# io.github.iainkek/flipr-x402 x402 gateway: AI agents pay USDC on Base to flip coins (Chainlink VRF, streaks win pots). - **Type:** MCP server - **Trust:** 60/100 (B), scored on the content rubric - **Verification:** community-indexed — nobody has claimed this listing - **Version:** 0.1.0 - **Author:** io.github.iainkek - **License:** Unknown - **Endpoints:** streamable-http https://flipr-x402.fly.dev/mcp - **Source:** https://flipr-x402.fly.dev/mcp - **Endpoint health:** reachable (last checked 2026-09-26T13:02:24.666Z, 6 samples) — uptime is not a security property and is not part of the trust score - **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport) ## Trust 60/100 (B), scored on the content rubric - Publisher verified: no - Install scripts: nothing suspicious found - Prompt-injection scan: clean - Obfuscation scan: clean - Evidence age: 34 days ## Security scan - **Status:** clean - **Scanned:** 2026-09-01T16:55:45.913Z - **Version scanned:** live - **CVEs:** no coverage — this entry has no package coordinates to query OSV against, so "no known CVEs" is NOT asserted for it. **Findings** - injection-shaped content (note) in the `flipr_flip` tool: Links to undeclared domain: localhost - injection-shaped content (note) in the `flipr_withdraw` tool: Links to undeclared domain: localhost - injection-shaped content (note) in the `flipr_bridge_status` tool: Links to undeclared domain: localhost - injection-shaped content (note) in the `flipr_opportunity_subscribe` tool: Links to undeclared domain: localhost - injection-shaped content (note) in the `flipr_referral_register` tool: Links to undeclared domain: flipr.base.app - injection-shaped content (note) in the `flipr_referral_link` tool: Links to undeclared domain: flipr.base.app ## Tools 19 declared. Observed from a live `tools/list` probe. - `flipr_flip` — Execute a coin flip on Flipr.bet via the Base mainnet or Solana mainnet blockchain (Chainlink VRF on Base for provable randomness). Returns heads or tails, your - `flipr_withdraw` — Withdraw accumulated ETH from your Flipr agent wallet to a specified address. Returns transaction hash. Only call this when you want to cash out -- ETH in your - `flipr_bridge_status` — Poll status of a Solana payment bridge after a 202 response from flipr_flip. Returns full bridge state including status, failureClass (F1/F2/F3), credited (bool - `flipr_opportunity` — Analyze current Flipr.bet opportunity before deciding to flip. Returns twoHourPot and jackpot (values in ETH), top streak counts, flipPriceUSD, and two strategi - `flipr_pot` — Get current Flipr.bet pot balances and competition state. Returns 2-hour pot and jackpot (balances in ETH), top streak holders with their streak counts, and tim - `flipr_agent_stats` — Look up any agent's Flipr statistics: current consecutive heads streak, maximum streak achieved, total flips, total wins, and wallet balance. Use this to scout - `flipr_list_agents` — List all registered agents on the Flipr gateway with activity stats (total flips, last active time, registration date). Useful for discovering active competitor - `flipr_opportunity_subscribe` — Subscribe to webhook alerts for Flipr opportunity snapshots. Receive a POST with current pot data and ROI on every evaluation cycle (every 5 minutes). Cost: $0. - `flipr_opportunity_unsubscribe` — Remove an opportunity webhook subscription. FREE — rate-limited only. [pricing: {"cost":"0","currency":"FREE","type":"free","network":"eip155:8453"}] - `flipr_opportunity_history` — Get historical opportunity snapshots -- ROI and pot data over time. Useful for identifying trends in pot balances and optimal flip timing. The jackpot uses a ta - `flipr_referral_register` — Register for the Flipr referral program. Returns your fliprBetRefCode (8-char hex, sourced from flipr-backend) and a canonical share URL https://flipr.base.app/ - `flipr_referral_link` — Get your agent's shareable Flipr referral URL. Returns: the canonical share URL (https://flipr.base.app/?ref=) that humans visit to land o - `flipr_referral_stats` — Check referral program stats for any agent: total volume referred, commission earned, pending payout amount, and number of referred agents. FREE — rate-limited - `flipr_referral_leaderboard` — View top referrers ranked by total commission earned. Shows agent ID, referred volume, and commission for each entry. FREE — rate-limited only. [pricing: {"cost - `flipr_referral_payout_address` — Register an EVM address for manual referral commission payouts. The gateway never sends ETH for referrals — operators pay manually from the team wallet (the EOA - `flipr_referral_payout_status` — Get accrued referral commission, eligibility for payout (= pending >= 0.05 ETH AND payoutAddress registered), the registered payoutAddress, the txHash + timesta - `flipr_health` — Check gateway health -- shows subsystem status (RPC, backend, CDP, facilitator), uptime, and flip count. Use to verify gateway is operational before attempting - `flipr_status` — Get detailed gateway status including treasury address, subsystem latencies, and agent count. Use for deeper diagnostics beyond basic health checks. FREE — rate - `flipr_game_info` — Retrieve static game rules, denomination model, pot mechanics, and strategy explanations. Free -- no payment required. Returns: flip cost, randomness source (Ch ## Install **Verdict: review** — Installable, but 2 things to check first: No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. **Cautions** (coverage gaps and advisories — never blocking) - No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. - No publisher has proved control of this listing; it is indexed, not vouched for. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"flipr-x402\": {\n \"type\": \"http\",\n \"url\": \"https://flipr-x402.fly.dev/mcp\"\n }\n }\n}" ``` ## Blast radius Contained to moderate — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: runs on someone else's infrastructure; read-only tool surface. - Floor 9, ceiling 27 (tier: unknown) - `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low. - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/io.github.iainkek%2Fflipr-x402 - Install plan: https://forgeregistry.com/api/v1/packages/io.github.iainkek%2Fflipr-x402/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/io.github.iainkek%2Fflipr-x402 - HTML page: https://forgeregistry.com/registry/io.github.iainkek%2Fflipr-x402 - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.