Bostrom MCP

NPM · BOSTROM-MCP · SCANNED AUG 3

86-tool MCP server for Bostrom blockchain: read chain state and sign transactions

Available components

npm · bostrom-mcp 0

0 this week 0 0 Trust /100

Recent critical change

CVE-2026-41242 affects this package (2 Aug 2026). See the changelog before you install this server.

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security65

No malware found by supply-chain analysis.Pass
CVE check failed: an unpatched critical CVE affects this package; the score is capped at 0. See how to fix → View diagnostics → Fail
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (171 of 175), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency19

Repository check failed: the declared repository URL returned HTTP 404. See how to fix → View diagnostics → Fail
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 144 days ago).Pass
Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified

Schema Quality & AI Usability77

AI-judged instruction clarity (excellent).Pass
Tool/resource definitions use about 4671 tokens (~55/item across 84 items; 84 tools + 0 resources), lean.Pass
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management27

Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage99

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
98% of tool parameters carry a description.Partial

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · bostrom-mcp

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add cyberia-to-bostrom-mcp -- npx -y bostrom-mcp

# add to Codex CLI

codex mcp add cyberia-to-bostrom-mcp -- npx -y bostrom-mcp

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "cyberia-to-bostrom-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "bostrom-mcp"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add cyberia-to-bostrom-mcp --command npx --arg -y --arg bostrom-mcp

# ~/.hermes/config.yaml

mcp_servers:
  cyberia-to-bostrom-mcp:
    command: "npx"
    args: ["-y", "bostrom-mcp"]

// mcp.json

{
  "mcpServers": {
    "cyberia-to-bostrom-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "bostrom-mcp"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

3 Aug 26 0
- Stability: unverified → 0.27 ▲ functional
2 Aug 26 0
- CVE-2026-41242 affects this package: high ▼ critical
- Known CVEs: unverified → fail ▼ critical
- Score status: scored → failed ▼ critical
- Provenance: unverified → fail ▼ security
- CVE-2025-14505 no longer affects this package ▲ security
- Install scripts: unverified → pass ▲ security
- Malware scan: unverified → pass ▲ security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- Tool coverage: unverified → 100 ▲ functional
- License: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- First check of Schema quality: fail functional
- First check of Schema quality: excellent functional
- First check of Tool coverage: 98 functional
- First check of Schema quality: pass functional
- Licence: MIT functional
1 Aug 26 −2
- Dependency health: partial → unverified ▼ functional
31 Jul 26 +2
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
30 Jul 26 −31
- Malware scan: pass → unverified ▼ security
- Known CVEs: partial → unverified ▼ security
- CVE-2025-14505 no longer affects this package ▲ security
- Dependency health: partial → unverified ▼ functional
28 Jul 26 +31
- CVE-2025-14505 affects this package ▼ security
- CVE-2026-41242 no longer affects this package ▲ security
- Known CVEs: fail → partial ▲ security
- Score status: failed → scored ▲ functional
27 Jul 26 −34
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
26 Jul 26 34

First indexed and scored.

Show 4 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Vulnerabilities 42 findings

ID	CVE	Severity	Vector	Fix available
GHSA-35jp-ww65-95wh	CVE-2026-44494	high	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N	yes
GHSA-3g43-6gmg-66jw	CVE-2026-44495	high	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L	yes
GHSA-3p68-rc4w-qgx5	CVE-2025-62718	medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N	yes
GHSA-3w6x-2g7m-8v23	CVE-2026-42044	medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N	yes
GHSA-42h9-826w-cgv3	CVE-2026-67313	medium		yes
GHSA-43fc-jf86-j433	CVE-2026-25639	high	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	yes
GHSA-445q-vr5w-6q77	CVE-2026-42037	medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	yes
GHSA-4hjh-wcwx-xvwj	CVE-2025-58754	high	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	yes
GHSA-5c9x-8gcm-mpgx	CVE-2026-42034	medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	yes
GHSA-62hf-57xw-28j9	CVE-2026-42039	high	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	yes
GHSA-6chq-wfr3-2hj9	CVE-2026-42035	high	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N	yes
GHSA-777c-7fjr-54vf	CVE-2026-44488	high	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	yes
GHSA-7q8q-rj6j-mhjq	CVE-2026-67319	medium		yes
GHSA-898c-q2cr-xwhg	CVE-2026-44490	medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L	yes
GHSA-fvcv-3m26-pcqx	CVE-2026-40175	medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N	yes
GHSA-hfxv-24rg-xrqf	CVE-2026-44496	high	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	yes
GHSA-j5f8-grm9-p9fc	CVE-2026-44486	high	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	yes
GHSA-jqh4-m9w3-8hp9	CVE-2026-67317	medium		yes
GHSA-jr5f-v2jv-69x6	CVE-2025-27152	high		yes
GHSA-m7pr-hjqh-92cm	CVE-2026-42038	medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N	yes
GHSA-mmx7-hfxf-jppx	CVE-2026-67316	medium		yes
GHSA-p92q-9vqr-4j8v	CVE-2026-44487	high		yes
GHSA-pf86-5x62-jrwf	CVE-2026-42033	high	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N	yes
GHSA-pmv8-rq9r-6j72	CVE-2026-67312	medium		yes
GHSA-pmwg-cvhr-8vh7	CVE-2026-42043	high	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	yes
GHSA-q8qp-cvcw-x6jj	CVE-2026-42264	high	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N	yes
GHSA-vf2m-468p-8v99	CVE-2026-42036	medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	yes
GHSA-w9j2-pvgh-6h63	CVE-2026-42041	medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N	yes
GHSA-xhjh-pmcv-23jw	CVE-2026-42040	low	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N	yes
GHSA-xx6v-rp6x-q39c	CVE-2026-42042	medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N	yes
GHSA-848j-6mx2-7j84	CVE-2025-14505	medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L	no
GHSA-2pr8-phx7-x9h3	CVE-2026-44294	medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	yes
GHSA-66ff-xgx4-vchm	CVE-2026-44293	high		yes
GHSA-685m-2w69-288q	CVE-2026-44289	high	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	yes
GHSA-75px-5xx7-5xc7	CVE-2026-44291	high	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	yes
GHSA-f38q-mgvj-vph7	CVE-2026-54269	medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	yes
GHSA-fx83-v9x8-x52w	CVE-2026-44292	medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	yes
GHSA-jggg-4jg4-v7c6	CVE-2026-45740	medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	yes
GHSA-jvwf-75h9-cwgg	CVE-2026-44290	high	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	yes
GHSA-q6x5-8v7m-xcrf	CVE-2026-44288	medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	yes
GHSA-wcpc-wj8m-hjx6	CVE-2026-48712	high	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	yes
GHSA-xq3m-2v4x-88gg	CVE-2026-41242	critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	yes

Dependencies 171 packages

171 packages in the resolved dependency tree · 145 deprecated · 55 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 84 exposed · ~4,671 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

li_stake ~60

Stake LI tokens to earn staking rewards. Sends CW-20 LI to the stake contract via litium-core Send.

Input Output Examples

Name	Type	Req	Description
amount	string	yes	Amount of LI to stake (base units)
contract	string	—	litium-stake contract address

No output schema declared.

No examples provided.

li_stake_config ~49

Get litium-stake config: core_contract, mine_contract, token_contract, unbonding_period_seconds, admin, paused

Input Output Examples

Name	Type	Req	Description
contract	string	—	litium-stake contract address

No output schema declared.

No examples provided.

li_stake_info ~64

Get staking state for an address: staked_amount, pending_unbonding, pending_unbonding_until, claimable_rewards

Input Output Examples

Name	Type	Req	Description
address	string	yes	Staker address (bostrom1...)
contract	string	—	litium-stake contract address

No output schema declared.

No examples provided.

li_staking_stats ~37

Get aggregate staking stats: reserve, total_staked, reward_index

Input Output Examples

Name	Type	Req	Description
contract	string	—	litium-stake contract address

No output schema declared.

No examples provided.

li_submit_proof ~154

Submit a lithium mining proof with client-chosen difficulty. Requires challenge (32-byte hex) and difficulty (leading zero bits). First referrer submission also binds the referrer permanently.

Input Output Examples

Name	Type	Req	Description
challenge	string	yes	Challenge (hex, 32 bytes)
contract	string	—	litium-mine contract address
difficulty	number	yes	Difficulty in bits (leading zero bits)
hash	string	yes	Computed hash (hex)
miner_address	string	yes	Miner address (bostrom1...)
nonce	number	yes	Nonce value
referrer	string	—	Referrer address (optional, bound permanently on first proof)
timestamp	number	yes	Timestamp (unix seconds)

No output schema declared.

No examples provided.

li_total_minted ~30

Get total LI minted and supply cap

Input Output Examples

Name	Type	Req	Description
contract	string	—	litium-core contract address

No output schema declared.

No examples provided.

li_total_staked ~33

Get total LI staked across all stakers

Input Output Examples

Name	Type	Req	Description
contract	string	—	litium-stake contract address

No output schema declared.

No examples provided.

li_unstake ~50

Unstake LI tokens. Subject to unbonding period.

Input Output Examples

Name	Type	Req	Description
amount	string	yes	Amount of LI to unstake (base units)
contract	string	—	litium-stake contract address

No output schema declared.

No examples provided.

li_window_status ~44

Get sliding window status: proof_count, window_d_rate, window_entries, base_rate, alpha, beta

Input Output Examples

Name	Type	Req	Description
contract	string	—	litium-mine contract address

No output schema declared.

No examples provided.

liquidity_create_pool ~88

Create a new Gravity DEX liquidity pool. WARNING: costs ~1,000 BOOT. Deposit coins are sorted alphabetically by denom automatically.

Input Output Examples

Name	Type	Req	Description
amount_a	string	yes	First token amount (base units)
amount_b	string	yes	Second token amount (base units)
denom_a	string	yes	First token denom
denom_b	string	yes	Second token denom

No output schema declared.

No examples provided.

liquidity_deposit ~79

Deposit tokens into an existing liquidity pool. Executes in batch at end of block.

Input Output Examples

Name	Type	Req	Description
amount_a	string	yes	First token amount
amount_b	string	yes	Second token amount
denom_a	string	yes	First token denom
denom_b	string	yes	Second token denom
pool_id	number	yes	Pool ID

No output schema declared.

No examples provided.

liquidity_pool_detail ~31

Get pool details: reserves, parameters, current batch info.

Input Output Examples

Name	Type	Req	Description
pool_id	number	yes	Pool ID

No output schema declared.

No examples provided.

liquidity_swap ~120

Swap tokens via a Gravity DEX pool. Batched execution: swap executes at end of block, not immediately. order_price is the limit price (use pool price for market swap).

Input Output Examples

Name	Type	Req	Description
demand_denom	string	yes	Denom you want to receive
offer_amount	string	yes	Amount you are selling (base units)
offer_denom	string	yes	Denom you are selling
order_price	string	yes	Limit price (decimal string, e.g. '1.5')
pool_id	number	yes	Pool ID

No output schema declared.

No examples provided.

liquidity_withdraw ~71

Withdraw LP tokens from a pool to receive underlying assets. Executes in batch at end of block.

Input Output Examples

Name	Type	Req	Description
pool_coin_amount	string	yes	Amount of LP tokens to withdraw
pool_coin_denom	string	yes	LP token denom (pool{id} format)
pool_id	number	yes	Pool ID

No output schema declared.

No examples provided.

swap_estimate ~83

Estimate a token swap: find the pool, get current price, and calculate expected output. Does not execute any transaction — use swap_tokens to execute.

Input Output Examples

Name	Type	Req	Description
demand_denom	string	yes	Denom you want to receive
offer_amount	string	yes	Amount you are selling (base units)
offer_denom	string	yes	Denom you are selling

No output schema declared.

No examples provided.

swap_tokens ~128

Swap tokens using Gravity DEX. Auto-discovers the right pool and calculates market price. Applies slippage tolerance (default 3%). Batched execution: swap executes at end of block. Use swap_estimate first to preview the swap.

Input Output Examples

Name	Type	Req	Description
demand_denom	string	yes	Denom you want to receive
offer_amount	string	yes	Amount you are selling (base units)
offer_denom	string	yes	Denom you are selling (e.g. 'boot', 'hydrogen')
slippage_percent	number	—	Slippage tolerance in percent (default 3)

No output schema declared.

No examples provided.

token_burn ~68

Burn tokens from a specified address. Must be denom admin.

Input Output Examples

Name	Type	Req	Description
amount	string	yes	Amount to burn (base units)
burn_from	string	yes	Address to burn from (bostrom1...)
denom	string	yes	Full denom (factory/{addr}/{subdenom})

No output schema declared.

No examples provided.

token_change_admin ~57

Transfer admin rights for a denom to a new address. Irreversible.

Input Output Examples

Name	Type	Req	Description
denom	string	yes	Full denom (factory/{addr}/{subdenom})
new_admin	string	yes	New admin address (bostrom1...)

No output schema declared.

No examples provided.

token_create ~58

Create a new TokenFactory denom. WARNING: costs ~10,000 BOOT. Denom will be factory/{your_address}/{subdenom}.

Input Output Examples

Name	Type	Req	Description
subdenom	string	yes	Subdenom name (e.g. 'mytoken')

No output schema declared.

No examples provided.

token_list_created ~21

List all TokenFactory denoms created by the agent wallet.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

token_mint ~67

Mint new tokens to a specified address. Must be denom admin.

Input Output Examples

Name	Type	Req	Description
amount	string	yes	Amount to mint (base units)
denom	string	yes	Full denom (factory/{addr}/{subdenom})
mint_to	string	yes	Recipient address (bostrom1...)

No output schema declared.

No examples provided.

token_set_metadata ~110

Set human-readable metadata for a TokenFactory denom (name, symbol, description). Idempotent — safe to call again with updated values.

Input Output Examples

Name	Type	Req	Description
denom	string	yes	Full denom (factory/{addr}/{subdenom})
description	string	yes	Token description
exponent	number	—	Decimal exponent (0 for no decimals, 6 for micro-units)
name	string	yes	Token display name
symbol	string	yes	Token symbol (e.g. 'MYT')

No output schema declared.

No examples provided.

wallet_claim_rewards ~43

Claim staking rewards. If no validator specified, claims from all delegations.

Input Output Examples

Name	Type	Req	Description
validator	string	—	Specific validator to claim from (optional — claims all if omitted)

No output schema declared.

No examples provided.

wallet_delegate ~64

Delegate (stake) tokens to a validator. Delegated tokens earn staking rewards.

Input Output Examples

Name	Type	Req	Description
amount	string	yes	Amount in base units
denom	string	—	Token denom (default: boot)
validator	string	yes	Validator address (bostromvaloper1...)

No output schema declared.

No examples provided.

wallet_info ~30

Get agent wallet address and all token balances. Works only when BOSTROM_MNEMONIC is set.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

wallet_redelegate ~80

Redelegate tokens from one validator to another without unbonding.

Input Output Examples

Name	Type	Req	Description
amount	string	yes	Amount in base units
denom	string	—	Token denom (default: boot)
dst_validator	string	yes	Destination validator (bostromvaloper1...)
src_validator	string	yes	Source validator (bostromvaloper1...)

No output schema declared.

No examples provided.

wallet_send ~89

Send tokens to a recipient address. Requires BOSTROM_MNEMONIC. Subject to BOSTROM_MAX_SEND_AMOUNT circuit breaker if set.

Input Output Examples

Name	Type	Req	Description
amount	string	yes	Amount in base units (e.g. '1000000' for 1 BOOT)
denom	string	—	Token denom (default: boot)
to	string	yes	Recipient address (bostrom1...)

No output schema declared.

No examples provided.

wallet_undelegate ~70

Undelegate (unstake) tokens from a validator. Unbonding takes ~21 days.

Input Output Examples

Name	Type	Req	Description
amount	string	yes	Amount in base units
denom	string	—	Token denom (default: boot)
validator	string	yes	Validator address (bostromvaloper1...)

No output schema declared.

No examples provided.

wallet_vote ~47

Vote on a governance proposal. Options: yes, no, abstain, no_with_veto.

Input Output Examples

Name	Type	Req	Description
option	string	yes	Vote option
proposal_id	number	yes	Proposal ID

No output schema declared.

No examples provided.

wasm_clear_admin ~52

Clear the admin of a CosmWasm contract, making it immutable. WARNING: This is irreversible — no future migrations possible.

Input Output Examples

Name	Type	Req	Description
contract	string	yes	Contract address
memo	string	—	Transaction memo

No output schema declared.

No examples provided.

wasm_instantiate ~122

Instantiate a CosmWasm contract from a code ID. Creates a new contract instance with the given initialization message. Set admin to your address to allow future migrations.

Input Output Examples

Name	Type	Req	Description
admin	string	—	Admin address (for migrations). If omitted, contract is immutable.
code_id	number	yes	Code ID from wasm_upload
funds	array	—	Initial funds to send to the contract
label	string	yes	Human-readable label for the contract
memo	string	—	Transaction memo
msg	object	yes	Instantiation message (JSON)

No output schema declared.

No examples provided.

wasm_migrate ~81

Migrate a CosmWasm contract to a new code ID. Only the contract admin can migrate. Runs the migrate entry point.

Input Output Examples

Name	Type	Req	Description
contract	string	yes	Contract address to migrate
memo	string	—	Transaction memo
msg	object	yes	Migration message (JSON)
new_code_id	number	yes	New code ID to migrate to

No output schema declared.

No examples provided.

wasm_update_admin ~61

Update the admin of a CosmWasm contract. Only the current admin can update it.

Input Output Examples

Name	Type	Req	Description
contract	string	yes	Contract address
memo	string	—	Transaction memo
new_admin	string	yes	New admin address (bostrom1...)

No output schema declared.

No examples provided.

wasm_upload ~72

Upload CosmWasm contract bytecode (.wasm file) to the chain. Returns a code_id for instantiation. Provide a local file path to the .wasm file.

Input Output Examples

Name	Type	Req	Description
file_path	string	yes	Absolute path to the .wasm file on local filesystem
memo	string	—	Transaction memo

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

26 Jul 3 Aug