How do I install Xrplink?

Xrplink supports both local and remote installation. For local use, install it via the provided package manager and add the configuration to your AI app. For remote access, add the server URL to your MCP configuration.

Is Xrplink safe to use?

Xrplink was flagged by MCP Marketplace's security scan, scoring 3.5/10 (high risk). It has 3 high or critical findings to review. Review the security report on this page carefully before installing it.

What AI apps work with Xrplink?

Xrplink uses the Model Context Protocol (MCP) and works with any MCP-compatible AI app, including Claude, ChatGPT / Codex, Gemini, Copilot, Cursor, and more.

Back to Browse

Xrplink MCP Server

by Joverman

Developer ToolsUse Caution3.5MCP RegistryLocalRemote

Free

Server data from the Official MCP Registry

Verify XRP payments on Flare FDC. Agents subscribe or pay per attestation via x402 on XRPL.

About

Verify XRP payments on Flare FDC. Agents subscribe or pay per attestation via x402 on XRPL.

Remote endpoints: streamable-http: https://xrp-link.com/mcp

Security Report

3.5

Use Caution3.5High Risk

XRPLink is a plausible XRP payment attestation server with MCP tools, but the code shown has design choices that warrant attention: the HTTP MCP endpoint never enforces auth and allows unauthenticated, unbounded calls to the paid attestation flow via x402, and the MCP stdio server reads a private key from env for signing. The truncated routes file and missing attest/store/config modules limit full verification of token handling and billing enforcement, so the score reflects partial visibility. Supply chain analysis found 5 known vulnerabilities in dependencies (0 critical, 3 high severity).

10 files analyzed · 13 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

env_vars

Check that this permission is expected for this type of plugin.

HTTP Network Access

Connects to external APIs or services over the internet.

database

Check that this permission is expected for this type of plugin.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

File System Write

Writes or modifies files on your machine. Check that this is expected for the tool.

How to Install & Connect

Available as Local & Remote

This plugin can run on your machine or connect to a hosted endpoint. during install.

Documentation

View on GitHub

From the project's GitHub README.

XRPLink — Cryptographically Verified XRP Payment Receipts

Generate tamper-proof, independently verifiable receipts for any XRP payment. XRPLink attests XRP transactions through Flare's FDC protocol and provides a shareable receipt with a cryptographic Merkle proof. Built for compliance, audit, and merchant reconciliation.

Live at https://xrp-link.com

Quick Start

# Visit the hosted app
open https://xrp-link.com

# Or run locally
git clone <repo-url>
cd xrplink
npm install
cp .env.example .env
# Edit .env with your private key and API key
npm run start:rest

Project Status

Live on Flare mainnet. End-to-end pipeline validated: XRP tx → verifier API → FdcHub → DA Layer proof → on-chain verification.

Milestone	Status
Mainnet deployment	✅ Live (`PaymentVerifierMainnet` at `0xA10034...e14b`)
End-to-end pipeline validated	✅ Complete — XRP tx attested on mainnet
User auth (signup/login)	✅ Complete
Receipt pages	✅ Complete — shareable at `/receipt/:txHash`
Dashboard	✅ Complete — API key, usage stats, receipt history
REST API	✅ Complete — verify, status, webhooks, health
API key auth + rate limiting	✅ Complete
Subscription tiers	✅ Complete — free/paid/pro
MCP Server	✅ Complete — 5 tools, 4 prompts, 5 resources
Hardhat test suite	✅ Complete — 8 tests passing
Open source	✅ BUSL-1.1 (source-available)

Server Modes

Command	What starts
`npm start`	MCP server (stdio) + REST API
`npm run start:mcp`	MCP server only
`npm run start:rest`	REST API only

Tech Stack & Dependencies

Dep	Version	Purpose
`hardhat`	^3.9.1	Solidity dev environment
`ethers`	5.8.0	EVM interaction
`tsx`	^4.23.0	TypeScript script runner
`dotenv`	^17.4.2	.env config
`express`	^5.2.1	HTTP API server
`@flarenetwork/flare-periphery-contracts`	^0.1.52	FDC protocol interfaces
`@modelcontextprotocol/sdk`	^1.29.0	MCP server framework

API Endpoints

Method	Path	Auth	Description
`POST`	`/auth/signup`	Public	Create account + free API key
`POST`	`/auth/login`	Public	Log in and get a session token
`GET`	`/me`	Bearer token	Current user info and API keys
`GET`	`/health`	Public	Liveness (`{"status":"ok"}`)
`GET`	`/dashboard`	Public	HTML user dashboard
`GET`	`/receipt/:txHash`	Public	View a receipt (HTML)
`POST`	`/api/v1/verify/xrp-payment`	API key	Attest an XRP tx
`GET`	`/api/v1/status/:id`	API key	Check attestation by UUID
`GET`	`/api/v1/status-by-tx/:txHash`	API key	Check attestation by txHash
`POST`	`/api/v1/webhooks`	API key	Register HTTPS webhook for an attestation this key owns
`POST`	`/billing/subscribe`	Bearer token	Upgrade subscription
`GET`	`/billing/portal`	Bearer token	Manage billing
`GET`	`/mcp/resources`	Public	List MCP resource metadata (no bodies)
`GET`	`/mcp/prompts`	Public	List MCP prompts
`POST`	`/api/v1/keys/rotate`	Session cookie	Regenerate the signed-in user's API key
`POST`	`/api/v1/dashboard/verify`	Session cookie	Attest from the dashboard without pasting a key
`GET`	`/api/v1/dashboard/status/:id`	Session	Poll a dashboard attestation the user owns
`GET/PUT/POST/DELETE`	`/api/v1/admin/*`	`X-Admin-Key`	Operator-only (disabled if `ADMIN_API_KEY` is unset)

MCP Tools

Tool	Description
`verify_xrp_payment`	Submit txHash for FDC attestation
`get_attestation_status`	Check attestation by UUID (public subset unless owning key)
`lookup_attestation_by_tx`	Find attestation by txHash (public subset unless owning key)
`get_server_info`	Server + network info

Connect via stdio: npm run start:mcp

Network Configuration

Param	Coston2 (Testnet)	Flare Mainnet
RPC	`https://coston2-api.flare.network`	`https://flare-api.flare.network`
Chain ID	114	14
FdcHub	`0x48aC463d7975828989331F4De43341627b9c5f1D`	`0xc25c749DC27Efb1864Cb3DADa8845B7687eB2d44`
FdcVerification	`0x906507E0B64bcD494Db73bd0459d1C667e14B933`	`0x9394c7A36b3Da8de1b4F27cdD0a554dA4Fa7132d`
DA Layer	`https://ctn2-data-availability.flare.network`	`https://flr-data-availability.flare.network`
Verifier API	`https://fdc-verifiers-testnet.flare.network`	`https://fdc-verifiers-mainnet.flare.network`
Source ID	`testXRP`	`XRP`
First Voting Round	`1658430000`	`1658430000`
Attestation fee	1 test FLR	20 FLR

Architecture

┌───────────────────────┐
│     User dApp         │  (Flare EVM)
│  (PaymentVerifier.sol)│
└────────┬──────────────┘
         │ verifyXRPPayment(proof)
         ▼
┌───────────────────────┐
│  FdcVerification      │  (enshrined FDC protocol contract)
│  (via ContractRegistry)│
└────────┬──────────────┘
         │
    ┌────┴────┐
    │ DA Layer│──── Proof + response
    └────┬────┘
         │
    ┌────┴────┐
    │ Verifier│──── ABI-encoded request with MIC
    └────┬────┘
         │
    XRP Testnet / Mainnet

Lookback: Flare's XRPPayment attestation (IXRPPayment lutlimit 0x127500) can only prove native XRP Payments from the last 14 days. Older hashes still exist on XRPL, but the hosted verifier returns INVALID: TRANSACTION DOES NOT EXIST. XRPLink preflights the ledger and returns TX_TOO_OLD instead of a misleading FdcHub error. Failed prepares do not consume monthly quota.

Key data flow:

XRP tx happens on XRP Ledger
Verifier API fetches tx details, computes MIC, returns ABI-encoded request
Request submitted to FdcHub on Flare with FLR fee
FDC providers independently verify the XRP tx, reach consensus (90s round)
Merkle root stored onchain via Relay contract
DA Layer serves attestation response + Merkle proof
Smart contract verifies proof against onchain Merkle root via FdcVerification

Contributing

See CONTRIBUTING.md. All contributions welcome — bug fixes, feature requests, docs improvements, and test additions.

XRPLink is source-available (BUSL-1.1) and built for the Flare ecosystem. Non-commercial use, evaluation, and personal use are free. Running XRPLink as a commercial service requires a license from the Licensor.

License

BUSL-1.1 — see LICENSE. Converts to MIT after four years.

Reviews

No reviews yet

Be the first to review this server!

4.8

Local

MCP Marketplace

Free

by mcp-marketplace · Developer Tools

Search and install MCP servers from inside your AI client.