1inch MCP
REMOTE · API.1INCH.COM · SCANNED AUG 3
Doc search, intent & cross-chain swaps, limit orders, portfolio, spot prices, gas & all APIs.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score →
Endpoint Security66
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (swap). See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC is configured correctly; the domain's records validate against the full chain to the root. View diagnostics → Pass
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability69
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 6609 tokens (~330/item across 20 items; 9 tools + 11 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
- Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
remote · api.1inch.com
claude mcp add --transport http com-1inch-business-mcp https://api.1inch.com/mcp/protocol
[mcp_servers.com-1inch-business-mcp] url = "https://api.1inch.com/mcp/protocol"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"com-1inch-business-mcp": {
"type": "remote",
"url": "https://api.1inch.com/mcp/protocol",
"enabled": true
}
}
} openclaw mcp add com-1inch-business-mcp --url https://api.1inch.com/mcp/protocol --transport streamable-http
mcp_servers:
com-1inch-business-mcp:
url: "https://api.1inch.com/mcp/protocol" {
"mcpServers": {
"com-1inch-business-mcp": {
"type": "http",
"url": "https://api.1inch.com/mcp/protocol"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 2 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.
- 31 Jul 26 +2
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 29 Jul 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
- 28 Jul 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Tool “swap” rewrote its description, which is the text the model reads security
- Tool “walletconnect” rewrote its description, which is the text the model reads security
- Tool “orderbook” rewrote its description, which is the text the model reads security
- Schema quality: 5721 → 6593 ▼ functional
- Schema quality: excellent → good functional
- New resource “aqua-workflow” functional
- New tool “aqua” functional
- “walletconnect” added an optional parameter “address” cosmetic
- “walletconnect” reworded the description of “action” cosmetic
- “walletconnect” reworded the description of “walletSessionToken” cosmetic
- 27 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 26 Jul 26 65
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Probed https://api.1inch.com/mcp/protocol
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=1inch.com | CN=WE1,O=Google Trust Services,C=US | 16 Jul 2026 | 14 Oct 2026 | ECDSA 256 | ECDSA-SHA256 | be67885f997b657d13f5bdee3bbb7ac3 |
| SANs: 1inch.com, *.1inch.com | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
DNSSEC secure
Validation of api.1inch.com. — Secure
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| 1inch.com. | present | 2371 | 13 | Verified |
| api.1inch.com. | Verified address RRset verified with the apex keys |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000; includeSubDomains; preload |
| content-security-policy | default-src 'self';script-src 'self';style-src 'self';img-src 'self' data: https:;connect-src 'self';font-src 'self';object-src 'none';media-src 'self';frame-src 'none';base-uri 'self';form-action 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | strict-origin-when-cross-origin |
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://api.1inch.com/mcp/protocol | Verified | 200 | |
| http (plaintext) | http://api.1inch.com/mcp/protocol | HTTPS enforced | 301 | https://api.1inch.com/mcp/protocol |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
aqua ~392
Query the 1inch Aqua API (v1.0) — analytics for Aqua strategies (shared-liquidity market making): maker stats, strategy lists, overview, activity, and volume series. Read-only. No OAuth required. REQUIRED: "action" — read actions (no OAuth): maker_stats, list_maker_strategies, strategy_overview, strategy_activity, strategy_volume, list_opened. Read the resource file://1inch-mcp/guides/aqua-workflow for per-action examples, priceRange semantics, and maker/taker flows. Raw HTTP: product_api with path "/aqua/v1.0/strategies/...".
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Invalid or missing "action" parameter. Must be one of: "maker_stats", "list_maker_strategies", "strategy_overview", "strategy_activity", "strategy_volume", "list_opened". Example: { "action": "maker_… |
| address | string | — | Maker EVM address (maker_stats, list_maker_strategies). |
| app | string | — | App contract address (strategy_* analytics actions). |
| chainId | — | yes | EVM chain ID (number) for single-strategy reads, or an array of chain IDs for list/stats filters. |
| cursor | string | — | Opaque pagination cursor from a previous response. |
| granularity | string | — | Volume series bucket (strategy_volume). |
| limit | integer | yes | Page size for list/activity/volume actions. |
| maker | string | — | Maker EVM address (strategy_* analytics actions). |
| sort | string | — | Sort direction for list/activity/volume (asc|desc). |
| status | array | yes | Filter by lifecycle status for list_maker_strategies (e.g. ["open"]). |
| strategyHash | string | — | Strategy hash (strategy_* analytics actions). |
No output schema declared.
No examples provided.
debug ~327
[Requires authentication] This tool needs OAuth. If it returns an authentication error, prompt the user to connect/authenticate this MCP server (OAuth), then retry. Look up production API request logs for your 1inch Business organization to troubleshoot integration issues. Results are always scoped to your authenticated organization. Two modes: 1) By request id: pass requestId (the x-request-id header returned on 1inch API responses). Optionally narrow startTime/endTime (defaults: last 24 hours ending now). 2) Logs in a time window: omit requestId and pass both startTime and endTime (RFC3339). Optionally set logLevel ("info", "warn", or "error") to filter by severity; omit to return all levels. Limits: each call covers at most a 24-hour window; how far back you can query depends on your plan's log retention.
| Name | Type | Req | Description |
|---|---|---|---|
| endTime | string | — | RFC3339 end of query window. Defaults to now when omitted. |
| limit | number | — | Max log lines (max 100) |
| logLevel | string | — | Filter by log level: "info", "warn", or "error". Omit to return all levels. Only applies to time-window mode (ignored when requestId is set). |
| requestId | string | — | Production x-request-id (or correlation id) to find logs for. When set, searches JSON logs for this value scoped to your organization. |
| startTime | string | — | RFC3339 start of query window. With requestId, defaults to 24h before endTime. |
No output schema declared.
No examples provided.
get_example ~92
Get the full source code of an SDK example. Use list_examples first to see available examples.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | — | Optional: specific file path to retrieve (e.g., 'src/evm/swap-native.ts'). If omitted, returns all files. |
| name | string | yes | Example name (e.g., '@1inch-examples/intent-swap', '@1inch-examples/limit-order') |
No output schema declared.
No examples provided.
list_examples ~27
List all available SDK code examples. Returns example names that can be used with get_example tool.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
orderbook ~565
[Requires authentication] This tool needs OAuth. If it returns an authentication error, prompt the user to connect/authenticate this MCP server (OAuth), then retry. Limit orders via the 1inch Orderbook API (v4.1). IMPORTANT: The "action" parameter is REQUIRED. Must be one of: "build", "create", "list", "cancel". Actions with example parameters: 1. build (recommended first step): { "action": "build", "chain": 1, "makerAsset": "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48", "takerAsset": "0xdAC17F958D2ee523a2206206994597C13D831ec7", "makingAmount": "1000000", "takingAmount": "990000", "makerAddress": "0x..." } Optional: expirationSeconds (default 604800 = 7 days). With an active WalletConnect session, the order is signed and submitted automatically (set execute=false to return typed data only). 2. create (after signing typedData from build): { "action": "create", "chain": 1, "orderHash": "0x...", "signature": "0x...", "orderData": { ... } } 3. list (query orders): - By maker: { "action": "list", "chain": 1, "listMode": "by_maker", "makerAddress": "0x..." } - By hash: { "action": "list", "chain": 1, "listMode": "by_hash", "orderHash": "0x..." } - Browse: { "action": "list", "chain": 1, "listMode": "all", "limit": 10 } 4. cancel (inspect + guidance): { "action": "cancel", "chain": 1, "orderHash": "0x..." } Typical flow: build -> sign typedData -> create (or one build call when WalletConnect is connected — order signed and submitted automatically). The maker asset may require a one-time ERC-20 approval for the Limit Order Protocol; it costs native gas even though the limit order itself is gasless. When a build response includes an "approval" block, tell the user upfront (approval.estimatedCost holds the estimated cost in native units) and broadcast the included approveTx before signing. With WalletConnect, the approve is sent automatically — "approvalTxSent": true means the first wallet prompt was the one-time approval. Requires authenticati…
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
product_api ~1,419
[Requires authentication] This tool needs OAuth. If it returns an authentication error, prompt the user to connect/authenticate this MCP server (OAuth), then retry. Call any 1inch product API endpoint using the authenticated user's credentials (base URL is the unified gateway, e.g. https://api.1inch.com). Optional: if your client can read MCP resources, file://1inch-mcp/guides/api-index has live Swagger links and extra gateway notes (mirrors business.1inch.com/portal/llms.txt). Common chain IDs: Ethereum=1, BNB=56, Polygon=137, Arbitrum=42161, Optimism=10, Base=8453, Avalanche=43114, Gnosis=100, zkSync=324, Linea=59144, Sonic=146, Unichain=130, Cronos=25, Monad=10143, Solana=501 (where applicable). Gateway products (use these path prefixes with this tool): - Portfolio: /portfolio/portfolio/v5.0/... — example path="/portfolio/portfolio/v5.0/general/current_value", query={"addresses":"0x..."}; token metrics path="/portfolio/portfolio/v5.0/tokens/metrics", query={"addresses":"0x...","timerange":"1year"} - Balance: /balance/v1.2/{chainId}/... — example path="/balance/v1.2/1/balances/0x..." - Spot Price: /price/v1.1/{chainId} — example path="/price/v1.1/1", method="POST", body={"tokens":["0x..."],"currency":"USD"} - Token: /token/v1.4/{chainId}/... — example path="/token/v1.4/1/search", query={"query":"USDC"} (prefer v1.4; older v1.2 chain search is deprecated in OpenAPI) - Token Details: /token-details/v1.0/details/{chain}/{tokenAddress} — example path="/token-details/v1.0/details/1/0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48" - Gas Price: /gas-price/v1.6/{chainId} — example path="/gas-price/v1.6/1" - Swap (Classic): /swap/v6.1/{chainId}/... — example path="/swap/v6.1/1/quote", query={"src":"0x...","dst":"0x...","amount":"..."} (exact query names per OpenAPI) - Orderbook: /orderbook/v4.1/{chainId}/... — example path="/orderbook/v4.1/1/all", query={"page":"1","limit":"10"} - Fusion (Intent): /fusion/orders/v2.0/..., /fusion/quoter/v2.0/..., /fusion/relayer/v2.0/... —…
| Name | Type | Req | Description |
|---|---|---|---|
| body | object | — | Request body for POST requests |
| method | string | — | HTTP method |
| path | string | yes | API path (e.g. /portfolio/portfolio/v5.0/general/current_value — unified gateway prefix) |
| query | object | — | Query parameters as key-value pairs |
No output schema declared.
No examples provided.
search ~80
Search 1inch documentation and API reference
| Name | Type | Req | Description |
|---|---|---|---|
| include_body | boolean | — | Include full document body in results (default true). Set to false for smaller responses. |
| limit | number | — | Maximum results per collection (default 10) |
| page | number | — | Page number for pagination (default 1) |
| query | string | yes | Search query string |
No output schema declared.
No examples provided.
swap ~990
[Requires authentication] This tool needs OAuth. If it returns an authentication error, prompt the user to connect/authenticate this MCP server (OAuth), then retry. Swap tokens via 1inch. Supports classic (on-chain), Fusion (intent/gasless), and cross-chain swaps. Omit preferredType and the tool picks a type for you; set preferredType (classic, fusion, crosschain) to choose explicitly. When quoteOnly returns a `recommended` type and that type is available, present **only** that type to the user. Do not mention, compare, or suggest other swap types unless the user explicitly asks to compare alternatives. ERC-20 source tokens may require a one-time approval transaction before the swap can proceed; the approval costs native gas on the source chain even for gasless Fusion/cross-chain swaps. When a response includes an `approval` block, tell the user upfront (approval.estimatedCost holds the estimated cost in native units). Usage modes: 1. **Quote** (quoteOnly=true): Returns only one swap type and its quote. If you pass `preferredType` explicitly (classic, fusion, or crosschain), the response returns that exact type (when a quote for it is available). If `preferredType` is omitted, the tool compares classic, Fusion, and cross-chain internally and picks the best one. The chosen type is echoed as `recommended`. 2. **Execute** (default): Returns data to sign. Response type depends on swap mode: - Classic → {type:"classic", step:"approve"|"swap", tx:{to,data,value}} → sign with eth_sendTransaction, wait for receipt. If step="approve", sign the approve tx first, then call swap again for the actual swap tx. - Fusion → {type:"fusion", orderHash, typedData} → sign typedData with eth_signTypedData_v4, then call this tool again with signedOrder=<signature> and orderHash. - Cross-chain → {type:"crosschain", orderHash, typedData, srcChain, dstChain} → same as Fusion: sign typedData, then submit with signedOrder. 3. **Submit** (signedOrder=<sig>): Submit a previously sig…
| Name | Type | Req | Description |
|---|---|---|---|
| amount | string | yes | Amount in wei/smallest unit. Pass large amounts as a string to avoid precision loss. |
| chain | integer | yes | Chain ID (e.g. 1 for Ethereum, 8453 for Base) |
| dst | string | yes | Destination token address or symbol (e.g. ETH, 0x...) |
| dstChain | integer | — | Destination chain for cross-chain swap |
| execute | boolean | — | Optional. When a WalletConnect session is active, defaults to true: classic approve/swap txs, Fusion/cross-chain EIP-712 sign+submit, and native escrow sends are handled via the wallet (user confirms… |
| from | string | yes | Wallet address executing the swap |
| gasPrice | string | — | Network gas price in wei (optional; omit for fast default) |
| orderHash | string | — | Order hash for submit mode |
| preferredType | string | — | Preferred swap type; the tool picks one if omitted |
| preset | string | — | Order preset for fusion/cross-chain: fast (quicker fill), medium, slow (better rate) |
| quoteOnly | boolean | — | If true, return quote comparison only (no tx/order) |
| signedOrder | string | — | Signed EIP-712 order (submit mode) |
| slippage | number | — | Slippage tolerance in % (default 0.5) |
| src | string | yes | Source token address or symbol (e.g. USDC, 0x...) |
No output schema declared.
No examples provided.
walletconnect ~1,620
Pair and use an EVM and/or Solana wallet via WalletConnect v2. **No authentication required** — available to every user (including unauthenticated/anonymous). Non-custodial: the server never holds keys and the user approves every signature/transaction in their own wallet. **Pairing proposal** is controlled per request via optional `pairingTarget` on `action: "connect"`: `eth` (default, eip155 only), `solana`, or `both`. Many mobile wallets fail if eip155 and solana are proposed together; prefer `eth` or `solana` unless the user needs both in one session. **Every call must include `action`** (string). **Connect QR (critical for assistants):** On `action: "connect"`, successful responses return **(1) a `resource_link`** to the pairing QR PNG when storage works, then **(2) text JSON** with `pairingQrResourceUri`, `presentation`, `nextSteps`, `url`, optional `mobileDeeplinks`, etc. **Desktop / scan UX:** surface the pairing QR **first**: call MCP `resources/read` on `pairingQrResourceUri` in the **same MCP session** as `connect`, then open the PNG per OS (`open` / `xdg-open` / `start`) or render it inline so the user can scan. **Mobile / no-camera:** follow `nextSteps`; when present, `mobileDeeplinks` lists HTTPS `url` (+ `nativeUrl`) per curated WalletConnect wallet so the user can open pairing without QR (`presentation.mobilePreferred === "deeplinks"`); links overlay WalletConnect Explorer data when Redis cache allows; otherwise curated fallbacks still work. Raw `wc:` (`url` / `walletConnectLinkForUser`) remains fallback if links fail to open in the host. **Avoid calling `connect` again while pairing is still in progress** unless the user must reset—duplicate calls used to invalidate the WalletConnect URI; the server now returns the same in-flight URI when Redis shows pairing pending *and* `pairingTarget` matches, but the wallet may still expire stale links if you wait too long. **Flow:** (1) `connect` as above. (2) User approves in the wallet (EVM only, Solana onl…
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Required. One of: connect (start pairing), status (session info), sign (EVM + Solana WC methods), send_transaction (EVM eth_sendTransaction or Solana solana_signAndSendTransaction), accept_terms (wal… |
| address | string | — | Optional; only with action "accept_terms". EVM address that signs the Terms-of-Use acceptance; must belong to the active WalletConnect session. When omitted, the session's primary EVM account is used. |
| chainId | integer | — | Optional; only when action is "sign" and method is personal_sign (EVM numeric chain id). Must be omitted for eth_signTypedData_v4, Solana methods, send_transaction, and other actions. |
| method | string | — | Required when action is "sign". EVM: personal_sign | eth_signTypedData_v4. Solana: solana_signMessage | solana_signTransaction. Omit for connect, status, send_transaction, disconnect. |
| pairingTarget | string | — | Optional; only with action "connect". What to advertise in the WalletConnect proposal: "eth" (eip155 only, default), "solana" only, or "both". Many mobile wallets fail if eip155 and solana are propos… |
| params | array | — | Required when action is "sign": exactly two items. personal_sign: [message, 0xAddress]. eth_signTypedData_v4: [0xSigner, typedDataJsonString]. solana_signMessage: [message, pubkey]. solana_signTransa… |
| sessionTtlDays | integer | — | Optional; only with action "connect". How long to persist this WalletConnect client state in Redis (days). Server clamps to [1, WALLETCONNECT_SESSION_TTL_DAYS_MAX] and defaults when omitted. |
| solanaChainId | string | — | Optional; only when action is "sign" and method is solana_signMessage or solana_signTransaction. CAIP-2 string (e.g. solana:5eykt4…). When omitted, the server uses the first Solana chain on the sessi… |
| tx | object | — | Required when action is "send_transaction". EVM or Solana shape — see `tx` field descriptions. Omit for connect, status, sign, disconnect. |
| walletSessionToken | string | — | Optional durable token for ANONYMOUS (unauthenticated) sessions. A fresh token is returned by `connect`; store it and pass it back on status/sign/send_transaction/accept_terms/disconnect so the walle… |
No output schema declared.
No examples provided.