pop-pay
About
Stop AI agents leaking your payment info or making hallucinated purchases. No SaaS, No login, No pain, fully local.
Details
- Author
- 100xpercent
- Categories
- Other, Security, AI
- Tags
- #payment
Jump to
Setup
Install pop-pay in your MCP client (Claude Desktop, Cursor, Windsurf, and others).
Repository: https://github.com/100xpercent/pop-pay
Follow the installation instructions in the repository README, then restart your MCP client.
it only takes0.1%of Hallucination to drain100%of your wallet.
The runtime security layer for AI agent commerce. Drop-in CLI + MCP server. Card credentials are injected directly into the browser DOM via CDP — they never enter the agent's context window. One hallucinated prompt can't drain a wallet it can't see.
📄Research Dataset & Reproduction— this repository hosts the open dataset and reproduction harness for"The Illusion of Single-Attacker Rankings". research: jump toResearch Dataset & Reproduction.
curl -fsSL https://raw.githubusercontent.com/100xPercent/pop-pay/main/install.sh | sh
All install paths expose the same binaries:pop-pay,pop-launch,pop-init-vault,pop-unlock.
Also available as@100xpercent/mcp-server-pop-pay— identical package under the MCP@scope/mcp-server-<name>convention. Tracks the same version on every release.
Using Python?Check outpop-pay-python—pip install pop-pay. Same security model, same vault format, independent release cycle — safe to switch between runtimes.
1. Initialize the encrypted credential vault
This encrypts your card credentials into~/.config/pop-pay/vault.enc(AES-256-GCM). For stronger protection (blocks agents with shell access):
pop-pay init-vault --passphrase # one-time setup pop-pay unlock # run once per session
2. Launch Chrome with CDP remote debugging
This opens a Chromium instance onhttp://localhost:9222that pop-pay injects credentials into. Your agent (via MCP, browser automation, or x402) then drives the checkout flow — card details never leave the browser process.
The CLI launches infrastructure; the actual payment tool calls come from your agent. Two supported paths:
- MCP server— add pop-pay to any MCP-compatible client (Claude Code, Cursor, Windsurf, OpenClaw). SeeMCP Serverbelow.
- x402 HTTP— pay for API calls via thex402 payment protocol.
Standard config for any MCP-compatible client:
{ "mcpServers": { "pop-pay": { "command": "npx", "args": ["-y", "pop-pay", "launch-mcp"], "env": { "POP_CDP_URL": "http://localhost:9222" } } } }
Claude Code uses its own CLI — the JSON config above is not needed.
claude mcp add --scope user pop-pay -- npx -y pop-pay launch-mcp
--scope usermakes it available across all projects. To remove:claude mcp remove pop-pay
- Cursor:~/.cursor/mcp.json
- Windsurf:~/.codeium/windsurf/mcp_config.json
- VS Code (Copilot):.vscode/mcp.jsonin project root
OpenClaw has its own CLI — the JSON config above is not needed.
openclaw mcp add pop-pay -- npx -y pop-pay launch-mcp
Or add to~/.openclaw/mcp_servers.jsonusing the JSON config above.
For System Prompt templates and NemoClaw sandbox setup, seeIntegration Guide §4.
Runs the MCP server + headless Chromium with CDP. Mount your encrypted vault from the host.
Tip for Claude Code users:Add the following to your project'sCLAUDE.mdto help the agent know when to call pop-pay:"When you encounter a payment form or checkout page, use therequest_virtual_cardtool. For billing/contact info forms, userequest_purchaser_infofirst."
Core variables in~/.config/pop-pay/.env. SeeENV_REFERENCE.mdfor the full list.
To enable LLM mode, seeIntegration Guide §1.
Priority:Stripe Issuing → BYOC Local → Mock.
SeeTHREAT_MODEL.mdfor the full STRIDE analysis andCOMPLIANCE_FAQ.mdfor enterprise details.
- TypeScript— MCP server, CDP injection engine, guardrails, CLI
- Rust (napi-rs)— Native security layer: XOR-split salt storage, scrypt key derivation
- Node.js crypto— AES-256-GCM vault encryption (OpenSSL binding)
- Chrome DevTools Protocol— Direct DOM injection via raw WebSocket
- Threat Model— STRIDE analysis, 5 security primitives, 10 attack scenarios
- Guardrail Benchmark— Cross-model evaluation (Anthropic / OpenAI / Gemini) across 585 payloads, 11 attack categories
- Compliance FAQ— PCI DSS, SOC 2, GDPR details
- Environment Reference— All POP_ environment variables
- Integration Guide— Setup for Claude Code, Node.js SDK, and browser agents
- Categories Cookbook— POP_ALLOWED_CATEGORIES patterns and examples
This repository hosts the open-source dataset and harness for the cross-vendor attacker-stability methodology described in the corresponding research paper. Reviewer/researcher reproduction artifacts:
- Corpus(585 attack payloads, 11 categories):tests/redteam/corpus/
- attacks.json— full payload set with category labels
- GENERATION.md— corpus generation protocol
- schema.json— payload schema
- PRIMARY whitebox-no-feedback runs:runs/adaptive/2026-04-28T19-50-
- Static panel runs:runs/static/
- Prompt-ablation (v3 / strict / paranoid):runs/ablation/
- python3 paper-artifacts/gen-tables.py --table all— Tab.~bypassk / threat-ablation / cross-vendor
- python3 paper-artifacts/gen-taxonomy-map.py— Fig.~taxonomy-map
For dataset schema, statistical methodology (bootstrap CI, Holm-Bonferroni, McNemar), full from-scratch re-collection instructions, JSONL row data dictionary, and responsible-disclosure policy, seedocs/PAPER_REPRODUCTION.md.
Proof-of-Work + Lightning Network authentication for AI agents. Wraps paid MCP tools with L402-signed receipts.
Trust intelligence platform for AI agents — identity certification, trust scoring, forensic audit trails, and x402 micropayments. 14 MCP tools.
Open-source API gateway that adds budget enforcement, cost attribution, and monetization to AI agent API calls. MCP-aware with per-tool cost tracking, macaroon-based bearer tokens, L402 Lightning micropayments, and enterprise budget control (Fiat402). The economic firewall for the agent economy.
ALTER - identity infrastructure for the AI economy
Enable AI Agents to purchase anything in a secure way using Fewsats
Give AI agents a Bitcoin wallet with Lightning Network payments
KHEPRA MCP Server smithery badge MCP Registry License Container PQC Sovereign compliance engine with 36,195 STIG/CCI/NIST/CMMC mappings. Air-gappable. Zero token costs. Run ert_scan → get a Godfather Report with dollar-denominated business impact. The only MCP compliance server that runs on your metal — with the World's First DoD PQC STIG built in. PQC-01-STIG-V1R1 — Full Whitepaper → 17 controls covering CNSA 2.0, FIPS 203/204/205, and the NSA's May 2026 MCP security advisory. The world's first DoD-style Post-Quantum Cryptography STIG, including the first PQC controls for agentic AI and MCP deployments.
Static MCP discovery card for x402 spend-policy, paid MCP launch guidance, seller checkout repair, and agent-payment safety APIs.
Cryptographic runtime governance for AI agents. 20 tools. Sealed policy artifacts, continuous measurement, tamper-evident proof. Ed25519 + SHA-256.
Auth0, but for agents. Identity and authentication service for AI agents.
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
