Skip to content

io.github.Kali123411/k402

by Kali123411 · remote · local (pypi) · no sign-in to list tools · v0.7.0 · published by GitHub user Kali123411

Agent-payable APIs on Kaspa: LLMs, chain data, covenants, zk proofs — pay per call, no API key

Final · 3Changes · 23
CompareRegistry entry

36 tools: 3 do something that can't be undone, 23 change things and 10 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http k402 https://x402-compute.68cxgfyr0.workers.dev/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

36 tools

Can't be undone 3Claude Code: ask
  • covenant_broadcastBroadcast a signed covenant tx (RpcTransaction JSON from covenant_build).Can send data outNo findings

    Why it is in this group

    • The name "covenant_broadcast" says "broadcast": a word for sending, and what is sent cannot be taken back.

    What it can reach

    • outboundThe name "covenant_broadcast" says "broadcast": it sends or publishes something to other people.
    Description, as the server wrote it
    Broadcast a signed covenant tx (RpcTransaction JSON from covenant_build). MAINNET moves real KAS — run covenant_check first. Paid (~$0.0003).
  • pay_per_callComplete a PER-CALL coin payment.Can send data outNo findings

    Why it is in this group

    • The name "pay_per_call" says "pay": a word that usually means money moves, which cannot be taken back.

    What it can reach

    • outboundThe input takes a URL (input.endpoint): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Complete a PER-CALL coin payment. After a paid tool returns a 402 with pay_per_call_offers, pay one offer on-chain from your own wallet, then call this with the 402's `endpoint` and `request_body`, the chosen offer's `scheme` and `payment_id`, and your payment `txid`. The gateway verifies the payment landed and returns the tool's real result. (Alternative to a prepaid session — use this when you'd rather pay each call directly in a specific coin.)
  • payment_optionsWhich coins and schemes this gateway accepts for payment.No findings

    Why it is in this group

    • The name "payment_options" says "payment": a word that usually means money moves, which cannot be taken back.
    Description, as the server wrote it
    Which coins and schemes this gateway accepts for payment. Free. Ways to pay any paid tool: a prepaid KAS session (open_session — simplest, no per-call step); per-call in any listed coin (pay the offer a 402 returns, then pay_per_call); or, where the experimental 'kaspa-channel' scheme is offered, a covenant payment channel that settles per-call vouchers on L1 with no custodian (see channel_config). Coins may include Kaspa, Pearl, BTC, LTC, DOGE, BCH, DASH, and EVM assets (ETC, ETH, USDC, USDT).
Changes things 23Claude Code: ask
  • attest_verifyVerify a RISC Zero receipt against an image_id -> {valid, journal_b64}.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Verify a RISC Zero receipt against an image_id -> {valid, journal_b64}. Anyone can check an attestation without trusting the prover. Paid (~$0.0002).
  • channel_configParameters for opening a kaspa-channel — a covenant-enforced payment channel that settles per-call vouchers on Kaspa L1 with NO custodian (the trustless alternative to a prepaid se…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Parameters for opening a kaspa-channel — a covenant-enforced payment channel that settles per-call vouchers on Kaspa L1 with NO custodian (the trustless alternative to a prepaid session). Returns the payee pubkey, min/max channel size, required expiry lead, and maxfee. Free. Opening a channel means funding the channel covenant on-chain (payer holds the key), then paying per call with signed vouchers — use the `k402` Python client (`pip install k402`, k402.channel) to build the covenant and sign vouchers, since that flow needs your Kaspa key. Returns {error} if this gateway hasn't enabled the (experimental) channel rail.
  • classifyClassify text into one (or multiple, if multi=true) of 2-32 labels; the result is constrained to your label set.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Classify text into one (or multiple, if multi=true) of 2-32 labels; the result is constrained to your label set. Paid (~$0.0003 in KAS).
  • covenant_addressDerive the covenant P2SH address for a compiled script on 'mainnet' or 'testnet-10'.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Derive the covenant P2SH address for a compiled script on 'mainnet' or 'testnet-10'. Paid (~$0.0003).
  • covenant_buildAssemble a covenant spend tx.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Assemble a covenant spend tx. Each input: {txid, index, entry, compute_budget?, and either sigscript:{source,decl,args,is_leader?} to build a covenant sigscript server-side, or omit sigscript for a P2PK input you sign locally}. Each output: {amount, address|script_public_key_hex, covenant?:{authorizing_input,covenant_id}}. Returns the tx, a broadcast-ready rpc_transaction, fee accounting, and (if fully authorized) a pre-verify. We never sign. Paid (~$0.001).
  • covenant_checkLocal txscript pre-verify of a signed covenant tx BEFORE broadcast — catches script failures that would otherwise cost you a broadcast.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Local txscript pre-verify of a signed covenant tx BEFORE broadcast — catches script failures that would otherwise cost you a broadcast. 'entries' are the spent UTXOs (covenant_utxos output plugs in directly). Returns {all_ok, inputs:[{index, ok, error?}]}. Paid (~$0.0005).
  • covenant_compileCompile a Silverscript covenant to script hex, ABI, hardened template hash, and its P2SH address on each network.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Compile a Silverscript covenant to script hex, ABI, hardened template hash, and its P2SH address on each network. constructor_args is the silverc ctor JSON (e.g. [{"kind":"int","data":7}]). Paid (~$0.002). NOTE: 'compiles' ≠ proven on-chain.
  • covenant_utxosLive UTXO set locked under a covenant address (covenant state inspection), from the node.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Live UTXO set locked under a covenant address (covenant state inspection), from the node. Optionally filter by covenant_id. Paid (~$0.0003).
  • embed_textEmbed up to 64 texts (768-dim vectors, nomic-embed-text).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Embed up to 64 texts (768-dim vectors, nomic-embed-text). Paid (~$0.0003 in KAS).
  • extractExtract structured data from text as JSON guaranteed to match your JSON schema (schema-constrained decoding, not best-effort).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Extract structured data from text as JSON guaranteed to match your JSON schema (schema-constrained decoding, not best-effort). Paid (~$0.0015 in KAS).
  • generateRun a prompt on a GPU model tier: 'chat' (fast 7B, ~$0.0015), 'llama' (budget 8B, ~$0.0008), 'reason' (35B, ~$0.004), 'think' (deep chain-of-thought 35B MoE, ~$0.004), 'code' (code…No findings

    Why it is in this group

    • The name "generate" says "generate": a word for a change.
    Description, as the server wrote it
    Run a prompt on a GPU model tier: 'chat' (fast 7B, ~$0.0015), 'llama' (budget 8B, ~$0.0008), 'reason' (35B, ~$0.004), 'think' (deep chain-of-thought 35B MoE, ~$0.004), 'code' (coder model, ~$0.0025), or 'kaspa-expert' (RAG-grounded, current Kaspa knowledge, ~$0.0015). Returns the completion text.
  • kaspa_balanceBalance of any Kaspa MAINNET address, straight from a node (no indexer, no API key).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Balance of any Kaspa MAINNET address, straight from a node (no indexer, no API key). Paid (~$0.00015 in KAS).
  • kaspa_fee_estimateCurrent Kaspa mainnet feerate buckets (sompi per gram of tx mass).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Current Kaspa mainnet feerate buckets (sompi per gram of tx mass). Paid (~$0.00015).
  • kaspa_networkKaspa mainnet status: DAA score, block count, difficulty, node sync state.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Kaspa mainnet status: DAA score, block count, difficulty, node sync state. Paid (~$0.00015 in KAS).
  • kaspa_utxosUTXO set of a Kaspa mainnet address, including scriptPublicKey and covenant_id where set.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    UTXO set of a Kaspa mainnet address, including scriptPublicKey and covenant_id where set. Paid (~$0.0003 in KAS).
  • open_sessionOpen a prepaid payment session: returns a session key and a personal Kaspa MAINNET deposit address.No findings

    Why it is in this group

    • The name "open_session" says "open": a word for a change.
    Description, as the server wrote it
    Open a prepaid payment session: returns a session key and a personal Kaspa MAINNET deposit address. Send KAS to the address from any wallet (min 0.25 KAS); confirmed deposits become spendable balance within seconds and every paid tool call meters against it. Free. The session is saved locally so subsequent calls use it automatically.
  • prove_guest_uploadUpload a RISC Zero program binary (the .bin risc0-build emits, base64) once; returns its content-addressed image_id (also the verification key), reusable across proofs.No findings

    Why it is in this group

    • The name "prove_guest_upload" says "upload": a word for a change.
    Description, as the server wrote it
    Upload a RISC Zero program binary (the .bin risc0-build emits, base64) once; returns its content-addressed image_id (also the verification key), reusable across proofs. Paid (~$0.01).
  • prove_preflightExecute a guest WITHOUT proving: exact cycle count + a signed price quote {total_cycles, price_kas, quote_id, quote_expires}.No findings

    Why it is in this group

    • The description's first verb is "execute": a word for a change.
    Description, as the server wrote it
    Execute a guest WITHOUT proving: exact cycle count + a signed price quote {total_cycles, price_kas, quote_id, quote_expires}. Run this first — proving cost scales with cycles by orders of magnitude. Paid (~$0.002).
  • prove_submitQueue a proving job -> {job_id, cost_kas}.No findings

    Why it is in this group

    • The name "prove_submit" says "submit": a word for a change.
    Description, as the server wrote it
    Queue a proving job -> {job_id, cost_kas}. Pass quote_id (from prove_preflight; charged the quote) or max_kas (skip preflight; priced on actual cycles, refuses if over the cap). Then poll job_status and fetch job_result. Paid: the proof's cycle-based price (dynamic).
  • registry_providerFull detail on one provider in the service exchange by its payee pubkey: every service it lists, its chain-verified reputation (settled KAS volume + settlement count), and its paye…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Full detail on one provider in the service exchange by its payee pubkey: every service it lists, its chain-verified reputation (settled KAS volume + settlement count), and its payee address. Free.
  • rewriteRewrite text per an instruction (tone, format, length...).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Rewrite text per an instruction (tone, format, length...). Paid (~$0.001 in KAS).
  • search_indexStore documents [{id, text, meta?}] in a named server-side collection for semantic search.Reads private dataNo findings

    Why it is in this group

    • The name "search_index" says "search": a word for reading.
    • The description's first verb is "store": a word for a change.

    What it can reach

    • private-dataThe description's first sentence says "document": it reads documents.
    Description, as the server wrote it
    Store documents [{id, text, meta?}] in a named server-side collection for semantic search. Use an unguessable collection name and keep it secret. Paid (~$0.0015 in KAS).
  • use_sessionAttach an existing k402 session key (from a previous open_session) so paid calls meter against its balance — use after reconnecting to the hosted endpoint, or to carry one funded s…No findings

    Why it is in this group

    • The description's first verb is "attach": a word for a change.
    Description, as the server wrote it
    Attach an existing k402 session key (from a previous open_session) so paid calls meter against its balance — use after reconnecting to the hosted endpoint, or to carry one funded session across clients. Returns the session's current balance. Free.
Only reads 10Claude Code: allow, ask for 2 outbound
  • catalogList every service this gateway sells (text tools, Kaspa chain data, LLM tiers) with live prices in KAS and USD.No findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.
    Description, as the server wrote it
    List every service this gateway sells (text tools, Kaspa chain data, LLM tiers) with live prices in KAS and USD. Free. Start here to see what's available and what calls cost.
  • channel_statusStatus of a kaspa-channel by its channel id (covenant id): funded value, amount spent via vouchers, remaining, expiry, and whether it has been closed on-chain.No findings

    Why it is in this group

    • The name "channel_status" says "status": a word for reading.
    Description, as the server wrote it
    Status of a kaspa-channel by its channel id (covenant id): funded value, amount spent via vouchers, remaining, expiry, and whether it has been closed on-chain. Free.
  • job_resultFetch a finished proving job's result {image_id, total_cycles, journal_b64, receipt_b64}.No findings

    Why it is in this group

    • The description's first verb is "fetch": a word for reading.
    Description, as the server wrote it
    Fetch a finished proving job's result {image_id, total_cycles, journal_b64, receipt_b64}. 404 until done; results kept 24h. Free.
  • job_statusPoll a proving job: queued/running/done/failed, queue position, cost.No findings

    Why it is in this group

    • The name "job_status" says "status": a word for reading.
    Description, as the server wrote it
    Poll a proving job: queued/running/done/failed, queue position, cost. Free.
  • kaspa_tx_statusMempool status of a Kaspa transaction.No findings

    Why it is in this group

    • The name "kaspa_tx_status" says "status": a word for reading.
    Description, as the server wrote it
    Mempool status of a Kaspa transaction. Absent from mempool means accepted-or-unknown — confirm acceptance by checking one of its outputs with kaspa_utxos. Paid (~$0.00015).
  • read_urlFetch a public web page and return its title + clean markdown; distill=true adds key-fact bullets.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "read_url" says "read": a word for reading.

    What it can reach

    • untrusted-inputThe name "read_url" says "read" and "url": it reads web pages, which anyone can write.
    • untrusted-inputThe description's first sentence says "fetch" and "web": it reads web pages, which anyone can write.
    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    Fetch a public web page and return its title + clean markdown; distill=true adds key-fact bullets. Useful when you have no web access of your own. Paid (~$0.0012 in KAS).
  • search_querySemantic-search a collection you indexed earlier; returns top-k matches with scores.No findings

    Why it is in this group

    • The name "search_query" says "search": a word for reading.
    Description, as the server wrote it
    Semantic-search a collection you indexed earlier; returns top-k matches with scores. Paid (~$0.0003 in KAS).
  • session_statusCheck the current payment session: deposit address, deposited / spent / remaining KAS.No findings

    Why it is in this group

    • The name "session_status" says "status": a word for reading.
    Description, as the server wrote it
    Check the current payment session: deposit address, deposited / spent / remaining KAS. Free.
  • summarizeSummarize text or a public URL in at most max_words.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "summarize" says "summarize": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "summarize" and "url": it reads web pages, which anyone can write.
    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    Summarize text or a public URL in at most max_words. Paid (~$0.001 in KAS).

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

8 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 private-data tool breaks every one.

Reads private data1
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write2
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out4
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__k402__search_index"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 14:52 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
26
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
none
RFC 9728 protected resource metadata
none
Authorization servers
none
Legacy HTTP+SSE transport
no
Dynamic client registration
not observed
Client ID metadata documents
not observed
  • HighThe whole server

    The endpoint served tools/list without credentials, and the list has 26 tools that change things (3 irreversible, 23 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://x402-compute.68cxgfyr0.workers.dev/mcp: tools/list returned 36 tools to an anonymous client, including payment_options (irreversible), pay_per_call (irreversible), covenant_broadcast (irreversible), open_session (write), use_session (write) and 21 more

    What this check looks for

Install

Pinned to version 0.7.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http k402 https://x402-compute.68cxgfyr0.workers.dev/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__k402__catalog",
      "mcp__k402__session_status",
      "mcp__k402__registry_search",
      "mcp__k402__channel_status",
      "mcp__k402__search_query",
      "mcp__k402__kaspa_tx_status",
      "mcp__k402__job_status",
      "mcp__k402__job_result"
    ],
    "ask": [
      "mcp__k402__open_session",
      "mcp__k402__use_session",
      "mcp__k402__registry_provider",
      "mcp__k402__channel_config",
      "mcp__k402__payment_options",
      "mcp__k402__pay_per_call",
      "mcp__k402__summarize",
      "mcp__k402__extract",
      "mcp__k402__rewrite",
      "mcp__k402__classify",
      "mcp__k402__read_url",
      "mcp__k402__embed_text",
      "mcp__k402__search_index",
      "mcp__k402__kaspa_balance",
      "mcp__k402__kaspa_utxos",
      "mcp__k402__kaspa_fee_estimate",
      "mcp__k402__kaspa_network",
      "mcp__k402__generate",
      "mcp__k402__covenant_compile",
      "mcp__k402__covenant_address",
      "mcp__k402__covenant_utxos",
      "mcp__k402__covenant_build",
      "mcp__k402__covenant_check",
      "mcp__k402__covenant_broadcast",
      "mcp__k402__prove_guest_upload",
      "mcp__k402__prove_preflight",
      "mcp__k402__prove_submit",
      "mcp__k402__attest_verify"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as k402. Review it before you use it.

Capability tags behind 5 rules
  • mcp__k402__pay_per_call outbound
  • mcp__k402__summarize untrusted-input, outbound
  • mcp__k402__read_url untrusted-input, outbound
  • mcp__k402__search_index private-data
  • mcp__k402__covenant_broadcast outbound