Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, email [email protected] and we’ll put it right.

fi.zxoar/zxoar

NPM · ZXOAR-MCP · SCANNED AUG 3

Agent-first trading on the ZXOAR launchpad (Uniswap V4): scan, vet, guarded buy/sell, atomic launch

Available components

+24 this week 63 Trust /100
Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security87
  • No malware found by supply-chain analysis.Pass
  • Only part of the dependency tree could be resolved (109 of 113), so this covers what we could see, not the whole tree.Partial
  • No install/post-install scripts declared.Pass
  • Only part of the dependency tree could be resolved (109 of 113), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency19
  • Repository check failed: the declared repository URL returned HTTP 404. See how to fix → View diagnostics → Fail
  • Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 9 days ago).Pass
  • Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability73
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 1532 tokens (~117/item across 13 items; 13 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
  • Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage97
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 90% of tool parameters carry a description.Partial
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · zxoar-mcp

# add to Claude Code
claude mcp add fi-zxoar-zxoar -- npx -y zxoar-mcp
# add to Codex CLI
codex mcp add fi-zxoar-zxoar -- npx -y zxoar-mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "fi-zxoar-zxoar": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "zxoar-mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add fi-zxoar-zxoar --command npx --arg -y --arg zxoar-mcp
# ~/.hermes/config.yaml
mcp_servers:
  fi-zxoar-zxoar:
    command: "npx"
    args: ["-y", "zxoar-mcp"]
// mcp.json
{
  "mcpServers": {
    "fi-zxoar-zxoar": {
      "command": "npx",
      "args": [
        "-y",
        "zxoar-mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 2 Aug 26 +63
    • Provenance: unverified → fail security
    • Install scripts: unverified → pass security
    • Known CVEs: unverified → partial security
    • Malware scan: unverified → pass security
    • Dependency health: unverified → partial functional
    • Maintenance: unverified → pass functional
    • MCP protocol: unverified → pass functional
    • Stability: unverified → 0.23 functional
    • Schema quality: unverified → good functional
    • Tool coverage: unverified → 100 functional
    • License: unverified → pass functional
    • Licence: MIT functional
  • 1 Aug 26 −21
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 31 Jul 26 −18
    • Malware scan: pass → unverified security
  • 27 Jul 26 39

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Dependencies 109 packages

109 packages in the resolved dependency tree · 108 deprecated · 29 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 13 exposed · ~1,532 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens
build_metadata ~240

Build a token metadata data URI from structured input. Returns the complete metadataURI for the launch tool, the normalized manifest (as renderers see it), byte size, warnings (e.g. invalid schemes, oversized URI). Social handles are normalized to full URLs. Max URI size: 32768 bytes.

NameTypeReqDescription
descriptionstringBrief token description
discordstringDiscord invite code or URL (e.g. abc123 or https://discord.gg/abc123)
imagestringToken image: data:image/* (base64), ipfs://, or https://
namestringyesToken display name
nsfwbooleanMark the logo NSFW (renderers blur it). Usually set from set_image's returned nsfw flag.
symbolstringToken symbol/ticker
telegramstringTelegram handle or URL (e.g. groupname or https://t.me/group)
twitterstringTwitter/X handle or URL (e.g. @handle or https://twitter.com/handle)
websitestringProject website (https:// only)

No output schema declared.

No examples provided.

buy ~180

Buy a ZXOAR token with ETH via the pool's locked concentrated liquidity. Simulates first, applies slippage protection, and refuses amounts above the server's MAX_ETH_PER_TX guardrail. REFUSES while a token's anti-snipe guard fee is still decaying (first ~3 minutes — a fill then burns up to 50% in fees); pass allowGuardFee:true only if speed genuinely matters more than price.

NameTypeReqDescription
allowGuardFeebooleanExplicitly accept buying during the anti-snipe window at up to 50% fee (default false)
ethAmountnumberyesETH to spend, e.g. 0.05
slippageBpsintegerSlippage tolerance in bps (default 300 = 3%)
tokenstringyesTicker or 0x address

No output schema declared.

No examples provided.

collect_fees ~69

Claim swap fees accrued to a token's locked liquidity position. Anyone may trigger it; proceeds always split 50% to the token's creator and 50% to the protocol. Principal liquidity cannot be withdrawn by anyone, ever.

NameTypeReqDescription
tokenstringyesTicker or 0x address

No output schema declared.

No examples provided.

get_activity ~95

Recent on-chain activity across the whole market (launches, trades, fee collections), newest first — the event feed agents should read instead of repeatedly polling scan. Optionally filter to one token. Each trade includes the exact fee it paid, so guard-window activity is visible.

NameTypeReqDescription
limitintegerMax events (default 20)
tokenstringTicker or 0x address to filter to one token

No output schema declared.

No examples provided.

get_market_stats ~47

Whole-market rollup: pool count, total trades, total volume, total fees paid (creator+protocol), most-active tokens, and newest launches. For dashboards and agent market-scanning.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_token_history ~84

Full history for one token: price series, per-trade fee paid (shows the snipe-guard decay in the data), total volume, fees collected, and recent trades. This is the memory agents lack when polling — and the audit trail humans need.

NameTypeReqDescription
tokenstringyesTicker or 0x address
tradeLimitinteger

No output schema declared.

No examples provided.

launch ~267

Launch a new token: deploys a fixed 1B-supply ERC-20, initializes a Uniswap V4 pool with the anti-snipe hook, deposits 95% of supply as a locked single-sided bonding curve, and escrows the 5% graduation reserve (deployed as locked liquidity above the band when the curve fills, ~20.6 ETH FDV). Launching is free, forever. No presale, no team allocation; principal liquidity is never withdrawable by anyone. The anti-snipe guard (50%→1% over 3 min) starts immediately. If firstBuyEth is provided the launch uses the ATOMIC launchAndBuy path — launch + creator buy in ONE transaction, guaranteed first position, nothing can front-run between them (the creator's buy still pays the t=0 guard fee — no creator privilege). Caller becomes the creator and earns 50% of all swap fees forever via collect_fees.

NameTypeReqDescription
firstBuyEthnumberOptional creator buy in ETH — atomic with the launch (guaranteed first position)
metadataURIstringOptional URI to JSON metadata (image, description, links)
namestringyes
symbolstringyesTicker, e.g. DEER

No output schema declared.

No examples provided.

scan ~81

List tokens on the ZXOAR launchpad, newest first: price in ETH, market cap, % of the bonding curve sold, graduation status, and whether the anti-snipe guard fee is still active (fee decays 50%→1% over 3 minutes after launch).

NameTypeReqDescription
limitintegerMax tokens to return (default 25)

No output schema declared.

No examples provided.

sell ~98

Sell a Lockwood token back into its pool for ETH. Provide tokenAmount (whole tokens) or percent of current holding. Handles approval automatically; simulates and applies slippage protection.

NameTypeReqDescription
percentnumberPercent of holding to sell (used if tokenAmount omitted)
slippageBpsinteger
tokenstringyesTicker or 0x address
tokenAmountnumberWhole tokens to sell

No output schema declared.

No examples provided.

set_image ~144

Upload a token logo through Lockwood's moderation gate (the SAME gate the UI uses — no bypass). Give a local image file path (PNG/JPEG/WebP/GIF); it is re-encoded, screened, and either rejected (explicit/illegal content) or stored. Returns { url, nsfw }. Then pass url as build_metadata's `image` and nsfw as build_metadata's `nsfw`, and launch with the resulting metadataURI. Requires the image service (IMAGE_SERVICE_URL, default http://127.0.0.1:3000).

NameTypeReqDescription
imagePathstringyesLocal path to a PNG/JPEG/WebP/GIF logo file

No output schema declared.

No examples provided.

token_info ~53

Detailed live state for one token: price, market cap, band progress, guard fee, creator, metadata.

NameTypeReqDescription
tokenstringyesTicker symbol (e.g. DEER) or 0x token address

No output schema declared.

No examples provided.

vet ~140

Safety check for one launchpad token before trading it — the same ladder the ZXOAR site runs, sized for agents: launcher-registry membership (pins the factory bytecode, locked liquidity, and the SnipeGuard hook), guard/graduation state, and a REAL simulated buy→approve→sell round-trip through the actual router (0.01 ETH probe via eth_simulateV1 — an eth_call, spends nothing). Returns a plain verdict: CLEAR / WAIT (guard active) / CAUTION / UNPROBEABLE. Call this before the first buy of any token.

NameTypeReqDescription
tokenstringyesTicker or 0x address

No output schema declared.

No examples provided.

wallet ~34

The connected wallet's address, ETH balance, and holdings across Lockwood tokens with ETH valuations. Read-only servers report readOnly:true.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.