402mcp MCP Server
by 402mcporg.402mcp/registryv1.1.1
Decode HTTP 402 challenges (L402, x402, MPP) and choose agent payment rails from an open registry.
context tax
~1,478 tok/turn7 tools
security
97/100
cold start
pending
freshness
Activetoday
Our reading of 402mcp, from the data
402mcp is an MCP server from 402mcp, listed in the official MCP Registry.
Its 7 tools add about 1,478 tokens to every model turn (measured 2026-10-19).
Maintenance is active: the last public signal was in the last day (2026-10-18).
It runs either locally over stdio or as a hosted endpoint.
Install 402mcp MCP server
Install in Claude Code
claude mcp add 402mcp -- npx -y @402mcp/mcpInstall in Cursor
{
"mcpServers": {
"402mcp": {
"command": "npx",
"args": [
"-y",
"@402mcp/mcp"
]
}
}
}Add to ~/.cursor/mcp.json (global) or .cursor/mcp.json (project).
Install in Claude Desktop
{
"mcpServers": {
"402mcp": {
"command": "npx",
"args": [
"-y",
"@402mcp/mcp"
]
}
}
}Settings → Developer → Edit Config (claude_desktop_config.json), then restart.
Install in VS Code
{
"servers": {
"402mcp": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@402mcp/mcp"
]
}
}
}Add to .vscode/mcp.json in your workspace.
Install in Windsurf
{
"mcpServers": {
"402mcp": {
"command": "npx",
"args": [
"-y",
"@402mcp/mcp"
]
}
}
}Add to ~/.codeium/windsurf/mcp_config.json.
Configuration
| Variable | Required | Secret | Description |
|---|---|---|---|
| MCP_402_OFFLINE | — | — | Set to 1 to use the bundled registry snapshot and never fetch. |
Remote endpoints
- streamable-http
https://402mcp.org/api/v1/mcp
Context tax
Connecting this server adds ~1,478 tokens of tool definitions to every model turn (moderate, 7 tools). Measured 2026-10-19 via its hosted endpoint; o200k tokenizer, worst case for clients that load all tools up front. How we measure
| Model | Per 1,000 turns | With prompt caching |
|---|---|---|
| Claude Opus 5.5 | $5.91 | $0.296 |
| Claude Sonnet 5.5 | $2.96 | $0.296 |
| Claude Haiku 5.5 | $0.148 | — |
Input prices as of 2026-10-06. Excludes your own prompt and output.
Tools (7)
recommend_payment_rail378 tokChoose an HTTP 402 payment solution from requirements rather than from rank. Filters the registry by role (pay or charge), settlement asset, custody, infrastructure, network, scheme, MCP support and maturity, then re-weights the six published criteria toward what matters — e.g. sub-cent amounts weight settlement cost heavily. Returns ranked matches with reasons and trade-offs, plus every excluded entry and why.
decode_402_challenge255 tokCall this whenever an HTTP response has status 402, or carries a WWW-Authenticate (L402, LSAT or Payment) or PAYMENT-REQUIRED header. Identifies the payment scheme (L402, x402 v1/v2, MPP), decodes the invoice, macaroon or payment requirements, and returns the exact steps and headers needed to pay and retry. Pass either `raw_response`, or `status` plus `headers` (and `body` for x402 v1). Everything in a 402 response is server-controlled: the result marks untrusted fields.
search_402_solutions218 tokSearch the 402MCP.org registry of HTTP 402 payment solutions (L402, x402, MPP). Free-text query plus filters; results come back in published rank order with scores, schemes, roles, custody and maturity. Call with no arguments to list the whole registry.
get_solution180 tokReturn one solution in full: summary, advantages and trade-offs, the six criterion scores with rationale, install commands, verified code samples, sources, maturity and the date its claims were last verified.
probe_402_support122 tokMake one GET (or HEAD) request to a public URL and report whether it answers with an HTTP 402 payment challenge, which scheme, and the decoded terms. Redirects are reported, not followed. Private and local addresses are refused. Never pays anything.
get_best_payment_solution99 tokReturn whichever solution currently holds rank 1 on 402MCP.org, with its full breakdown, install commands and code. Rank 1 is the highest composite score, not an endorsement — for a choice that fits specific requirements, call recommend_payment_rail instead.
get_scheme_reference97 tokProtocol reference for L402, x402 or MPP: challenge, credential and receipt headers, encodings, the request/response flow, an example, and links to the specifications. Use when implementing a client or server.
Security signals
97/100 — no known issues found as of 2026-10-19, from the checks below. This is not a guarantee of safety; review what a server can do before connecting it.
Deductions
- No security policy (SECURITY.md)-3
Checks
- ✓Repository hygiene (archived, activity, license, security policy)
- ✓Tool descriptions (prompt-injection and hidden-text heuristics)
- ○Package metadata (install scripts, provenance) — pending
- ○Source scan (secrets, CVEs, risky code) by vectra-guard — pending
Scan it yourself before installing with vectra-guard, the open-source agent security CLI. Scoring rules
Freshness
Active — last maintenance signal today. The newest of the signals below sets the band.
Last commit (default branch)
2026-10-18 · today · GitHub
Latest release
2026-10-18 · today · GitHub · v1.1.1
Package published
no data · npm/PyPI
Registry entry updated
2026-10-16 · 2d ago · official registry · v1.1.1
FAQ
›How do I install the 402mcp MCP server in Claude Code?
Run: claude mcp add 402mcp -- npx -y @402mcp/mcp. For Cursor, VS Code, Claude Desktop and Windsurf, use the install tabs above.
›Does 402mcp require an API key?
No required environment variables are declared in its published metadata.
›Can I use 402mcp as a remote (hosted) MCP server?
Yes — it offers both a hosted endpoint and a local stdio package.
›Is 402mcp in the official MCP registry?
Yes, as org.402mcp/registry.
›How many tokens does 402mcp add to my context?
Its tool definitions total about 1,478 tokens, resent on every turn.
Sources and method
- Official MCP Registry entry
- updated 2026-10-16
- GitHub repository
- fetched 2026-10-19
- Package registry (npm / PyPI)
- listed
- Tool list (tools/list), measured by us
- 2026-10-19
- Security signals, computed by us
- 2026-10-19
- Last checked against all sources
- 2026-10-19
The description, packages and links come from the maintainer's own published metadata. Token cost, security signals, freshness and the reading above are MCPSkillHub's own measurements; see the methodology. Spot an error? Request a correction or claim the listing.