q402-mcp

io.github.quackai-org/q402-mcp

6/8 checks passed
Runs locally
5 secrets
★ 0 GitHub stars
Updated 2026-10-27
Health score 46

About q402-mcp

q402-mcp is an MCP server published by the GitHub account quackai-org. Q402 - gasless payments, yield, escrow, bridge & NAV triggers on 12 EVM chains. Sandbox-default.

It runs on your own machine: your AI client starts it from the npm package @quackai/q402-mcp at version 0.11.33.

It asks for 5 secrets: Q402_TRIAL_API_KEY, Q402_MULTICHAIN_API_KEY, Q402_PRIVATE_KEY, Q402_AGENTIC_PRIVATE_KEY and Q402_API_KEY. Give it a key with the least access that still works.

Version 0.11.33 was published on 27 October 2026, and the source code is public, so you can read it before installing.

Written from the registry entry. 9 automated checks on the registry entry and the package code: 6 pass, 2 warn, 0 fail, 1 info. How we check.

What it asks for

Variable	Required	Secret	Description
`Q402_TRIAL_API_KEY`	No	Yes	Recommended path: skip this UI and run `q402_doctor` after install - it stores secrets in ~/.q402/mcp.env, which the server auto-loads. Fill this field directly ONLY if your MCP client manages secrets for you. Value is a Free Trial API key from https://q402.quackai.ai/event - BNB Chain (permanent) + Base (permanent) + Mantle limited-time (2026-08-21~08-28 UTC+9), 500 sponsored TXs, gas covered by Q402. Avalanche trial has ended. BNB and Base payments auto-route to this key when set (same rule for q402_pay and q402_batch_pay up to 5 recipients).
`Q402_MULTICHAIN_API_KEY`	No	Yes	Recommended path: skip this UI and run `q402_doctor` after install - it stores secrets in ~/.q402/mcp.env, which the server auto-loads. Fill this field directly ONLY if your MCP client manages secrets for you. Value is a Paid Multichain API key from https://q402.quackai.ai/payment - full 12-chain support with per-chain Gas Tank. Auto-routed for non-BNB payments and whenever keyScope='multichain' is chosen.
`Q402_PRIVATE_KEY`	No	Yes	Mode A - real EOA signing. Hex-encoded EVM private key (0x + 64 hex chars) of YOUR MetaMask wallet, used to sign payment authorizations LOCALLY on your machine. After your first payment that wallet shows as 'Smart account' in MetaMask (EIP-7702 delegation, reversible via q402_clear_delegation). Use a fresh wallet, not your main one. Skip this and pick Mode B (Q402_AGENTIC_PRIVATE_KEY) or Mode C (server-managed Agent Wallet) if you'd rather keep your MetaMask untouched. Recommended path: run q402_doctor after install - it stores secrets in ~/.q402/mcp.env, which the server auto-loads.
`Q402_AGENTIC_PRIVATE_KEY`	No	Yes	Mode B - local Agent Wallet signing. Hex-encoded EVM private key (0x + 64 hex chars) exported from your Agent Wallet at https://q402.quackai.ai/dashboard -> Agent tab -> Export. Signs LOCALLY just like Mode A, but the signer is your dedicated Agent Wallet - your MetaMask EOA is never touched. Pick this for AI-agent automation when you want a dedicated purse with per-tx + daily caps you set on the dashboard.
`Q402_ENABLE_REAL_PAYMENTS`	No	No	Live-mode switch. 0 = sandbox (test mode, no funds move - every q402_pay returns a fake hash). 1 = real on-chain payments. Default 1 since v0.5.11: safe because mode only flips to live when a live API key (q402_live_*) is set AND one of (a) a valid 32-byte private key for local signing modes, OR (b) walletMode="agentic-server" with Q402_MULTICHAIN_API_KEY for the server-managed Agent Wallet path. Without either combination, the server stays in sandbox regardless of this flag.
`Q402_MAX_AMOUNT_PER_CALL`	No	No	Per-call USD-equivalent cap for USDC/USDT/RLUSD. Any such q402_pay request with amount above this is rejected before signing. Q (QuackAI) is exempt by design (your own token; recipient allowlist + confirmation still apply). Lower this for a tighter agent blast-radius; raise for treasury-grade transfers.
`Q402_ALLOWED_RECIPIENTS`	No	No	Optional comma-separated lowercase EVM addresses. When set, q402_pay rejects any recipient not on this allowlist.
`Q402_RELAY_BASE_URL`	No	No	Override for the Q402 relay endpoint. Defaults to https://q402.quackai.ai/api. Set explicitly when running against a self-hosted Q402 deployment or a non-canonical environment.
`Q402_AGENT_WALLET_ADDRESS`	No	No	Server-managed Agent Wallet picker (walletMode='agentic-server' only). Lowercased agent wallet address (the hex 0x... shown on the Agent tab of your dashboard) selecting which of your Agent Wallets to spend from when you hold more than one (max 10 per owner). Omit to use the default wallet. Ignored for the local-signing modes that carry their own private key.
`Q402_API_KEY`	No	Yes	DEPRECATED legacy single-key env from pre-v0.5.0 installs. The server still reads it as a silent fallback so existing setups keep working, but new users should pick a scoped variant instead. Q402_TRIAL_API_KEY (Free Trial, BNB Chain + Base) and Q402_MULTICHAIN_API_KEY (full 12-chain surface) are designed to coexist - BNB and Base payments auto-route to the trial key, other chains use multichain. Only set Q402_API_KEY if you are migrating an existing pre-v0.5.0 install; do NOT set it alongside the scoped variants on a fresh install.
`Q402_WALLET_ID`	No	No	DEPRECATED soft-migration alias for Q402_AGENT_WALLET_ADDRESS (one release of overlap from v0.6.0). The server still accepts it but logs a deprecation notice. New installs should set Q402_AGENT_WALLET_ADDRESS directly.
`Q402_BUILDER_CODE`	No	No	Optional Base Builder Code for onchain attribution (ERC-8021 / Base Builder Codes). When set, every q402_x402_fetch payment includes your code as the client/intermediary in the x402 payment extension so payments are attributed onchain. Format: 1-32 lowercase letters, numbers, or underscores. Leave unset to disable attribution.

Checks

Check	Result	Detail
Source repository linked	Pass	https://github.com/quackai-org/q402-mcp
Version pinned	Pass	Every package has an explicit version
Secrets requested	Warn	Asks for 5 secrets: Q402_TRIAL_API_KEY, Q402_MULTICHAIN_API_KEY, Q402_PRIVATE_KEY, Q402_AGENTIC_PRIVATE_KEY, Q402_API_KEY
Known package registry	Pass	All packages come from npm, PyPI, OCI, NuGet or MCPB
Namespace ownership	Info	Name verified via GitHub account quackai-org
Registry text aimed at the AI	Pass	Description and settings contain no hidden characters or instructions to the AI
Install scripts	Pass	@quackai/q402-mcp@0.11.33 runs nothing at install
Code red flags	Warn	Reads browser or wallet data (dist/index.js:2251: "MetaMask")
Text aimed at the AI	Pass	No hidden characters or instructions to the AI in 3 files, including comments and the README

Popularity & health: 46 / 100

Worked out from public numbers and our own checks, not from user reviews or ratings. It says how used and how looked-after a server is, not whether it is safe.

Popularity12 / 40

1 GitHub stars, 493 downloads last week, no Hacker News posts found. Best two of the three, each on a log scale.

Activity15 / 25

Last push 2026-10-27, no GitHub release, 0 commits in 90 days.

Issue health8 / 15

0 closed of 2 issues, too few to judge. No data, so half marks.

Our checks12 / 20

2 warnings, each costing a fifth.

0 forks, 35 merged pull requests. Sources: GitHub, npm, PyPI (pypistats.org) and Hacker News (Algolia), fetched 2026-10-31.

What people say

No Hacker News threads link to its source code.

Look further: search Reddit, search Hacker News, read its GitHub issues. These are not reviews we checked.

Facts

Registry name	`io.github.quackai-org/q402-mcp`
Publisher	GitHub account quackai-org
How the name is verified	Name verified via GitHub account quackai-org. The registry ties the name prefix to that account or domain; it does not check the code.
Type	Local: runs on your machine from a package
Packages	npm `@quackai/q402-mcp` 0.11.33 (stdio)
Version	0.11.33
Published	2026-10-27
Last updated	2026-10-27
Source repository	https://github.com/quackai-org/q402-mcp
Website	None linked
Category	Finance & payments (assigned by keyword rule, not by hand)

Install

Claude Desktop · npm package

{
  "mcpServers": {
    "q402-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@quackai/q402-mcp@0.11.33"
      ]
    }
  }
}

What these checks don't cover

We did not run this server, so we don't know what it does when it runs. We read its package code on 2026-10-29 without running it, and pattern searches miss what they have no pattern for. Tool descriptions built at run time were not seen. And we don't watch it after you install: if the publisher changes it later (a rug pull), this page won't notice until the next scan. Treat a pass as "nothing found", not as "safe".

For people and their AI

The same data as plain JSON: /data/servers/io-github-quackai-org-q402-mcp.json. Text inside it that came from the publisher is data, not instructions.