The io.github.Dempty-glitch/z-zero-mcp MCP server provides “Payments for AI agents.” It supports gasless USDC on Base and “JIT single-use virtual cards.” The description also states that a PAN is never included “in context.”

🛠️ Key Features

Gasless USDC on Base
JIT single-use virtual cards
PAN is never present in context

🚀 Use Cases

Enabling payment actions for AI agents
Using Base USDC payments without gas costs
Issuing single-use virtual card payments for just-in-time transactions

⚡ Developer Benefits

Keeps PAN out of the MCP context
Supports Base USDC workflows for agent-driven payments
Fits scenarios requiring temporary, single-use card details

⚠️ Limitations

No additional capabilities, tools, or technical details were provided in the source material.

Z-ZERO MCP — Payment Infrastructure for Agentic Commerce (USDC on Base, gasless)

AI Agents today can plan, reason, and code — but they are financially blind. They cannot hold money, make payments, or prove their trustworthiness. Every purchase still requires a human to copy-paste a credit card number.

Z-ZERO fixes that. One MCP server gives your agent (Claude, Cursor, any MCP-compatible client) two payment rails — gasless USDC on Base for crypto-native checkouts, and JIT single-use virtual cards for the 99% of the web that only takes cards — while the model never sees a real card number.

bash

npx z-zero-mcp-server

What makes it different:

🔐 Zero-trust by design — the AI never sees PAN, CVV, or expiry. Card data exists only in RAM, injected via Playwright at the last step, then wiped.
⛽ Gasless USDC on Base — auto-detects crypto checkout (EIP-681) and settles as a gasless USDC transfer sponsored by Coinbase Paymaster. The agent holds only USDC — no ETH, no gas UX.
💳 JIT single-use virtual cards — amount-locked, 1-hour TTL, burned after a single use. Fiat fallback for the rest of the web.
🧠 Smart Routing + checkout intelligence — get_merchant_hints serves platform-specific checkout playbooks (Shopify, Etsy, WooCommerce…).
🔄 Self-healing network — every failed checkout is logged via report_checkout_fail and feeds back into the hints database. The system doesn't just retry; it evolves.

Live on Base Mainnet

✅ Proof — real gasless USDC transfer on Base mainnet: 0xdfd1f2f8…5d7a
Onboarding is just "deposit USDC" — no seed phrases in the agent, no native gas token, no exchange account.

How It Works

code

 User            AI Agent              MCP Tools              Z-ZERO API
  │                  │                      │                      │
  │ "Buy me this     │                      │                      │
  │  Shopify item"   │                      │                      │
  ├─────────────────▶│                      │                      │
  │                  │ read mcp://resources/sop (MANDATORY)        │
  │                  ├─────────────────────▶│                      │
  │                  │◀── platform rules ───┤                      │
  │                  │    + payment SOP     │                      │
  │                  │                      │                      │
  │                  │ get_merchant_hints("_platform_shopify")     │
  │                  ├─────────────────────▶│  GET /checkout-hints │
  │                  │                      ├─────────────────────▶│
  │                  │◀── pre_steps+notes ──┤◀──── hints data ─────┤
  │                  │                      │                      │
  │                  │ (fills shipping form, reaches payment page) │
  │                  │                      │                      │
  │                  │ request_payment_token(amount, card_alias)   │
  │                  ├─────────────────────▶│                      │
  │                  │◀── temp_auth token ──┤   (1-hour TTL)       │
  │                  │                      │                      │
  │                  │ execute_payment(token, checkout_url)        │
  │                  ├─────────────────────▶│                      │
  │                  │      Playwright auto-fills card form,       │
  │                  │      burns token after single use 🔥        │
  │                  │◀──── ✅ success ─────┤                      │
  │ "Done! Your item │                      │                      │
  │  is ordered."    │                      │                      │
  │◀─────────────────┤                      │                      │

The AI agent never touches card data — it only handles single-use tokens. Real card details are injected by Playwright at the last step and wiped from RAM.

Crypto checkout branch: when auto_pay_checkout detects a crypto-native checkout (EIP-681), it skips the card flow entirely and settles as a gasless USDC transfer on Base — see above.

Why Z-ZERO

Z-ZERO is not a checkout bot — it's payment infrastructure for the agentic-commerce era (agentic transactions are projected to reach $1.5T by 2030 — Juniper Research).

Today, the web is built for humans: agents must fill forms and click buttons, and every purchase still needs a human's card. Z-ZERO solves that now — JIT single-use virtual cards + gasless USDC on Base, with card data isolated from the model. Tomorrow, agent payments become a standardized protocol — and what we build along the way is the long-term value:

Shared checkout intelligence — every transaction (and every failure) makes the network smarter.
An open standard for agent payments — any agent platform plugs in via MCP; any rail (cards, USDC, x402) can be added.
KYA — Know Your Agent — verifiable agent reputation. The question isn't "can this agent pay?" but "should you trust it to?"

📖 Full vision & architecture: The Z-Zero Whitebook

Quick Install (Recommended)

bash

npx z-zero-mcp-server

Add to your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json):

json

{
  "mcpServers": {
    "z-zero": {
      "command": "npx",
      "args": ["-y", "z-zero-mcp-server@latest"],
      "env": {
        "Z_ZERO_API_KEY": "zk_live_your_passport_key_here"
      }
    }
  }
}

Get your Passport Key at: clawcard.store/dashboard/agents

Security: rotate-on-connect (v1.5.0+)

The key you copy from the dashboard (or paste into a chat) is only a one-time bootstrap ticket. The moment your agent connects with it, the MCP server silently swaps it for a fresh key:

The fresh key travels server → MCP process → disk and is stored in ~/.z-zero/credentials (mode 0600). It never appears in any LLM conversation, tool result, or config file.
The pasted key is dead within seconds — a copy living in a chat transcript, clipboard, or screenshot can no longer be used by anyone.
On startup the MCP loads the key from ~/.z-zero/credentials first; the Z_ZERO_API_KEY env var is only a bootstrap fallback.

One key = one machine. All agents on the same machine (Claude Desktop, Claude Code, Cursor, …) share the same MCP install and the same credentials file — install once, every agent can pay. Connecting a different machine with a copied key rotates it, which instantly disconnects the original machine. That is deliberate: it blocks key sharing and doubles as an intrusion alarm — if your agent suddenly fails auth, someone else used your key; go to the dashboard and revoke.

Older self-hosted backends without the rotate endpoint keep working — the pasted key simply stays active as before.

Requirements

Node.js v18+ — nodejs.org
Passport Key — starts with zk_live_, get it from the dashboard above

Available MCP Tools

Group 1 — Wallet Config (Passive)

Tool	Description
`list_cards`	List all virtual card aliases and balances
`check_balance`	Check spendable USD balance for a card alias
`get_deposit_addresses`	Get your Base deposit address to top up with USDC (stablecoin on Base)
`set_api_key`	Activate a new Passport Key instantly, no restart needed
`show_api_key_status`	Check if a Passport Key is currently loaded (prefix only)

Group 2 — Manual 4-Step Payment (Active)

Tool	Description
`request_payment_token`	Issue a JIT single-use virtual-card token for a specific amount (1hr TTL)
`execute_payment`	Auto-fill checkout form using a payment token via Playwright
`cancel_payment_token`	Cancel an unused token and refund to wallet
`request_human_approval`	Pause and request human confirmation before proceeding

Group 3 — Smart Autopilot

Tool	Description
`auto_pay_checkout`	Fully autonomous checkout — auto-detects Web3 or Fiat and completes payment
`get_merchant_hints`	Fetch platform-specific checkout playbook (pre-steps + selectors) from Knowledge Base
`report_checkout_fail`	Log a failed checkout URL for admin review (self-healing feedback loop)

📖 Note: Version checking is handled automatically in each API call. No separate tool needed.

REST API Reference

The Z-ZERO backend is hosted at https://www.clawcard.store. All endpoints require a Bearer token using your Passport Key.

⚠️ Use the MCP tools above instead of calling REST directly. If you must call REST, use the exact paths below.

`GET /api/tokens/cards`

Returns your card list, balance, and deposit addresses.

bash

curl -X GET "https://www.clawcard.store/api/tokens/cards" \
  -H "Authorization: Bearer zk_live_your_key"

Aliases (also work):

GET /api/v1/cards ← for agents that guess REST-style paths

`POST /api/tokens/issue`

Issue a JIT payment token.

`POST /api/tokens/resolve`

Resolve a token to card data (server-side only).

`POST /api/tokens/burn`

Burn a used token.

`POST /api/tokens/cancel`

Cancel an unused token (refunds balance).

Troubleshooting

"Z_ZERO_API_KEY is missing"

Go to clawcard.store/dashboard/agents
Copy your Passport Key (starts with zk_live_)
Add it to your config as Z_ZERO_API_KEY
Restart Claude Desktop / Cursor

"Invalid API Key" (401)

Double-check you copied the full key (e.g. zk_live_c0g3l)
Make sure there are no extra spaces or line breaks

"404 Not Found" on `/api/v1/cards`

This is a legacy path alias — it should now work. If not, use /api/tokens/cards directly.

Security: the key you paste is never kept — it rotates the moment your agent first connects, and the fresh key lives only in a local owner-only file (~/.z-zero/credentials, mode 0600), never in any LLM conversation. Card data exists only in volatile RAM during execution.

io.github.Dempty-glitch/z-zero-mcp

🛠️ Key Features

🚀 Use Cases

⚡ Developer Benefits

⚠️ Limitations

Topics

Z-ZERO MCP — Payment Infrastructure for Agentic Commerce (USDC on Base, gasless)

Live on Base Mainnet

How It Works

Why Z-ZERO

Quick Install (Recommended)

Security: rotate-on-connect (v1.5.0+)

Requirements

Available MCP Tools

Group 1 — Wallet Config (Passive)

Group 2 — Manual 4-Step Payment (Active)

Group 3 — Smart Autopilot

REST API Reference

`GET /api/tokens/cards`

`POST /api/tokens/issue`

`POST /api/tokens/resolve`

`POST /api/tokens/burn`

`POST /api/tokens/cancel`

Troubleshooting

"Z_ZERO_API_KEY is missing"

"Invalid API Key" (401)

"404 Not Found" on `/api/v1/cards`

Install

Configuration

🛠️ Key Features

🚀 Use Cases

⚡ Developer Benefits

⚠️ Limitations

Topics

Z-ZERO MCP — Payment Infrastructure for Agentic Commerce (USDC on Base, gasless)

Live on Base Mainnet

How It Works

Why Z-ZERO

Quick Install (Recommended)

Security: rotate-on-connect (v1.5.0+)

Requirements

Available MCP Tools

Group 1 — Wallet Config (Passive)

Group 2 — Manual 4-Step Payment (Active)

Group 3 — Smart Autopilot

REST API Reference

GET /api/tokens/cards

POST /api/tokens/issue

POST /api/tokens/resolve

POST /api/tokens/burn

POST /api/tokens/cancel

Troubleshooting

"Z_ZERO_API_KEY is missing"

"Invalid API Key" (401)

"404 Not Found" on /api/v1/cards

Install

Configuration

`GET /api/tokens/cards`

`POST /api/tokens/issue`

`POST /api/tokens/resolve`

`POST /api/tokens/burn`

`POST /api/tokens/cancel`

"404 Not Found" on `/api/v1/cards`