docs

MCP server

A remote MCP server. Add it to any MCP client with one URL and sign in with your browser: no key to paste.

mcp config (sign in with the browser)

{
  "mcpServers": {
    "xinf": { "url": "https://xavainf.com/mcp/account" }
  }
}

Transport: Streamable HTTP. Each call is independent (no session).
Sign in: /mcp/account answers an unauthenticated connection with 401, so your client opens the browser. You sign in, pick a monthly spending cap and click Allow; the client gets its own token. Calls use your balance, buyback token and Reward Status.
Open endpoint: /mcp works without a credential for the catalog tools, and the media tools can be paid per call with x402. Only the account tools (chat, balance, usage) answer 401 there.
API key: Authorization: Bearer <key> works on both endpoints, as before.

or with an API key

{
  "mcpServers": {
    "xinf": {
      "url": "https://xavainf.com/mcp",
      "headers": { "Authorization": "Bearer xk_live_..." }
    }
  }
}

We implement the MCP authorization spec: OAuth 2.1 with PKCE, protected resource metadata at /.well-known/oauth-protected-resource/mcp/account, server metadata at /.well-known/oauth-authorization-server, dynamic client registration and Client ID Metadata Documents. Access tokens last an hour and refresh by themselves; refresh tokens rotate on every use.

Consent: "Allow <app> to use your Xava Inference account", with what it can do (run models; see balance and usage) and a monthly spending cap (default $50 a month; it resets on the first of the month at 00:00 UTC). A request that would pass the cap is refused with 402 spending_cap_reached before anything runs.
Connected apps: every signed-in app is listed in your dashboard under API keys, with this month's spend. Spending requests require your explicit confirmation. Change the cap or disconnect the app there.
Device login, for clients without MCP sign-in: POST /oauth/device gives a code you confirm at /login/device; the plugin's xinf-login script does it for you and saves a connection key to ~/.xinf/credentials (mode 600) without printing it.

Install and sign-in steps for each client (Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, OpenCode, Kimi, Pi, Cline, Windsurf) are on Agent plugins.

device login (any client)

curl -fsSLo xinf-login.mjs https://raw.githubusercontent.com/xavadao/xinf-plugin/main/bin/xinf-login.mjs
node xinf-login.mjs
export XINF_API_KEY="$(sed -n 's/^XINF_API_KEY=//p' ~/.xinf/credentials)"

Connect your application

Create an application in My Clients to receive a client ID and a secret shown once. Keep secrets on your backend; browser and native applications use public PKCE clients. Every authorization requires S256 PKCE, an exact registered callback and a fresh state value.

Request profile account:read for identity and balances. Read them at /oauth/userinfo and /oauth/account. Request inference for model use or tools:call for the required marketplace tools selected in your client's settings. Select your own approved submissions through My Tools. Users review the tool prices and explicitly confirm that usage spends their credits.

Send the access token to /mcp/account. Use this site's origin as the OAuth resource when the application needs both account and MCP endpoints. Each managed marketplace tools/call must carry a unique Idempotency-Key header. Reuse the same key only to check or retry that operation; retries return a receipt and never execute the tool again. Tool arguments and results are not retained for replay. If the provider's outcome is unknown, check with that provider before starting another operation.

Calls use the listed marketplace price and the user's shared monthly app budget. A call to your published tool records your earnings through the marketplace. Tools requiring a provider account have a separate connection step under Connected apps.

Tools

tool	account	what it does
`list_models`	no	search the catalog by type, provider or name, with the list price per unit
`get_model_pricing`	no	list price for one model
`chat`	yes	one chat completion on any text model (prompt or messages)
`generate_image`	yes or x402	images from a prompt; returns file URLs
`generate_video`	yes or x402	video from a prompt, by duration and resolution
`generate_audio`	yes or x402	speech from text, or music and sound from a prompt
`get_balance`	yes	your available and held credit
`get_usage_summary`	yes	spend, requests and buybacks over the last N days, per model

For agents that read docs: /llms.txt (an index) and /llms-full.txt (everything, with the model list).

← Agent pluginsx402 pay-per-request →

MCP server

Sign in (OAuth)

Connect your application

Tools