{"id":28051,"library":"pop-pay","title":"pop-pay","description":"pop-pay is a runtime security layer for AI agent commerce. It provides a drop-in CLI and MCP server to block hallucinated purchases and keep card credentials out of agent context. Current version is 0.8.9, and it follows an active release cadence with security hardening and documentation updates.","status":"active","version":"0.8.9","language":"python","source_language":"en","source_url":"https://github.com/100xPercent/pop-pay-python","tags":["ai","security","commerce","agent","vault","guardrails"],"install":[{"cmd":"pip install pop-pay","lang":"bash","label":"Install from PyPI"}],"dependencies":[],"imports":[{"wrong":"from pop_pay import PopPay","symbol":"PopPay","correct":"from pop_pay import PopPay"}],"quickstart":{"code":"from pop_pay import PopPay, create_guardrails, inject_payment_info\nfrom pop_pay.vault import initialize_vault\n\n# Initialize vault (passphrase stored in env var)\ninitialize_vault()\n\n# Create guardrails with allowed vendor domains\napp = PopPay(guardrails=create_guardrails(allowed_vendors=[\"stripe.com\", \"shopify.com\"]))\n\n# Inject payment info into a checkout form (after domain verification)\ninject_payment_info(page_url=\"https://stripe.com/checkout\", card_number=os.environ.get('CARD_NUMBER', ''))\n\n# Run the MCP server\napp.run_mcp()","lang":"python","description":"Initialize the vault, set guardrails, inject credentials, and start MCP server."},"warnings":[{"fix":"Ensure all agents use pop-pay >= 0.6.0 with same passphrase.","message":"Passphrase vault mode (v0.6.0+) requires a passphrase; vault created without passphrase cannot be read by older versions.","severity":"breaking","affected_versions":"<0.6.0 or >=0.6.0 if mixing vaults"},{"fix":"Always set allowed_vendors in guardrails and ensure the agent navigates to the correct domain before calling inject_payment_info.","message":"inject_payment_info verifies current page domain against guardrails BEFORE injection. If domain check fails, injection is blocked silently.","severity":"gotcha","affected_versions":">=0.6.0"},{"fix":"Do not rely on database storage for card data; use vault with passphrase.","message":"SQLite storage of card_number/cvv was removed in v0.6.0. The issued_seals table no longer contains full card details.","severity":"deprecated","affected_versions":">=0.6.0"},{"fix":"Use 'pip install pop-pay' for Python library; CLI install via npm or brew available for Node.js users.","message":"The CLI tool is named 'pop-pay' but the Python package import uses underscore: pop_pay. Commands like 'pop-pay init' require the CLI, not the Python module.","severity":"gotcha","affected_versions":"all"}],"env_vars":null,"search_vec":"'0.8.9':41 'activ':46 'agent':14,36,58 'ai':13,55 'block':27 'cadenc':48 'card':32 'cli':22 'commerc':15,57 'context':37 'credenti':33 'current':38 'document':53 'drop':20 'drop-in':19 'follow':44 'guardrail':60 'hallucin':28 'harden':51 'keep':31 'layer':11 'mcp':24 'pay':3,6 'pop':2,5 'pop-pay':1,4 'provid':17 'purchas':29 'releas':47 'runtim':9 'secur':10,50,56 'server':25 'updat':54 'vault':59 'version':39","created_at":"2026-05-09T05:53:28.278618+00:00","updated_at":"2026-05-09T05:53:28.278618+00:00","problems":{"verify_error":"Traceback (most recent call last):\n  File \"<string>\", line 1, in <module>\nImportError: cannot import name 'PopPay' from 'pop_pay' (/tmp/tmpe5u5bhvx/venv/lib/python3.12/site-packages/pop_pay/__init__.py)"},"ecosystem":"pypi","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":null,"cli_name":"pop-pay","cli_version":"","type":"library","homepage":"https://pop-pay.com","github":"https://github.com/100xPercent/pop-pay-python","docs":null,"changelog":null,"pypi":"https://pypi.org/project/pop-pay/","npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["auth-security","ai-ml","llm-agents","payments"],"base_url":null,"auth_type":null,"provenance":{"verified_status":"import_fail","verified_at":"2026-07-03","last_verified":"2026-07-03","next_check":"2026-07-10","install_tag":null}}