io.github.kaditang/agent-wallet-mcp
NPM · @KADITANG/AGENT-WALLET-MCP · SCANNED AUG 7
Non-custodial Solana MCP: compare yields, buy tokenized US stocks (xStocks) & Ondo USDY. You sign.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security90
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects uuid 8.3.2, reached via @solana/web3.js > jayson > uuid. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 65 of 248 dependencies flagged as unhealthy (2 deprecated). View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 46 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability68
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2157 tokens (~154/item across 14 items; 14 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · @kaditang/agent-wallet-mcp
claude mcp add kaditang-agent-wallet-mcp -- npx -y @kaditang/agent-wallet-mcp
codex mcp add kaditang-agent-wallet-mcp -- npx -y @kaditang/agent-wallet-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"kaditang-agent-wallet-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"@kaditang/agent-wallet-mcp"
],
"enabled": true
}
}
} openclaw mcp add kaditang-agent-wallet-mcp --command npx --arg -y --arg @kaditang/agent-wallet-mcp
mcp_servers:
kaditang-agent-wallet-mcp:
command: "npx"
args: ["-y", "@kaditang/agent-wallet-mcp"] {
"mcpServers": {
"kaditang-agent-wallet-mcp": {
"command": "npx",
"args": [
"-y",
"@kaditang/agent-wallet-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 7 Aug 26 +4
- Security disclosure: fail → pass ▲ functional
- Dependency health: partial → 0.87 functional
- 6 Aug 26 +28
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- MCP protocol: unverified → pass ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- First check of Schema quality: fail functional
- First check of Schema quality: excellent functional
- First check of Schema quality: fail functional
- First check of Tool coverage: 100 functional
- 5 Aug 26 0
- CVE-2026-69207 no longer affects this package ▲ security
- 4 Aug 26 0
- CVE-2026-69207 affects this package: high ▼ security
- 2 Aug 26 +28
- CVE-2026-54285 affects this package: high ▼ security
- CVE-2026-41907 affects this package: high ▼ security
- Provenance: unverified → fail ▼ security
- Known CVEs: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Malware scan: unverified → pass ▲ security
- Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
- License: unverified → pass ▲ functional
- Maintenance: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. functional
- Tool coverage: Tool coverage not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet. functional
- Capabilities: Protocol version not yet verified: we do not have a sandbox capture of the MCP handshake this version of the package performs yet. functional
- Licence: MIT functional
- 31 Jul 26 −1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 −18
- Malware scan: pass → unverified ▼ security
- 27 Jul 26 24
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 7 Aug 2026 · Analysed npm/@kaditang/[email protected]
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Vulnerabilities 2 findings
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-8988-4f7v-96qf | CVE-2026-54285 | medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | yes |
| GHSA-w5hq-g745-h8pq | CVE-2026-41907 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | yes |
Dependencies 248 packages
| Packages resolved | 248 |
|---|---|
| Deprecated | 2 |
| Stale | 63 |
| No linked repository | 1 |
| Tree resolution | Complete |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
build_buy_xstock_tx ~126
Build (do NOT send) an unsigned Solana transaction that swaps USDC for a Backed xStock via Jupiter. Returns base64 versioned tx + sign URL. SERVICE only — user signs in their wallet.
| Name | Type | Req | Description |
|---|---|---|---|
| amountUsdc | string | yes | USDC to spend |
| slippageBps | number | – | Slippage in bps (default 50) |
| ticker | string | yes | US ticker e.g. NVDA, AAPL, TSLA, SPY |
| wallet | string | yes | User's Solana wallet pubkey (base58) |
No output schema declared.
No examples provided.
build_deposit_yield_tx ~124
Build (do NOT send) an unsigned Solana transaction that swaps USDC for a yield-bearing tokenized treasury (USDY for non-US users). Returns base64 versioned tx + a one-click sign URL. SERVICE only — user signs in their wallet.
| Name | Type | Req | Description |
|---|---|---|---|
| amountUsdc | string | yes | USDC amount to deposit |
| asset | string | yes | Yield token slug |
| slippageBps | number | – | Slippage in bps (default 50) |
| wallet | string | yes | User's Solana wallet pubkey (base58) |
No output schema declared.
No examples provided.
build_sell_xstock_tx ~150
Build (do NOT send) an unsigned Solana transaction that sells a Backed xStock back to USDC via Jupiter. Returns base64 versioned tx + sign URL. SERVICE only.
| Name | Type | Req | Description |
|---|---|---|---|
| amountShares | string | yes | Number of xStock shares to sell, e.g. '0.02' — or 'max' to sell the entire balance (reads exact on-chain amount; avoids the rounding error that breaks selling the displayed balance) |
| slippageBps | number | – | Slippage in bps (default 50) |
| ticker | string | yes | Stock ticker to sell, e.g. NVDA |
| wallet | string | yes | User's Solana wallet pubkey |
No output schema declared.
No examples provided.
build_withdraw_yield_tx ~140
Build (do NOT send) an unsigned Solana transaction that swaps a yield-bearing token (e.g. USDY) back to USDC via Jupiter. Returns base64 versioned tx + sign URL.
| Name | Type | Req | Description |
|---|---|---|---|
| amount | string | yes | Amount of the yield token to redeem (token units, e.g. '8.5' USDY) — or 'max' to redeem the entire balance (exact on-chain amount) |
| asset | string | yes | Yield token slug |
| slippageBps | number | – | Slippage in bps (default 50) |
| wallet | string | yes | User's Solana wallet pubkey |
No output schema declared.
No examples provided.
check_xstock_safety ~271
Pre-trade SAFETY check for a tokenized US stock — verify it's the REAL token (not a copycat) and OK to buy right now, BEFORE building a buy tx. Works for any issuer (Backed/xStocks, Ondo, Remora) and any Solana mint or EVM address. Pass `ticker` (e.g. NVDA → checks the canonical xStock) OR `token` (a symbol like AAPLx / AAPLon, or a raw mint/0x address) → returns decision (ok/review/avoid), issuer + whether it's verified against the issuer's own registry, and why. Catches copycats/fakes (the #1 risk — agents buy impersonator tokens), depeg, thin liquidity, off-hours mispricing, trading halts. FREE, read-only. STRONGLY recommended before build_buy_xstock_tx, and essential before buying any token NOT in list_xstocks.
| Name | Type | Req | Description |
|---|---|---|---|
| ticker | string | – | US ticker (e.g. NVDA, AAPL) — checks the canonical Backed xStock for it |
| token | string | – | OR a specific token: a symbol (AAPLx/AAPLon/TSLAr) or a raw Solana mint / 0x EVM address |
No output schema declared.
No examples provided.
compare_yields ~291
Rank USDC lending + tokenized-treasury yields across major chains (Solana, Ethereum, Base, Arbitrum) via DefiLlama, RISK-ADJUSTED. Results are ranked by riskAdjustedApy (not headline APY): each pool's APY is discounted by volatility (sigma), TVL depth, protocol risk, DefiLlama's stability prediction, reward-emission dependence, and IL exposure. Each entry includes riskScore (0-100), riskFactors breakdown, and riskNotes explaining the discount — surface these so the user understands WHY a lower headline APY may be the better pick. Solana protocols (Kamino, MarginFi, Drift, JLP) are executable=true; other chains read-only in V1. Returns BOTH topExecutable (best risk-adjusted pool the user can act on today — recommend this for action) AND topByRiskAdjustedOverall (best across ALL chains, may be read-only in V1 — surface it so the user sees the true market-best, e.g. 'the global best is X% on Ethereum but the best you can execute now is Y% on Solana'). topByRiskAdjusted is a deprecated alias of topExecutable.
| Name | Type | Req | Description |
|---|---|---|---|
| amountUsdc | number | – | Optional intended deposit size for impact estimation |
| minTvlUsd | number | – | Minimum pool TVL filter (default 100000) |
No output schema declared.
No examples provided.
export_history ~162
Errand tool: export a wallet's tokenized-equity + yield-token TRADE HISTORY (a record for the user's accountant — NOT tax advice / not a tax calculation). Reconstructs USDC↔xStock and USDC↔yield-token swaps from on-chain history; execution price is derived from each tx's own balance deltas (no external price feed). Returns structured trades (date, buy/sell, asset, amount, USDC, price, Solscan link) + a CSV string. Capped at the last N signatures (default 100). Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | How many recent signatures to scan (default 100, max 200) |
| wallet | string | yes | Solana wallet pubkey (base58) |
No output schema declared.
No examples provided.
get_portfolio ~54
Snapshot a Solana wallet: SOL, USDC, every held xStock or yield token priced via Jupiter. Returns total USD value. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| wallet | string | yes | Solana wallet pubkey (base58) |
No output schema declared.
No examples provided.
list_xstocks ~124
List supported tokenized US equities (Backed xStocks). 16 tickers across mega-cap-tech (NVDA/AAPL/TSLA/MSFT/GOOGL/AMZN/META), crypto-equity (COIN/MSTR/HOOD/CRCL), broad-market-etf (SPY/QQQ), commodity-etf (GLD), consumer (MCD), ai-defense (PLTR). Includes live Jupiter liquidity + USD price. For non-US holders only.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | Optional category filter; omit to return all 16 |
No output schema declared.
No examples provided.
list_yield_tokens ~72
List supported tokenized treasury / yield-bearing tokens (USDY by Ondo Finance, more coming). These are SEC-registered securities under non-US prospectus, NOT stablecoins — unaffected by GENIUS/CLARITY Acts that ban stablecoin-issuer interest. Each share appreciates as interest accrues.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
portfolio_health ~189
Stateless 'should I do anything?' check for a wallet — the periodic re-engagement tool. Returns holdings (via get_portfolio), compares held yield to the best RISK-ADJUSTED executable yield available right now, and for each held xStock computes its live premium/discount vs the underlying + an entry/exit timing signal (from accumulated microstructure data). Emits actionable `notes` the AI should surface conversationally: e.g. 'your USDY is still the best risk-adjusted option', 'Kamino now offers more', 'the NVDAx you hold is at a +2% premium — rich if you're thinking of selling', 'you have idle USDC earning nothing'. Read-only, no signing. Run it when a user checks in to give them a reason to act (or reassurance to hold).
| Name | Type | Req | Description |
|---|---|---|---|
| wallet | string | yes | Solana wallet pubkey (base58) |
No output schema declared.
No examples provided.
quote_tokenized_stock ~149
Live Jupiter quote for buying a Backed xStock with USDC on Solana. Returns expected output, price impact, route, AND a best-entry timing signal (live premium vs the underlying NYSE price, z-scored against a same-market-regime trailing baseline: good-entry / fair / rich-wait). Surface the timing note to the user. READ ONLY — no on-chain action.
| Name | Type | Req | Description |
|---|---|---|---|
| amountUsdc | string | yes | USDC to spend, e.g. '5' |
| slippageBps | number | – | Slippage tolerance in bps (default 50) |
| ticker | string | yes | US ticker like NVDA, AAPL, TSLA, SPY |
No output schema declared.
No examples provided.
suggest_rebalance ~262
Discipline tool: given a TARGET allocation, compute the trades that move a wallet toward it. READ-ONLY — it suggests buy/sell USD amounts per asset; the user executes via build_buy_xstock_tx / build_sell_xstock_tx / build_deposit_yield_tx and signs in their own wallet. Allocation base = USDC + held xStocks + held yield tokens (SOL is excluded as gas reserve). Each asset gets current% / target% / drift / deltaUsd (+buy / −sell) / action. Holds assets already within the drift threshold (no churn on noise); flags held assets not in the target (sold to 0). Surface the actions conversationally so the user can approve each trade.
| Name | Type | Req | Description |
|---|---|---|---|
| driftThresholdPct | number | – | Only suggest a trade if drift exceeds this (default 3%). |
| minTradeUsd | number | – | Suppress trades smaller than this USD amount (default 1). |
| targets | array | yes | Target allocation. Each item: { asset, percent }. asset is a ticker (NVDA, SPY), a yield-token symbol (USDY), or 'USDC' for cash. Percents should sum to ~100. |
| wallet | string | yes | Solana wallet pubkey (base58) |
No output schema declared.
No examples provided.
track_tx ~43
Check a Solana transaction's on-chain status. Returns confirmation, success/fail, Solscan URL.
| Name | Type | Req | Description |
|---|---|---|---|
| signature | string | yes | Solana tx signature (base58) |
No output schema declared.
No examples provided.