fi.zxoar/zxoar
NPM · ZXOAR-MCP · SCANNED AUG 3
Agent-first trading on the ZXOAR launchpad (Uniswap V4): scan, vet, guarded buy/sell, atomic launch
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security87
- No malware found by supply-chain analysis.Pass
- Only part of the dependency tree could be resolved (109 of 113), so this covers what we could see, not the whole tree.Partial
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (109 of 113), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency19
- Repository check failed: the declared repository URL returned HTTP 404. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 9 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability73
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 1532 tokens (~117/item across 13 items; 13 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
- Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage97
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 90% of tool parameters carry a description.Partial
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · zxoar-mcp
claude mcp add fi-zxoar-zxoar -- npx -y zxoar-mcp
codex mcp add fi-zxoar-zxoar -- npx -y zxoar-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"fi-zxoar-zxoar": {
"type": "local",
"command": [
"npx",
"-y",
"zxoar-mcp"
],
"enabled": true
}
}
} openclaw mcp add fi-zxoar-zxoar --command npx --arg -y --arg zxoar-mcp
mcp_servers:
fi-zxoar-zxoar:
command: "npx"
args: ["-y", "zxoar-mcp"] {
"mcpServers": {
"fi-zxoar-zxoar": {
"command": "npx",
"args": [
"-y",
"zxoar-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 2 Aug 26 +63
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Malware scan: unverified → pass ▲ security
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Stability: unverified → 0.23 ▲ functional
- Schema quality: unverified → good ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- License: unverified → pass ▲ functional
- Licence: MIT functional
- 1 Aug 26 −21
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 31 Jul 26 −18
- Malware scan: pass → unverified ▼ security
- 27 Jul 26 39
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Analysed npm/[email protected]
Provenance none
Ecosystem: npm · Outcome: none
Dependencies 109 packages
109 packages in the resolved dependency tree · 108 deprecated · 29 stale.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
build_metadata ~240
Build a token metadata data URI from structured input. Returns the complete metadataURI for the launch tool, the normalized manifest (as renderers see it), byte size, warnings (e.g. invalid schemes, oversized URI). Social handles are normalized to full URLs. Max URI size: 32768 bytes.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | — | Brief token description |
| discord | string | — | Discord invite code or URL (e.g. abc123 or https://discord.gg/abc123) |
| image | string | — | Token image: data:image/* (base64), ipfs://, or https:// |
| name | string | yes | Token display name |
| nsfw | boolean | — | Mark the logo NSFW (renderers blur it). Usually set from set_image's returned nsfw flag. |
| symbol | string | — | Token symbol/ticker |
| telegram | string | — | Telegram handle or URL (e.g. groupname or https://t.me/group) |
| string | — | Twitter/X handle or URL (e.g. @handle or https://twitter.com/handle) | |
| website | string | — | Project website (https:// only) |
No output schema declared.
No examples provided.
buy ~180
Buy a ZXOAR token with ETH via the pool's locked concentrated liquidity. Simulates first, applies slippage protection, and refuses amounts above the server's MAX_ETH_PER_TX guardrail. REFUSES while a token's anti-snipe guard fee is still decaying (first ~3 minutes — a fill then burns up to 50% in fees); pass allowGuardFee:true only if speed genuinely matters more than price.
| Name | Type | Req | Description |
|---|---|---|---|
| allowGuardFee | boolean | — | Explicitly accept buying during the anti-snipe window at up to 50% fee (default false) |
| ethAmount | number | yes | ETH to spend, e.g. 0.05 |
| slippageBps | integer | — | Slippage tolerance in bps (default 300 = 3%) |
| token | string | yes | Ticker or 0x address |
No output schema declared.
No examples provided.
collect_fees ~69
Claim swap fees accrued to a token's locked liquidity position. Anyone may trigger it; proceeds always split 50% to the token's creator and 50% to the protocol. Principal liquidity cannot be withdrawn by anyone, ever.
| Name | Type | Req | Description |
|---|---|---|---|
| token | string | yes | Ticker or 0x address |
No output schema declared.
No examples provided.
get_activity ~95
Recent on-chain activity across the whole market (launches, trades, fee collections), newest first — the event feed agents should read instead of repeatedly polling scan. Optionally filter to one token. Each trade includes the exact fee it paid, so guard-window activity is visible.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | — | Max events (default 20) |
| token | string | — | Ticker or 0x address to filter to one token |
No output schema declared.
No examples provided.
get_market_stats ~47
Whole-market rollup: pool count, total trades, total volume, total fees paid (creator+protocol), most-active tokens, and newest launches. For dashboards and agent market-scanning.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_token_history ~84
Full history for one token: price series, per-trade fee paid (shows the snipe-guard decay in the data), total volume, fees collected, and recent trades. This is the memory agents lack when polling — and the audit trail humans need.
| Name | Type | Req | Description |
|---|---|---|---|
| token | string | yes | Ticker or 0x address |
| tradeLimit | integer | — | — |
No output schema declared.
No examples provided.
launch ~267
Launch a new token: deploys a fixed 1B-supply ERC-20, initializes a Uniswap V4 pool with the anti-snipe hook, deposits 95% of supply as a locked single-sided bonding curve, and escrows the 5% graduation reserve (deployed as locked liquidity above the band when the curve fills, ~20.6 ETH FDV). Launching is free, forever. No presale, no team allocation; principal liquidity is never withdrawable by anyone. The anti-snipe guard (50%→1% over 3 min) starts immediately. If firstBuyEth is provided the launch uses the ATOMIC launchAndBuy path — launch + creator buy in ONE transaction, guaranteed first position, nothing can front-run between them (the creator's buy still pays the t=0 guard fee — no creator privilege). Caller becomes the creator and earns 50% of all swap fees forever via collect_fees.
| Name | Type | Req | Description |
|---|---|---|---|
| firstBuyEth | number | — | Optional creator buy in ETH — atomic with the launch (guaranteed first position) |
| metadataURI | string | — | Optional URI to JSON metadata (image, description, links) |
| name | string | yes | — |
| symbol | string | yes | Ticker, e.g. DEER |
No output schema declared.
No examples provided.
scan ~81
List tokens on the ZXOAR launchpad, newest first: price in ETH, market cap, % of the bonding curve sold, graduation status, and whether the anti-snipe guard fee is still active (fee decays 50%→1% over 3 minutes after launch).
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | — | Max tokens to return (default 25) |
No output schema declared.
No examples provided.
sell ~98
Sell a Lockwood token back into its pool for ETH. Provide tokenAmount (whole tokens) or percent of current holding. Handles approval automatically; simulates and applies slippage protection.
| Name | Type | Req | Description |
|---|---|---|---|
| percent | number | — | Percent of holding to sell (used if tokenAmount omitted) |
| slippageBps | integer | — | — |
| token | string | yes | Ticker or 0x address |
| tokenAmount | number | — | Whole tokens to sell |
No output schema declared.
No examples provided.
set_image ~144
Upload a token logo through Lockwood's moderation gate (the SAME gate the UI uses — no bypass). Give a local image file path (PNG/JPEG/WebP/GIF); it is re-encoded, screened, and either rejected (explicit/illegal content) or stored. Returns { url, nsfw }. Then pass url as build_metadata's `image` and nsfw as build_metadata's `nsfw`, and launch with the resulting metadataURI. Requires the image service (IMAGE_SERVICE_URL, default http://127.0.0.1:3000).
| Name | Type | Req | Description |
|---|---|---|---|
| imagePath | string | yes | Local path to a PNG/JPEG/WebP/GIF logo file |
No output schema declared.
No examples provided.
token_info ~53
Detailed live state for one token: price, market cap, band progress, guard fee, creator, metadata.
| Name | Type | Req | Description |
|---|---|---|---|
| token | string | yes | Ticker symbol (e.g. DEER) or 0x token address |
No output schema declared.
No examples provided.
vet ~140
Safety check for one launchpad token before trading it — the same ladder the ZXOAR site runs, sized for agents: launcher-registry membership (pins the factory bytecode, locked liquidity, and the SnipeGuard hook), guard/graduation state, and a REAL simulated buy→approve→sell round-trip through the actual router (0.01 ETH probe via eth_simulateV1 — an eth_call, spends nothing). Returns a plain verdict: CLEAR / WAIT (guard active) / CAUTION / UNPROBEABLE. Call this before the first buy of any token.
| Name | Type | Req | Description |
|---|---|---|---|
| token | string | yes | Ticker or 0x address |
No output schema declared.
No examples provided.
wallet ~34
The connected wallet's address, ETH balance, and holdings across Lockwood tokens with ETH valuations. Read-only servers report readOnly:true.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.