Payfetch

The buy-side seat of the Forum Labs network: a paying-fetch client with spending controls you set, and a wallet that stays yours.

npm v1.0.1 signed npm provenance source on GitHub MCP registry Smithery 393 tests passing MIT

Real footage: the payment settles on Base (the tx hash is in frame) and the over-cap call is refused. Watch the full 82-second take.

Point it at a URL that answers HTTP 402 (the x402 payment challenge). Payfetch reads the terms, checks them against your policy, optionally consults the Trust and Safety checks, pays with a single gasless USDC authorization, and returns the content, with a receipt. It's the piece of the network that sits where the money moves: the safe way to let an agent buy on its own without handing it your credit card.

Read the full methodology →

Your wallet, your rules

Fund only what you can lose. Bring your own wallet, a local key or your own server-wallet credentials; the key never leaves your process, and we never touch, hold, or route funds. Run it on a dedicated wallet funded with only what you're prepared to spend: the balance is the hard blast-radius, the caps are the rate limiter and audit line.
Reserve-before-pay hard caps. Per-call, per-day, and per-host spending limits. A payment is budget-held the moment it's authorized and only released when it provably can't be claimed; it over-counts before it under-counts.
The agent can never raise its own limits. There is no tool that widens policy; an agent's parameters can only tighten a call, never loosen your caps.
Human-in-the-loop above a threshold you set (default $0.10), plus deny/allow lists, a dry-run mode, and per-host auto-deny for endpoints that take money without delivering.
Append-only receipts. Every payment writes a local, tamper-evident receipt: your own audit trail.

Checks before it pays

Payfetch can consult Forum Labs' Trust Score (is this endpoint reliable?) and Token Safety (is this asset a serial-rug risk?) before releasing a payment. The trust check is on by default and is disclosed plainly: it sends the target endpoint (query string stripped) plus a pseudonymous install id to our trust API before paying, so the check can run. That is Payfetch's only phone-home, and a single flag turns it off. The safety check is off by default and opt-in. By default both checks are advisory: if a check is unavailable, Payfetch degrades to a note and does not block your agent. In enforce mode, which you opt into, an unavailable check fails closed and blocks the payment, since enforce means do not pay without a clean answer. The checks are consultative by design: they inform or pause a payment under your policy; the verdict surfaces and their methodology are published at Trust Score and Token Safety.

The full methodology covers the wallet and cap model, exactly what a guard call sends, receipts, the SSRF block, outcome reporting, and what it does not protect against. Source: github.com/forum-labs/payfetch.

What payfetch does not protect against. Fetched content is untrusted input to your agent, so a malicious page can still tell it to fetch or pay elsewhere. The dedicated wallet's balance and the caps, deny lists, approval threshold, receipts, and SSRF block bound the damage; they do not make the agent wise, so keep the wallet balance small. There is no on-chain settlement verification yet, so a lying server can misreport (payfetch over-counts, which is the safe direction), and the ledger is single-instance. We would rather you know.

Full threat model → · Security and disclosure in the README →

Install

npm i @forum-labs/payfetch

# Wire into Claude Code (TEST_MODE keeps first runs on Base Sepolia):
claude mcp add payfetch \
  --env PAYFETCH_PRIVATE_KEY=0x... \
  --env PAYFETCH_TEST_MODE=1 \
  -- npx -y -p @forum-labs/payfetch payfetch-mcp

The package ships two binaries, so the MCP server is launched with npx -y -p @forum-labs/payfetch payfetch-mcp (the -p selects the server binary; the payfetch binary is the operator CLI). Drop PAYFETCH_TEST_MODE=1 when you are ready to spend real USDC on Base. Requires Node 22 or newer.

Works with Claude Code. Hard caps the agent can never raise, autonomous payment below your approval threshold (default $0.10), refusal with clear guidance above it unless you pre-approve a ceiling or specific hosts in config, and a local receipt for every payment. Approval prompts use MCP elicitation: in clients that support it, a payment above your threshold pauses and shows the host, resource, amount, network, guard results, and today's remaining budgets before a human approves it once. Current Claude Code and Claude Desktop versions do not yet service elicitation prompts (Claude Code does not advertise the capability; Claude Desktop cancels the prompt), so approval there is explicit config pre-approval. When a client adds elicitation support, the prompt works with no payfetch change.

Ships as a TypeScript library, a CLI, and an MCP server. The server exposes five tools: paid_fetch fetches a URL and pays if it answers 402, payment_quote prices a URL and checks it against your policy without paying, spend_status reports today's spend and remaining budgets, list_receipts queries the local receipt ledger, and approve_pending lists or resolves payments waiting on a human. Free. Payfetch never takes a cut; you pay only the endpoints you choose to.

Framework integrations

Payfetch also plugs into the two stacks agents are already built on — same operator-owned policy either way: the same per-call, per-day, and per-host caps, a receipt for every attempt, keys that never leave your machine, and no tool that lets the agent raise its own limits.

Coinbase AgentKit — a payfetch action provider: npm i @forum-labs/payfetch-agentkit
Vercel AI SDK — a payfetch tool: npm i @forum-labs/payfetch-vercel

Both carry signed npm provenance and depend on the same core client. Source in the adapters directory.

Forum Labs · Payfetch · Trust Score · Token Safety · Methodology · GitHub · ops@forum-labs.com · @shopforumlabs
© 2026 Forum Labs. Non-custodial software. You control the wallet and the spending policy. Not financial advice.