惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

Latest news
Latest news
爱范儿
爱范儿
V
V2EX
J
Java Code Geeks
I
InfoQ
博客园 - 三生石上(FineUI控件)
V
Visual Studio Blog
A
Arctic Wolf
月光博客
月光博客
D
Darknet – Hacking Tools, Hacker News & Cyber Security
S
SegmentFault 最新的问题
C
Cyber Attacks, Cyber Crime and Cyber Security
L
Lohrmann on Cybersecurity
Cisco Talos Blog
Cisco Talos Blog
量子位
C
CERT Recently Published Vulnerability Notes
Know Your Adversary
Know Your Adversary
酷 壳 – CoolShell
酷 壳 – CoolShell
OSCHINA 社区最新新闻
OSCHINA 社区最新新闻
小众软件
小众软件
Hugging Face - Blog
Hugging Face - Blog
P
Privacy & Cybersecurity Law Blog
大猫的无限游戏
大猫的无限游戏
钛媒体:引领未来商业与生活新知
钛媒体:引领未来商业与生活新知
人人都是产品经理
人人都是产品经理
T
The Exploit Database - CXSecurity.com
奇客Solidot–传递最新科技情报
奇客Solidot–传递最新科技情报
有赞技术团队
有赞技术团队
freeCodeCamp Programming Tutorials: Python, JavaScript, Git & More
Scott Helme
Scott Helme
C
Cisco Blogs
T
Tor Project blog
I
Intezer
Project Zero
Project Zero
罗磊的独立博客
T
Tenable Blog
Jina AI
Jina AI
P
Proofpoint News Feed
T
Threatpost
NISL@THU
NISL@THU
N
News and Events Feed by Topic
Engineering at Meta
Engineering at Meta
cs.AI updates on arXiv.org
cs.AI updates on arXiv.org
AI
AI
Recorded Future
Recorded Future
T
Tailwind CSS Blog
T
The Blog of Author Tim Ferriss
S
Security @ Cisco Blogs
云风的 BLOG
云风的 BLOG
N
News | PayPal Newsroom

DEV Community

Authentication Security Deep Dive: From Brute Force to Salted Hashing (With Java Examples) Why AI Systems Don’t Fail — They Drift Spilling beans for how i learn for exam😁"Reinforcement Learning Cheat Sheet" I Replaced Chrome with Safari for AI Browser Automation. Here's What Broke (and What Finally Worked) How Python Borrows Other People's Work The $40 Architecture: Processing 1 Billion API Requests with 99.99% Uptime Vibe Coding: A Workflow Guide (From Zero to SaaS) Most webhook security guides protect the wrong side. The scary part is delivery. Headless CMS for TanStack Start: Build a Blog with Cosmic EU Age Verification App "Hacked in 2 Minutes" — What Actually Happened Comfy Cloud’s delete function does not actually remove files Running AI Models on GPU Cloud Servers: A Beginner Guide Event-driven media intelligence with AWS Step Functions and Bedrock I scored 500 AI prompts across 8 quality dimensions — here's what broke How to Call Google Gemini API from Next.js (Free Tier, No Backend Needed) The Portal Protocol: Reclaiming Human Connection in the Age of AI How to Fix Your Team's Scattered Knowledge Problem With a Self-Hosted Forum Intro to tc Cloud Functors: A Graph-First Mental Model for the Modern Cloud Designing Multi-Tenant Backends With Both Ownership and Team Access I Built a Neumorphic CSS Library with 77+ Components — Here's What I Learned PostgreSQL Performance Optimization: Why Connection Pooling Is Critical at Scale Cómo construí un SaaS multi-rubro para gestionar expensas en Argentina con FastAPI + Vue 3 🚀 I Built an Ethical Hacking Scanner Tool – Open Source Project I Replaced /usage and /context in Claude Code With a Single Statusline A Pythonic Way to Handle Emails (IMAP/SMTP) with Auto-Discovery and AI-Ready Design I Collected 8.9 Million Polymarket Price Points — Here's What I Found About How Markets Really Move EcoTrack AI — Carbon Footprint Tracker & Dashboard Everyone's Using AI. No One Agrees How. 5 self-hosted ebook managers worth trying in 2026 Building Your First AI Agent with LangChain: From Chatbot to Autonomous Assistant Common SOC 2 Failures (Real World) Stop Vibe-Checking Your AI App: A Practical Guide to Evals How to Use SonarQube and SonarScanner Locally to Level Up Your Code Quality Your Next To-Do App Is Dead — I Replaced Mine with an OpenClaw AI Sign a Nostr event in 60 lines of Python using coincurve — no nostr-sdk, no nbxplorer, no rust toolchain ITGC Audit Explained Like You’re in Big 4 Patch Tuesday abril 2026: Microsoft parcha 163 vulnerabilidades y un zero-day en SharePoint Stop scraping everything: a better way to track competitor price changes Listing on MCPize + the Official MCP Registry while routing payments OUTSIDE the marketplace — how I kept 100% of my x402 revenue Building an AI-Powered Risk Intelligence System Using Serverless Architecture Why We Ripped Function Overloading Out of Our AI Toolchain Testing AI-Generated Code: How to Actually Know If It Works SaaS Churn Is Killing Your Business. Here Is What to Do About It (Without a Support Team) The Speed of AI Is No Longer Linear - And Self-Improving Models Are Why How to Implement RBAC for MCP Tools: A Practical Guide for Engineering Teams From Standard Quote to Persuasive Proposal: AI Automation for Arborists I built a CLI that scaffolds complete multi-tenant SaaS apps Axios CVE-2025–62718: The Silent SSRF Bug That Could Be Hiding in Your Node.js App Right Now The dashboard that ended our friendship Data Pipelines Explained Simply (and How to Build Them with Python) The Hidden Cost of AI Systems Nobody Talks About. undefined vs undeclared, and how typeof behaves Switching from file-based jobs to NATS/Kafka in Rust without changing code io_uring Adventures: Rust Servers That Love Syscalls Why Agentic AI is Killing the Traditional Database The POUR principles of web accessibility for developers and designers Quantum Neural Network 3D — A Deep Dive into Interactive WebGL Visualization How To Install Caveman In Codex On macOS And Windows Automation Pipeline Reliability: Why Your Workflow Breaks When Nobody Is Watching I Built an 'Open World' AI Coding Agent — It Works From ANY Folder From Freelancing to Product: A Tech Service Company's SaaS Transformation China's AI Giants: Adding Tencent Hunyuan & ByteDance Doubao to AI University (74 Providers) On the Vibe Coders and Their Lies clerk: Auto-Summarize Your Claude Code Sessions AI Weekly — 2026/04/10–04/17 | The Model Lockdown Is Here, but the Toolchain Is the Real Battleground AI 週報 — 2026/04/10–2026/04/17 模型封鎖潮來了,但工具鏈才是真戰場 Maybe this is how Open-Source apps are born... 🚀 Fine-Tune LLMs with LoRA and QLoRA: 2026 Guide tRPC v11 + Next.js App Router: End-to-End Type Safety Without the Boilerplate ShadCN UI in 2026: Why I Stopped Installing Component Libraries and Started Owning My Components SaaS Billing in React Server Components: Stripe + Supabase Without a Single `useEffect` Join our DEV Weekend Challenge — $1,000 in Prizes Across TEN winners! Submissions Due April 20 at 6:59 AM UTC. Implementing FSRS Spaced Repetition in Flutter + Supabase — Adding Memory Science to an AI Learning App "I Texted My Localhost From the Train — Claude Code Fixed the Bug Before I Got Home" I Built a Sales Prep AI and It Went Deeper Than Expected Design to Code #2: One JSON, Eleven Outputs Solving the 100M-Row Problem: A Summary Table Pattern for High-Volume Push Notification Logs Flutter Web With Wasm: What Actually Changes For Developers I Built 50 Royalty-Free Soundtracks for My Side Project in a Weekend Using AI Music Generation The Vibe Coding Security Checklist: 7 Things to Check Before You Ship Stop Letting Googlebot Guess Fix Your React App's SEO Right Desconstruindo o Streaming do LinkedIn: Como Criar um Engine de Extração de Vídeo de Alta Performance com HLS e FFmpeg (EDA Part-1) EDA (Exploratory Data Analysis) Explained With Real Life — Why Looking at Your Data Is the Most Important Step in Machine Learning Brand Relationship Management at Scale: Our 4-Touch Outreach System for 200+ Brands Why String.fromEnvironment() Might Return an Empty String in Dart JGuardrails 1.0.0 — Hardening Java LLM Apps Against Jailbreaks, Toxicity, and Prompt Injection Plan and Schedule a Full Week of Threads Content From One Claude Conversation Coding Cat Oran Ep3, Five Tables Changed Everything Updated: BFF Pattern I'm done watching freelancers get buried by 200 proposals. So I'm building the alternative. This is my first post BFS Algorithm in Java Step by Step Tutorial with Examples Tracking LLM Pricing Monthly: An Open Dataset for 22 AI Models How We Measure Content ROI on a Comparison Site: Revenue Attribution Without Perfect Data Introducing Nova AI Ops: The AI-Native Operating System for SRE Teams I built a free desktop video downloader for Windows — Grabbit How Talkie OCR Helps Vision-Impaired & Dyslexic Users Read the World Around Them VRCFaceTracking安装和iPhone面捕配置教程,有bug Even CrowdStrike Can't See Your Agents The Automation Gold Rush: What n8n Workflows and Claude Are Opening Up for Developers Right Now
Pay for Any API from Inside Claude with Base MCP + APIbase
whiteknighto · 2026-05-27 · via DEV Community

On 2026-05-19 Base launched mcp.base.org — their official MCP server that connects your Base Account (the Coinbase smart wallet you use in Base App) to Claude, ChatGPT, and Cursor. One of its launch features: "Pay for x402-enabled services".

APIbase has been x402-native on Base mainnet since 2026-05-01. The two pair side-by-side with zero code changes on either side. This post walks through what that means for your agent in practice.

The pairing in one paragraph

Add both MCP servers to your AI client config. Base MCP handles wallet auth + payment signing (your Base Account pops up when an agent wants to spend USDC). APIbase serves 618 paid API tools across 191 providers — flights, stock quotes, weather, jobs, music, chess, EV charging, food safety, government docs, you name it. When your agent calls a paid APIbase tool, our 402 response returns an x402 challenge; Base MCP signs it from your Base Account; we settle it on-chain through our self-hosted facilitator. The agent never touches API keys, the user never opens a separate wallet.

Config: two servers, side-by-side

For Claude Desktop, Cursor, or Windsurf:

{
  "mcpServers": {
    "base-mcp": {
      "url": "https://mcp.base.org"
    },
    "apibase": {
      "url": "https://apibase.pro/mcp",
      "transport": "streamable-http"
    }
  }
}

Enter fullscreen mode Exit fullscreen mode

That's it. After saving the config and signing into Base MCP via OAuth (uses your Base App credentials), your agent has access to both. ChatGPT and Cursor have similar UI flows under their respective Connectors / MCP settings.

What happens on a paid call (end-to-end)

Let's trace one real request. User asks the agent: "What's the current price of AAPL?"

1. Agent invokes APIbase tool: POST /api/v1/tools/finnhub.quote/call
   Body: {"symbol": "AAPL"}

2. APIbase pipeline hits ESCROW stage, no payment header found:
   → returns HTTP 402 with x402 challenge:
   {
     "x402Version": 2,
     "error": "payment_required",
     "price_usd": "0.001",
     "accepts": [{
       "scheme": "exact",
       "network": "eip155:8453",
       "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",  // USDC on Base
       "payTo": "0x50EbDa9dA5dC19c302Ca059d7B9E06e264936480",
       "amount": "1000",  // microUSDC
       "maxTimeoutSeconds": 30
     }]
   }

3. Agent hands the challenge to Base MCP.
   → Base App popup: "Allow Agent to pay $0.001 USDC to apibase.pro?"
   → User clicks Confirm.
   → Base MCP returns the signed EIP-3009 payload.

4. Agent retries the call with X-Payment header containing signed payload.

5. APIbase x402 middleware verifies the EIP-3009 signature locally,
   sets ctx.x402Paid = true, runs the rest of the pipeline.

6. PROVIDER_CALL stage hits Finnhub API → gets quote.

7. ESCROW_FINALIZE invokes our LocalFacilitatorClient (since
   X402_FACILITATOR_MODE=local). The facilitator submits
   transferWithAuthorization on Base mainnet via a viem WalletClient.
   Settlement is observable as a real on-chain tx on basescan.

8. Agent returns: "AAPL is trading at $187.42 (+0.34%) as of 14:23 ET."

Enter fullscreen mode Exit fullscreen mode

Total latency: ~200ms for the API path + ~1-3s for Base finality on settlement (settle is async after the user gets their response in our current implementation).

Why we are not a Base MCP "plugin"

Base MCP has a plugin model (docs.base.org/ai-agents/plugins/custom-plugins) for protocols like Morpho, Uniswap, Aerodrome, Avantis. A plugin is a markdown spec teaching the agent how to fetch unsigned calldata (to, value, data, chainId) which Base MCP then passes to its send_calls flow for the user to sign on-chain.

That model works perfectly for DeFi protocol calls (swap, lend, borrow — every action is an on-chain transaction).

APIbase's model is different:

  • The user signs an off-chain EIP-3009 typed-data message authorizing USDC transfer
  • That signed payload travels in an HTTP header (X-Payment)
  • The merchant (us) — or our facilitator — submits the on-chain transaction afterwards

Same blockchain, same USDC contract, same protocol primitives. But the transaction is not user-signed; only the authorization is. Squeezing this into Base MCP's plugin spec would misrepresent the architecture.

The fix is: don't be a plugin. Be a companion. Both speak EIP-3009 on Base mainnet, the user installs both, the AI client routes calls naturally based on tool descriptions. No marketplace listing, no spec file. Just MCP.

What this enables for builders

If you're building an AI agent and want it to be able to spend USDC on real-world API data, this is the cleanest stack today:

  1. Base App account — already in many users' phones, smart wallet, gasless UX (Base sponsors gas for many tx types)
  2. Base MCP in their AI client — handles auth + payment signing
  3. APIbase in their AI client — exposes 618 tools across 191 providers, all priced per-call

The agent's tool catalog now includes:

  • Flight prices (Amadeus, Sabre, Aviasales)
  • Stock quotes (Finnhub, real-time)
  • Weather (WeatherAPI, NWS, NOAA Aviation METAR/TAF)
  • Jobs (BLS, ESCO, Reed, TheirStack, USAJOBS, Jooble, Adzuna)
  • Government docs (GOV.UK Content, Federal Register, Census, Congress)
  • Crypto (CoinGecko, Polymarket, Hyperliquid)
  • And ~590 more.

The agent decides which to call based on tool descriptions. Payment flows are uniform — every paid call follows the 402 → sign → retry → settle cycle.

Tradeoffs to be honest about

Aspect What you get What you give up
Latency ~200ms for cached / free tools, +1-3s for first-time settle on a paid tool Marginally slower than pre-paid balance models
Cost $0.0005-$0.05 per call (most tools $0.001), real-time No flat monthly cap; high-volume use needs cost monitoring
Auth Zero API key management on user side Need a Base Account (Base App signup — quick but not zero)
Failure Failed upstream auto-refunds, you only pay for what worked Settlement is async; the receipt isn't instant
Discovery One MCP endpoint, 618 tools Need to know the URL (no central directory yet)

Try it

If you have Claude Desktop or Cursor with both MCP servers configured (config snippet above):

You: What's the current weather at JFK airport, and find me a flight 
     from JFK to LHR for next Saturday in business class under $3000?

Agent: [calls APIbase awc.metar for JFK → 402 → Base App popup → settled → result]
Agent: [calls APIbase amadeus.flight_search → 402 → cached signed payload reused → result]
Agent: "JFK is currently VFR with 10mi visibility, 12kt SW winds, 18°C, 
        partly cloudy. I found 3 flights JFK→LHR Saturday in business 
        under $3000: ..."

Enter fullscreen mode Exit fullscreen mode

If you don't have a Base App account yet, you can still use APIbase via traditional API keys or pre-funded USDC balance — apibase.pro/frameworks covers the full config matrix.

Common questions

Q: Does this require gas paid by the user?
Base mainnet gas is paid by whoever submits the on-chain transferWithAuthorization. In our setup, that's APIbase's operator wallet — the user signs an off-chain EIP-3009 message, our facilitator submits and pays gas. Your Base Account spends only the $0.001 USDC, not ETH for gas. (We absorb ~$0.0005 of gas per settle into our gateway margin.)

Q: What happens if the upstream API fails after I've paid?
Our ESCROW_FINALIZE stage refunds on provider failure within the same Postgres transaction. The agent gets billing_status: REFUNDED and the USDC stays in your Base Account. There's also a reconciliation job that sweeps stalled escrows every 60 seconds as a safety net for crashes mid-call.

Q: Can I rate-limit my agent's spending?
Yes, two ways: (1) Base App lets you set per-app spending caps when you approve the agent's session — set $5/day if you want. (2) Our gateway has a min_balance_usd check in the 402 response that lets agents short-circuit signing if the call price exceeds an account's tolerance.

Q: What about MPP / Tempo as the second payment rail?
Same pattern — Base MCP doesn't help here because MPP is on a different chain (Tempo, not Base). If you have a Tempo wallet, you can use MPP directly without Base MCP. For agents that want both, MPP and x402 can coexist on the same APIbase request flow.

Q: How does this compare to traditional API key pricing?
Traditional: pay $99/month flat, use up to N calls, throw away the rest. Pay-per-call with x402: $0 commitment, you pay only for tools you actually invoke, settle in real-time. At low volume (< 1000 calls/month) you save dramatically. At very high volume (> 100K calls), traditional flat pricing is usually still cheaper — but you give up the failure-refund and immediate-settlement guarantees.

Q: Is the agent's tool list visible to Base MCP somehow?
No. Each MCP server is independent. Your AI client (Claude / ChatGPT / Cursor) sees the union of tools from all configured servers and chooses based on tool descriptions. Base MCP doesn't proxy APIbase calls — it just signs payments when an APIbase call returns a 402.

What's next

We're tracking how Base MCP's plugin marketplace evolves. If their model ever expands to support HTTP-API plugins (not just send_calls for on-chain transactions), we'll write a plugin spec then. Until then, the side-by-side pairing is the right shape.

The open-source repo: github.com/whiteknightonhorse/APIbase. Our self-hosted x402 facilitator implementation: src/payments/local-facilitator.ts (~120 lines, runs on viem + @x402/core/facilitator). Full architecture write-up in docs/x402-facilitator.md.

Fork it. Add it as a companion to your own Base MCP setup. Ship something.


APIbase is a unified MCP gateway with 618 tools across 191 providers, paid per call via x402 USDC on Base or MPP USDC on Tempo. Production endpoint: https://apibase.pro/mcp. Disclosure: end-to-end test from a real Base App account is still pending — protocol compatibility verified via documentation (both sides use EIP-3009 on Base mainnet with the same USDC contract). Follow-up post with E2E results coming once we run it.