Back to Browse

Payperscreen MCP Server

Developer ToolsLow Risk9.7MCP RegistryLocal
Free

Server data from the Official MCP Registry

Sanctions, crypto wallet, email and IP screening for agents. Pay per check in USDC via x402.

About

Sanctions, crypto wallet, email and IP screening for agents. Pay per check in USDC via x402.

Security Report

9.7
Low Risk9.7Low Risk

Valid MCP server (3 strong, 3 medium validity signals). No known CVEs in dependencies. ⚠️ Package registry links to a different repository than scanned source. Imported from the Official MCP Registry. 1 finding(s) downgraded by scanner intelligence.

7 files analyzed · 1 issue found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

What You'll Need

Set these up before or after installing:

Private key of a wallet holding a few dollars of USDC; pays 1 to 2 cents per check. Free tools work without it.Required

Environment variable: PAYPERSCREEN_PRIVATE_KEY

Maximum USD the server may spend per session (default 1.00).Optional

Environment variable: PAYPERSCREEN_MAX_SPEND

Where the wallet holds USDC: base (default), polygon or arbitrum.Optional

Environment variable: PAYPERSCREEN_NETWORK

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-tonythetiger22-payperscreen": {
      "env": {
        "PAYPERSCREEN_NETWORK": "your-payperscreen-network-here",
        "PAYPERSCREEN_MAX_SPEND": "your-payperscreen-max-spend-here",
        "PAYPERSCREEN_PRIVATE_KEY": "your-payperscreen-private-key-here"
      },
      "args": [
        "-y",
        "payperscreen-mcp"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

PayPerScreen

Pay-per-check compliance screening over x402. Sanctions names, crypto wallets, emails and IP addresses, paid per request in USDC on Base, Polygon or Arbitrum. No account, no API key, no contract.

This repo is the whole thing: the paid API, the website, the case queue and the list ingest. Use the hosted version, or run your own.

What it checks

EndpointPriceWhat it does
GET /screen?name=$0.02Fuzzy name match against OFAC SDN, UN Consolidated, EU Consolidated and UK Sanctions lists, refreshed daily. Each hit includes record ID, programmes, aliases and a date of birth / nationality / type comparison
GET /context?name=$0.05The same comparison for the top hit; now included in /screen, kept for existing integrations
GET /screen-address?address=$0.02Exact match against OFAC sanctioned addresses (with the listed party), Tether USDT freezes on Tron, and known hack proceeds. Each source is reported separately
GET /screen-email?email=$0.02Ten deterministic signals: MX, disposable domain, domain age, certificate history, DNSBL, typo-squat, role account, mailbox probe and more
GET /screen-ip?ip=$0.01Spamhaus ZEN and Tor exit node check (beta)

No LLM anywhere in the scoring. Every result says which sources it checked.

Calling it

Any x402 client works. The reference client is a single file:

PRIVATE_KEY=0x... node examples/agent-client.mjs screen "Jane Doe"

An unpaid request returns 402 Payment Required with the price; the client signs a USDC payment and retries.

Use it from Claude, Cursor or any MCP client

The mcp/ folder is an MCP server (npx -y payperscreen-mcp) that gives an AI agent screen_name, screen_wallet, check_email and check_ip tools, paying per check from a wallet you configure, with a spending cap. See mcp/README.md.

claude mcp add payperscreen -e PAYPERSCREEN_PRIVATE_KEY=0xYOUR_KEY -- npx -y payperscreen-mcp

Running your own

Two Node services from one repo, plus Postgres:

ServiceEntryPortWhat it is
APIcompliance-api.js4025The paid x402 endpoints and list refresh
Sitepayment-agent.js (npm start)4030Website, wallet payments, prepaid balance, case queue, admin
npm install
psql "$DATABASE_URL" -f schema.sql
node compliance-api.js        # API
npm start                     # website

API settings

VariableNeededPurpose
DATABASE_URLyesPostgres with the pg_trgm extension
SELLER_ADDRESSyesWallet that receives payments
CDP_API_KEY_ID, CDP_API_KEY_SECRETyesCoinbase CDP facilitator (settles payments)
AUTO_REFRESH_LISTS=1recommendedRefresh every list daily, starting 60 s after start
TRONGRID_API_KEYoptionalFaster USDT-on-Tron freeze sync
ETH_RPC_URL, BASE_RPC_URL, ARB_RPC_URL, OP_RPC_URLoptionalNode URLs that serve historical logs (e.g. Infura). Each one set switches on freeze coverage for that chain (USDT and USDC on Ethereum, USDC on Base, Arbitrum, Optimism); unset chains are skipped and not claimed
PUBLIC_API_URLoptionalPublic URL reported to x402 directories
TOPUP_MIN_USDoptionalMinimum prepaid top-up (default 1.25)
INTERNAL_API_KEYrecommendedSame random value (32+ characters) on both services. Prepaid-balance checks then come straight off the customer's balance via /internal/*, with no second on-chain payment
SOLANA_PAY_TOoptionalA Solana address to receive USDC; when set, every paid route also accepts payment on Solana

Site settings

VariableNeededPurpose
COMPLIANCE_API_URLyesWhere the API runs
BUYER_KEYyesSite wallet: pays the API for admin test checks (and for prepaid checks if INTERNAL_API_KEY isn't set)
INTERNAL_API_KEYrecommendedSame value as on the API; prepaid checks then come off customers' balances directly
ADMIN_CODEyesCode for /admin
DB_PATHyes in productionSQLite file for accounts, cases, balances (put it on a persistent volume)
CONTACT_EMAIL, CONTACT_X, CONTACT_FACEBOOKoptionalFooter contact details
ANALYTICS_SALToptionalSalt for privacy-preserving visitor counts
BASE_RPC_URLoptionalVerifies smart-contract wallet sign-ins

Data sources

SourceLicence
OFAC SDN and sdn_advanced.xml (US Treasury)Public domain
UN Security Council Consolidated ListPublic
EU Consolidated Financial Sanctions ListPublic
UK Sanctions List (FCDO)Open Government Licence
Stablecoin freezesRead from the Tether USDT contract's public on-chain events on Tron (Ethereum and Circle USDC chains switch on when an RPC is set, see below)
Known hack proceeds (data/hack-addresses.json)Curated here from FBI notices (public domain) and published incident reports; each incident lists its sources
Crypto address fallback0xB10C/ofac-sanctioned-digital-currency-addresses, MIT

Not legal advice

A screening result is a lookup against the listed sources, not a compliance decision. "No match" means no match on those lists only. See the methodology for exactly what each check does and doesn't cover.

Contributing

Issues and pull requests are welcome. Most useful right now: new public data sources (each kept as its own labelled result, never folded into "sanctioned"), and corrections to the hack list with a source link.

server.js, shop.js and check.js are early x402 experiments (a demo weather API), kept for reference; they aren't part of PayPerScreen.

Licence

MIT, see LICENSE.

Reviews

No reviews yet

Be the first to review this server!