Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

BagOS

NPM · BAGOS-MCP-SERVER · SCANNED SEP 20

MCP server for Bags on Solana: token analytics, trade quotes, and gated write operations.

Available components

npm · bagos-mcp-server 80
−1 this week 80 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security89
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known high-severity CVE affects axios 1.11.0, reached via @bagsfm/bags-sdk > axios. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • Dependency health was assessed across the 400 of 437 dependencies we could resolve, so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency48
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Build provenance is cryptographically sound, but it attests a different repository to the one declared in the registry. Most often the declared URL is simply stale. View diagnostics → Unverified
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 35 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability80
  • AI-judged instruction clarity (excellent).Pass
  • Tool/resource definitions use about 1193 tokens (~85/item across 14 items; 14 tools + 0 resources), lean.Pass
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management93
  • Stability observed for 28 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "bags_execute_trade" implies "execute" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 14 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the BagOS MCP server?

BagOS runs locally as an npm package, launched with npx -y bagos-mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · bagos-mcp-server

# add to Claude Code
claude mcp add edycutjong-bagos -- npx -y bagos-mcp-server
// .cursor/mcp.json
{
  "mcpServers": {
    "edycutjong-bagos": {
      "command": "npx",
      "args": [
        "-y",
        "bagos-mcp-server"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "edycutjong-bagos": {
      "command": "npx",
      "args": [
        "-y",
        "bagos-mcp-server"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add edycutjong-bagos -- npx -y bagos-mcp-server
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "edycutjong-bagos": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "bagos-mcp-server"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add edycutjong-bagos --command npx --arg -y --arg bagos-mcp-server
# ~/.hermes/config.yaml
mcp_servers:
  edycutjong-bagos:
    command: "npx"
    args: ["-y", "bagos-mcp-server"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "edycutjong-bagos": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "bagos-mcp-server"
      ]
    }
  }
}
# add to Vellum
assistant mcp add edycutjong-bagos -t stdio -c npx -a -y bagos-mcp-server
// mcp.json
{
  "mcpServers": {
    "edycutjong-bagos": {
      "command": "npx",
      "args": [
        "-y",
        "bagos-mcp-server"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 20 Sept 26 0
    • GHSA-5p4m-2wfm-xmqj affects this package: high ▼ security
    • CVE-2025-58754 affects this package: high ▼ security
    • CVE-2026-42040 affects this package: high ▼ security
    • CVE-2026-42043 affects this package: high ▼ security
    • CVE-2026-41907 affects this package: high ▼ security
    • CVE-2026-44496 affects this package: high ▼ security
    • CVE-2026-42037 affects this package: high ▼ security
    • CVE-2026-42042 affects this package: high ▼ security
    • CVE-2026-67312 affects this package: high ▼ security
    • CVE-2026-27903 affects this package: high ▼ security
    • CVE-2026-25639 affects this package: high ▼ security
    • CVE-2026-44488 affects this package: high ▼ security
    • CVE-2026-27904 affects this package: high ▼ security
    • GHSA-5c6j-r48x-rmvq affects this package: high ▼ security
    • CVE-2026-42039 affects this package: high ▼ security
    • CVE-2026-67316 affects this package: high ▼ security
    • CVE-2026-40175 affects this package: high ▼ security
    • CVE-2026-42041 affects this package: high ▼ security
    • CVE-2026-67213 affects this package: high ▼ security
    • CVE-2026-67313 affects this package: high ▼ security
    • CVE-2026-67319 affects this package: high ▼ security
    • CVE-2026-73086 affects this package: high ▼ security
    • CVE-2026-42038 affects this package: high ▼ security
    • GHSA-g7r4-m6w7-qqqr affects this package: high ▼ security
    • CVE-2026-42033 affects this package: high ▼ security
    • CVE-2024-55565 affects this package: high ▼ security
    • CVE-2026-34043 affects this package: high ▼ security
    • CVE-2026-24001 affects this package: high ▼ security
    • CVE-2026-84375 affects this package: high ▼ security
    • CVE-2026-42036 affects this package: high ▼ security
    • CVE-2026-63376 affects this package: high ▼ security
    • CVE-2026-26996 affects this package: high ▼ security
    • CVE-2026-44486 affects this package: high ▼ security
    • CVE-2026-42035 affects this package: high ▼ security
    • CVE-2025-64718 affects this package: high ▼ security
    • CVE-2026-59869 affects this package: high ▼ security
    • CVE-2026-67317 affects this package: high ▼ security
    • CVE-2026-42034 affects this package: high ▼ security
    • CVE-2026-44494 affects this package: high ▼ security
    • CVE-2026-42044 affects this package: high ▼ security
    • CVE-2026-12143 affects this package: high ▼ security
    • CVE-2026-42264 affects this package: high ▼ security
    • CVE-2026-53550 affects this package: high ▼ security
    • CVE-2026-44495 affects this package: high ▼ security
    • CVE-2025-62718 affects this package: high ▼ security
    • CVE-2026-71429 affects this package: high ▼ security
    • CVE-2026-67214 affects this package: high ▼ security
    • CVE-2026-77465 affects this package: high ▼ security
    • CVE-2026-44487 affects this package: high ▼ security
    • CVE-2026-44490 affects this package: high ▼ security
    • CVE-2024-11831 affects this package: high ▼ security
  • 19 Sept 26 +1
    • CVE-2026-44494 affects this package: high ▼ security
    • CVE-2025-58754 affects this package: high ▼ security
    • CVE-2026-42040 affects this package: high ▼ security
    • CVE-2026-42043 affects this package: high ▼ security
    • CVE-2026-41907 affects this package: high ▼ security
    • CVE-2026-44496 affects this package: high ▼ security
    • CVE-2026-42037 affects this package: high ▼ security
    • CVE-2026-42042 affects this package: high ▼ security
    • CVE-2026-67312 affects this package: high ▼ security
    • CVE-2026-27903 affects this package: high ▼ security
    • CVE-2026-25639 affects this package: high ▼ security
    • CVE-2026-44488 affects this package: high ▼ security
    • CVE-2026-27904 affects this package: high ▼ security
    • GHSA-5c6j-r48x-rmvq affects this package: high ▼ security
    • CVE-2026-42039 affects this package: high ▼ security
    • CVE-2026-67316 affects this package: high ▼ security
    • CVE-2026-40175 affects this package: high ▼ security
    • CVE-2026-42041 affects this package: high ▼ security
    • CVE-2026-67213 affects this package: high ▼ security
    • CVE-2026-67313 affects this package: high ▼ security
    • CVE-2026-67319 affects this package: high ▼ security
    • CVE-2026-73086 affects this package: high ▼ security
    • CVE-2026-42038 affects this package: high ▼ security
    • GHSA-g7r4-m6w7-qqqr affects this package: high ▼ security
    • CVE-2026-42033 affects this package: high ▼ security
    • CVE-2024-55565 affects this package: high ▼ security
    • CVE-2026-34043 affects this package: high ▼ security
    • CVE-2026-24001 affects this package: high ▼ security
    • CVE-2026-84375 affects this package: high ▼ security
    • CVE-2026-42036 affects this package: high ▼ security
    • CVE-2026-63376 affects this package: high ▼ security
    • CVE-2026-26996 affects this package: high ▼ security
    • CVE-2026-44486 affects this package: high ▼ security
    • CVE-2026-42035 affects this package: high ▼ security
    • CVE-2025-64718 affects this package: high ▼ security
    • CVE-2026-59869 affects this package: high ▼ security
    • CVE-2026-67317 affects this package: high ▼ security
    • CVE-2026-42034 affects this package: high ▼ security
    • CVE-2026-42044 affects this package: high ▼ security
    • CVE-2026-12143 affects this package: high ▼ security
    • CVE-2026-42264 affects this package: high ▼ security
    • CVE-2026-53550 affects this package: high ▼ security
    • CVE-2026-44495 affects this package: high ▼ security
    • CVE-2025-62718 affects this package: high ▼ security
    • CVE-2026-71429 affects this package: high ▼ security
    • CVE-2026-67214 affects this package: high ▼ security
    • CVE-2026-77465 affects this package: high ▼ security
    • CVE-2026-44487 affects this package: high ▼ security
    • CVE-2026-44490 affects this package: high ▼ security
    • CVE-2024-11831 affects this package: high ▼ security
    • GHSA-5p4m-2wfm-xmqj affects this package: high ▼ security
  • 18 Sept 26 0
    • CVE-2025-58754 affects this package: high ▼ security
    • CVE-2026-42040 affects this package: high ▼ security
    • CVE-2026-42043 affects this package: high ▼ security
    • CVE-2026-41907 affects this package: high ▼ security
    • CVE-2026-44496 affects this package: high ▼ security
    • CVE-2026-42037 affects this package: high ▼ security
    • CVE-2026-42042 affects this package: high ▼ security
    • CVE-2026-67312 affects this package: high ▼ security
    • CVE-2026-27903 affects this package: high ▼ security
    • CVE-2026-25639 affects this package: high ▼ security
    • CVE-2026-44488 affects this package: high ▼ security
    • CVE-2026-27904 affects this package: high ▼ security
    • GHSA-5c6j-r48x-rmvq affects this package: high ▼ security
    • CVE-2026-42039 affects this package: high ▼ security
    • CVE-2026-67316 affects this package: high ▼ security
    • CVE-2026-40175 affects this package: high ▼ security
    • CVE-2026-42041 affects this package: high ▼ security
    • CVE-2026-67213 affects this package: high ▼ security
    • CVE-2026-67313 affects this package: high ▼ security
    • CVE-2026-67319 affects this package: high ▼ security
    • CVE-2026-73086 affects this package: high ▼ security
    • CVE-2026-42038 affects this package: high ▼ security
    • GHSA-g7r4-m6w7-qqqr affects this package: high ▼ security
    • CVE-2026-42033 affects this package: high ▼ security
    • CVE-2024-55565 affects this package: high ▼ security
    • CVE-2026-34043 affects this package: high ▼ security
    • CVE-2026-24001 affects this package: high ▼ security
    • CVE-2026-84375 affects this package: high ▼ security
    • CVE-2026-42036 affects this package: high ▼ security
    • CVE-2026-63376 affects this package: high ▼ security
    • CVE-2026-26996 affects this package: high ▼ security
    • CVE-2026-44486 affects this package: high ▼ security
    • CVE-2026-42035 affects this package: high ▼ security
    • CVE-2024-11831 affects this package: high ▼ security
    • CVE-2025-64718 affects this package: high ▼ security
    • CVE-2026-59869 affects this package: high ▼ security
    • CVE-2026-67317 affects this package: high ▼ security
    • CVE-2026-42034 affects this package: high ▼ security
    • CVE-2026-44494 affects this package: high ▼ security
    • CVE-2026-42044 affects this package: high ▼ security
    • CVE-2026-12143 affects this package: high ▼ security
    • CVE-2026-42264 affects this package: high ▼ security
    • CVE-2026-53550 affects this package: high ▼ security
    • CVE-2026-44495 affects this package: high ▼ security
    • CVE-2025-62718 affects this package: high ▼ security
    • CVE-2026-71429 affects this package: high ▼ security
    • CVE-2026-67214 affects this package: high ▼ security
    • CVE-2026-77465 affects this package: high ▼ security
    • CVE-2026-44487 affects this package: high ▼ security
    • CVE-2026-44490 affects this package: high ▼ security
    • GHSA-5p4m-2wfm-xmqj affects this package: high ▼ security
  • 17 Sept 26 +1

    We did not load change detail this far back for this component, so this day may have recorded more than is shown.

    • CVE-2026-67213 affects this package: high ▼ security
    • CVE-2024-11831 affects this package: high ▼ security
    • CVE-2026-44490 affects this package: high ▼ security
    • CVE-2026-44487 affects this package: high ▼ security
    • CVE-2026-77465 affects this package: high ▼ security
    • CVE-2026-67214 affects this package: high ▼ security
    • CVE-2026-71429 affects this package: high ▼ security
    • CVE-2025-62718 affects this package: high ▼ security
    • CVE-2026-44495 affects this package: high ▼ security
    • CVE-2026-53550 affects this package: high ▼ security
    • CVE-2026-42264 affects this package: high ▼ security
    • CVE-2026-12143 affects this package: high ▼ security
    • CVE-2026-42044 affects this package: high ▼ security
    • CVE-2026-44494 affects this package: high ▼ security
    • CVE-2026-42034 affects this package: high ▼ security
    • CVE-2026-67317 affects this package: high ▼ security
    • CVE-2026-59869 affects this package: high ▼ security
    • CVE-2025-64718 affects this package: high ▼ security
    • CVE-2026-42035 affects this package: high ▼ security
    • CVE-2026-44486 affects this package: high ▼ security
    • CVE-2026-26996 affects this package: high ▼ security
    • CVE-2026-63376 affects this package: high ▼ security
    • CVE-2026-42036 affects this package: high ▼ security
    • CVE-2026-84375 affects this package: high ▼ security
    • CVE-2026-24001 affects this package: high ▼ security
    • CVE-2026-34043 affects this package: high ▼ security
    • CVE-2024-55565 affects this package: high ▼ security
    • CVE-2026-42033 affects this package: high ▼ security
    • GHSA-g7r4-m6w7-qqqr affects this package: high ▼ security
    • CVE-2026-42038 affects this package: high ▼ security
    • CVE-2026-73086 affects this package: high ▼ security
    • CVE-2026-67319 affects this package: high ▼ security
    • CVE-2026-67313 affects this package: high ▼ security
    • CVE-2026-42041 affects this package: high ▼ security
    • CVE-2026-40175 affects this package: high ▼ security
    • CVE-2026-67316 affects this package: high ▼ security
    • CVE-2026-42039 affects this package: high ▼ security
    • GHSA-5c6j-r48x-rmvq affects this package: high ▼ security
    • CVE-2026-27904 affects this package: high ▼ security
    • CVE-2026-44488 affects this package: high ▼ security
    • CVE-2026-25639 affects this package: high ▼ security
    • CVE-2026-27903 affects this package: high ▼ security
    • CVE-2026-67312 affects this package: high ▼ security
    • CVE-2026-42042 affects this package: high ▼ security
    • CVE-2026-42037 affects this package: high ▼ security
  • 16 Sept 26 −3

    We did not load change detail this far back for this component, so this day may have recorded more than is shown.

  • 13 Sept 26 +1

    We did not load change detail this far back for this component, so this day may have recorded more than is shown.

  • 11 Sept 26 +1

    We did not load change detail this far back for this component, so this day may have recorded more than is shown.

  • 9 Sept 26 +1

    We did not load change detail this far back for this component, so this day may have recorded more than is shown.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed npm/bagos-mcp-server@2.6.0

Provenance Repository mismatch

The attestation is cryptographically sound but binds a different repository to the one the registry declares. Most often the declared URL is simply stale.

Result Repository mismatch
Ecosystem npm
Reason Repository mismatch
Discovered via Registry attestation endpoint
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/edycutjong/BagOS/.github/workflows/publish.yml@refs/heads/main
Rekor log index 2483579068
Predicate type https://slsa.dev/provenance/v1
Subject digest sha512:19dd57933715d0ee67a7a809f82e0f39acd0eb0dcbb11bd2141ed4c9fbc38a1c9991be4117dad5935ad49b4a6c5954212a92b8a3faea8a35782410388

Background: How many MCP packages publish verified provenance →

Vulnerabilities 52 findings
ID CVE Severity Vector Fix available
GHSA-35jp-ww65-95wh CVE-2026-44494 high CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N yes
GHSA-3g43-6gmg-66jw CVE-2026-44495 high CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L yes
GHSA-3p68-rc4w-qgx5 CVE-2025-62718 medium CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N yes
GHSA-3w6x-2g7m-8v23 CVE-2026-42044 medium CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N yes
GHSA-42h9-826w-cgv3 CVE-2026-67313 medium yes
GHSA-43fc-jf86-j433 CVE-2026-25639 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes
GHSA-445q-vr5w-6q77 CVE-2026-42037 medium CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N yes
GHSA-4hjh-wcwx-xvwj CVE-2025-58754 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes
GHSA-5c9x-8gcm-mpgx CVE-2026-42034 medium CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L yes
GHSA-62hf-57xw-28j9 CVE-2026-42039 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes
GHSA-6chq-wfr3-2hj9 CVE-2026-42035 high CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N yes
GHSA-777c-7fjr-54vf CVE-2026-44488 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes
GHSA-7q8q-rj6j-mhjq CVE-2026-67319 medium yes
GHSA-898c-q2cr-xwhg CVE-2026-44490 medium CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L yes
GHSA-fvcv-3m26-pcqx CVE-2026-40175 medium CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N yes
GHSA-hfxv-24rg-xrqf CVE-2026-44496 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes
GHSA-j5f8-grm9-p9fc CVE-2026-44486 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N yes
GHSA-jqh4-m9w3-8hp9 CVE-2026-67317 medium yes
GHSA-m7pr-hjqh-92cm CVE-2026-42038 medium CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N yes
GHSA-mmx7-hfxf-jppx CVE-2026-67316 medium yes
GHSA-p92q-9vqr-4j8v CVE-2026-44487 high yes
GHSA-pf86-5x62-jrwf CVE-2026-42033 high CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N yes
GHSA-pmv8-rq9r-6j72 CVE-2026-67312 medium yes
GHSA-pmwg-cvhr-8vh7 CVE-2026-42043 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N yes
GHSA-q8qp-cvcw-x6jj CVE-2026-42264 high CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N yes
GHSA-vf2m-468p-8v99 CVE-2026-42036 medium CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L yes
GHSA-w9j2-pvgh-6h63 CVE-2026-42041 medium CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N yes
GHSA-xhjh-pmcv-23jw CVE-2026-42040 low CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N yes
GHSA-xx6v-rp6x-q39c CVE-2026-42042 medium CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N yes
GHSA-3gc7-fjrx-p6mg CVE-2025-3194 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H no
GHSA-73rr-hh4g-fpgx CVE-2026-24001 low yes
GHSA-g7r4-m6w7-qqqr low CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N yes
GHSA-hmw2-7cc7-3qxx CVE-2026-12143 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N yes
GHSA-2883-xcg3-v3hh CVE-2026-84375 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes
GHSA-52cp-r559-cp3m CVE-2026-59869 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes
GHSA-5p4m-2wfm-xmqj high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes
GHSA-h67p-54hq-rp68 CVE-2026-53550 medium CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L yes
GHSA-mh29-5h37-fv8m CVE-2025-64718 medium CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N yes
GHSA-23c5-xmqv-rm74 CVE-2026-27904 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes
GHSA-3ppc-4f35-3m26 CVE-2026-26996 high yes
GHSA-7r86-cg39-jmmj CVE-2026-27903 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes
GHSA-28wg-ghj8-5hjv CVE-2026-67214 medium CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H yes
GHSA-2v37-7h3g-55p8 CVE-2026-67213 medium CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H yes
GHSA-mwcw-c2x4-8c55 CVE-2024-55565 medium CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N yes
GHSA-xwg4-73v4-xw9w CVE-2026-73086 high CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N yes
GHSA-5c6j-r48x-rmvq high CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H yes
GHSA-76p7-773f-r4q5 CVE-2024-11831 medium CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N yes
GHSA-qj8w-gfj5-8c6v CVE-2026-34043 medium CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H yes
GHSA-528h-pc64-c93x CVE-2026-71429 medium CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes
GHSA-82x6-q7mm-w9cf CVE-2026-77465 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes

Showing 50 of 52 vulnerabilities.

Background: What a vulnerability scan can and cannot prove →

Dependencies 400 packages
Packages resolved 400
Deprecated 4
Stale 118
No linked repository 12
Tree resolution Partial

The dependency tree was only partially resolved, so these counts may be incomplete.

Background: SBOMs and build attestations, explained →

MCP tools · 14 exposed · ~1,193 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
bags_authenticate ~60

Authenticate with Bags API utilizing the V2 signature challenge flow. Automatically loads local wallet.

NameTypeReqDescription
privateKeyPathstring–Optional path to the wallet keypair. Defaults to ~/.config/bags/keypair.json or BAGS_KEYPAIR_PATH env var.

No output schema declared.

No examples provided.

bags_claim_fees ~100

GATED WRITE: Claim pending creator/LP fees for the given token mints. Requires $BOS. Two-step: the first call previews and returns a confirmation token; call again with it to sign and submit. Returns confirmed on-chain signatures.

NameTypeReqDescription
confirmstring–Confirmation token from the preview call. Omit on the first call.
tokenMintsarrayyesToken mint addresses to claim fees for (max 10).

No output schema declared.

No examples provided.

bags_execute_trade ~225

GATED WRITE: Swap tokens on Bags pools. Requires $BOS. Two-step: the first call returns a preview and a confirmation token; call again with that token to sign and submit. Returns a confirmed on-chain signature. SOL mint: So11111111111111111111111111111111111111112.

NameTypeReqDescription
amountnumber–Amount of the input token, human-readable (e.g. 0.1 SOL). Default: 0.1
confirmstring–Confirmation token from the preview call. Omit on the first call.
inputMintstring–Input token mint. Defaults to SOL: So11111111111111111111111111111111111111112
outputMintstring–Output token mint. Defaults to BOS: EkJuyYyD3to61CHVPJn6wHb7xANxvqApnVJ4o2SdBAGS
slippageBpsinteger–Allowed slippage in basis points. Default 300 (3%).

No output schema declared.

No examples provided.

bags_get_claimable_fees ~51

Query all claimable creator/LP fees for a wallet. Free read-only tier.

NameTypeReqDescription
walletAddressstring–Wallet address to check. Defaults to the local keypair wallet if omitted.

No output schema declared.

No examples provided.

bags_get_creators ~53

Query top creators by lifetime fees on Bags. Free read-only tier.

NameTypeReqDescription
limitnumber–Amount of creators to return (default 10)
offsetnumber–Pagination offset (default 0)

No output schema declared.

No examples provided.

bags_get_partner_stats ~38

View partner referral earnings for the configured wallet. Free read-only tier.

NameTypeReqDescription
partnerIdstringyesThe partner's public key address

No output schema declared.

No examples provided.

bags_get_token_analytics ~45

Get pool info, claim stats, and bonding curve progress for a token. Free read-only tier.

NameTypeReqDescription
tokenMintstringyesThe token mint address to analyze

No output schema declared.

No examples provided.

bags_get_token_claim_events ~94

Get the fee-claim audit trail for a token: who claimed, how much, when, and the transaction signature. Paginated via limit/offset. Free read-only tier.

NameTypeReqDescription
limitinteger–Maximum number of events to return (default 100)
offsetinteger–Pagination offset (default 0)
tokenMintstringyesThe token mint address to get claim events for

No output schema declared.

No examples provided.

bags_get_token_claim_stats ~56

Get per-creator claim totals for a token: each fee-share creator with their royalty split and total claimed amount. Free read-only tier.

NameTypeReqDescription
tokenMintstringyesThe token mint address to get claim stats for

No output schema declared.

No examples provided.

bags_get_token_creators ~59

Get the royalty split for a token: every creator sharing its fees, their wallet, social provider, and share in basis points. Free read-only tier.

NameTypeReqDescription
tokenMintstringyesThe token mint address to look up creators for

No output schema declared.

No examples provided.

bags_get_trade_quote ~207

Get a swap quote to trade SOL and any Bags ecosystem token. Free read-only tier. SOL mint: So11111111111111111111111111111111111111112. Default BOS token mint: EkJuyYyD3to61CHVPJn6wHb7xANxvqApnVJ4o2SdBAGS.

NameTypeReqDescription
amountnumberyesAmount of input token to swap in human-readable units (e.g., 0.1 for 0.1 SOL).
inputMintstring–Input token mint address. Defaults to SOL: So11111111111111111111111111111111111111112
outputMintstring–Output token mint address. Defaults to BOS: EkJuyYyD3to61CHVPJn6wHb7xANxvqApnVJ4o2SdBAGS
sidestringyesIs this a buy or sell action?

No output schema declared.

No examples provided.

bags_heartbeat ~29

Periodic health check combining basic node status with an earnings/balance summary. Free read-only tier.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

bags_prepare_token_metadata ~105

GATED: Create token info and metadata on Bags, returning the reserved mint address and metadata URL. Requires $BOS. This PREPARES a launch — it does not launch the token and does not send an on-chain transaction.

NameTypeReqDescription
descriptionstringyesDescription for the token
imageUrlstring–URL of the token image
namestringyesThe full name of the new token
symbolstringyesThe ticker symbol

No output schema declared.

No examples provided.

bags_resolve_launch_wallet ~71

Resolve a social handle (twitter, tiktok, kick, or github) to its Bags fee-share launch wallet. Free read-only tier.

NameTypeReqDescription
providerstringyesThe social platform the username belongs to
usernamestringyesThe username to resolve (a leading @ is stripped automatically)

No output schema declared.

No examples provided.

Common questions

What is the BagOS MCP server?

BagOS is an MCP server listed in the public MCP registry as io.github.edycutjong/bagos. MCP server for Bags on Solana: token analytics, trade quotes, and gated write operations. This page covers its npm package (bagos-mcp-server).

Is the BagOS MCP server safe to use?

BagOS scores 80 out of 100 on VerifyMCP. We recorded 52 known advisories against it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the BagOS MCP server expose?

BagOS exposes 14 tools: bags_authenticate, bags_claim_fees, bags_execute_trade, bags_get_claimable_fees, bags_get_creators, and 9 more. Their descriptions and schemas cost roughly 1,193 tokens of context every time the server is loaded.

Is the BagOS MCP server still maintained?

BagOS is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the BagOS MCP server under?

BagOS declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.