An agent wallet and payment tool for finding paid services and paying for them with USDC, a digital dollar-like currency, through the x402 payment system. It provides MCP tools, command-line access, and an SDK, and can create or reuse a Solana wallet.

Finding a paid API, comparing its price and network, paying for and calling the service, sending USDC, checking the balance, and reviewing spending.

It handles service discovery, wallet use, payment, and network routing so the agent does not need custom payment code. This lets an agent call paid APIs when its wallet is funded.

xpay — Skill for Claude Code and Codex by xona-labs

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add xona-labs/xpay --skill xpay

Clone the repo

git clone --depth 1 https://github.com/xona-labs/xpay

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/xona-labs/xpay/xpay/github.svg)](https://agentmods.dev/skills/xona-labs/xpay/xpay)

Your own site

<a href="https://agentmods.dev/skills/xona-labs/xpay/xpay"><img src="https://agentmods.dev/badge/skills/xona-labs/xpay/xpay/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/xona-labs/xpay/xpay"><img src="https://agentmods.dev/badge/skills/xona-labs/xpay/xpay.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 83 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,753 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00083	$0.02753
Opus 5.5	$0.00033	$0.01101
Sonnet 5.5	$0.00017	$0.00551
Haiku 4.5	$0.00008	$0.00275

Measured today against content hash e4768b7d81a5, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

xpay scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

The scan reads SKILL.md. This mod also ships 6 executable files (examples/agenc-hire.ts, examples/agenc-local-sandbox.ts, examples/claude-agent.ts, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

SKILL.md · 172 lines

How it starts

The opening of the file, as written. The whole thing — 172 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Xona Wallet: a wallet and payment rail for agents

Xona Wallet lets an agent find a service, pay for it, and get the result without writing any payment plumbing. It hides x402, USDC, RPC, and multi-network routing behind a flat set of tools.

The fastest mental model: discover (find a paid service) → use (pay + call it) → you get the response. Or skip straight to do (find the best service for an intent and call it in one step).

Setup (zero-config)

Add Xona Wallet as an MCP server - no keys, no init:

{ "mcpServers": { "xpay": { "command": "npx", "args": ["-y", "@xona-labs/xpay", "mcp"] } } }

On first run the agent is given its own wallet. Its Solana address is printed to the server's stderr - fund that address with USDC and the agent can pay. The wallet persists and is reused across restarts.

To use a wallet you already hold instead, set XPAY_SOLANA_SECRET (base58) in the MCP env. To require an explicit wallet (no auto-generation), set XPAY_NO_AUTO_WALLET=1.

Tools

Tool	Use it to
`xpay_discover`	Find paid services by natural-language query. Returns ranked candidates with price, network, and payee; Solana payees carry `trust` (ERC-8004 identity + reputation). `minTrust` keeps only registered merchants.
`xpay_trust_check`	ERC-8004 agent identity + reputation of a Solana merchant wallet (e.g. a resource's `payTo`): name, 0-100 feedback score, review count, ATOM tier. Free, read-only. Unregistered is the common case, not a red flag.
`xpay_use`	Pay for and call a specific service. Pass the full `resource` object from `xpay_discover` (preferred), or a `resourceUrl`. Handles the x402 402-challenge → pay → retry flow.
`xpay_do`	One step: discover the best service for an intent and call it. Use when you don't need to compare options.
`xpay_transfer`	Send USDC (or any Solana SPL token, or USDT0 on Stable) directly to an address. Executes immediately, gated by the user's guardrail - confirm amount + destination with the user before calling.
`xpay_token_find`	Find Solana tokens by ticker, name, or mint (price, mcap, liquidity, `verified` flag). Read-only.
`xpay_rwa_find`	List tradable RWA tokens on Solana: tokenized stocks/ETFs (xStocks, Ondo, Remora) + treasury-backed USDY. Free, read-only; results swappable via `xpay_swap`.
`xpay_order_create`	Save a standing tokenized-stock order (recurring buy, or a one-shot that waits for e.g. premium <= 0.5%). Starts `pending_approval`: tell the user to run the returned `xpay orders approve <id>`; agents cannot approve.
`xpay_orders_list`	Standing orders with status, caps used, next run, and why an active one is still waiting. Read-only.
`xpay_order_cancel`	Cancel a standing order by id.
`xpay_orders_run`	Execute due, approved orders whose conditions hold now (irreversible swaps). Idempotent; `dryRun: true` previews.
`xpay_swap`	Swap tokens inside the wallet via Jupiter (Solana only). Irreversible; guardrail-gated. Confirm with the user first.
`xpay_x_user`	Realtime X (Twitter) profile - followers, bio, verification. Paid (~$0.01 at cost via x402).
`xpay_x_posts`	Recent posts from an X account with engagement metrics. Paid (~$0.06 at cost via x402).
`xpay_shop_quote`	Free preflight for product search: exact price, marketplaces it would hit, and whether the query parses as a product search. Quote first when a query is ambiguous.
`xpay_shop_search`	Product discovery across Google Shopping, Amazon, and eBay from one free-text query: normalized, deduped, ranked. Paid (~$0.02 via x402, less for fewer marketplaces).
`xpay_balance`	The wallet's balance per network, plus its addresses (use this to tell the user where to send funds).
`xpay_report`	Spending/income report (daily / weekly / monthly).
`xpay_guardrail`	Read the active spending caps (per-tx, per-day, allowed hosts, approval threshold).
`xpay_agenc_status`	Check the progress of an AgenC marketplace hire (see below). Read-only.
`xpay_bento_status`	Check whether the Bento intent firewall is on (read-only).
`xpay_bento_enable`	Turn the Bento intent firewall on. Returns the agent wallet address to register at app.bentoguard.xyz.
`xpay_bento_disable`	Turn the Bento firewall off - use if the wallet isn't registered and payments are rejected.

Read the full file on GitHub · 172 lines

Files

What ships with it

6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

today Changed · +2 lines e4768b7d81a5
1mo ago Changed · +5 lines 90e4f74fb225
2mo ago First seen · 165 lines · 83 tokens per session scan A f1e7aa97b573

Subscribe to this mod's changes

xpay is a skill published in the GitHub repository xona-labs/xpay (1 stars, last pushed yesterday), licensed MIT. It adds 83 tokens to every session and 2,753 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Finance and fintech Web3 and blockchain

xpay next to 6 skills from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
xpayxona-labs/xpay	Skill	1	yesterday	MIT	A	83	Claude Code, Codex
agentic-streetLeoYeAI/openclaw-master-skills	Skill	2.2k	6d ago	MIT	A	91	Claude Code, Codex
token-pickaeonfun/aeon	Skill	788	yesterday	MIT	A	25	Claude Code, Codex
bridgealsk1992/CloddsBot	Skill	3.1k	1mo ago	MIT	A	13	Claude Code, Codex
hyperliquidalsk1992/CloddsBot	Skill	3.1k	1mo ago	MIT	A	19	Claude Code, Codex
marginfialsk1992/CloddsBot	Skill	3.1k	1mo ago	MIT	A	11	Claude Code, Codex
airdrop-hunting-guidenirholas/three.ws	Skill	269	yesterday	Apache-2.0	A	54	Claude Code, Codex