PipRail

MCP server · agent payments · 29 chains · local-only

An MCP server that lets Claude pay for things.

Hand any MCP client a budget-bound payment wallet. Claude Desktop, Cursor, Claude Code, Windsurf, VS Code, and Cline can pay x402-gated URLs on their own — across 29 chains, capped by a spend policy the model cannot exceed. No backend, no custody, no code.

$ npx -y @piprail/mcp
@piprail/mcp on npm

Add it in one block.

Drop this into your MCP client with your wallet key and a budget. The defaults are deliberately small and safe — 0.10 per payment, 10.00 lifetime per token, USDC on Base.

claude_desktop_config.json 
// claude_desktop_config.json — paste, restart, done
{
  "mcpServers": {
    "piprail": {
      "command": "npx",
      "args": ["-y", "@piprail/mcp"],
      "env": {
        "PIPRAIL_PRIVATE_KEY": "0x…",
        "PIPRAIL_CHAIN": "base",
        "PIPRAIL_MAX_AMOUNT": "0.10"
      }
    }
  }
}

Restart your client — the tools appear.

Never commit your key. Cursor, Claude Code, Windsurf and VS Code support ${env:PIPRAIL_PRIVATE_KEY} interpolation — keep it out of the file. Claude Desktop takes the plain value, so treat that config as a secret.

Per-client config Every env var

Eight tools, the moment it connects.

A complete, safe payment workflow — discover → quote → plan → pay, then verify. Only piprail_pay_request moves money; the rest are read-only.

Budget-bound and local-only — the policy is enforced before any send, so the model can’t overspend even if it tries. Full tool reference →

Drop it into your framework.

First-party integrations give your agent a budget-bound wallet — most by wrapping this same MCP server (the native elizaOS plugin and n8n node use the SDK directly). No config wrangling.

OpenClaw logo

OpenClaw

ClawHub skill

Hand an OpenClaw agent a budget-bound wallet across every major chain. Install the ClawHub skill or add one mcp.servers entry — the eight piprail_* tools appear, capped by a spend policy.

clawhub install piprail
Set it up
Hermes logo

Hermes

Native MCP

Hand a Hermes agent a budget-bound wallet across every major chain. One command and the eight piprail_* tools appear — no facilitator, no fee, capped by a spend policy.

hermes mcp add piprail --command npx --args -y @piprail/mcp
Set it up
elizaOS logo

elizaOS

Native plugin

Hand an elizaOS agent a budget-bound wallet across every major chain. Add one plugin and it gets six native payment actions — pay, quote, plan, discover, budget, guide — no facilitator, no fee, capped by a spend policy.

npm i @piprail/elizaos-plugin
Set it up
n8n logo

n8n

Community node

Pay x402 URLs from any n8n workflow. Install one community node and a PipRail node appears with four operations — pay, plan, quote, estimate cost — callable by n8n AI Agent nodes and capped by a spend policy. EVM chains, no facilitator, no fee.

@piprail/n8n-nodes-piprail
Set it up
Mastra logo

Mastra

MCP server

The first x402 payment integration for Mastra. Wire @piprail/mcp in through Mastra's MCPClient and an agent gets all eight PipRail tools — pay, plan, quote, discover, budget and more — capped by a spend policy. Every chain, no facilitator, no fee.

npx -y @piprail/mcp
Set it up
More coming Vercel AI SDKCrewAI

Building on a framework that isn’t here yet? It already works as a raw MCP server. All integrations →

Why it's safe.

The spend policy is the boundary — and it's enforced where it counts.

Caps enforced before any send

Per-call and lifetime-per-token limits are checked against the token's true on-chain decimals — a server can't understate a price to slip past a cap. Over budget → declined, nothing moves.

No custody, no backend

Runs locally with your key, your RPC, your limits. Payments settle wallet-to-wallet — PipRail holds nothing and runs no service. Nothing to compromise.

Open and auditable

MIT-licensed and open source — read it, audit it, run it yourself. No key ever leaves your machine.

Pay across all 29 chains — 20 EVM mainnets plus Solana, TON, Tron, NEAR, Sui, Aptos, Algorand, Stellar, and the XRP Ledger. See every chain →

MCP FAQ.

The trust questions, answered. The setup how-to lives in the docs.

How does spend budgeting work — can the agent overspend?

No. PIPRAIL_MAX_AMOUNT caps each individual payment and PIPRAIL_MAX_TOTAL caps lifetime spend per token. Both are enforced by the SDK before any on-chain send, and checked against the token’s true on-chain decimals — so a malicious server can’t slip past a limit by misstating the price. An over-budget request comes back as { declined: true, reason } and nothing moves. You can also restrict tokens (PIPRAIL_TOKENS) and destination hosts (PIPRAIL_HOSTS).

How do I give Claude Desktop a spending-capped crypto wallet?

Add @piprail/mcp to your MCP config with a wallet key, a chain, and your caps — PIPRAIL_MAX_AMOUNT for the per-payment ceiling and PIPRAIL_MAX_TOTAL for lifetime spend. Claude Desktop then has a wallet it can spend from autonomously and cannot exceed, because the policy is enforced by the SDK before any on-chain send, not by asking the model to behave. Nothing is hosted: the server runs locally, the key stays on your machine, and payments go wallet-to-wallet with no custodian and no PipRail account. The same block works in Cursor, Claude Code, Windsurf, VS Code and Cline.

How do I set a budget limit on an AI agent that spends money?

PipRail enforces the limit in code, below the model, so a looping or jailbroken agent cannot talk its way past it. You get a per-payment cap (PIPRAIL_MAX_AMOUNT), a lifetime cap per token (PIPRAIL_MAX_TOTAL), a cross-token grand total by denomination (PIPRAIL_MAX_TOTAL_DENOM, e.g. USD:20.00), rolling-window caps on both spend and payment count (PIPRAIL_WINDOW_SECONDS with PIPRAIL_WINDOW_TOTAL and PIPRAIL_MAX_PAYMENTS_PER_WINDOW), plus token, chain and host allowlists. Set PIPRAIL_CONFIRM to require a human to approve each payment where the client supports elicitation, PIPRAIL_WARN_AT_FRACTION to be warned as a cap approaches, and PIPRAIL_SPEND_LOG to keep the budget durable across restarts. An over-budget request returns { declined: true, reason } and nothing moves.

Does the MCP take custody of my funds or run a backend?

No. The server runs locally on your machine with your key, your RPC, and your limits. Payments settle wallet-to-wallet straight to the recipient — PipRail runs no service and holds nothing. There’s no PipRail backend to compromise and no facilitator in the path. The server code is MIT and open; you can audit or run it yourself.

Which AI clients and chains does the MCP support?

Clients: Claude Desktop, Cursor, Claude Code, Windsurf, VS Code, and Cline — any MCP client. Chains: all 29 PipRail supports — 20 EVM mainnets plus Solana, TON, Tron, NEAR, Sui, Aptos, Algorand, Stellar, and the XRP Ledger. EVM works out of the box (the server ships with viem); non-EVM chains pull their SDK peer library on demand. Each server instance is one wallet on one chain — register it once per chain to give an agent several rails.

What’s the difference between @piprail/sdk and @piprail/mcp?

The SDK is for developers who write code — you call requirePayment / createPaymentGate to charge, or PipRailClient to pay, in TypeScript. The MCP flips that: you write no code, you add an env block, and agents in your MCP client pay x402 URLs autonomously, capped by a spend policy. Same engine, same 29 chains, same backendless self-custody — the MCP is the zero-integration path for AI/agent operators.

Give your agent a wallet.

One env block, budget-bound, on every chain that matters.

npm install GitHub Read the docs