ClawPay

AI Shopping Agent — connects your AI to Lithic virtual cards, Stripe, and PayPal.

[!WARNING] Production mode by default. Real transactions, real money. Set LITHIC_ENVIRONMENT=sandbox for testing.

⚖️ Legal Notice

ClawPay is a SOFTWARE CONNECTOR ONLY. We do NOT:

• Handle, hold, or transmit your funds
• Act as a money transmitter or payment processor
• Have access to your money at any time

Money flows directly: YOU ↔ Lithic / Stripe / PayPal. ClawPay only connects APIs and automates browser forms.

You are responsible for compliance with payment provider terms and applicable laws. See DISCLAIMER.md for full legal terms.

Quick Start

npm install -g @xodn348/clawpay
npx playwright install chromium
export LITHIC_API_KEY=your_production_key
clawpay install

Then ask your AI: "Buy me a blue t-shirt on automationexercise.com"

How It Works

1. Tell your AI what to buy and where
2. ClawPay navigates the store and shows you a summary
3. You confirm — no auto-purchase ever
4. A Lithic single-use virtual card is created and used for checkout
5. Card self-destructs. PAN/CVV never touch disk or logs.

MCP Tools

| Tool | Description | |------|-------------| | setup_lithic | Configure Lithic virtual card API | | browse_and_buy | AI shopping with single-use virtual card | | setup_payment | Configure Stripe payment method | | pay | Charge via Stripe | | get_balance | Stripe account balance | | list_transactions | Recent Stripe payments | | refund | Issue Stripe refund | | setup_paypal | Configure PayPal | | send_paypal | Send money via PayPal |

Environment Variables

| Variable | Required | Default | Description | |----------|----------|---------|-------------| | LITHIC_API_KEY | Yes (shopping) | — | Lithic API key | | LITHIC_ENVIRONMENT | No | production | production or sandbox | | STRIPE_SECRET_KEY | Yes (Stripe) | — | Stripe secret key | | PAYPAL_CLIENT_ID | Yes (PayPal) | — | PayPal client ID | | PAYPAL_CLIENT_SECRET | Yes (PayPal) | — | PayPal client secret | | PAYPAL_ENVIRONMENT | No | production | production or sandbox |

Guardrails

Default limits: $100/transaction, $500/day, USD only.

Override in ~/.clawpay/config.json:

{
  "guardrails": {
    "maxAmountPerTransactionCents": 10000,
    "maxDailySpendCents": 50000,
    "allowedCurrencies": ["usd"]
  }
}

Client Setup

Claude Code:

claude mcp add -s user clawpay -e LITHIC_API_KEY=your_key -- clawpay

opencode.json / Claude Desktop / Cursor:

{
  "mcp": {
    "clawpay": {
      "type": "local",
      "command": ["clawpay"],
      "environment": { "LITHIC_API_KEY": "your_key" }
    }
  }
}

Security

• PAN/CVV exist in memory only during checkout — never logged, never stored
• Stripe card data handled by PCI-compliant Stripe Checkout
• All actions logged to ~/.clawpay/audit.log (no sensitive data)
• Guardrails block excessive spending before it reaches the API

For vulnerabilities: SECURITY.md

License

Apache 2.0 — LICENSE. Full legal terms: DISCLAIMER.md.