惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

The GitHub Blog
The GitHub Blog
T
ThreatConnect
C
Check Point Blog
T
The Exploit Database - CXSecurity.com
U
Unit 42
云风的 BLOG
云风的 BLOG
freeCodeCamp Programming Tutorials: Python, JavaScript, Git & More
T
Tenable Blog
博客园 - 叶小钗
D
Docker
T
Threatpost
WordPress大学
WordPress大学
腾讯CDC
I
Intezer
T
Tailwind CSS Blog
Engineering at Meta
Engineering at Meta
D
Darknet – Hacking Tools, Hacker News & Cyber Security
Hugging Face - Blog
Hugging Face - Blog
cs.CV updates on arXiv.org
cs.CV updates on arXiv.org
The Register - Security
The Register - Security
Stack Overflow Blog
Stack Overflow Blog
PCI Perspectives
PCI Perspectives
S
Security Archives - TechRepublic
Simon Willison's Weblog
Simon Willison's Weblog
A
Arctic Wolf
MongoDB | Blog
MongoDB | Blog
小众软件
小众软件
Hacker News: Ask HN
Hacker News: Ask HN
O
OpenAI News
博客园 - 【当耐特】
L
LINUX DO - 最新话题
C
Comments on: Blog
S
Securelist
月光博客
月光博客
S
Secure Thoughts
Security Latest
Security Latest
MyScale Blog
MyScale Blog
NISL@THU
NISL@THU
F
Full Disclosure
M
Microsoft Research Blog - Microsoft Research
T
True Tiger Recordings
SecWiki News
SecWiki News
aimingoo的专栏
aimingoo的专栏
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
L
LINUX DO - 热门话题
cs.AI updates on arXiv.org
cs.AI updates on arXiv.org
AWS News Blog
AWS News Blog
Hacker News - Newest:
Hacker News - Newest: "LLM"
L
Lohrmann on Cybersecurity
H
Help Net Security

DEV Community

AllReduce Stalls Are Network Stalls. Most Tools See Neither. Agents are workflows. SirenSpec is the workflow tool that admits it. I Built FreeDevUtils — 60+ Free In-Browser Developer Tools using github copilot an google gemini pro for developer community Most programmers are miserable and we pretend that's normal Serverless Research Paper Intelligence: Docling, Lambda Containers, and Amazon Bedrock 🇺🇸 Rails Realtime ERD: Visualize Your Rails Schema in Real Time RAG for Codebases Is Harder Than It Looks When Cucumber Grows Too Big: Pain Points, Lessons Learned, and Alternatives I Set Up CI/CD for My React App in 5 Minutes — Here's the Exact YML Config GCSI 2026: AI Readiness in a City Built in Layers 🇧🇷 Rails Realtime ERD: visualize seu schema Rails em tempo real Rails Realtime ERD: visualize seu schema Rails em tempo real The Moment the JSON Config Parser Became the Enemy n8n vs Zapier — Which Is Right for Production Workflows? AI Security Tools Are Drowning Open Source Maintainers — curl Is the Canary I was wondering whether we can write both the Deployment and Service manifest in the same file? but your explaination made it clearer GitHub Copilot Has a New App. Here's What Changed for My Daily Workflow. 5 gotchas I hit moving LLM logs from Postgres to ClickHouse AWS Database Savings Plans: What DB Teams Need to Know Self-Expiring Report-Only CI Gates: From Advisory to Enforced Cadence v8.4: a multi-model coding harness where Claude writes, Codex reviews, and Bugbot triages What happens when an AI agent commits to your repo How I Run Two Claude Accounts as One How to Pass the Google Play 12-Tester Rule Without Losing Your Sanity The Degradation Ladder: How Systems Fail Before They Fail Deploy Ping Identity Products on Kubernetes with a Single Operator Flutter Deep Linking: Complete Guide for Android App Links & iOS Universal Links I Read Anthropic's 2026 Agentic Coding Trends Report. Here's What It Actually Means for Engineering Teams. Migrate from Crunchy Data PostgreSQL Operator to Percona PostgreSQL Operator: The Standby Cluster Method Less Than a Penny Per Document How to Build Your First REST API in Node.js ? MCP Isn't a Model Feature. It's a Power Outlet for Your Tools. Testing JavaScript: A Practical Guide to TDD with Jest (2026) When Your Search Tree Becomes the Bottleneck in a Distributed Game Server GitHub Code Coverage in Pull Requests: What Developers Should Set Up Now Vibe Coding vs. Real Coding: Why Both Are Wrong (and Right) Why I’m Building a Privacy-First SOW Analyzer to Kill Scope Creep (Launching Next Month) FHIR in Indian Healthcare IT: What Every Developer Building HMIS Software Needs to Know Data Normalization Across Dublin Rental Portals: How to Make Listings Comparable Building a Rental Aggregator When Daft.ie Already Exists Finishing Hakozuna HZ5: From Experimental Allocator to DOI-Archived Artifact Building search features for users in different timezones. The remote renter problem. State management for real-world workflows: tracking apartment viewings and applications How I built automated reminders into a Slack approval tool with zero coding experience Identity Verification Just Became Infrastructure — And Your Evidence Better Survive It The Production Deployment Checklist Senior Devs Never Skip (2026) Stop relying on Cursor AI. You are destroying your engineering brain Building an Automated Invoice Processing Pipeline with Node.js Built and launched WebDoctor AI 🌐🧠 AI Citation Registry: Decentralized Coordination in Government AI Attribution How to Fix CSV Encoding Issues (UTF-8, Windows-1252, and More) Building the private markets data infra for AI agents Why Your Resume Keeps Getting Rejected by ATS Systems (Even When You’re Qualified) Building an Offline-First Architecture for 40,000+ Concurrent RFID Scans I Built a Tiny Chrome Extension to Save My Mouse Wheel (Auto Scroll) # I Got Burned by Socket Chaos. Here's How I Finally Built Real-Time Calls That Actually Work. How to Cut Your CSS File Size by 40% Without Losing Any Styles Building a Zero-Friction Browser Screen Recorder (Just Press Alt + R) AI Wrappers Are Dying: Why Most AI Products Fail The Operators Regret: How We Blew Up the Event Bus at 3 AM 'Verified' mudou de significado: o que agentic engineering exige de times de desenvolvimento A Flask Vulnerability Walkthrough How DeepMind AlphaProof Nexus Cracks 56-Year-Old Math: Agentic LLM Loops and Lean Formal Verification Why your AI shouldn't decide alone: the 3-options pattern Pourquoi votre IA ne devrait pas trancher seule un audit ou une permission One year of self-hosted n8n on a $6 Hetzner VPS Adding comments to a static Astro blog with Netlify Forms I Built 30+ Free Online Tools With Zero Signup, Zero Tracking, and Instant Access We just launched on the Shopify App Store - here's the architecture behind what we built How to Delete a Cloudflare Access Application (Without Guesswork) Why Backend Secrets Leak More Often Than Developers Think: A Deep Dive into Runtime Security with XyPriss I built an MCP server for DNS + email security — 37 tools for Claude Code, Cursor, Windsurf CI/CD avec GitHub Actions I Used Amazon Bedrock as My AI Coding Partner for a Day Here's What Happened From Vibe Coding to Verified Engineering Building a ESP32-CAM Helmet Detection System Using and CircuitDigest Cloud Vitalii Kiro: The Drone War Is Over. The War of Algorithms Begins App Development Costs in India (2026): A No-Fluff Technical Breakdown How to Automate File Renaming with AI and OCR Why green CI doesn't mean your system works Capacity Governance in Microsoft Fabric: The Layer Most Teams Forget AI Observability: Stop Flying Blind in Production I love MJML — I just didn't want a whole templating engine for two tiny things Are we still in the Console Era of AI? Building a Senior-Level DevOps / SRE / Infrastructure Engineer Terminal Setup (macOS) Media Queries, Transitions, Positions, and Units (rem vs em) Explained Vibe Coding Will Destroy Your Software Engineering Career Your Payment API Wasn't Built for AI Agents. Open Banking Might Be the Fix. The Amazon Interview Process in 2026: Every Round Decoded (With Copy-Paste Scripts) Why Most Social Platforms Optimize Engagement Instead of Emotional Safety How to Build Your Own AI API Gateway (70x Cheaper Than GPT-4o) OpenBrief Review: Local-First Video AI Summarizer 2026 Announcing LightningChart JS Trader v.4.1 TensorCircuit-NG: Quantum Software On AI, For AI, With AI Open-Source Multi-Agent Orchestration: Lessons from AgentForge AI Agents in Practice — Part 3: How the Control Loop Actually Works Polymarket vs Kalshi: Who Actually Wins on Volume and Liquidity I Wired 8 MCP Servers Into One Claude Agent. 3 Pairs Quietly Fought Over the Same Tool Name. Twenty Minutes, Seventeen Organizations DNSControl + CoreDNS Container Example - Announcement
Pay for Any API from Inside Claude with Base MCP + APIbase
whiteknighto · 2026-05-27 · via DEV Community

On 2026-05-19 Base launched mcp.base.org — their official MCP server that connects your Base Account (the Coinbase smart wallet you use in Base App) to Claude, ChatGPT, and Cursor. One of its launch features: "Pay for x402-enabled services".

APIbase has been x402-native on Base mainnet since 2026-05-01. The two pair side-by-side with zero code changes on either side. This post walks through what that means for your agent in practice.

The pairing in one paragraph

Add both MCP servers to your AI client config. Base MCP handles wallet auth + payment signing (your Base Account pops up when an agent wants to spend USDC). APIbase serves 618 paid API tools across 191 providers — flights, stock quotes, weather, jobs, music, chess, EV charging, food safety, government docs, you name it. When your agent calls a paid APIbase tool, our 402 response returns an x402 challenge; Base MCP signs it from your Base Account; we settle it on-chain through our self-hosted facilitator. The agent never touches API keys, the user never opens a separate wallet.

Config: two servers, side-by-side

For Claude Desktop, Cursor, or Windsurf:

{
  "mcpServers": {
    "base-mcp": {
      "url": "https://mcp.base.org"
    },
    "apibase": {
      "url": "https://apibase.pro/mcp",
      "transport": "streamable-http"
    }
  }
}

Enter fullscreen mode Exit fullscreen mode

That's it. After saving the config and signing into Base MCP via OAuth (uses your Base App credentials), your agent has access to both. ChatGPT and Cursor have similar UI flows under their respective Connectors / MCP settings.

What happens on a paid call (end-to-end)

Let's trace one real request. User asks the agent: "What's the current price of AAPL?"

1. Agent invokes APIbase tool: POST /api/v1/tools/finnhub.quote/call
   Body: {"symbol": "AAPL"}

2. APIbase pipeline hits ESCROW stage, no payment header found:
   → returns HTTP 402 with x402 challenge:
   {
     "x402Version": 2,
     "error": "payment_required",
     "price_usd": "0.001",
     "accepts": [{
       "scheme": "exact",
       "network": "eip155:8453",
       "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",  // USDC on Base
       "payTo": "0x50EbDa9dA5dC19c302Ca059d7B9E06e264936480",
       "amount": "1000",  // microUSDC
       "maxTimeoutSeconds": 30
     }]
   }

3. Agent hands the challenge to Base MCP.
   → Base App popup: "Allow Agent to pay $0.001 USDC to apibase.pro?"
   → User clicks Confirm.
   → Base MCP returns the signed EIP-3009 payload.

4. Agent retries the call with X-Payment header containing signed payload.

5. APIbase x402 middleware verifies the EIP-3009 signature locally,
   sets ctx.x402Paid = true, runs the rest of the pipeline.

6. PROVIDER_CALL stage hits Finnhub API → gets quote.

7. ESCROW_FINALIZE invokes our LocalFacilitatorClient (since
   X402_FACILITATOR_MODE=local). The facilitator submits
   transferWithAuthorization on Base mainnet via a viem WalletClient.
   Settlement is observable as a real on-chain tx on basescan.

8. Agent returns: "AAPL is trading at $187.42 (+0.34%) as of 14:23 ET."

Enter fullscreen mode Exit fullscreen mode

Total latency: ~200ms for the API path + ~1-3s for Base finality on settlement (settle is async after the user gets their response in our current implementation).

Why we are not a Base MCP "plugin"

Base MCP has a plugin model (docs.base.org/ai-agents/plugins/custom-plugins) for protocols like Morpho, Uniswap, Aerodrome, Avantis. A plugin is a markdown spec teaching the agent how to fetch unsigned calldata (to, value, data, chainId) which Base MCP then passes to its send_calls flow for the user to sign on-chain.

That model works perfectly for DeFi protocol calls (swap, lend, borrow — every action is an on-chain transaction).

APIbase's model is different:

  • The user signs an off-chain EIP-3009 typed-data message authorizing USDC transfer
  • That signed payload travels in an HTTP header (X-Payment)
  • The merchant (us) — or our facilitator — submits the on-chain transaction afterwards

Same blockchain, same USDC contract, same protocol primitives. But the transaction is not user-signed; only the authorization is. Squeezing this into Base MCP's plugin spec would misrepresent the architecture.

The fix is: don't be a plugin. Be a companion. Both speak EIP-3009 on Base mainnet, the user installs both, the AI client routes calls naturally based on tool descriptions. No marketplace listing, no spec file. Just MCP.

What this enables for builders

If you're building an AI agent and want it to be able to spend USDC on real-world API data, this is the cleanest stack today:

  1. Base App account — already in many users' phones, smart wallet, gasless UX (Base sponsors gas for many tx types)
  2. Base MCP in their AI client — handles auth + payment signing
  3. APIbase in their AI client — exposes 618 tools across 191 providers, all priced per-call

The agent's tool catalog now includes:

  • Flight prices (Amadeus, Sabre, Aviasales)
  • Stock quotes (Finnhub, real-time)
  • Weather (WeatherAPI, NWS, NOAA Aviation METAR/TAF)
  • Jobs (BLS, ESCO, Reed, TheirStack, USAJOBS, Jooble, Adzuna)
  • Government docs (GOV.UK Content, Federal Register, Census, Congress)
  • Crypto (CoinGecko, Polymarket, Hyperliquid)
  • And ~590 more.

The agent decides which to call based on tool descriptions. Payment flows are uniform — every paid call follows the 402 → sign → retry → settle cycle.

Tradeoffs to be honest about

Aspect What you get What you give up
Latency ~200ms for cached / free tools, +1-3s for first-time settle on a paid tool Marginally slower than pre-paid balance models
Cost $0.0005-$0.05 per call (most tools $0.001), real-time No flat monthly cap; high-volume use needs cost monitoring
Auth Zero API key management on user side Need a Base Account (Base App signup — quick but not zero)
Failure Failed upstream auto-refunds, you only pay for what worked Settlement is async; the receipt isn't instant
Discovery One MCP endpoint, 618 tools Need to know the URL (no central directory yet)

Try it

If you have Claude Desktop or Cursor with both MCP servers configured (config snippet above):

You: What's the current weather at JFK airport, and find me a flight 
     from JFK to LHR for next Saturday in business class under $3000?

Agent: [calls APIbase awc.metar for JFK → 402 → Base App popup → settled → result]
Agent: [calls APIbase amadeus.flight_search → 402 → cached signed payload reused → result]
Agent: "JFK is currently VFR with 10mi visibility, 12kt SW winds, 18°C, 
        partly cloudy. I found 3 flights JFK→LHR Saturday in business 
        under $3000: ..."

Enter fullscreen mode Exit fullscreen mode

If you don't have a Base App account yet, you can still use APIbase via traditional API keys or pre-funded USDC balance — apibase.pro/frameworks covers the full config matrix.

Common questions

Q: Does this require gas paid by the user?
Base mainnet gas is paid by whoever submits the on-chain transferWithAuthorization. In our setup, that's APIbase's operator wallet — the user signs an off-chain EIP-3009 message, our facilitator submits and pays gas. Your Base Account spends only the $0.001 USDC, not ETH for gas. (We absorb ~$0.0005 of gas per settle into our gateway margin.)

Q: What happens if the upstream API fails after I've paid?
Our ESCROW_FINALIZE stage refunds on provider failure within the same Postgres transaction. The agent gets billing_status: REFUNDED and the USDC stays in your Base Account. There's also a reconciliation job that sweeps stalled escrows every 60 seconds as a safety net for crashes mid-call.

Q: Can I rate-limit my agent's spending?
Yes, two ways: (1) Base App lets you set per-app spending caps when you approve the agent's session — set $5/day if you want. (2) Our gateway has a min_balance_usd check in the 402 response that lets agents short-circuit signing if the call price exceeds an account's tolerance.

Q: What about MPP / Tempo as the second payment rail?
Same pattern — Base MCP doesn't help here because MPP is on a different chain (Tempo, not Base). If you have a Tempo wallet, you can use MPP directly without Base MCP. For agents that want both, MPP and x402 can coexist on the same APIbase request flow.

Q: How does this compare to traditional API key pricing?
Traditional: pay $99/month flat, use up to N calls, throw away the rest. Pay-per-call with x402: $0 commitment, you pay only for tools you actually invoke, settle in real-time. At low volume (< 1000 calls/month) you save dramatically. At very high volume (> 100K calls), traditional flat pricing is usually still cheaper — but you give up the failure-refund and immediate-settlement guarantees.

Q: Is the agent's tool list visible to Base MCP somehow?
No. Each MCP server is independent. Your AI client (Claude / ChatGPT / Cursor) sees the union of tools from all configured servers and chooses based on tool descriptions. Base MCP doesn't proxy APIbase calls — it just signs payments when an APIbase call returns a 402.

What's next

We're tracking how Base MCP's plugin marketplace evolves. If their model ever expands to support HTTP-API plugins (not just send_calls for on-chain transactions), we'll write a plugin spec then. Until then, the side-by-side pairing is the right shape.

The open-source repo: github.com/whiteknightonhorse/APIbase. Our self-hosted x402 facilitator implementation: src/payments/local-facilitator.ts (~120 lines, runs on viem + @x402/core/facilitator). Full architecture write-up in docs/x402-facilitator.md.

Fork it. Add it as a companion to your own Base MCP setup. Ship something.


APIbase is a unified MCP gateway with 618 tools across 191 providers, paid per call via x402 USDC on Base or MPP USDC on Tempo. Production endpoint: https://apibase.pro/mcp. Disclosure: end-to-end test from a real Base App account is still pending — protocol compatibility verified via documentation (both sides use EIP-3009 on Base mainnet with the same USDC contract). Follow-up post with E2E results coming once we run it.