Pop Pay

Name: Pop Pay
Author: 100xPercent

by 100xPercentversion 0.5.7i★ –iRuns on your computer

Registry nameio.github.100xPercent/pop-pay

Install

Overview

Description from the maker (original English)

Runtime security for AI agent commerce. CLI + MCP server blocks hallucinated purchases.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiNot measured yet★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs on your computer
Transport: stdio
Category: Online shops & payments

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on your computer with your user’s permissions (files, network, apps).
You fill in yourself: POP_CDP_URL, POP_ALLOWED_CATEGORIES, POP_MAX_PER_TX, POP_MAX_DAILY, POP_GUARDRAIL_ENGINE

You need

npmNode.js installed (for the npx command)

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "pop-pay": {
      "command": "npx",
      "args": [
        "-y",
        "pop-pay"
      ],
      "env": {
        "POP_CDP_URL": "your-value",
        "POP_ALLOWED_CATEGORIES": "your-value",
        "POP_MAX_PER_TX": "your-value",
        "POP_MAX_DAILY": "your-value",
        "POP_GUARDRAIL_ENGINE": "your-value"
      }
    }
  }
}

Run this in your terminal

claude mcp add pop-pay --env POP_CDP_URL=your-value --env POP_ALLOWED_CATEGORIES=your-value --env POP_MAX_PER_TX=your-value --env POP_MAX_DAILY=your-value --env POP_GUARDRAIL_ENGINE=your-value -- npx -y pop-pay

Fill in the empty values before running it.

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "pop-pay": {
      "command": "npx",
      "args": [
        "-y",
        "pop-pay"
      ],
      "env": {
        "POP_CDP_URL": "your-value",
        "POP_ALLOWED_CATEGORIES": "your-value",
        "POP_MAX_PER_TX": "your-value",
        "POP_MAX_DAILY": "your-value",
        "POP_GUARDRAIL_ENGINE": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "pop-pay": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "pop-pay"
      ],
      "env": {
        "POP_CDP_URL": "your-value",
        "POP_ALLOWED_CATEGORIES": "your-value",
        "POP_MAX_PER_TX": "your-value",
        "POP_MAX_DAILY": "your-value",
        "POP_GUARDRAIL_ENGINE": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.

Your choice stays on this device in a cookie; no account needed.

Values you fill in

POP_CDP_URL env
Chrome DevTools Protocol endpoint for credential injection (default: http://localhost:9222)
POP_ALLOWED_CATEGORIES env
JSON array of allowed vendor categories (e.g. '["aws","cloudflare"]')
POP_MAX_PER_TX env
Per-transaction spending limit in USD
POP_MAX_DAILY env
Daily spending limit in USD
POP_GUARDRAIL_ENGINE env
Guardrail engine: 'keyword' (offline, default) or 'llm' (requires API key)

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Runs on your computer; the tool list appears in your AI app after you install it.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 8, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account 100xPercent, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
– Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
– Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
… Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints

Compared with others in Online shops & paymentsi

More stars than 0% of the other 2546 servers in this category
Published to the registry more recently than 5% of the other 2546 servers in this category
Basic checks equal to or better than 100% of the other 2546 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is Pop Pay safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

The registry does not list a required key, though some servers ask you to sign in on first use.

Does it run on my computer or in the cloud?

It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).

Is it still maintained?

The GitHub repo last changed –, and the latest version (0.5.7) reached the registry 7 months ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Node.js on your computer.

What can I use instead?

In the same category: Spree Commerce: open-source B2B and marketplace ecommerce, Stripe MCP, MCP Cn Commerce

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Spree Commerce: open-source B2B and marketplace ecommerce

by spree

Open-source B2B and marketplace ecommerce; new stores include an MCP server for AI agents.

Runs in the cloud★ 15,812BSD-3-ClauseUpdated 8 days ago

Install

Stripe MCP

by stripe

Stripe’s official server lets AI view and manage customers, products, payments and invoices. Connect to Stripe’s cloud and sign in with OAuth.

Runs in the cloud★ 2,043MITUpdated 12 months ago

Install

MCP Cn Commerce

by TonyWang-hub

8 read-only MCP platform entries; support is operation-specific; merchant live acceptance pending

Runs on your computer★ 96MITUpdated 29 days ago

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

Point One Percent — pop-pay

it only takes 0.1% of Hallucination to drain 100% of your wallet.

The runtime security layer for AI agent commerce. Drop-in CLI + MCP server. Card credentials are injected directly into the browser DOM via CDP — they never enter the agent's context window. One hallucinated prompt can't drain a wallet it can't see.

📄 Research Dataset & Reproduction — this repository hosts the open dataset and reproduction harness for *"The Illusion of Single-Attacker Rankings"*. research: jump to Research Dataset & Reproduction.

Install

Choose your preferred method:

Homebrew (macOS)

brew install 100xpercent/tap/pop-pay

curl (Linux / macOS) — bootstraps via npm; requires Node.js 18+

curl -fsSL https://raw.githubusercontent.com/100xPercent/pop-pay/main/install.sh | sh

npm (global)

npm install -g pop-pay

npx (no install — one-off runs)

npx -y pop-pay <command>

All install paths expose the same binaries: pop-pay, pop-launch, pop-init-vault, pop-unlock.

Also available as @100xpercent/mcp-server-pop-pay — identical package under the MCP @scope/mcp-server- convention. Tracks the same version on every release.

Using Python? Check out pop-pay-python — pip install pop-pay. Same security model, same vault format, independent release cycle — safe to switch between runtimes.

Quick Start (CLI)

1. Initialize the encrypted credential vault

pop-pay init-vault

This encrypts your card credentials into ~/.config/pop-pay/vault.enc (AES-256-GCM). For stronger protection (blocks agents with shell access):

pop-pay init-vault --passphrase   # one-time setup

pop-pay unlock # run once per session

2. Launch Chrome with CDP remote debugging

pop-pay launch

This opens a Chromium instance on http://localhost:9222 that pop-pay injects credentials into. Your agent (via MCP, browser automation, or x402) then drives the checkout flow — card details never leave the browser process.

3. Plug into your agent

The CLI launches infrastructure; the actual payment tool calls come from your agent. Two supported paths:

MCP server — add pop-pay to any MCP-compatible client (Claude Code, Cursor, Windsurf, OpenClaw). See MCP Server below.
x402 HTTP — pay for API calls via the x402 payment protocol.

Full CLI reference: pop-pay --help.

MCP Server (optional)

Add to your MCP client

Standard config for any MCP-compatible client:

"mcpServers": { "pop-pay": { "command": "npx", "args": ["-y", "pop-pay", "launch-mcp"], "env": { "POP_CDP_URL": "http://localhost:9222" } } } }

Claude Code

Claude Code uses its own CLI — the JSON config above is not needed.

claude mcp add --scope user pop-pay -- npx -y pop-pay launch-mcp

--scope user makes it available across all projects. To remove: claude mcp remove pop-pay

Cursor / Windsurf / VS Code

Add the JSON config above to:

Cursor: ~/.cursor/mcp.json
Windsurf: ~/.codeium/windsurf/mcp_config.json
VS Code (Copilot): .vscode/mcp.json in project root

OpenClaw / NemoClaw

OpenClaw has its own CLI — the JSON config above is not needed.

openclaw mcp add pop-pay -- npx -y pop-pay launch-mcp

Or add to ~/.openclaw/mcp_servers.json using the JSON config above.

For System Prompt templates and NemoClaw sandbox setup, see Integration Guide §4.

Docker

docker-compose up -d

Runs the MCP server + headless Chromium with CDP. Mount your encrypted vault from the host.

MCP Tools

Tool	Description
`request_virtual_card`	Issue a virtual card and inject credentials into the checkout page via CDP. Automatically scans the page for hidden prompt injections.
`request_purchaser_info`	Auto-fill billing/contact info (name, address, email, phone). Automatically scans the page for hidden prompt injections.
`request_x402_payment`	Pay for API calls via the x402 HTTP payment protocol.

Tip for Claude Code users: Add the following to your project's CLAUDE.md to help the agent know when to call pop-pay:

*"When you encounter a payment form or checkout page, use the request_virtual_card tool. For billing/contact info forms, use request_purchaser_info first."*

Configuration

Core variables in ~/.config/pop-pay/.env. See ENV_REFERENCE.md for the full list.

Variable	Default	Description
`POP_ALLOWED_CATEGORIES`	`["aws","cloudflare"]`	Approved vendor categories — see Categories Cookbook
`POP_MAX_PER_TX`	`100.0`	Max USD per transaction
`POP_MAX_DAILY`	`500.0`	Max USD per day
`POP_BLOCK_LOOPS`	`true`	Block hallucination/retry loops
`POP_AUTO_INJECT`	`true`	Enable CDP card injection
`POP_GUARDRAIL_ENGINE`	`keyword`	`keyword` (zero-cost) or `llm` (semantic)

Guardrail Mode

	`keyword` (default)	`llm`
Mechanism	Keyword matching on reasoning string	Semantic analysis via LLM
Cost	Zero — no API calls	One LLM call per request
Best for	Development, low-risk workflows	Production, high-value transactions

To enable LLM mode, see Integration Guide §1.

Providers

Provider	Description
BYOC (default)	Bring Your Own Card — encrypted vault credentials, local CDP injection.
Stripe Issuing	Real virtual cards via Stripe API. Requires `POP_STRIPE_KEY`.
Lithic	Multi-issuer adapter (Stripe Issuing / Lithic).
Mock	Test mode with generated card numbers for development.

Priority: Stripe Issuing → BYOC Local → Mock.

Security

Layer	Defense
Context Isolation	Card credentials never enter the agent's context window or logs
Encrypted Vault	AES-256-GCM with XOR-split salt and native scrypt key derivation (Rust)
TOCTOU Guard	Domain verified at the moment of CDP injection — blocks redirect attacks
Repr Redaction	Automatic masking (`****-4242`) in all MCP responses, logs, and tracebacks

See THREAT_MODEL.md for the full STRIDE analysis and COMPLIANCE_FAQ.md for enterprise details.

Architecture

TypeScript — MCP server, CDP injection engine, guardrails, CLI
Rust (napi-rs) — Native security layer: XOR-split salt storage, scrypt key derivation
Node.js crypto — AES-256-GCM vault encryption (OpenSSL binding)
Chrome DevTools Protocol — Direct DOM injection via raw WebSocket

Documentation

Threat Model — STRIDE analysis, 5 security primitives, 10 attack scenarios
Guardrail Benchmark — Cross-model evaluation (Anthropic / OpenAI / Gemini) across 585 payloads, 11 attack categories
Compliance FAQ — PCI DSS, SOC 2, GDPR details
Environment Reference — All POP_* environment variables
Integration Guide — Setup for Claude Code, Node.js SDK, and browser agents
Categories Cookbook — POP_ALLOWED_CATEGORIES patterns and examples

Research Dataset & Reproduction

This repository hosts the open-source dataset and harness for the cross-vendor attacker-stability methodology described in the corresponding research paper. Reviewer/researcher reproduction artifacts:

Corpus (585 attack payloads, 11 categories): tests/redteam/corpus/
attacks.json — full payload set with category labels
GENERATION.md — corpus generation protocol
schema.json — payload schema
Run JSONLs (26,325 rows, 9 models × 585 payloads × N=5): tests/redteam/runs/
PRIMARY whitebox-no-feedback runs: runs/adaptive/2026-04-28T19-50-*
Static panel runs: runs/static/
Prompt-ablation (v3 / strict / paranoid): runs/ablation/
Manifest hashes: tests/redteam/runs/MANIFEST.sha256 — byte-level integrity for all artifacts
Croissant 1.0 metadata (Core + RAI fields): paper-artifacts/croissant.json
Reproduction scripts (regenerate paper tables/figures from JSONL):
python3 paper-artifacts/gen-tables.py --table all — Tab.~bypassk / threat-ablation / cross-vendor
python3 paper-artifacts/gen-taxonomy-map.py — Fig.~taxonomy-map
License: corpus CC BY-SA 4.0, harness MIT.

For dataset schema, statistical methodology (bootstrap CI, Holm-Bonferroni, McNemar), full from-scratch re-collection instructions, JSONL row data dictionary, and responsible-disclosure policy, see [docs/PAPER_REPRODUCTION.md](docs/PAPER_REPRODUCTION.md).

License

MIT

Pop Pay

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

Values you fill in

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Online shops & paymentsi

Common questions

Alternatives

Spree Commerce: open-source B2B and marketplace ecommerce

Stripe MCP

MCP Cn Commerce

README from the maker

Point One Percent — pop-pay

Install

Quick Start (CLI)

1. Initialize the encrypted credential vault

2. Launch Chrome with CDP remote debugging

3. Plug into your agent

MCP Server (optional)

Add to your MCP client

MCP Tools

Configuration

Guardrail Mode

Providers

Security

Architecture

Documentation

Research Dataset & Reproduction

License