How to Charge for MCP Tools: Per-Call Pricing With x402.

TL;DR: Charging for an MCP tool on Cloudflare is a small code change: wrap your McpServer with withX402, give it a network, a recipient wallet, and a facilitator, and declare the priced tool with paidTool instead of tool. A client that calls it unpaid gets 402 Payment Required with the price, pays in USDC, retries with proof, and receives the result. The code takes an afternoon. The product decisions (which tools to price, at what price, and how not to double-charge) are the actual work.

Part 4 of 5 in the Field Notes series When Agents Pay. Previously: how AI agents pay over HTTP 402, should you charge AI crawlers, and x402 vs MPP. Next: verifying that an agent is who it claims.

What does a paid MCP tool look like to the agent?

The Model Context Protocol (MCP) is the open standard that lets AI assistants connect to a server you control and use it: ask questions, pull live data, take actions. An MCP tool is one of those capabilities, with a name, a description, and an input schema. Assistants such as Claude and ChatGPT discover the tools a server offers and call them as needed.

A paid tool is the same tool with a price attached. From the agent’s side, per Cloudflare’s charge for MCP tools documentation:

1. The agent calls the tool with no payment.
2. The server responds 402 Payment Required with the price and payment details.
3. The agent’s client pays via x402 and retries the same call with proof of payment.
4. The server verifies the payment and returns the tool result.

If the client is wrapped with withX402Client, steps 2 and 3 happen automatically, inside a budget the agent’s operator has set. The agent experiences one tool call that cost a known amount. That is the whole user experience, and it is why per-call pricing works for machines when it never worked for people: nobody has to stop and enter a card.

How do you add per-tool pricing on Cloudflare?

Cloudflare’s Agents SDK does the protocol work. The moving parts, from the same documentation:

• withX402 wraps your McpServer and enables payment handling.
• X402Config tells it where the money goes: network (base for production, base-sepolia for testing), recipient (the wallet address that receives payment), and facilitator (the URL that verifies and settles; the default is https://x402.org/facilitator).
• paidTool is “a drop-in replacement for tool that adds x402 payment requirements.” It takes the tool name, description, a USD price per call (the docs’ example is 0.01), a Zod input schema, annotations, and the async handler that does the work.
• tool stays as it was, for everything you want free. One server can mix both.

Testing runs on base-sepolia with test USDC from the Circle faucet, so you can exercise the 402, the payment, and the retry end to end without spending anything. Move network to base when you are ready to be paid.

Cloudflare also documents MPP for MCP tools, where the tool result comes back with an MPP receipt in the response _meta and cards through Stripe become an option. Part 3 covered when that matters. For a first paid tool, x402 is the shortest path, and because MPP clients can consume x402 services, you are not closing a door.

Which tools should be free and which should be paid?

This is the decision that determines whether the server earns anything, and it is a product question, not a technical one.

Free: discovery and low-value reads. What services do you offer, what are your hours, what does this term mean, is this thing in stock. Free tools are how agents find you, learn to trust your answers, and come back. Charging for them is charging for your own marketing. Our public MCP server at /mcp is entirely free for this reason: it answers questions about Bold Crow, makes recommendations, and takes project and audit requests, because those are the interactions we want more of.

Paid: anything with real marginal cost or real standalone value. A verification lookup against data only you hold. A generated report that would take a person an hour. A capacity or availability check that a competitor’s agent would happily pay a nickel for. An action that consumes a scarce resource on your side. The test we use with MCP development clients: if a stranger’s agent called this tool ten thousand times tonight, would you be delighted or alarmed? Delighted means free. Alarmed means priced.

How do you price a tool call?

Three constraints box the number in.

Above your marginal cost. Compute, data licensing, third-party API fees, and the human time that occasionally goes into keeping the answer correct. Below that line every call is a subsidy.

Below the buyer’s approval threshold. Machine buyers operate under budgets set by their operators. A price that makes an agent stop and ask a human for permission has left the machine economy and re-entered the sales cycle. Cloudflare’s example of a cent per call is not a recommendation, but the order of magnitude is telling: prices for machine calls are set where no one needs to think about them.

Small enough that volume is the model. The whole premise of agentic commerce is value that is real but too granular to sell through people. A five-cent lookup sold a hundred thousand times is a business; a fifty-dollar lookup sold twice is a consulting engagement that happens to have an API.

Start with the lowest price at which the call is not a loss, watch the receipts, and raise it when demand tells you to. You can change a price in a config file. You cannot recover a market you priced away before it arrived.

What breaks if you skip the boring parts?

The protocol handles the payment. It does not handle your mistakes. Before the first paid call reaches production:

• Verify server-side, every call. Never trust a client’s claim that it paid. withX402 verifies through the facilitator; do not add a code path that bypasses it for “trusted” callers.
• Make fulfillment idempotent. Networks time out. Clients retry. The same payment credential must produce the same result exactly once and never bill twice. Key your fulfillment on the payment, not the request.
• Scope the response to the price. A paid lookup that returns the whole record set has sold your dataset for a cent. Return what was bought.
• Keep receipts with results. Store the payment reference alongside the fulfillment record. It is your evidence in a dispute and your usage ledger for pricing.
• Meter and rate-limit. Paid does not mean unlimited. An agent in a loop can run up a bill it will later contest.

These are the deliverables that make a paid MCP server a product rather than a demo, and they are the parts we spend the most time on.

What does the sequence look like?

Ship the free tools first. Get them into the directories agents use, watch what gets called, and learn which questions your market’s agents actually ask. Then price the one or two tools that carry real value, on base-sepolia first, then base. Then, if card-paying buyers show up, add MPP. Payments are the last layer of an agent-ready business, not the first.

The question isn’t whether you can charge for an MCP tool. It’s whether you know which of your tools an agent would pay for, and whether you would be delighted or alarmed if it did.

Thinking about a paid MCP server?

Bold Crow AI builds and hosts MCP servers, free where it helps and priced where it matters, with the verification, idempotency, and receipts that make agentic commerce hold up in production. Try our own at /mcp first.

Contact Bold Crow AI to map which of your capabilities an agent would pay for.