📦

mppx

Name: mppx
Author: internet-court

Content revision r1 Medium Risk ⚙️ External commands🌐 Network access🔑 Env variables

Build mppx Payment Authentication Flows

402 Payment Required integrations need careful client, server, wallet, and secret handling. This skill guides mppx setup for Tempo, Stripe, MCP, and framework middleware.

Supports: Claude Codex Code(CC)

📊 69 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "mppx" from https://skillstore.io/skills/internet-court-mppx.md and its manifest at https://skillstore.io/api/skills/internet-court-mppx/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/internet-court-mppx.md Signed manifest GET /api/skills/internet-court-mppx/manifest Signed lockfile GET /api/skills/internet-court-mppx/lockfile

Test it

Using "mppx". I need a client integration for paid API calls.

Expected outcome:

The assistant explains global fetch handling, explicit mppx fetch calls, required account data, and where secrets must not be placed.

Using "mppx". I want to charge for one protected server endpoint.

Expected outcome:

The assistant outlines required recipient, currency, amount, secret key storage, challenge handling, credential verification, and receipt response behavior.

Using "mppx". I need to decide between Tempo sessions and card payments.

Expected outcome:

The assistant compares stablecoin charges, metered Tempo sessions, and Stripe charges against product needs and operational requirements.

Security Audit

Medium Risk

v2 • 7/21/2026 Open versioned report

Most static findings are Markdown, placeholder, or documentation matches and are false positives. The two request examples intentionally contact a user-selected endpoint and can handle payment challenges. The documented CLI can create wallets and issue paid requests, so payment actions require explicit user review.

Files scanned

128

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

SKILL.md:112-117

Paid Request and Wallet Creation Capability

The documented CLI can create a wallet and make a paid request. These actions can create financial consequences when run against a real endpoint or funded account.

The CLI section explicitly describes wallet creation and making a paid request. This is intended payment functionality, not evidence of unauthorized activity.

Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low

SKILL.md:46

Fetch API call

const res = await fetch('https://api.example.com/resource')

The example deliberately sends a request to a user-selected endpoint through a payment-aware client. A 402 response can initiate a payment flow, so users must control the target and account.

Low

SKILL.md:57

Fetch API call

const res = await mppx.fetch('https://api.example.com/resource')

The example deliberately sends a request to a user-selected endpoint through a payment-aware client. A 402 response can initiate a payment flow, so users must control the target and account.

Risk Factors

Audited by: claude View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/internet-court-mppx/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/internet-court-mppx/security.svg)](https://skillstore.io/skills/internet-court-mppx?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/internet-court-mppx?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/internet-court-mppx/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/internet-court-mppx.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

internet-court. (2026). mppx security audit report (audit version 2) [Author version unspecified]. Skillstore. https://skillstore.io/skills/internet-court-mppx/audits/2

BibTeX citation

@techreport{internet-court-internet-court-mppx-2026,
  author = {internet-court},
  title = {mppx security audit report (audit version 2)},
  institution = {Skillstore},
  year = {2026},
  number = {2},
  url = {https://skillstore.io/skills/internet-court-mppx/audits/2},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "mppx security audit report (audit version 2)"
version: "unspecified"
type: report
authors:
  - name: "internet-court"
date-released: "2026-07-21"
url: "https://skillstore.io/skills/internet-court-mppx/audits/2"
identifiers:
  - type: other
    value: "skillstore:internet-court-mppx:audit:2"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Add Paid API Client Calls

Integrate mppx client handling so a TypeScript app can respond to 402 challenges.

Protect Server Routes

Design a server route that issues challenges, verifies credentials, and returns receipts.

Plan Paid MCP Tools

Wrap MCP clients or servers so selected tool calls can require payment.

Try These Prompts

Add Client Handling

Use the mppx skill to add client-side 402 handling for an existing TypeScript fetch call. Keep secrets out of browser code.

Protect a Route

Use the mppx skill to protect a server route with Tempo charge payments. Include required inputs and security checks.

Choose a Method

Use the mppx skill to compare tempo.charge, tempo.session, and stripe.charge for this product: [describe product].

Design Paid MCP Flow

Use the mppx skill to design a paid MCP client and server flow. Include confirmation points before wallet or payment actions.

Best Practices

Keep MPP_SECRET_KEY and wallet private keys only on trusted server systems.
Verify runtime 402 challenges before signing credentials or sending payments.
Confirm amount, currency, recipient, and network before any paid request.

Avoid

Do not paste real wallet private keys into prompts or source examples.
Do not expose server secret keys to browser code or logs.
Do not run paid CLI commands without explicit user approval.

Frequently Asked Questions

What does this skill help build?

It helps build TypeScript integrations for mppx 402 Payment Required flows.

Does it process payments by itself?

No. It gives implementation guidance for SDK use, payment challenges, credentials, and receipts.

Can it be used with Claude, Codex, and Claude Code?

Yes. The report lists support for Claude, Codex, and Claude Code.

Which payment methods are covered?

It covers Tempo charges, Tempo sessions, Stripe charges, and MCP payment wrapping patterns.

Where should MPP_SECRET_KEY be stored?

Store it only on trusted servers, outside browser code, logs, prompts, and committed files.

What should users confirm before paying?

Users should confirm the amount, currency, recipient, network, and current 402 challenge terms.

Developer Details

Author

internet-court

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/internet-court/internet-court-skill/tree/main/vendored/tempo/mppx

Ref

3f6e026a3363e0954ede7bef0cfe88d4475de137

Maintenance freshness

7/21/2026

Usage

1 downloads · 1 views

File structure

📄 SKILL.md