Install
$ agentstack add mcp-jarrodwatts-scuttlepay ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
ScuttlePay
ScuttlePay lets AI agents buy things online - no humans (or credit cards) required.
- For merchants: Allow AI agents to discover and purchase products from your store.
- A Shopify plugin that exposes your store's products to AI agents via an API.
- An admin dashboard for merchants to see purchases made by AI agents on their store.
- For agents: Browse items and buy products - without a human in the loop!
- A User dashboard where you can add funds and set spending limits for your AI agents.
- An agent skill to teach agents how to autonomously purchase products.
How It Works
Architecture
┌─────────────┐ REST API ┌──────────────────────────────────────────────┐
│ AI Agent │◄────(sk_* key)───►│ ScuttlePay │
│ (Claude) │ │ │
└─────────────┘ │ ┌──────────┐ ┌──────────┐ ┌───────────┐ │
│ │ Spending │ │ Wallet │ │ Payment │ │
│ │ Policies │ │ Service │ │ Service │ │
│ └────┬─────┘ └────┬──────┘ └─────┬─────┘ │
│ │ │ │ │
│ ▼ ▼ ▼ │
│ ┌─────────┐ ┌──────────┐ ┌───────────┐ │
│ │ Postgres │ │ thirdweb │ │ Stripe │ │
│ │ │ │ Engine │ │ x402 │ │
│ └──────────┘ └────┬─────┘ └─────┬─────┘ │
└─────────────────────┼──────────────┼────────┘
│ │
▼ ▼
┌─────────┐ ┌───────────┐
│ Base │ │ Shopify │
│ (USDC) │ │ Admin │
└─────────┘ └───────────┘
ScuttlePay is a Next.js 15 app backed by PostgreSQL, thirdweb Engine for wallet management, and Stripe x402 for settlement. Agents authenticate with API keys (sk_*) and interact through a REST API — no MCP server or separate process needed.
Agent wallets and API keys
When a user signs up, ScuttlePay creates a server-side wallet on Base via thirdweb Engine. The user funds it with USDC, then creates API keys from the dashboard — each key is bound to a spending policy with per-transaction and daily limits (in USDC). The raw key is shown once; only a SHA-256 hash is stored.
Purchase flow
When an agent calls POST /api/mcp/purchase:
- Product lookup — Fetch the product (and optional variant) from the merchant's Shopify Storefront API. Resolve the USDC price.
- Serializable transaction — Inside a single Postgres
SERIALIZABLEtransaction:
- Read the wallet's on-chain USDC balance
- Evaluate spending limits (per-tx max, daily cap with UTC window)
- Insert a
PENDINGtransaction row
- Settlement — Transfer USDC on Base to Stripe's x402 crypto deposit address (or directly to a settlement address in testnet mode). thirdweb Engine signs and submits the transaction.
- Order creation — Create an order in Shopify Admin marked as
PAIDwith the blockchain tx hash as payment proof. This step is non-fatal — if Shopify is down, the agent's payment still settles.
All USDC math uses bigint arithmetic (never floating point) to preserve 6-decimal precision.
Merchant onboarding
Merchants install the Shopify app, which stores their Storefront API token (for product browsing) and Admin API token (for order creation). They connect a Stripe account to receive settlement payouts. The merchant dashboard shows orders placed by agents and sales stats.
Agent-facing API
| Method | Endpoint | Purpose | |--------|----------|---------| | GET | /api/mcp/wallet | Balance and wallet info | | GET | /api/mcp/merchants | List available stores | | GET | /api/mcp/products | Search or get product details | | POST | /api/mcp/purchase | Execute a purchase | | GET | /api/mcp/transactions | Transaction history |
Stack
| Layer | Tech | |-------|------| | Frontend | Next.js 15 (App Router), React 19, Tailwind 4, shadcn/ui | | API | tRPC 11 + TanStack Query 5, Next.js route handlers | | Database | PostgreSQL (Drizzle ORM) | | Wallets | thirdweb Engine (server-side wallets on Base) | | Payments | Stripe x402 crypto mode (USDC on Base) | | Validation | Zod (shared schemas in packages/shared) | | Auth | thirdweb wallet signatures (JWT) + API keys |
Configuration
Two environment variables are required:
| Variable | Description | |----------|-------------| | SCUTTLEPAY_API_KEY | Your API key (starts with sk_) — get it from the dashboard | | SCUTTLEPAY_API_URL | ScuttlePay instance URL (e.g. https://scuttlepay.com) |
Safety
The plugin instructs Claude to always confirm purchases with you before executing. Your agent will show the product, price, and merchant before spending any USDC.
Spending limits (per-transaction and daily) are configured when you create your API key in the dashboard. Limits are enforced server-side inside a serializable database transaction — agents cannot circumvent them.
License
MIT — see [LICENSE](LICENSE)
Source & license
This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: jarrodwatts
- Source: jarrodwatts/scuttlepay
- License: MIT
- Homepage: https://scuttlepay.com
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.