Name: Stablevoy
Author: stablevoy

94/100

trust score

272

downloads a day

local

runs on your machine

downloads in 30d

What it does

Stablevoy (https://stablevoy.com) is a non-custodial USDT and USDC payment gateway. This MCP server lets Claude, Cursor or any MCP client bill a client, check whether an invoice is paid or sum up the week, across all your stores. It runs on your computer and talks only to the Stablevoy API and site.

"Bill Acme 250 dollars for the October work" gives a payment link.
"Has Acme paid?" gives the status and the transactions.
"What came in this week in the Main store?" gives the totals per network.
"How do I verify a Stablevoy webhook in PHP?" answers from the documentation.

Ready prompts for common tasks: a payments summary for a period compared with the one before, unpaid invoices to follow up, the payments of one order or client, a review of transfers that matched no invoice, and getting started. The documentation is also there as resources, one per page.Setup: run npx stablevoy-mcp login once. It opens the Stablevoy dashboard, you sign in with your wallet and tick the stores the assistant may use. Then add the server to your client. For a single store without the login, create a key on the store page of the dashboard and set STABLEVOY_API_KEY. Without any key the server still starts: the documentation tools, resources and the getting_started prompt work, and the store tools say how to connect.Safety: the server holds store API keys only. It can create invoices, cancel unpaid ones and read your stores and invoices. It cannot move funds or change your payout address, webhooks, keys or stores: those need your wallet signature in the dashboard. Set STABLEVOY_MCP_READ_ONLY to true to leave create_invoice and cancel_invoice out.

Documentation: https://stablevoy.com/mcp/

Source: https://github.com/stablevoy/stablevoy-mcp

Questions: https://github.com/orgs/stablevoy/discussions/categories/mcp-server

Quickstart

# 1 — add it to Claude Code
claude mcp add --scope user stablevoy-mcp '--' npx -y stablevoy-mcp

# 2 — ask your agent for something these tools do
#   list_stores, get_store, get_invoice and 7 more

Stablevoy costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.

Publisher

stablevoy1 server

1 category

All 1 server

Installation

Where are you running it?

Every route below installs the same thing and ends at the same approval screen. This one runs on your machine: your client starts Stablevoy as a process under your own user, with your files and your network, so the tool surface below is what it can do to your computer rather than to a server somewhere else. Its scan result is on the Security tab — read the surface before you approve it.

Claude Codedeclared by this listing

This is a public server: you run it yourself and this marketplace is not in the path. You need Node.js — the current LTS (24) is the safe choice; npx comes with it. Claude Code registers it in one command; --scope user makes it available in every project. The '--' is in quotes so that PowerShell passes it on.

claude mcp add --scope user stablevoy-mcp '--' npx -y stablevoy-mcp

Reconnect, or start a new session, and the tools appear in the model’s tool list.

Free on mcprush, and it runs from its publisher’s own package: this marketplace is not in the path, so there is no key of ours to hold and no card to add — some of its tools take a key of its publisher’s own, and the rest work without.

What it asks of you

Nothing is required, but it can take STABLEVOY_API_KEY (A store API key (sk_live_...) for one store. Leave unset to use the keys of npx stablevoy-mcp login; with neither, the store tools answer not_signed_in and the documentation works.), STABLEVOY_MCP_READ_ONLY (true leaves create_invoice and cancel_invoice out: read tools only.), STABLEVOY_MCP_PROFILE (Which login profile to use, default by default.) if you want to set them. Its publisher says some of its tools need one of them, and the rest work without.

What it writes

One config entry your client uses to start the process locally. A local server runs with your file system and your network, which is why it is priced without metering.

What you approve

10 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.

Tool surface

What the model actually sees. Descriptions are diffed on every release — see version history.

Only tools that write or reach the network

Lists every Stablevoy store this server has a key for, all at once with no paging (usually one to a few). Needs a store key (npx stablevoy-mcp login). Each entry has id, name, status, enabledNetworks, canAcceptPayments and evmPayoutStatus; a store whose key no longer works shows its error instead. Call it first to learn the names for the store argument of the other tools. For the full settings of

Takes no parameters.

Gets one store with its settings, read only. Needs a store key (npx stablevoy-mcp login). Each call reads the store, the platform limits and the fee live from the API (three requests, nothing cached), so a change made in the dashboard shows at once; nothing here can change a setting, that is done in the Stablevoy dashboard. Returned, grouped: status and canAcceptPayments; networks and payout state

Parameter	Type	Required	Notes
store	string	no	Store id or exact store name from list_stores. Needed only when several stores are connected.

Gets one invoice by its id: status, amountUsd, reference, dates (createdAt, expiresAt, paidAt), holdReason, networks and the payments received. Needs a store key (npx stablevoy-mcp login). The id comes from create_invoice, list_invoices or the merchant. Without store every connected store is asked; an id no store has gives not_found. To find invoices by status, reference or date, use list_invoices

Parameter	Type	Required	Notes
invoiceId	string	yes	The invoice id.
store	string	no	Store id or exact store name from list_stores. Needed only when several stores are connected.

Lists invoices newest first, to find invoices when you have no id. Needs a store key (npx stablevoy-mcp login). All filters are optional and combine: status, source, search (an invoice id or the start of the reference), createdFrom and createdTo (UTC days, both included) and limit (1 to 100, 20 by default). Each call returns one page per store: its name, invoices with the fields of get_invoice, an

Parameter	Type	Required	Notes
status	string	no	awaiting_payment, confirming, paid, overpaid, underpaid, paid_late, expired, on_hold or cancelled.
source	string	no	How the invoice was made: payment_link, woocommerce, edd, whmcs, api_key or not_recorded.
search	string	no	Invoice id or the start of the reference.
createdFrom	string	no	First UTC day, YYYY-MM-DD.
createdTo	string	no	Last UTC day, YYYY-MM-DD.
limit	integer	no	Invoices per page, 20 by default.
cursor	string	no	nextCursor of the previous page, with the same store.
store	string	no	Store id or exact store name from list_stores. Needed only when several stores are connected.

Sums up the invoices created in a period, instead of paging through list_invoices. Needs a store key (npx stablevoy-mcp login). It returns how many invoices are in each status, invoicedUsd (cancelled and expired left out), receivedUsd (confirmed payments that passed sanctions screening) and the money per network and token. Pass either period or both createdFrom and createdTo as UTC days. A period

Parameter	Type	Required	Notes
period	string	no	A ready-made range of UTC days ending today. Leave out when giving dates.
createdFrom	string	no	First UTC day, YYYY-MM-DD, with createdTo.
createdTo	string	no	Last UTC day, YYYY-MM-DD, included.
store	string	no	Store id or exact store name from list_stores. Needed only when several stores are connected.

Lists payments that reached the merchant's own Tron wallet but matched no invoice, newest first. Needs a store key (npx stablevoy-mcp login). This usually happens when an exchange took its fee out of the amount. At most the 100 newest are returned; there is no paging past them. Each transfer has amountUsd, network, token, fromAddress, txHash, explorerUrl, detectedAt and the stores it was listed fo

Parameter	Type	Required	Notes
store	string	no	Store id or exact store name from list_stores. Needed only when several stores are connected.

Creates a Stablevoy invoice the buyer pays in USDT or USDC and returns its payment link, checkoutUrl. Needs a store key (npx stablevoy-mcp login). Send that link to the buyer yourself; Stablevoy does not email it. Give a reference (for example "acme-october") whenever you can: the same amount and reference return the same invoice instead of a second one. returnUrl is an https page the buyer goes b

Parameter	Type	Required	Notes
amountUsd	string	yes	Amount in US dollars as a decimal string, for example "250" or "19.99".
reference	string	no	Your reference for this invoice, sent back in webhooks, 1 to 200 characters.
returnUrl	string	no	https address the buyer returns to after paying.
expiresInMinutes	integer	no	How long the buyer has to pay, 15 to 10080 minutes; leave it out for the store default. Use a day or more for an invoice sent by email.
store	string	no	Store id or exact store name from list_stores. Needed only when several stores are connected.

Cancels an unpaid invoice so the buyer can no longer pay it, for example when the order was called off. Needs a store key (npx stablevoy-mcp login). Pass the invoiceId from create_invoice, list_invoices or get_invoice. Without store every connected store is tried and only the one that owns the invoice cancels it. It works only while no payment has been seen; otherwise it returns invoice_not_cancel

Parameter	Type	Required	Notes
invoiceId	string	yes	The invoice id.
store	string	no	Store id or exact store name from list_stores. Needed only when several stores are connected.

Searches the Stablevoy documentation for how-to questions and returns up to 5 matching sections. Needs no key. Matching ignores case and common words such as "the", "how" and "to"; a section ranks higher for each query word it contains, more when the word is in its heading or page title, so two to four specific words work best, for example "webhook signature" or "Tron fee". Each hit has the page t

Parameter	Type	Required	Notes
query	string	yes	2 to 200 characters: the words to look for, for example "webhook retries". Words shorter than 2 letters and common words are dropped; a query of only those matches nothing.

Gets one whole page of the Stablevoy documentation as Markdown. Needs no key. Pass a path from search_docs; the OpenAPI outline lists every API endpoint with its parameters, the errors page every error code with what to do. Only Stablevoy pages are read: any other address is refused with the list of pages, and a page over 1 MB is refused rather than cut. Use search_docs first when you do not know

Parameter	Type	Required	Notes
path	string	yes	A docs path like "/docs/webhooks.md", or "openapi", or "errors".

Free

$0 forever

Every tool, no call limit
No card, and mcprush charges nothing for it
Source published under MIT
Runs on your machine — nothing of it reaches our gateway
Nothing to cap, because mcprush bills nothing

Nothing here is billable: mcprush charges nothing to install Stablevoy or to call it, at any volume.

ATrust score 94 / 100

Release 0.5.0 · scanned 9 Nov 2026

Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.

Threat score100

Client score94

Findings1 threat · 0 capability

Capabilityhigh

Coveragesource

Verificationsource

Surface digest1ff67f0bed64e357e3db2e1462e190233b26a1cc67f4393a86603041ca9a30ce

Score vectorthreat 100 → client 94

Term	Level	What it prices	Points
capability-exposure	high	capability blast radius (high) — client exposure if the model is manipulated	−6
verification-discount	source	publisher verification (provenance) — cryptographic build provenance ties the artifact to its source	−0
coverage-honesty	source	inspection depth (source) — how much of the target the scan could see	−0

score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.

What the scan could actually read

A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.

Tool surfacenot available

Implementation sourceread

Package metadataread

Live transportnot available

No tools were enumerated, so prompt-injection, capability and toxic-flow analysis had no tool surface to inspect. To grade a package’s real runtime tools, scan the running server: --command "npx -y <package>".

Capability — what it could do if the model were manipulated

Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. high is the level these add up to.

Tool	Capability tags	Why the tag was assigned
No per-tool rows for this release — see the note below.

can execute shell commands or code

Toxic-flow graph

The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.

The public result for this release does not print the flow graph, so there is nothing to show here. That is not the same as "no paths were found": what the scan did read is above, under coverage.

Supply chain and provenance

Integrityfirst-seen

Surface digest1ff67f0bed64e357

Scanned2026-11-09

This is the first scan of this surface here, so there is nothing yet to compare it against.

Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.

Stablevoy MCP