@bankofai/x402-mcp
x402 Payment Protocol
This report shows the evidence for @bankofai/x402-mcp@1.1.1. 1 of 4 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package’s payment behavior matches its stated purpose, but the client silently enables automatic payment and defaults the approval callback to true. Under the review policy, automatic spending without explicit payment approval is malicious.
Static reason
No blocking static signals were detected.
Trigger
An application constructs the payment client and calls a tool that returns a payment challenge.
Impact
Funds may be transferred to the challenged tool without a user reviewing or approving that specific payment.
Mechanism
autoPayment defaults to true and the default onPaymentRequested callback returns true, allowing the client to create and submit a payment payload after a challenge.
Attack narrative
When a configured client calls a tool that requests payment, automatic payment is enabled by default. If the application does not provide an approval callback, the built-in callback approves the challenge, after which the client creates a payment payload using the configured payment client. This can spend funds without per-payment user approval.
AI rationale
The package’s payment behavior matches its stated purpose, but the client silently enables automatic payment and defaults the approval callback to true. Under the review policy, automatic spending without explicit payment approval is malicious.
Evidence
dist/cjs/index.jsREADME.md
Decision evidence
public snapshotAI called this Malicious at 85.0% confidence as Malware with low false-positive risk.
Evidence for block
- The client defaults autoPayment to true and defaults its payment approval callback to always approve.
- On a payment challenge, the client calls the approval callback and then creates a payment payload when approval succeeds.
- The README demonstrates configuring an EVM wallet with autoPayment enabled and an approval callback that returns true.
Evidence against
- The package is explicitly described as an x402 payment integration, so payment handling is part of its stated purpose.
- package.json has no install lifecycle scripts; the reviewed payment behavior runs through client API calls.
Behavioral surface
Source & flagged code
3 flaggeddist/cjs/index.jsView file
190this.options = {
autoPayment: options.autoPayment ?? true,
onPaymentRequested: options.onPaymentRequested ?? (() => true)
};
}
High
Ai Review Evidence
The client defaults autoPayment to true and defaults its payment approval callback to always approve.
dist/cjs/index.jsView on unpkg · L190499const approved = await this.options.onPaymentRequested(paymentRequestedContext);
if (!approved) {
throw new Error("Payment request denied");
}
for (const hook
High
Ai Review Evidence
On a payment challenge, the client calls the approval callback and then creates a payment payload when approval succeeds.
dist/cjs/index.jsView on unpkg · L499README.mdView file
71// Create client with factory (simplest approach)
const client = createX402MCPClient({
name: "my-agent",
version: "1.0.0",
schemes: [{ network: "eip155:84532", client: new ExactEvmScheme(walletAccount) }],
autoPayment: true,
onPaymentRequested: async ({ paymentRequired }) => {
console.log(`Tool requires payment: ${paymentRequired.accepts[0].amount}`);
return true; // Return false to deny payment
}
Findings
3 High1 Low
HighAi Review Evidencedist/cjs/index.js
HighAi Review Evidencedist/cjs/index.js
HighAi Review EvidenceREADME.md
LowScripts Present
Affected versions and remediation
This report applies to @bankofai/x402-mcp@1.1.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing @bankofai/x402-mcp@1.1.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.