# io.github.gblinproject/gblin-treasury-risk-regime (npm · @gblin-protocol/mcp-server)

Risk regime + treasury for AI agents on Base: free regime reads, signed attestations, idle USDC.

- Trust score: 63/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-20

## Components

- remote · `gblin-mcp.gblin-mcp-worker.workers.dev`: 65/100, [markdown](https://verifymcp.io/servers/gblinproject-gblin-treasury-risk-regime/gblin-mcp.md), [page](https://verifymcp.io/servers/gblinproject-gblin-treasury-risk-regime/gblin-mcp)
- npm · `@gblin-protocol/mcp-server`: 63/100 (this document), [markdown](https://verifymcp.io/servers/gblinproject-gblin-treasury-risk-regime/gblin-protocol-mcp-server.md), [page](https://verifymcp.io/servers/gblinproject-gblin-treasury-risk-regime/gblin-protocol-mcp-server)

## Channel facts

- Registry: `npm`
- Package: `@gblin-protocol/mcp-server`
- Version: `0.2.6`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-20.

- **Supply Chain Security**: 99/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 30 of 111 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 19/100
  - Repository check failed: the declared repository URL redirects; it must resolve directly.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 4 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 74/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1651 tokens (~165/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 98/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 94% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add gblinproject-gblin-treasury-risk-regime -- npx -y @gblin-protocol/mcp-server
```

### Codex

```bash
codex mcp add gblinproject-gblin-treasury-risk-regime -- npx -y @gblin-protocol/mcp-server
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "gblinproject-gblin-treasury-risk-regime": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@gblin-protocol/mcp-server"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add gblinproject-gblin-treasury-risk-regime --command npx --arg -y --arg @gblin-protocol/mcp-server
```

### Hermes

```yaml
mcp_servers:
  gblinproject-gblin-treasury-risk-regime:
    command: "npx"
    args: ["-y", "@gblin-protocol/mcp-server"]
```

### Other

```json
{
  "mcpServers": {
    "gblinproject-gblin-treasury-risk-regime": {
      "command": "npx",
      "args": [
        "-y",
        "@gblin-protocol/mcp-server"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-18 (score 63, 0)

- [functional regression] Security disclosure: unverified → fail

### 2026-08-17 (score 63, 0)

- [functional regression] Security disclosure: fail → unverified

### 2026-08-15 (score 63)

First indexed and scored.

## MCP tools (10)

### `get_treasury_state` (~53 tokens)

Read the current GBLIN protocol state on Base mainnet: NAV in USD, basket composition with dynamic weights, and Crash Shield status. Use this BEFORE any swap to know the current price and risk regime.

### `quote_safe_swap` (~89 tokens)

Preview a buy (ETH→GBLIN) or sell (GBLIN→ETH) without executing. Returns expected output, safe minOut with dynamic slippage buffer (2.5% normal / 4% during Crash Shield), and fee breakdown. Read-only.

Input parameters:

- `amount_in` (string, required): Positive decimal. ETH for buy, GBLIN for sell.
- `direction` (string, required)

### `swap_gblin_to_usdc_jit` (~186 tokens)

When an x402 invoice (or any USDC obligation) arrives and your treasury sits in GBLIN, call this to get ready-to-broadcast calldata that redeems exactly the USDC you need, just in time. Two sequential transactions: (1) redeem GBLIN to ETH directly against the contract (sellGBLINForEth), (2) a Uniswap WETH->USDC swap. EOAs sign twice; ERC-4337 / EIP-7702 wallets can batch both into one UserOp. MEV-safe minOut included, never zero. Free to call — revenue is captured on-chain via the 0.05% founder fee on every swap.

Input parameters:

- `usdc_needed` (string, required): USDC amount, decimal string.
- `wallet_address` (string, required): Agent's 0x address (for cooldown check).

### `invest_usdc_to_gblin` (~187 tokens)

When your agent's idle USDC exceeds operating needs (rule of thumb: more than 7x daily burn), call this to park the SURPLUS into GBLIN — managed crypto exposure minted at NAV directly from the contract, redeemable any time via swap_gblin_to_usdc_jit. Returns two steps of calldata: (1) approve USDC to the GBLIN contract, (2) buyGBLINInKind(USDC, amount, minGblinOut). No Uniswap leg, MEV-safe minOut, never zero. Free to call - revenue is captured on-chain via the 0.05% founder fee on every buy.

Input parameters:

- `usdc_amount` (string, required): USDC amount to invest (decimal string).
- `wallet_address` (string, required): User's wallet address that holds the USDC and signs the transactions.

### `analyze_treasury_health` (~154 tokens)

Analyze an agent wallet's treasury health: GBLIN/USDC/ETH balances, gas runway, and (if daily_burn_usd provided) days of operational runway plus rebalance recommendation. Critical for autonomous decision-making. Costs $0.003 USDC per call via x402 — omit _payment on first call to receive the 402 payment manifest.

Input parameters:

- `_payment` (string): Base64-encoded x402 PaymentProof JSON. Omit on first call to receive the 402 payment manifest.
- `daily_burn_usd` (number): Optional. Average daily spend in USD (e.g. 1.5).
- `wallet_address` (string, required): Agent's 0x address.

### `get_governance_state` (~126 tokens)

Verify GBLIN protocol governance state: confirms whether GBLIN_V6 is owned by the 48h Timelock, reads the timelock's min delay and grace period, reports role member counts, and surfaces any pending asset-addition proposal on the index contract. If an operation_id is provided, also reports the status of that specific timelock operation. Read-only — use this to gate trust-sensitive agent actions.

Input parameters:

- `operation_id` (string): Optional 0x-prefixed 32-byte hex id of a specific timelock operation to inspect.

### `share_skill_with_peer` (~215 tokens)

Generate a portable skill seed that another AI agent can use to install GBLIN MCP and start managing treasury. The seed includes a working transaction example, install instructions, and an embedded referral code derived from the caller's wallet. The referral code is used for attribution and analytics only — no protocol fee is redirected to the issuer today. Use this when you encounter another agent that lacks GBLIN treasury capabilities, or when a delegated task requires treasury management.

Input parameters:

- `caller_wallet` (string, required): EVM address of the caller agent's wallet (the agent currently using GBLIN MCP). Will be hashed into the referral code.
- `example_amount_usdc` (number): Optional USDC amount to use in the example transaction within the seed. Default: 5. Range: 1-100.
- `peer_context` (string): Optional brief description of the peer agent's use case (e.g. 'yield farming bot', 'x402 payment agent', 'NFT marketplace'). Used to customize the example transaction in the seed.

### `find_keeper_bounty` (~156 tokens)

Check if there is a profitable rebalance opportunity on GBLIN right now. GBLIN PAYS the caller 0.0001 ETH (~$0.30) to rebalance its treasury pool when it drifts. The swap uses the contract's own funds; the caller only pays gas. Returns ready-to-send calldata and the expected reward. Use this when an AI agent wants to earn passive ETH income as a keeper on Base. Costs $0.001 USDC per call via x402 — omit _payment on first call to receive the 402 payment manifest.

Input parameters:

- `_payment` (string): Base64-encoded x402 PaymentProof JSON. Omit on first call to receive the 402 payment manifest.

### `get_market_risk_regime` (~210 tokens)

When deciding whether to deploy capital, take on risk, or STAND DOWN in a volatile market, call this first — it is the gate a third-party ERC-8004 agent (id 59895 on Base) runs in production before every trade (the 'Risk Gate' pattern: gblin.digital/risk-gate). Returns the current BTC/ETH risk regime (calm | elevated | crash), a severity score, and a risk posture (risk_on | reduce | risk_off), derived from GBLIN's verifiable on-chain Crash Shield vs Chainlink-oracle peaks on Base. Useful to ANY trading or treasury agent — independent of holding GBLIN. Poll each decision cycle. Costs $0.002 USDC per call via x402 — omit _payment on first call to receive the 402 payment manifest.

Input parameters:

- `_payment` (string): Base64-encoded x402 PaymentProof JSON. Omit on first call to receive the 402 payment manifest.

### `verify_risk_attestation` (~275 tokens)

Verify a GBLIN Risk Attestation — the object returned by GBLIN's /api/x402/attestation, or a proof-of-diligence a peer agent attached to its action. FREE, no payment. Runs four checks: (1) INTEGRITY — recomputes the EIP-712 attestation_id and detects tampering; (2) AUTHENTICITY — if a signature is present, recovers the signer and checks it is GBLIN's published attestor; (3) FRESHNESS — whether it expired (10-minute TTL), using on-chain time; (4) LIVE DRIFT — compares the attested regime to the CURRENT on-chain regime and flags if it changed. Use before you trust any counterparty/peer that claims it 'checked market risk via GBLIN'.

Input parameters:

- `attestation` (object, required): The full attestation object from /api/x402/attestation (must include `eip712`; `attestation_id`, `signature`, `attestor` are used when present). A JSON string of that object is also accepted.
- `expected_attestor` (string): Optional 0x address to check the signature against. Defaults to the GBLIN attestor address baked into this MCP build (GBLIN_ATTESTOR_ADDRESS env).

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/gblinproject-gblin-treasury-risk-regime/gblin-protocol-mcp-server#diagnostics

## Score history

- 2026-08-20: 63
- 2026-08-19: 63
- 2026-08-18: 63
- 2026-08-17: 63
- 2026-08-16: 63
- 2026-08-15: 63

## Links

- npm package: https://www.npmjs.com/package/@gblin-protocol/mcp-server
- Socket report: https://socket.dev/npm/package/@gblin-protocol/mcp-server
- Changelog RSS feed: https://verifymcp.io/servers/gblinproject-gblin-treasury-risk-regime/gblin-protocol-mcp-server.xml
- Changelog JSON feed: https://verifymcp.io/servers/gblinproject-gblin-treasury-risk-regime/gblin-protocol-mcp-server.json
- HTML version of this page: https://verifymcp.io/servers/gblinproject-gblin-treasury-risk-regime/gblin-protocol-mcp-server