The @blockchain0x/mcp server gives an MCP host five agent-wallet tools: read a wallet, list wallets, check a transaction, send a USDC payment, and settle an x402 invoice. Run it with npx @blockchain0x/mcp (your key stays on your machine) or point at the hosted URL. Separately, the package exports requirePayment so you can put a price on your own MCP tools with an x402 402 challenge.

Two ways to run it. No install for the hosted one.

Run it locally over stdio with npx (your key stays on your machine), or point any MCP host at the hosted Streamable HTTP URL and pass the key as a Bearer token. Both drop straight into the host's MCP config. Node 20+ for the local path.

{
  "mcpServers": {
    "blockchain0x": {
      "command": "npx",
      "args": ["-y", "@blockchain0x/mcp"],
      "env": {
        "BLOCKCHAIN0X_API_KEY": "sk_live_...",
        "BLOCKCHAIN0X_API_BASE_URL": "https://api.blockchain0x.com"
      }
    }
  }
}

{
  "mcpServers": {
    "blockchain0x": {
      "url": "https://mcp.blockchain0x.com/mcp",
      "headers": { "Authorization": "Bearer sk_live_..." }
    }
  }
}

BLOCKCHAIN0X_API_KEY is a sk_test_ testnet or sk_live_ mainnet key from your dashboard; BLOCKCHAIN0X_API_BASE_URL defaults to https://api.blockchain0x.com. The server forwards your key to the backend and stores nothing, so the scope and caps on that key are exactly what the agent can do. The five tools it exposes: get_wallet, list_wallets, get_transaction, send_payment, and settle_payment_request.

Mark the caller paid when the webhook lands.

When a payment settles, Blockchain0x POSTs a signed payment.received event to your webhook URL. Verify it with webhooks.verify from the Node SDK, then record that the caller paid in whatever store you already run. There is no shipped receipt cache to configure - you own that bit, which means no surprise infrastructure.

import express from "express";
import { webhooks } from "@blockchain0x/node";

const app = express();
// Capture the RAW body. The HMAC is over the exact bytes on the wire.
app.use(express.raw({ type: "application/json" }));

app.post("/webhooks/payment", (req, res) => {
  const result = webhooks.verify({
    headers: req.headers,
    rawBody: req.body, // Buffer, raw bytes
    secret: process.env.BLOCKCHAIN0X_WEBHOOK_SECRET!,
  });
  if (!result.ok) return res.status(400).json({ code: result.code });

  if (result.eventType === "payment.received") {
    // Mark this payer paid however you like - a DB row, a Redis key, your call.
    markPaid(result.eventId);
  }
  res.status(200).send("ok");
});

webhooks.verify does HMAC-SHA256 in constant time and returns a discriminated union, so you branch on result.ok with no try/catch. Read the raw body, not a parsed copy, because the signature covers the exact bytes. The shipped events are payment.received, payment.sent, wallet.deployed, and webhook.test; a payment to your wallet is payment.received. Where you persist 'this caller paid' - a database row, a Redis key, an in-memory map for a single process - is your call.

Five MCP-specific traps to avoid.

These come from operators running paid MCP servers in production. Most relate to the cache architecture and the MCP protocol's specific error format.