MCP server

An MCP server for agents: compare prices, get a quote, call a model, or pay one request in USDG. The hosted version is read-only by construction.

On npm

@heura/mcp version 0.1.0 is published. A clean install from the registry was tested: npx -y @heura/mcp starts the server, completes the MCP handshake, and answers live calls. Without a key or wallet it has six read-only tools and can spend nothing.

Install

bash

# read-only: prices, quotes, status. Nothing can be spent
claude mcp add heura -- npx -y @heura/mcp

# or the hosted read-only server, nothing to install
claude mcp add --transport http heura https://mcp.useheura.com/mcp

Hosted, read-only

The hosted server has six tools and cannot spend anything: it has no key and no wallet, and ignores any you put in its environment.

Tool	What it does
`heura_status`	Is heura reachable, how many sellers are healthy, what this server may spend
`heura_models`	Models on the market now, with the best price and discount. Filter by name or by maximum input price
`heura_catalog`	The list price of every model before seller discounts
`heura_topup_info`	Where to send USDG to add balance (read only)
`heura_quote`	The price of paying one request in USDG. Nothing is signed
`heura_spend`	What this session has spent or reserved

Local, with spending

Run locally through npx, the same server adds two tools, and only when you configure the credential for them:

bash

claude mcp add heura \
  -e HEURA_API_KEY=sk-your-key \
  -e HEURA_WALLET_KEY_FILE=$HOME/.heura-wallet \
  -- npx -y @heura/mcp

Use a dedicated wallet with a few dollars of USDG and a little ETH for gas, in a file only you can read (mode 600). The server refuses to start otherwise.

Tool	Needs	What it does
`heura_chat`	`HEURA_API_KEY`	Calls a model and returns the reply, paid from the key's balance
`heura_pay`	`HEURA_WALLET_KEY_FILE`	Pays one request with USDG. A dry run until confirm is true

Safety rules the server enforces

The receiving address is pinned. A quote that pays any other address is refused before anything is signed, as are quotes for another token, another network, or a malformed amount.
Caps live in the server, not in the prompt: per call, per payment and per session. The budget is reserved before the network call, so parallel calls cannot exceed it.
The model never supplies a URL, header, address or secret. Only a model name, messages and numbers.
The wallet key is read from a mode-600 file and the server refuses to start if others can read it.
If a payment goes through but the request fails, the error carries the transaction hash and tells the agent not to pay again.

What was checked

27 automated tests, including hostile quotes and parallel spending. A mutation check breaks eleven safeguards one at a time and confirms the tests catch every one. A real run through the MCP protocol paid $0.001 USDG on Robinhood Chain: the payer wallet lost exactly 1000 micro-units, the receiver gained exactly 1000, and the model answered. Treat the beta notice on the Overview page as current.