.ts:920 entropy_analyzer · 75%
medium
Hex string literal (>50 chars) in vhew-ic402-3fd9923/test/demo-codec.test.ts:112 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in vhew-ic402-3fd9923/test/demo-codec.test.ts:129 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in vhew-ic402-3fd9923/test/demo-codec.test.ts:133 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in vhew-ic402-3fd9923/test/demo-codec.test.ts:136 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in vhew-ic402-3fd9923/example/client/src/steps.ts:1095 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in vhew-ic402-3fd9923/example/client/src/steps.ts:1120 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in vhew-ic402-3fd9923/example/client/src/steps.ts:1122 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in vhew-ic402-3fd9923/example/client/src/steps.ts:1123 entropy_analyzer · 70%
medium
Buffer.from base64 in vhew-ic402-3fd9923/integrations/mcp/src/index.ts:396 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Tool: configure manifest_parser · 70%
info
Tool: search manifest_parser · 70%
info
Tool: request_session manifest_parser · 70%
info
Tool: open_session manifest_parser · 70%
info
Tool: session_query manifest_parser · 70%
info
Tool: get_session manifest_parser · 70%
info
Tool: close_session manifest_parser · 70%
info
Tool: list_sessions manifest_parser · 70%
info
Tool: fetch_content manifest_parser · 70%
info
Tool: fetch_x402 manifest_parser · 70%
info
Tool: register_agent manifest_parser · 70%
info
Tool: list_services manifest_parser · 70%
info
Tool: submit_request manifest_parser · 70%
info
Tool: get_job_result manifest_parser · 70%
info
Tool: dispute_job manifest_parser · 70%
info
Tool: call manifest_parser · 70%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (15) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 20 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%