FibX
NPM · FIBX · SCANNED SEP 20
Swap, transfer, portfolio and Aave V3 on Base, HyperEVM and Monad, with the FibX app as MCP Apps UI.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 14 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability48
- 0% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Fail
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2421 tokens (~121/item across 20 items; 19 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management83
- Stability observed for 25 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 21 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
- Supports UI / widget rendering.Pass
How do I install the FibX MCP server?
FibX runs locally as an npm package, launched with npx -y fibx. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · fibx
claude mcp add finance-fibrous-fibx -- npx -y fibx
{
"mcpServers": {
"finance-fibrous-fibx": {
"command": "npx",
"args": [
"-y",
"fibx"
]
}
}
} {
"servers": {
"finance-fibrous-fibx": {
"command": "npx",
"args": [
"-y",
"fibx"
]
}
}
} codex mcp add finance-fibrous-fibx -- npx -y fibx
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"finance-fibrous-fibx": {
"type": "local",
"command": [
"npx",
"-y",
"fibx"
],
"enabled": true
}
}
} openclaw mcp add finance-fibrous-fibx --command npx --arg -y --arg fibx
mcp_servers:
finance-fibrous-fibx:
command: "npx"
args: ["-y", "fibx"] {
"McpServers": {
"finance-fibrous-fibx": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"fibx"
]
}
}
} assistant mcp add finance-fibrous-fibx -t stdio -c npx -a -y fibx
{
"mcpServers": {
"finance-fibrous-fibx": {
"command": "npx",
"args": [
"-y",
"fibx"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Sept 26 −3
- Stability: pass → 0.80 functional
- 18 Sept 26 +1
- Stability: 0.97 → pass security
- 16 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 −3
- Stability: pass → 0.80 functional
- 11 Sept 26 +1
- Stability: 0.97 → pass security
- 9 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 7 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/fibx@0.10.1
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
aave_action Aave V3 Action ~160
Execute an Aave V3 action on Base: supply, borrow, repay, or withdraw. ETH supply/repay can auto-wrap and ETH withdraw can auto-unwrap; borrowing the ETH market returns WETH. Use 'max' as amount to repay or withdraw the full balance. Set simulate=true for a no-broadcast operation preview.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Aave action to perform |
| amount | string | yes | Amount (e.g. '100', '0.5', 'max'). Use 'max' for full repay/withdraw. |
| simulate | boolean | – | Set true for a no-broadcast operation preview |
| token | string | yes | Token symbol (e.g. 'ETH', 'USDC', 'WETH') |
No output schema declared.
No examples provided.
clear_policy_rule Remove a Signing Policy Rule ~97
Remove one rule from the local signing policy with `rule`, or remove the whole policy with `all: true`. Removing everything leaves nothing limiting what this wallet will sign. Exactly one of `rule` or `all` must be given — a call naming neither or both is rejected.
| Name | Type | Req | Description |
|---|---|---|---|
| all | boolean | – | Set to true to remove the whole policy, instead of `rule` |
| rule | string | – | The rule to remove |
No output schema declared.
No examples provided.
config_action Manage RPC Configuration ~129
View and modify fibx RPC configuration. Use 'set-rpc' to set a custom RPC URL for a chain (helps avoid rate limits), 'get-rpc' to view the current RPC for a chain, 'reset-rpc' to reset a chain's RPC to default (omit chain to reset all), or 'list' to show all custom RPC settings.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Config action to perform |
| chain | string | – | Target chain (required for set-rpc and get-rpc) |
| url | string | – | RPC URL to set (required for set-rpc) |
No output schema declared.
No examples provided.
connect_wallet Connect an External Wallet ~59
Start a WalletConnect pairing so the user can sign with their own wallet (MetaMask, Rabby, Rainbow, Phantom). Returns a URI and a QR image immediately — show the QR to the user, then poll get_connect_status until it reports connected.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_aave_markets Aave V3 Markets ~53
List all Aave V3 reserve markets on Base with supply/borrow APY, total supply, total borrow, and LTV. Always call this before Aave supply/borrow operations. No wallet required.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_aave_status Aave V3 Account Status ~36
Get Aave V3 position health on Base: health factor, total collateral, total debt, and available borrows in USD.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_auth_status Check Auth & Fibrous Status ~71
Check authentication status and Fibrous API health. open_fibx already returns this as its auth field; call this on its own only when you need the session state and nothing else, or before a transactional tool you are calling yourself.
| Name | Type | Req | Description |
|---|---|---|---|
| chain | string | – | Target chain to check Fibrous health for |
No output schema declared.
No examples provided.
get_balance Get Wallet Balance ~45
Get native token and all ERC-20 token balances for the active wallet on a specific chain. Only returns tokens with non-zero balances.
| Name | Type | Req | Description |
|---|---|---|---|
| chain | string | – | Target blockchain network |
No output schema declared.
No examples provided.
get_connect_status Check Wallet Connection ~42
Poll a pairing started by connect_wallet. Returns pending, connected, failed, or unknown.
| Name | Type | Req | Description |
|---|---|---|---|
| pairingId | string | yes | The pairingId returned by connect_wallet |
No output schema declared.
No examples provided.
get_policy Read the Signing Policy ~50
Read the local signing policy that bounds every transaction fibx signs. Returns active with its rules, absent when nothing is set, or unreadable when a file is present but cannot be parsed — which refuses everything.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_portfolio Cross-Chain Portfolio ~48
Get a complete cross-chain portfolio overview with USD valuations for all token holdings across Base, HyperEVM, and Monad. Includes DeFi positions (Aave V3). Returns total net worth.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_quote Get Swap Quote ~227
Get a price quote for a token swap without authentication. Shows expected output amount, exchange rate, and route info. No wallet or session required — use this to check prices before committing to a swap. Supported chains: Base, HyperEVM, Monad. Returns both a readable summary and a `quote` object carrying the route's hops, the exact output, the slippage floor and a derived price impact — computed from the tokens' spot prices, not reported by the router, so treat it as an estimate. In a host that renders UI, prefer open_fibx, which shows the route and lets the user swap from it.
| Name | Type | Req | Description |
|---|---|---|---|
| amount | string | yes | Amount to quote (e.g. '0.1', '100') |
| chain | string | – | Target blockchain network |
| from_token | string | yes | Source token symbol (e.g. 'ETH', 'USDC', 'MON') |
| slippage | number | – | Slippage tolerance percentage (0.01-50, default: 0.5) |
| to_token | string | yes | Destination token symbol |
No output schema declared.
No examples provided.
get_tx_status Get Transaction Status ~61
Check the on-chain status and receipt of a transaction by its hash. Returns confirmation status, block number, gas used, and addresses.
| Name | Type | Req | Description |
|---|---|---|---|
| chain | string | – | Chain the transaction was submitted on |
| hash | string | yes | Transaction hash (0x...) |
No output schema declared.
No examples provided.
list_tokens List Tokens ~44
List the tokens Fibrous supports on a chain, with symbol, name, address, decimals and USD price where known.
| Name | Type | Req | Description |
|---|---|---|---|
| chain | string | – | Chain to list tokens for |
No output schema declared.
No examples provided.
logout End the Session ~32
Log out: end any WalletConnect pairing and clear the local session. The user will need to authenticate again before signing anything.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
open_fibx Open FibX ~234
Open the FibX app: wallet, balances, signing policy, and a swap form with the Fibrous route. Call this FIRST for anything about the wallet, a balance, a quote, or a swap — it returns the session, balances, policy and quote in one snapshot, so get_auth_status, get_balance, get_policy and get_quote are not needed before it. It executes nothing; where the host renders MCP Apps UI the user sees the app and presses Simulate and Swap themselves. Pass from/to/amount to open it pre-filled with a quote. Supported chains: Base, HyperEVM, Monad. If the host does not render UI, the result is still a complete JSON snapshot you can read and summarise.
| Name | Type | Req | Description |
|---|---|---|---|
| amount | string | – | Amount of the source token, to pre-fill a swap |
| chain | string | – | Chain to open on |
| from | string | – | Source token symbol, to pre-fill a swap |
| slippage | number | – | Slippage percent for the pre-filled quote |
| to | string | – | Destination token symbol, to pre-fill a swap |
No output schema declared.
No examples provided.
send_tokens Send Tokens ~153
Send native tokens (ETH, cBTC, HYPE, MON) or ERC-20 tokens to a recipient address. If token is omitted, the chain's native token is used. Set simulate=true for a no-broadcast preview; a gas estimate is returned where available.
| Name | Type | Req | Description |
|---|---|---|---|
| amount | string | yes | Amount to send (e.g. '0.1', '100') |
| chain | string | – | Target blockchain network |
| recipient | string | yes | Recipient address (0x...) |
| simulate | boolean | – | Set true for a no-broadcast preview; gas estimates may be unavailable |
| token | string | – | Token symbol (e.g. 'USDC', 'ETH'). Omit for native token transfer. |
No output schema declared.
No examples provided.
set_policy_rule Set a Signing Policy Rule ~119
Set one rule on the local signing policy. Rules: expiry, allowedChains, <chain>.maxValue, <chain>.allowedDestinations. Lists are comma-separated. maxValue caps the native value of one transaction and does not bound token amounts — an ERC-20 transfer carries value 0 — so use allowedDestinations to bound where tokens may go.
| Name | Type | Req | Description |
|---|---|---|---|
| rule | string | yes | expiry, allowedChains, <chain>.maxValue or <chain>.allowedDestinations |
| value | string | yes | The value; comma-separated for lists |
No output schema declared.
No examples provided.
swap_tokens Swap Tokens via Fibrous ~174
Swap tokens using Fibrous aggregator for optimal routing. Handles ERC-20 approvals and wrap/unwrap automatically. Supported chains: Base, HyperEVM, Monad. Set simulate=true for a no-broadcast preview; a gas estimate is returned where it can be calculated safely.
| Name | Type | Req | Description |
|---|---|---|---|
| amount | string | yes | Amount to swap (e.g. '0.1', '100') |
| chain | string | – | Target blockchain network |
| from_token | string | yes | Source token symbol (e.g. 'ETH', 'USDC', 'MON') |
| simulate | boolean | – | Set true for a no-broadcast preview; gas estimates may be unavailable |
| slippage | number | – | Slippage tolerance percentage (0.01-50, default: 0.5) |
| to_token | string | yes | Destination token symbol |
No output schema declared.
No examples provided.
What is the FibX MCP server?
FibX is an MCP server listed in the public MCP registry as finance.fibrous/fibx. Swap, transfer, portfolio and Aave V3 on Base, HyperEVM and Monad, with the FibX app as MCP Apps UI. This page covers its npm package (fibx).
Is the FibX MCP server safe to use?
FibX scores 77 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the FibX MCP server expose?
FibX exposes 19 tools: get_auth_status, config_action, connect_wallet, get_connect_status, logout, and 14 more. Their descriptions and schemas cost roughly 1,834 tokens of context every time the server is loaded.
Is the FibX MCP server still maintained?
FibX is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the FibX MCP server under?
FibX declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.