ScanPay MCP

An autonomous security oracle suite for AI agents providing deterministic code scanning, transaction pre-flight simulation, and web scraping capabilities, with micropayments handled via x402 on Solana and Base.

Endpoint and access

No sign-in to connect and list tools. Individual tools may still need a vendor account, credentials, or permissions; check the documented prerequisites.

Community listingStreamable HTTPNo sign-inEndpoint checked 2026-11-01Published by Misterio070

MCP endpoint (Streamable HTTP)

https://scanpay-ob3w.onrender.com/mcp

Vendor documentation

What you can do with it

Scan Python and JS/TS code for 65 AST vulnerability patterns and generate deterministic patches
Simulate EVM and Solana transactions to detect honeypots, drainers, and MEV traps
Scrape URLs with stealth headers to bypass Cloudflare and extract clean Markdown
Create prepaid session vouchers for sub-millisecond latency across all tools

Source and maintenance

Community listingRegistry 1.2.0

mcp-registry: io.github.Misterio070/scanpay@1.2.0 Source repository

Maintenance checked: Nov 1, 2026, 8:45 AM UTC

Protocol and capabilities

Server: scanpay 1.2.0
MCP protocol: 2025-06-18
Tools: 7 advertised
Resources: Not advertised
Resource templates: Not advertised
Prompts: Not advertised

Server-advertised capabilities

{
  "tools": {
    "listChanged": false
  }
}

Tools

7 advertised

scan_code

Advertised by the server during the last successful anonymous check.

Use before shipping or executing agent-generated code. Deterministic AST scan for Python, JavaScript and TypeScript with 65 rules (36 Python, 29 JS/TS) covering injection, hardcoded secrets, wallet key exfiltration, SSRF, infinite x402 payment loops and unsimulated Solana transactions. Returns findings with severity, deterministic patches, unified diffs and an execution verdict (PASS, WARN, BLOCK). Pay per call: 0.10 Base USDC or 0.0007 SOL over x402, no signup or API key.

scan_code input schema

{
  "type": "object",
  "required": [
    "source_code"
  ],
  "properties": {
    "language": {
      "enum": [
        "python",
        "javascript",
        "typescript",
        "tsx"
      ],
      "type": "string",
      "default": "python",
      "description": "Source code programming language"
    },
    "payment_tx": {
      "type": "string",
      "description": "Optional x402 payment transaction proof: Base EVM tx hash (0x...) transferring USDC to 0xb295E606F38C363b476FC546c27226B5fBcAAEFA, or Solana tx signature transferring SOL/USDC."
    },
    "source_code": {
      "type": "string",
      "description": "Source code to scan (Python or JS/TS)"
    },
    "session_token": {
      "type": "string",
      "description": "Optional prepaid session voucher token (scanpay_sess_...) for 0ms instant execution."
    },
    "auto_remediate": {
      "type": "boolean",
      "default": true,
      "description": "Whether to generate deterministic patches and unified diffs"
    }
  }
}

scan_quick

Advertised by the server during the last successful anonymous check.

Cheapest way to check a snippet before running it: one deterministic AST pass over Python, JavaScript or TypeScript, returning severity-ranked findings and a PASS/WARN/BLOCK verdict without patches or diffs. 65 rules, about 0.2 ms. Pay per call: 0.02 Base USDC or 0.00015 SOL over x402, no signup. Upgrade to scan_code for deterministic patches.

scan_quick input schema

{
  "type": "object",
  "required": [
    "source_code"
  ],
  "properties": {
    "language": {
      "enum": [
        "python",
        "javascript",
        "typescript",
        "tsx"
      ],
      "type": "string",
      "default": "python",
      "description": "Source code programming language"
    },
    "payment_tx": {
      "type": "string",
      "description": "Optional x402 payment transaction proof: Base EVM tx hash (0x...) transferring USDC to 0xb295E606F38C363b476FC546c27226B5fBcAAEFA, or Solana tx signature transferring SOL/USDC."
    },
    "source_code": {
      "type": "string",
      "description": "Source code to screen (Python or JS/TS)"
    },
    "session_token": {
      "type": "string",
      "description": "Optional prepaid session voucher token (scanpay_sess_...) for 0ms instant execution."
    }
  }
}

simulate_tx

Advertised by the server during the last successful anonymous check.

Pre-flight transaction & drainer shield for AI agents. Simulates and inspects EVM (Base/Ethereum) and Solana transactions before signing or broadcasting. Detects unlimited approvals, known drainers, honeypots, MEV sandwich exposure (min_output=0), and unauthorized Solana authority takeovers. Returns execution verdict (ALLOW, WARN, BLOCK) and cryptographic oracle attestation. Price: $0.05 Base USDC or 0.00035 SOL.

simulate_tx input schema

{
  "type": "object",
  "required": [
    "chain",
    "tx"
  ],
  "properties": {
    "tx": {
      "type": "object",
      "description": "Transaction payload (EVM: to, data, value; Solana: instructions)"
    },
    "chain": {
      "enum": [
        "base",
        "ethereum",
        "solana"
      ],
      "type": "string",
      "default": "base",
      "description": "Target blockchain network"
    },
    "payment_tx": {
      "type": "string",
      "description": "Optional x402 payment transaction proof: Base EVM tx hash (0x...) transferring USDC to 0xb295E606F38C363b476FC546c27226B5fBcAAEFA, or Solana tx signature transferring SOL/USDC."
    },
    "session_token": {
      "type": "string",
      "description": "Optional prepaid session voucher token (scanpay_sess_...) for 0ms instant execution."
    }
  }
}

audit_token

Advertised by the server during the last successful anonymous check.

Live on-chain token & smart contract rug-pull / honeypot shield for Base, Ethereum, and Solana. Inspects live EVM bytecode (blacklist selectors, mutable tax fees, pause toggles, unverified proxies) and Solana SPL / Token-2022 mint accounts (active mint authority, freeze authority, Permanent Delegate wallet seizure, Transfer Hook honeypots) plus live DexScreener liquidity and 24h buy/sell ratios. Price: $0.05 Base USDC or 0.00035 SOL.

audit_token input schema

{
  "type": "object",
  "required": [
    "chain",
    "token_address"
  ],
  "properties": {
    "chain": {
      "enum": [
        "base",
        "ethereum",
        "solana"
      ],
      "type": "string",
      "default": "base",
      "description": "Blockchain network where the token is deployed"
    },
    "payment_tx": {
      "type": "string",
      "description": "Optional x402 payment transaction proof: Base EVM tx hash (0x...) transferring USDC to 0xb295E606F38C363b476FC546c27226B5fBcAAEFA, or Solana tx signature transferring SOL/USDC."
    },
    "session_token": {
      "type": "string",
      "description": "Optional prepaid session voucher token (scanpay_sess_...) for 0ms instant execution."
    },
    "token_address": {
      "type": "string",
      "description": "Token contract address (0x... for Base/Ethereum or Base58 mint address for Solana)"
    }
  }
}

scrape_url

Advertised by the server during the last successful anonymous check.

Anti-bot web access & scraper oracle for AI agents. Fetches web pages with stealth headers to bypass Cloudflare Turnstile, WAFs, and anti-bot challenges. Purifies HTML by removing scripts, stylesheets, tracking pixels, ads, and navigation boilerplate, returning clean, token-efficient Markdown ready for LLM consumption with cryptographic oracle attestation. Price: $0.02 Base USDC or 0.00015 SOL.

scrape_url input schema

{
  "type": "object",
  "required": [
    "url"
  ],
  "properties": {
    "url": {
      "type": "string",
      "description": "Target URL to scrape"
    },
    "payment_tx": {
      "type": "string",
      "description": "Optional x402 payment transaction proof: Base EVM tx hash (0x...) transferring USDC to 0xb295E606F38C363b476FC546c27226B5fBcAAEFA, or Solana tx signature transferring SOL/USDC."
    },
    "strip_media": {
      "type": "boolean",
      "default": true,
      "description": "Strip image tags and heavy media to conserve LLM context tokens"
    },
    "extract_mode": {
      "enum": [
        "markdown",
        "text",
        "raw_html"
      ],
      "type": "string",
      "default": "markdown",
      "description": "Extracted content format"
    },
    "session_token": {
      "type": "string",
      "description": "Optional prepaid session voucher token (scanpay_sess_...) for 0ms instant execution."
    }
  }
}

create_session_deposit

Advertised by the server during the last successful anonymous check.

Activate a prepaid session voucher (0.006 SOL or 0.85 Base USDC for 10 operations). Eliminates per-request payment prompts and RPC latency in autonomous agent loops.

create_session_deposit input schema

{
  "type": "object",
  "required": [
    "deposit_tx"
  ],
  "properties": {
    "deposit_tx": {
      "type": "string",
      "description": "Transaction signature/hash transferring 0.006 SOL or 0.85 Base USDC to merchant wallet"
    },
    "payer_wallet": {
      "type": "string",
      "description": "Public key / address of the payer"
    }
  }
}

health_check

Advertised by the server during the last successful anonymous check.

Check ScanPay engine health, available AST rules, and x402 payment configurations.

health_check input schema

{
  "type": "object",
  "properties": {}
}

Prompts

Not advertised

No prompt definitions available.

Resources

Not advertised

No resource definitions available.

30-day availability

Aggregated from read-only remote checks; this is not a tool-execution or security guarantee.

Successful checks: 1 of 1 (100%)
Average latency: 665 ms
95th percentile latency: 665 ms

Maintenance history

Public check and source-refresh events. Editorial and ownership records remain private.

Nov 1, 2026, 8:50 AM UTC · probe · passed · 665 ms · metadata changed · 7 tool(s)

Connect from your client

Each snippet registers the same endpoint; pick the client you use.

This server is operated by the named third party. Listing and endpoint checks are not an endorsement or a security audit. Review the operator's permissions, terms, and data handling before connecting. How listings are checked and corrected.

Claude Code

Run this once in a terminal. It registers the remote server. Use --scope project to write .mcp.json for the repo.

Claude Code configuration

claude mcp add --transport http scanpay-mcp https://scanpay-ob3w.onrender.com/mcp

Codex

Run this once. Codex stores MCP servers in ~/.codex/config.toml (or .codex/config.toml in a trusted project).

Codex configuration

codex mcp add scanpay-mcp --url https://scanpay-ob3w.onrender.com/mcp

Cursor

Merge this server into .cursor/mcp.json in your project, then enable scanpay-mcp in your MCP settings.

Cursor configuration

{
  "mcpServers": {
    "scanpay-mcp": {
      "url": "https://scanpay-ob3w.onrender.com/mcp"
    }
  }
}

Cline

Merge this into cline_mcp_settings.json (Cline → MCP Servers → Configure).

Cline configuration

{
  "mcpServers": {
    "scanpay-mcp": {
      "type": "streamableHttp",
      "url": "https://scanpay-ob3w.onrender.com/mcp",
      "disabled": false
    }
  }
}

VS Code

Merge this server into .vscode/mcp.json. Use MCP: List Servers to start scanpay-mcp and inspect its tools.

VS Code configuration

{
  "servers": {
    "scanpay-mcp": {
      "type": "http",
      "url": "https://scanpay-ob3w.onrender.com/mcp"
    }
  }
}

Gemini CLI

Run this once. It writes .gemini/settings.json in the current project; pass --scope user for ~/.gemini/settings.json.

Gemini CLI configuration

gemini mcp add --transport http scanpay-mcp https://scanpay-ob3w.onrender.com/mcp

Claude Desktop

Merge this into claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/, Windows: %APPDATA%\Claude\), then restart Claude Desktop.

Claude Desktop configuration

{
  "mcpServers": {
    "scanpay-mcp": {
      "url": "https://scanpay-ob3w.onrender.com/mcp"
    }
  }
}

Windsurf

Merge this into ~/.codeium/windsurf/mcp_config.json, then refresh MCP in Cascade. Windsurf remote servers use serverUrl, not url.

Windsurf configuration

{
  "mcpServers": {
    "scanpay-mcp": {
      "serverUrl": "https://scanpay-ob3w.onrender.com/mcp"
    }
  }
}

Let your agent find its tools

Find servers like ScanPay MCP from your agent. Add Koskamo once to search the index for endpoints, access requirements, and client setup. Public discovery needs no key.

Connect Koskamo Explore workflows