registry / z-zero-mcp-server / 1.3.2

z-zero-mcp-server@1.3.2

Z-ZERO MCP Server — Secure JIT Virtual Card Payment tools for AI Agents (Claude, Cursor, AutoGPT) — Real Single-Use Virtual Cards, settled in USDC on Base

AI Security Review

scanned 19h ago · by lpm-firewall-ai

Runtime MCP tools can initiate capped USDC/card payments and navigate public checkout pages. This is an explicit payment-agent capability, not hidden install-time behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

An MCP client invokes auto_pay_checkout or execute_payment with a checkout URL and configured key.

Impact

Can cause a payment to a checkout recipient within the implemented $1–$100 automatic limit.

Mechanism

Playwright card-form automation and Z-ZERO payment API requests.

Rationale

The package is not malicious by source inspection, but it provides a high-impact autonomous payment capability to AI-agent callers. Its network and secret handling are aligned with that documented function.

Evidence

package.jsondist/index.jsdist/wdk_backend.jsdist/playwright_bridge.jsdist/lib/url-guard.jsdist/lib/key-store.js

Network endpoints1

www.clawcard.store

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Unknown with low false-positive risk.

z-zero-mcp-server@1.3.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code