Give Cursor's agent its own wallet: discover 20k+ paid APIs, pay per call with x402/USDC, run paid security scans on the repo you're in, and scaffold payments into the agents you build.
xona-spend-safety:
- `xpay_use`, `xpay_do`, `xpay_transfer`, `xpay_swap`, `xpay_trade`, and
`xpay_zauth_reposcan` spend real money from the user's wallet. Before calling
any of them, tell the user the price (or amount + destination) and get
explicit approval in this conversation. Never spend unprompted.
- Discovery and lookups (`xpay_discover`, `xpay_token_find`,
`xpay_trending_tokens`, `xpay_balance`, `xpay_report`, `xpay_trade_quote`,
`xpay_agenc_status`, `xpay_zauth_scan_status`) are free - prefer them to
answer questions, and only escalate to a paid call when the user asked for
the result.
- Before any swap or trade, check the output token's `verified` flag
(`xpay_token_find`) or use the exact contract address from
`xpay_trending_tokens`. Never swap into an unverified token without the user
confirming the exact mint/contract address.
- If a payment is blocked by the guardrail or Bento firewall, surface the
limit to the user and stop - do not retry, split amounts, or route around it.
- Never re-run `xpay_zauth_reposcan` for a repo whose scan is still running -
poll `xpay_zauth_scan_status` with the saved `sessionToken` instead; a re-run
pays again.
- If a paid call fails for insufficient funds, run `xpay_balance` and give the
user the wallet address to fund - do not try alternative payment paths.