Payment hygiene for XRPL agents

Check before you send.
Every time.

XRPreflight verifies destination readiness, payer affordability, and settlement receipts for XRPL Payments — so your agent never drops funds into a broken destination.

Validate first. Spend last. Fail closed.

Install the MCP in one step

Agents using Claude, Cursor, or any MCP-compatible runtime can install the XRPreflight stdio server in seconds. The default install is dry-run only — no wallet credential in MCP config, and nothing is sent to our server.

// ~/.config/claude/claude_desktop_config.json — dry-run only, no wallet credential { "mcpServers": { "xrpreflight": { "command": "/path/to/mcp-venv/bin/python", "args": ["-m", "xrpreflight_mcp.server"], "env": { "PYTHONPATH": "/path/to/mcp_server", "XRPREFLIGHT_SESSION_BUDGET_DROPS": "10000", "XRPREFLIGHT_DAILY_BUDGET_DROPS": "20000" } } } }
// .cursor/mcp.json — dry-run only, no wallet credential; do not commit secrets { "mcpServers": { "xrpreflight": { "command": "/path/to/mcp-venv/bin/python", "args": ["-m", "xrpreflight_mcp.server"], "env": { "PYTHONPATH": "/path/to/mcp_server" } } } }
# 1. Clone and install (single-phase; pip check exits 0) git clone <this-repo> xrpreflight cd xrpreflight bash mcp_server/install.sh mcp-venv # 2. Dry-run mode — default. No wallet credential. No payments. PYTHONPATH=mcp_server mcp-venv/bin/python -m xrpreflight_mcp.server # 3. Phase 1 is dry-run only. Paid mainnet is disabled and unadvertised. # 4. Disable: remove "xrpreflight" from MCP config. No background processes. rm -rf mcp-venv rm -f ~/.xrpreflight/ledger.json # optional: reset daily spend counter

Phase 1 — dry-run only. The public install contains no wallet credential field. Paid mainnet MCP mode is disabled and unadvertised until later independent review. This merchant never collects a seed. Never paste a seed into chat, a remote service, a checked-in file, or MCP JSON config.

Four preflight checks

All paid endpoints cost 1000 drops (0.001 XRP) via x402 exact on XRPL mainnet. Free inspect/dry-run available via the MCP before paying.

📬

Receive Card

GET /v1/receive-card

Can this r-address receive XRP or RLUSD right now? Returns ready and a list of blockers: ACT_NOT_FOUND, REQUIRE_DEST_TAG, DEPOSIT_AUTH, DISALLOW_XRP, NO_RLUSD_TRUSTLINE, and more.

1000 drops · asset=XRP|RLUSD
💰

Payer Ready

GET /v1/payer-ready

Can the sending account afford to pay amount of XRP or RLUSD? Checks spendable balance against reserve requirements and trust-line limits.

1000 drops · amount in drops or RLUSD value
🧾

Receipt

GET /v1/receipt

Structured, machine-readable receipt for a completed XRPL Payment transaction. Pass the tx hash; get back amounts, ledger index, destination tag, and delivery confirmation.

1000 drops · hash=<64-char hex>
📦

Batch Receive Card

POST /v1/receive-card/batch

Check up to 10 destination addresses in a single paid call. Same fields as Receive Card per address — ideal for pre-screening a recipient list before a multi-send.

1000 drops · up to 10 addresses

How the safety loop works

The MCP preflight_payment tool enforces this order automatically. The agent never skips a step.

1

Payer check

Verify the sending account can afford the amount — including XRPL reserves and RLUSD trust-line limits.

payer_ready(address, amount)
2

Destination check

Confirm the destination can receive the asset. Detect frozen accounts, deposit-auth, missing trust-lines, and disallowXRP flags.

receive_card(address, asset)
3

Payment

Both checks pass → the agent submits the signed XRPL Payment. XRPreflight does not sign or submit — your agent does.

agent.sign_and_submit(tx)
4

Receipt

After settlement, fetch a structured receipt for the transaction hash — amounts, ledger index, and delivery confirmation.

receipt(tx_hash)

Live on-chain activity

Recent preflight API usage from the free /v1/activity endpoint.

This table aggregates public on-chain XRPL data. It is not private user history. Payer and destination addresses are withheld here; the raw API may still expose public ledger fields.

Loading recent activity…
Could not load activity — view the public API

Powered by destinationpreflight.com/v1/activity

Safety & trust model

Validate first. Spend last. Fail closed.

When payment safety is uncertain, XRPreflight does not send.

Validate before signing Destination, payer, 402 challenge, network (xrpl:0), price, PayTo, and local budget are all checked before any signing begins.
Ambiguous settlement = spent If the payment outcome is uncertain after signing begins, the budget is marked used — not retried. Overcounting is preferred to missing real spend.
Keys stay local Phase 1 never reads a buyer seed. destinationpreflight.com never accepts one.

Payment hygiene, not AML, risk scoring, or security tooling.

🔒

Receive-only merchant

The server never signs or submits transactions. rEB3eMYcrd1L7WXQMrAAWKfFiM1fRtpggt is a public receive-only address. We never ask for, store, or transmit any XRPL seed or private key.

🏦

Strict local spend caps

The MCP enforces a per-session and per-day drop budget locally before signing anything. Defaults: 10,000 drops/session, 20,000 drops/day. These caps are advisory and do not replace limiting the buyer wallet's balance.

Challenge validation before every payment

Every 402 challenge is verified: network must be xrpl:0, PayTo must match the known merchant, resource host must be destinationpreflight.com, and price must be ≤ max. Rejects anything else — fail-closed.

🔍

Dry-run by default

All MCP tools default to dry_run=True: they fetch and validate the 402 challenge without signing or paying. Set dry_run=False explicitly when ready to pay.

📊

Not AML, not risk scoring

XRPreflight is a payment hygiene tool — it checks ledger state, not identity or compliance. We do not score wallets, flag addresses, or share data with compliance databases.

🔕

No logs of secrets

Payment signatures, signed transaction blobs, seeds, and wallet config are never written to logs. The MCP logs only the derived classic address for audit purposes.

Part of the XRPL agent ecosystem

XRPreflight is an independent service. We are not affiliated with Ripple, the XRPL Foundation, or t54 Labs. We complement — not compete with — the broader x402 ecosystem.

x402 protocol · T54 facilitator

The x402 payment flow is handled by the T54 mainnet facilitator at xrpl-facilitator-mainnet.t54.ai. T54 verifies and settles the on-chain payment; XRPreflight is the resource server.

T54 docs →

XRPL AI Hub

XRPreflight is listed in the XRPL AI Hub bazaar at xrpl-ai.org. Agents can discover this service via /.well-known/x402 or the Hub's discovery API.

Hub listing →

Canonical API origin

destinationpreflight.com is the stable canonical API domain. All integrations, x402 resource URLs, and llms.txt references use this domain. xrpreflight.com is the discovery and install hub.

llms.txt →