Runtime security for AI agent commerce. CLI + MCP server blocks hallucinated purchases.
Connect Runs on your machine
claude mcp add pop-pay -e POP_CDP_URL=<POP_CDP_URL> -e POP_ALLOWED_CATEGORIES=<POP_ALLOWED_CATEGORIES> -e POP_MAX_PER_TX=<POP_MAX_PER_TX> -e POP_MAX_DAILY=<POP_MAX_DAILY> -e POP_GUARDRAIL_ENGINE=<POP_GUARDRAIL_ENGINE> -- npx -y [email protected]{
"mcpServers": {
"pop-pay": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"POP_CDP_URL": "<POP_CDP_URL>",
"POP_ALLOWED_CATEGORIES": "<POP_ALLOWED_CATEGORIES>",
"POP_MAX_PER_TX": "<POP_MAX_PER_TX>",
"POP_MAX_DAILY": "<POP_MAX_DAILY>",
"POP_GUARDRAIL_ENGINE": "<POP_GUARDRAIL_ENGINE>"
}
}
}
}{
"mcpServers": {
"pop-pay": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"POP_CDP_URL": "<POP_CDP_URL>",
"POP_ALLOWED_CATEGORIES": "<POP_ALLOWED_CATEGORIES>",
"POP_MAX_PER_TX": "<POP_MAX_PER_TX>",
"POP_MAX_DAILY": "<POP_MAX_DAILY>",
"POP_GUARDRAIL_ENGINE": "<POP_GUARDRAIL_ENGINE>"
}
}
}
}{
"servers": {
"pop-pay": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"POP_CDP_URL": "<POP_CDP_URL>",
"POP_ALLOWED_CATEGORIES": "<POP_ALLOWED_CATEGORIES>",
"POP_MAX_PER_TX": "<POP_MAX_PER_TX>",
"POP_MAX_DAILY": "<POP_MAX_DAILY>",
"POP_GUARDRAIL_ENGINE": "<POP_GUARDRAIL_ENGINE>"
}
}
}
}Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.
Tools
This server runs locally, so its tools are listed by your MCP client once it starts.
Environment variables
| Name | Description |
|---|---|
POP_CDP_URLOptional | Chrome DevTools Protocol endpoint for credential injection (default: http://localhost:9222) |
POP_ALLOWED_CATEGORIESOptional | JSON array of allowed vendor categories (e.g. '["aws","cloudflare"]') |
POP_MAX_PER_TXOptional | Per-transaction spending limit in USD |
POP_MAX_DAILYOptional | Daily spending limit in USD |
POP_GUARDRAIL_ENGINEOptional | Guardrail engine: 'keyword' (offline, default) or 'llm' (requires API key) |
Details
| Package | [email protected] (NPM, stdio) |
| First published | 13 Apr 2026 |
| Last updated | 13 Apr 2026 |
| Registry name | io.github.100xPercent/pop-pay |
More ai and media servers See all
Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.