Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add xona-labs/xpay --skill xpaygit clone --depth 1 https://github.com/xona-labs/xpayWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/xona-labs/xpay/xpay)<a href="https://agentmods.dev/skills/xona-labs/xpay/xpay"><img src="https://agentmods.dev/badge/skills/xona-labs/xpay/xpay/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/xona-labs/xpay/xpay"><img src="https://agentmods.dev/badge/skills/xona-labs/xpay/xpay.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00083 | $0.02459 |
| Opus 5 | $0.00042 | $0.01229 |
| Sonnet 5 | $0.00017 | $0.00492 |
| Haiku 4.5 | $0.00008 | $0.00246 |
Grade A, and why
xpay scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 165 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Xona Wallet: a wallet and payment rail for agents
Xona Wallet lets an agent find a service, pay for it, and get the result without writing any payment plumbing. It hides x402, USDC, RPC, and multi-network routing behind a flat set of tools.
The fastest mental model: discover (find a paid service) → use (pay + call
it) → you get the response. Or skip straight to do (find the best service for
an intent and call it in one step).
Setup (zero-config)
Add Xona Wallet as an MCP server - no keys, no init:
{ "mcpServers": { "xpay": { "command": "npx", "args": ["-y", "@xona-labs/xpay", "mcp"] } } }
On first run the agent is given its own wallet. Its Solana address is printed to the server's stderr - fund that address with USDC and the agent can pay. The wallet persists and is reused across restarts.
To use a wallet you already hold instead, set XPAY_SOLANA_SECRET (base58) in
the MCP env. To require an explicit wallet (no auto-generation), set
XPAY_NO_AUTO_WALLET=1.
Tools
| Tool | Use it to |
|---|---|
xpay_discover |
Find paid services by natural-language query. Returns ranked candidates with price, network, and payee. |
xpay_use |
Pay for and call a specific service. Pass the full resource object from xpay_discover (preferred), or a resourceUrl. Handles the x402 402-challenge → pay → retry flow. |
xpay_do |
One step: discover the best service for an intent and call it. Use when you don't need to compare options. |
xpay_transfer |
Send USDC (or any Solana SPL token, or USDT0 on Stable) directly to an address. Executes immediately, gated by the user's guardrail - confirm amount + destination with the user before calling. |
xpay_token_find |
Find Solana tokens by ticker, name, or mint (price, mcap, liquidity, verified flag). Read-only. |
xpay_rwa_find |
List tradable RWA tokens on Solana: tokenized stocks/ETFs (xStocks, Ondo, Remora) + treasury-backed USDY. Free, read-only; results swappable via xpay_swap. |
xpay_swap |
Swap tokens inside the wallet via Jupiter (Solana only). Irreversible; guardrail-gated. Confirm with the user first. |
xpay_x_user |
Realtime X (Twitter) profile - followers, bio, verification. Paid (~$0.01 at cost via x402). |
xpay_x_posts |
Recent posts from an X account with engagement metrics. Paid (~$0.06 at cost via x402). |
xpay_shop_quote |
Free preflight for product search: exact price, marketplaces it would hit, and whether the query parses as a product search. Quote first when a query is ambiguous. |
xpay_shop_search |
Product discovery across Google Shopping, Amazon, and eBay from one free-text query: normalized, deduped, ranked. Paid (~$0.02 via x402, less for fewer marketplaces). |
xpay_balance |
The wallet's balance per network, plus its addresses (use this to tell the user where to send funds). |
xpay_report |
Spending/income report (daily / weekly / monthly). |
xpay_guardrail |
Read the active spending caps (per-tx, per-day, allowed hosts, approval threshold). |
xpay_agenc_status |
Check the progress of an AgenC marketplace hire (see below). Read-only. |
xpay_bento_status |
Check whether the Bento intent firewall is on (read-only). |
xpay_bento_enable |
Turn the Bento intent firewall on. Returns the agent wallet address to register at app.bentoguard.xyz. |
xpay_bento_disable |
Turn the Bento firewall off - use if the wallet isn't registered and payments are rejected. |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 165 lines · 83 tokens per session scan A f1e7aa97b573
xpay is a skill published in the GitHub repository xona-labs/xpay (1 stars, last pushed 20d ago), licensed MIT. It adds 83 tokens to every session and 2,459 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
mpp-agent
Pay HTTP 402 APIs via Machine Payments Protocol (MPP).
crypto-market-rank
Crypto market rankings and leaderboards. Query trending tokens, top searched tokens, Binance Alpha tokens, tokenized stocks, social hype sentiment ranks, smart money inflow token rankings, top meme token rankings from Pulse launchpad, and top trader PnL leaderboards. Use this skill when users ask about token rankings…
trading-signal
Subscribe and retrieve on-chain Smart Money signals. Monitor trading activities of smart money addresses, including buy/sell signals, trigger price, current price, max gain, and exit rate. Use this skill when users are looking for investment opportunities — smart money signals can serve as valuable references for…
cobie-cycle-filter
Use when evaluating crypto decisions through a Cobie-style cycle filter: common-sense risk, narrative traps, leverage humility, and avoiding obvious stupid trades.
token-pick
One token recommendation and one prediction market pick - scored, quantified, with a skip branch when signals are weak.
bridge
Cross-chain token transfers using Wormhole and CCTP.