# MERX - TRON Resource Exchange (npm · merx-mcp)

TRON energy exchange for AI agents. 54 tools, 30 prompts, 21 resources. A2A + ACP.

- Trust score: 68/100 (medium)
- Change this week: +15
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `merx.exchange`: 67/100, [markdown](https://verifymcp.io/servers/exchange-merx-mcp/merx.md), [page](https://verifymcp.io/servers/exchange-merx-mcp/merx)
- npm · `merx-mcp`: 68/100 (this document), [markdown](https://verifymcp.io/servers/exchange-merx-mcp/merx-mcp.md), [page](https://verifymcp.io/servers/exchange-merx-mcp/merx-mcp)

## Channel facts

- Registry: `npm`
- Package: `merx-mcp`
- Version: `1.0.5`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 91/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known high-severity CVE affects ws 8.17.1, reached via tronweb > ethers > ws. A fixed version is available.
  - No install/post-install scripts declared.
  - 7 of 53 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 116 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 82/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 3537 tokens (~52/item across 68 items; 54 tools + 14 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 20/100
  - Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add exchange-merx-mcp -- npx -y merx-mcp
```

### Codex

```bash
codex mcp add exchange-merx-mcp -- npx -y merx-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "exchange-merx-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "merx-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add exchange-merx-mcp --command npx --arg -y --arg merx-mcp
```

### Hermes

```yaml
mcp_servers:
  exchange-merx-mcp:
    command: "npx"
    args: ["-y", "merx-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "exchange-merx-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "merx-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 68, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 67, +62)

- [security regression] CVE-2026-48779 affects this package: high
- [security regression] CVE-2026-45736 affects this package: high
- [security regression] Provenance: unverified → fail
- [security regression] Known CVEs: unverified → fail
- [security improvement] Malware scan: unverified → pass
- [security improvement] Install scripts: unverified → pass
- [functional regression] MCP protocol: unverified → fail
- [functional improvement] Schema quality: unverified → good
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → 0.95
- [functional improvement] Schema quality: unverified → 100
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] Tool coverage: unverified → 100
- [functional] Licence: MIT

### 2026-08-01 (score 5, −21)

- [functional regression] Schema quality: 100 → unverified
- [functional regression] Tool coverage: 100 → unverified

### 2026-07-31 (score 26, +17)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 9, −15)

- [security regression] Malware scan: pass → unverified
- [functional improvement] Dependency health: unverified → partial

### 2026-07-28 (score 24, −29)

- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified

### 2026-07-27 (score 53)

First indexed and scored.

## MCP tools (54)

### `get_prices` (~52 tokens)

Get current energy and bandwidth prices from all Merx providers. No auth required.

Input parameters:

- `duration` (number): Filter by duration in seconds.
- `resource` (string): Filter by resource type. Omit for all.

### `get_best_price` (~45 tokens)

Find the cheapest provider for a given resource and amount. No auth required.

Input parameters:

- `amount` (number): Amount of resource units needed.
- `resource` (string, required): Resource type.

### `analyze_prices` (~36 tokens)

Market price analysis with trends and recommendations. No auth required.

Input parameters:

- `resource` (string): Filter by resource type. Omit for all.

### `get_price_history` (~54 tokens)

Historical price snapshots. No auth required.

Input parameters:

- `period` (string): Time period (default: 24h).
- `provider` (string): Filter by provider name.
- `resource` (string): Filter by resource type.

### `compare_providers` (~39 tokens)

Side-by-side provider comparison with prices and availability. No auth required.

Input parameters:

- `resource` (string): Filter by resource type. Omit for all.

### `estimate_transaction_cost` (~126 tokens)

Estimate energy and bandwidth cost for a TRON transaction. Compares rental vs burn cost. No auth required.

Input parameters:

- `amount` (string): Token amount (as string).
- `contract_address` (string): Contract address (custom).
- `from_address` (string): Sender TRON address.
- `function_selector` (string): Function selector (custom).
- `operation` (string, required): Transaction type.
- `parameter` (string): ABI-encoded parameter (custom).
- `to_address` (string): Recipient TRON address.
- `token_address` (string): TRC20 contract address.

### `check_address_resources` (~42 tokens)

Check energy, bandwidth, and TRX balance for any TRON address. No auth required.

Input parameters:

- `address` (string, required): TRON address (starts with T).

### `create_order` (~130 tokens)

Buy energy or bandwidth on Merx. Routed to cheapest provider. Auth required.

Input parameters:

- `amount` (number, required): Amount of resource units (min 65000 for ENERGY, 300 for BANDWIDTH).
- `duration_sec` (number, required): Rental duration in seconds (e.g. 300, 3600, 86400, 2592000).
- `max_price_sun` (number): Optional max price in SUN/unit. Order fails if no provider is cheaper.
- `resource_type` (string, required): Resource type to purchase.
- `target_address` (string, required): TRON address to receive delegated resources.

### `get_order` (~31 tokens)

Get order details and fill status by ID. Auth required.

Input parameters:

- `order_id` (string, required): The order UUID.

### `list_orders` (~48 tokens)

List recent orders with optional status filter. Auth required.

Input parameters:

- `limit` (number): Max number of orders to return (default: 20).
- `status` (string): Filter by order status.

### `ensure_resources` (~92 tokens)

Declarative resource provisioning. Checks current resources on target address and purchases only what is missing. Auth required.

Input parameters:

- `bandwidth_minimum` (number): Minimum bandwidth the address should have.
- `duration_sec` (number): Rental duration in seconds (default: 3600).
- `energy_minimum` (number): Minimum energy the address should have.
- `target_address` (string, required): TRON address to provision resources for.

### `get_balance` (~29 tokens)

Get your Merx account balance (TRX, USDT, locked). Requires MERX_API_KEY.

### `get_deposit_info` (~25 tokens)

Get your Merx deposit address and memo. Requires MERX_API_KEY.

### `get_transaction_history` (~40 tokens)

Get your Merx account transaction history. Requires MERX_API_KEY.

Input parameters:

- `period` (string): Time period to query. Default: 30D.

### `explain_concept` (~54 tokens)

Explain a TRON or Merx concept. No authentication required.

Input parameters:

- `topic` (string, required): Topic: energy, bandwidth, staking, delegation, sun_units, burn_vs_rent, merx_routing, provider_types

### `suggest_duration` (~48 tokens)

Recommend a rental duration based on your use case. No authentication required.

Input parameters:

- `transaction_count` (number): Expected number of transactions (optional).
- `use_case` (string, required): Your intended use case.

### `calculate_savings` (~55 tokens)

Calculate savings from renting energy vs burning TRX. No authentication required.

Input parameters:

- `operation` (string): Operation type. Default: trc20_transfer.
- `transaction_count` (number): Number of transactions. Default: 1.

### `list_providers` (~26 tokens)

List all Merx providers with types, durations, and availability. No authentication required.

### `get_account_info` (~43 tokens)

Full on-chain account state: TRX balance, energy, bandwidth, creation date. No auth required.

Input parameters:

- `address` (string, required): TRON address (T...).

### `get_trx_balance` (~37 tokens)

Quick TRX balance for a TRON address. No auth required.

Input parameters:

- `address` (string, required): TRON address (T...).

### `get_trc20_balance` (~70 tokens)

Get TRC-20 token balance for an address. Supports symbol (USDT, USDC) or contract address. No auth required.

Input parameters:

- `address` (string, required): TRON address to query.
- `token` (string, required): Token symbol (USDT, USDC) or contract address.

### `get_transaction` (~34 tokens)

Look up a transaction by ID on TRON. No auth required.

Input parameters:

- `tx_id` (string, required): Transaction ID (hash).

### `get_block` (~40 tokens)

Get TRON block info by number (or latest if omitted). No auth required.

Input parameters:

- `block_number` (number): Block number. Omit for latest.

### `get_chain_parameters` (~33 tokens)

Get TRON network parameters (energy fee, bandwidth cost, etc.) with Merx price comparison. No auth required.

### `convert_address` (~50 tokens)

Convert TRON address between base58 (T...) and hex (41...) formats. No auth required.

Input parameters:

- `address` (string, required): TRON address in base58 (T...) or hex (41...).

### `get_trx_price` (~38 tokens)

Get current TRX price from CoinGecko. No auth required.

Input parameters:

- `currency` (string): Fiat currency code (default: usd).

### `validate_address` (~36 tokens)

Validate a TRON address format and check on-chain status. No auth required.

Input parameters:

- `address` (string, required): TRON address to validate.

### `search_transaction_history` (~62 tokens)

Get on-chain transaction history for a TRON address. No auth required.

Input parameters:

- `address` (string, required): TRON address.
- `limit` (number): Max results (default: 20).
- `type` (string): Transaction type filter (default: all).

### `transfer_trx` (~65 tokens)

Send TRX to an address. Checks bandwidth, buys via Merx if needed. Signs and broadcasts on-chain. Requires TRON_PRIVATE_KEY.

Input parameters:

- `amount_trx` (string, required): Amount of TRX to send.
- `to_address` (string, required): Recipient TRON address.

### `transfer_trc20` (~77 tokens)

Transfer TRC-20 tokens with automatic energy optimization. Signs and broadcasts on-chain. Requires TRON_PRIVATE_KEY.

Input parameters:

- `amount` (string, required): Amount to transfer (human-readable).
- `to_address` (string, required): Recipient TRON address.
- `token` (string, required): Token symbol (USDT, USDC) or contract address.

### `approve_trc20` (~73 tokens)

Approve TRC-20 spending allowance. Signs and broadcasts on-chain. Requires TRON_PRIVATE_KEY.

Input parameters:

- `amount` (string, required): Allowance amount (human-readable, or "unlimited").
- `spender` (string, required): Spender TRON address.
- `token` (string, required): Token symbol or contract address.

### `get_token_info` (~42 tokens)

Get TRC-20 token metadata: name, symbol, decimals, total supply. No auth required.

Input parameters:

- `token` (string, required): Token symbol or contract address.

### `read_contract` (~73 tokens)

Call a view/pure function on a TRON smart contract. No auth or private key required.

Input parameters:

- `contract_address` (string, required): Contract TRON address.
- `function_selector` (string, required): Function signature, e.g. "balanceOf(address)".
- `parameter` (string): ABI-encoded parameter hex (optional).

### `estimate_contract_call` (~93 tokens)

Estimate energy and bandwidth cost for a smart contract call. Compares rental vs burn cost. No auth required.

Input parameters:

- `caller_address` (string): Caller TRON address for simulation (optional).
- `contract_address` (string, required): Contract TRON address.
- `function_selector` (string, required): Function signature, e.g. "transfer(address,uint256)".
- `parameter` (string): ABI-encoded parameter hex (optional).

### `call_contract` (~99 tokens)

Execute a state-changing smart contract function. Estimates resources, buys via Merx if needed. Requires TRON_PRIVATE_KEY and TRON_ADDRESS.

Input parameters:

- `call_value_trx` (string): TRX to send with call (optional).
- `contract_address` (string, required): Contract TRON address.
- `function_selector` (string, required): Function signature, e.g. "stake(uint256)".
- `parameter` (string): ABI-encoded parameter hex (optional).

### `get_swap_quote` (~87 tokens)

Get a real swap quote from SunSwap V2. No auth required.

Input parameters:

- `amount` (string, required): Amount of source token to swap
- `from_token` (string, required): Source token symbol (TRX, USDT, USDC, etc.)
- `slippage` (number): Slippage tolerance in percent (default 1)
- `to_token` (string, required): Destination token symbol

### `execute_swap` (~87 tokens)

Execute a token swap on SunSwap V2. Requires TRON_PRIVATE_KEY.

Input parameters:

- `amount` (string, required): Amount of source token to swap
- `from_token` (string, required): Source token symbol (TRX, USDT, USDC, etc.)
- `slippage` (number): Slippage tolerance in percent (default 1)
- `to_token` (string, required): Destination token symbol

### `get_token_price` (~46 tokens)

Get token price via SunSwap quote + CoinGecko USD rate. No auth required.

Input parameters:

- `token` (string, required): Token symbol (USDT, USDC, SUN, etc.)

### `create_account` (~54 tokens)

Create a new Merx account, generate an API key, and get deposit info. No auth needed.

Input parameters:

- `email` (string, required): Email address for the account
- `password` (string, required): Password (min 8 characters)

### `login` (~40 tokens)

Log in to an existing Merx account. No MERX_API_KEY needed.

Input parameters:

- `email` (string, required): Email address
- `password` (string, required): Password

### `set_api_key` (~60 tokens)

Set your Merx API key for this session. Unlocks all authenticated tools (trading, balance, orders). Use this if you already have an API key.

Input parameters:

- `api_key` (string, required): Your Merx API key (starts with sk_live_)

### `set_private_key` (~77 tokens)

Set your TRON private key for this session. Address is derived automatically. Enables write tools: transfer_trx, transfer_trc20, approve_trc20, execute_swap, deposit_trx. Key stays local - never sent to Merx servers.

Input parameters:

- `private_key` (string, required): Your TRON private key (64 hex characters)

### `deposit_trx` (~44 tokens)

Deposit TRX to your Merx account. Requires MERX_API_KEY + TRON_PRIVATE_KEY.

Input parameters:

- `amount_trx` (string, required): Amount of TRX to deposit

### `enable_auto_deposit` (~73 tokens)

Configure automatic top-up when balance drops below a threshold. Session-only.

Input parameters:

- `deposit_amount_trx` (string, required): Amount of TRX per deposit
- `max_daily_deposits` (number): Max deposits per day (default 5)
- `threshold_trx` (string, required): Balance threshold in TRX

### `pay_invoice` (~33 tokens)

Pay an x402 invoice by sending TRX and verifying payment.

Input parameters:

- `invoice_id` (string, required): Invoice ID to pay

### `create_paid_order` (~73 tokens)

Create a zero-registration order via x402 pay-per-use. Requires TRON_PRIVATE_KEY.

Input parameters:

- `amount` (number, required): Amount of resource units
- `duration_sec` (number, required): Duration in seconds
- `resource_type` (string, required): Resource type
- `target_address` (string, required): TRON address to receive resources

### `execute_intent` (~92 tokens)

Execute a multi-step operation (transfer, swap, buy resources, etc). Validates and simulates all steps with resource cost estimates. Auth required.

Input parameters:

- `dry_run` (boolean): If true, simulate only without executing (default: false).
- `resource_strategy` (string): Resource acquisition strategy (default: batch_cheapest).
- `steps` (array, required): Array of { action, params } steps to execute.

### `simulate` (~56 tokens)

Simulate a multi-step operation without executing. Returns resource estimates and costs.

Input parameters:

- `resource_strategy` (string): Resource acquisition strategy (default: batch_cheapest).
- `steps` (array, required): Array of { action, params } steps to simulate.

### `create_standing_order` (~148 tokens)

Create a server-side standing order with trigger-based automation. Auth required.

Input parameters:

- `action_params` (object, required): Action parameters: { resource_type, amount, duration_sec, target_address }.
- `action_type` (string, required): Action to perform when triggered.
- `budget_trx` (string, required): Maximum budget in TRX (converted to SUN internally).
- `expires_at` (string): ISO 8601 expiration date (optional).
- `max_executions` (number, required): Maximum number of times this order can execute.
- `trigger_params` (object, required): Trigger parameters: { resource, threshold_sun } or { cron }.
- `trigger_type` (string, required): Condition that triggers the order.

### `list_standing_orders` (~32 tokens)

List all standing orders with optional status filter. Auth required.

Input parameters:

- `status` (string): Filter by status.

### `create_monitor` (~103 tokens)

Create a persistent monitor (delegation expiry, balance, price alert). Auth required.

Input parameters:

- `monitor_type` (string, required): Type of monitor to create.
- `notify` (object, required): Notification config: { webhook, telegram_chat_id }.
- `params` (object, required): Monitor params: { alert_before_sec, auto_renew, resource_type, max_price_sun, duration_sec }.
- `target_address` (string): TRON address to monitor (for delegation_expiry).

### `list_monitors` (~31 tokens)

List all monitors with optional status filter. Auth required.

Input parameters:

- `status` (string): Filter by monitor status.

### `withdraw` (~87 tokens)

Withdraw TRX or USDT from your Merx account to an external TRON address. Requires MERX_API_KEY.

Input parameters:

- `address` (string, required): Destination TRON address (starts with T).
- `amount_trx` (string, required): Amount to withdraw in TRX (e.g. "100"). Converted to SUN internally.
- `currency` (string): Currency to withdraw. Default: TRX.

### `compile_policy` (~161 tokens)

Convert a natural language energy management policy into MERX automation. Creates standing orders and monitors based on your instructions.

Examples:
\- "Keep 500k energy on my wallet, buy when price is below 55 SUN, max 200 TRX/week"
\- "Buy energy every day at 6 AM UTC, 1 million units, for 24 hours"
\- "Alert me when my energy drops below 100k"

Returns a preview of what will be created. Set apply=true to execute.

Input parameters:

- `address` (string): TRON address this policy applies to (optional)
- `apply` (boolean): Set to true to create the standing orders. Default false (preview only).
- `instruction` (string, required): Natural language description of the desired automation policy

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/exchange-merx-mcp/merx-mcp#diagnostics

## Score history

- 2026-08-03: 68
- 2026-08-02: 67
- 2026-08-01: 5
- 2026-07-31: 26
- 2026-07-30: 9
- 2026-07-28: 24
- 2026-07-27: 53

## Links

- npm package: https://www.npmjs.com/package/merx-mcp
- Socket report: https://socket.dev/npm/package/merx-mcp
- Repository: https://github.com/Hovsteder/merx-mcp
- Changelog RSS feed: https://verifymcp.io/servers/exchange-merx-mcp/merx-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/exchange-merx-mcp/merx-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/exchange-merx-mcp/merx-mcp