Open-source B2B and marketplace ecommerce; new stores include an MCP server for AI agents.
Runs in the cloud★ 15,812BSD-3-ClauseUpdated 8 days ago
Install
Payment Guard MCP
Overview
Description from the maker (original English)
Pre-send risk check for AI agents that move money — screen an address or payment URL before sending.
PopNx MCP’s three pillars
These three are never merged into one score: opinions, measurements and popularity are different things.
- User voiceiNo reviews yetReviews open together with accounts in a later step
- Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
- UsageiNot measured yet★ –
What you can do with it
We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.
- Connection: Runs on your computer
- Transport: stdio
- Category: Online shops & payments
Install
Pick the AI app you use, then copy the settings.
Before you install
- Basic checks: 1 of 1 passed
- Runs on your computer with your user’s permissions (files, network, apps).
- The registry lists no key to fill in.
You need
- npmNode.js installed (for the npx command)
Which app do you use?
Pick your app above. We remember it, so next time the button says “Install in …”.
Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json
{
"mcpServers": {
"payment-guard": {
"command": "npx",
"args": [
"-y",
"payment-guard-mcp"
]
}
}
}Run this in your terminal
claude mcp add payment-guard -- npx -y payment-guard-mcpOr copy the settings yourself
Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json
{
"mcpServers": {
"payment-guard": {
"command": "npx",
"args": [
"-y",
"payment-guard-mcp"
]
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
Or copy the settings yourself
Paste into .vscode/mcp.json in your project
{
"servers": {
"payment-guard": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"payment-guard-mcp"
]
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.
Your choice stays on this device in a cookie; no account needed.
These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.
What it can do
Runs on your computer; the tool list appears in your AI app after you install it.
Basic checksi
We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 8, 2026
- ✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account mlawsonking, which owns the repo
- … Not checked yet
Still maintained
We have not read this repo from GitHub yet
- … Not checked yet
Has a licence
We have not read this repo from GitHub yet
- – Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
- – Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
- … Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints
Compared with others in Online shops & paymentsi
- More stars than 0% of the other 2547 servers in this category
- Published to the registry more recently than 24% of the other 2547 servers in this category
- Basic checks equal to or better than 100% of the other 2547 servers in this category
Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.
Common questions
Is Payment Guard MCP safe?
It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.
What keys or codes does it need?
The registry does not list a required key, though some servers ask you to sign in on first use.
Does it run on my computer or in the cloud?
It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).
Is it still maintained?
The GitHub repo last changed –, and the latest version (1.3.0) reached the registry 3 months ago.
Which apps can use it?
Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Node.js on your computer.
What can I use instead?
In the same category: Spree Commerce: open-source B2B and marketplace ecommerce, Stripe MCP, MCP Cn Commerce
Alternatives
Servers in the same category from other makers, sorted by stars.
Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi
Stripe MCP
by stripe
Stripe’s official server lets AI view and manage customers, products, payments and invoices. Connect to Stripe’s cloud and sign in with OAuth.
Runs in the cloud★ 2,043MITUpdated 12 months ago
Install
MCP Cn Commerce
by TonyWang-hub
8 read-only MCP platform entries; support is operation-specific; merchant live acceptance pending
Runs on your computer★ 96MITUpdated 29 days ago
Install
README from the maker
Open the README
Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.
payment-guard-mcp
An MCP server that checks who your agent is about to pay, before it sends anything. Give it a crypto address, an ENS name, or a payment URL and it returns a verdict. Deterministic, no LLM, free.
Agents are starting to move real money on their own, over crypto rails, x402 endpoints, and payment links. The obvious way that goes wrong is paying a sanctioned or scam address by mistake, which is usually irreversible. screen_address is the check to run first.
Install
{ "mcpServers": { "payment-guard": { "command": "npx", "args": ["-y", "payment-guard-mcp"] } } }Tools
screen_address: the main guard. Takes an EVM address or ENS name and checks OFAC sanctions, scam and abuse blocklists, and on-chain signals (brand-new and unused addresses, contracts). Returns safe, caution, or block.screen_payment: vet an x402 or merchant payment URL for a punycode host, a known brand name sitting outside the registrable domain, shorteners, abuse-prone TLDs, freshly registered domains, and the final URL after redirects.check_sanctioned: a quick OFAC-only check for an address or ENS name.resolve_name: resolve an ENS name to its address and screen that address. It catches names that don't resolve. It does not detect spoofed lookalike names.screen_token: before buying, swapping, or approving a token, check the contract for honeypot behavior (you can buy but not sell), extreme sell taxes, and blocklist hits.
On-chain checks run on Ethereum, Base, Polygon, Arbitrum and Optimism. Data comes from the OFAC SDN list, community scam lists (ethereum-lists, ScamSniffer), public RPC nodes, and ENS.
ENS coverage: resolution is namehash, then resolver(node) on the mainnet ENS registry, then a direct addr(bytes32) call. The address that comes back is screened against the sanctions and scam lists. There is no confusable check and no ENSIP-15 normalization, so lookalike and homoglyph names are not detected. There is no ENSIP-10 wildcard resolution and no CCIP-Read, so offchain and L2 names — Basenames, .cb.id, gasless subnames — report as not resolving here even though a wallet resolves them.
Honeypot coverage: the buy+sell simulation is api.honeypot.is, Ethereum and Base only. It returns 400 Invalid chain for Polygon, Arbitrum and Optimism, so the honeypot and tax fields are not populated there. The response says which chains it covers, and when no simulation ran the verdict is never safe — it is caution, or block if the scam blocklist already hit.
URL coverage: the lookalike rule is a substring match on 14 brand names, flagged when the brand is not the registrable domain. paypal.com.secure-pay.xyz is caught; paypa1.com is not, because there is no edit distance or homoglyph mapping. Only the final URL after redirects is compared, not each hop.
Sanctions coverage, stated plainly: OFAC publishes sanctioned addresses by currency, not by chain, so this checks the union of every EVM-format list (ETH, ARB, BSC, ETC, USDC, USDT) and that result applies to any EVM chain. Bitcoin, Tron, Solana, Monero and other non-EVM sanctioned addresses are not checked, because only EVM addresses are accepted. Every response carries a coverage object saying so. If the list cannot be loaded the result is unknown, never clear.
Rule updates
About once a day this server asks the rules feed whether there is a newer ruleset, and applies it if there is. The request carries two things: which surface asked, which here is facade, and the rules version already installed. No machine id, no user id, no file names, nothing you scanned.
Bundles are signed with Ed25519 and verified against a public key compiled into this package, so it does not matter which mirror served one. A bundle that fails its signature, its schema, or its ReDoS check is discarded and the rules you already had stay in place. --offline turns updates off, as does AGENT_GUARDS_NO_FEED=1 or {"feed": false} in ~/.agent-guards/config.json. The bundle format and how to verify one yourself: https://github.com/mlawsonking/MCP/blob/main/rules/README.md
It calls https://payment-guard.vercel.app (set PAYMENT_GUARD_API to override). One of six agent guards in this repo. MIT.