/ 100

1 month ago

glama

LemonCake — AI Agent Wallet & USDC Pay-per-call

Pay-per-call USDC payment proxy for AI agents. Issue scoped Pay Tokens with hard spending caps and auto-journal every charge to freee / Money Forward / QuickBooks.

→ evidai/lemon-cake · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

🚨

Secret credentials may flow to a network call

1 flow detected: GITHUB_OAUTH_CLIENT_ID. We can’t prove the destination matches the brand the credential belongs to.

🔐

You'll be asked for 12 credentials: ALPACA_API_KEY, ALPACA_SECRET_KEY, CDP_API_PRIVATE_KEY, GITHUB_OAUTH_CLIENT_SECRET, GOOGLE_OAUTH_CLIENT_SECRET, LEMONCAKE_PAY_TOKEN, LEMONCAKE_SELLER_KEY, LEMON_CAKE_PAY_TOKEN, NEXT_PUBLIC_TRANSAK_API_KEY, RESEND_API_KEY, STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configADMIN_EMAILS

🔐 secretALPACA_API_KEY

configALPACA_GUARD_ALLOW_LIVE

configALPACA_GUARD_LEDGER_DIR

configALPACA_PAPER_TRADE

🔐 secretALPACA_SECRET_KEY

configCDP_API_KEY_ID

🔐 secretCDP_API_PRIVATE_KEY

configCLOUD_RUN_URL

configGITHUB_OAUTH_CLIENT_ID

🔐 secretGITHUB_OAUTH_CLIENT_SECRET

configGOOGLE_APPLICATION_CREDENTIALS_JSON

configGOOGLE_OAUTH_CLIENT_ID

🔐 secretGOOGLE_OAUTH_CLIENT_SECRET

configGOOGLE_SERVICE_ACCOUNT_JSON

configGOOGLE_SHEETS_CONTACT_ID

configGOOGLE_SHEETS_CONTACT_SHEET

🔐 secretLEMONCAKE_PAY_TOKEN

configLEMONCAKE_SANDBOX_BASE

🔐 secretLEMONCAKE_SELLER_KEY— then add a Seller Key in /app and set → it charges for real (no code change)

🔐 secretLEMON_CAKE_PAY_TOKEN

configNEXT_PUBLIC_API_URL

configNEXT_PUBLIC_APP_URL

configNEXT_PUBLIC_COINBASE_PROJECT_ID

configNEXT_PUBLIC_GA_ID

configNEXT_PUBLIC_PRIVY_APP_ID

🔐 secretNEXT_PUBLIC_TRANSAK_API_KEY

configPORT

configPOSTGRES_URL

configPOSTGRES_URL_NON_POOLING

configPRICE_PER_CALL

🔐 secretRESEND_API_KEY

🔐 secretSTRIPE_SECRET_KEY

🔐 secretSTRIPE_WEBHOOK_SECRET

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/evidai-lemon-cake-dc2crf)](https://m8ven.ai/mcp/evidai-lemon-cake-dc2crf)

commit: 020faed8d9538a9b32ea1993e290e5641a583bab

code hash: 173060242f62a115c025d096d76e8c55486b95c704c1cf0b7a41459567eb54c8

verified: 6/10/2026, 10:44:46 AM

view raw JSON →