# io.github.lightningfaucet/mcp-server (npm · lightning-faucet-mcp)

Give AI agents a Bitcoin wallet with Lightning Network payments and L402 support.

- Trust score: 62/100 (medium)
- Change this week: +22
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-04

## Components

- npm · `lightning-faucet-mcp`: 62/100 (this document), [markdown](https://verifymcp.io/servers/lightningfaucet-mcp-server/lightning-faucet-mcp.md), [page](https://verifymcp.io/servers/lightningfaucet-mcp-server/lightning-faucet-mcp)

## Channel facts

- Registry: `npm`
- Package: `lightning-faucet-mcp`
- Version: `2.0.5`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-04.

- **Supply Chain Security**: 83/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known medium-severity CVE affects hono 4.12.33, reached via @modelcontextprotocol/sdk > hono. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 19/100
  - Repository check failed: the declared repository URL redirects; it must resolve directly.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 197 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 71/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 1763 tokens (~47/item across 37 items; 37 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add lightningfaucet-mcp-server -- npx -y lightning-faucet-mcp
```

### Codex

```bash
codex mcp add lightningfaucet-mcp-server -- npx -y lightning-faucet-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "lightningfaucet-mcp-server": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "lightning-faucet-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add lightningfaucet-mcp-server --command npx --arg -y --arg lightning-faucet-mcp
```

### Hermes

```yaml
mcp_servers:
  lightningfaucet-mcp-server:
    command: "npx"
    args: ["-y", "lightning-faucet-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "lightningfaucet-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "lightning-faucet-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-04 (score 62, +3)

- [security regression] CVE-2026-69207 affects this package: medium
- [security regression] Known CVEs: partial → fail
- [functional improvement] Stability: unverified → 0.27

### 2026-08-02 (score 59, +43)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Schema quality: unverified → good
- [functional] Licence: MIT

### 2026-07-31 (score 16, −6)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 22, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 40)

First indexed and scored.

## MCP tools (37)

### `check_balance` (~26 tokens)

Check your current Lightning balance in satoshis. Works with both operator and agent keys.

### `pay_l402_api` (~113 tokens)

Make a request to an L402-protected API. If payment is required (HTTP 402), automatically pay the Lightning invoice and complete the request. REQUIRES AGENT KEY - use set_agent_credentials first if operating as an operator.

Input parameters:

- `body` (string): Request body for POST/PUT requests
- `max_payment_sats` (integer): Maximum amount in satoshis to pay for this request
- `method` (string): HTTP method
- `url` (string, required): The URL to request

### `pay_invoice` (~73 tokens)

Pay a BOLT11 Lightning invoice from the agent balance. Returns preimage as proof of payment. REQUIRES AGENT KEY.

Input parameters:

- `bolt11` (string, required): BOLT11 invoice string to pay (starts with lnbc...)
- `max_fee_sats` (integer): Maximum routing fee in satoshis

### `create_invoice` (~54 tokens)

Create a Lightning invoice to receive payment. Use get_invoice_status to check if paid.

Input parameters:

- `amount_sats` (integer, required): Amount in satoshis to request
- `memo` (string): Description/memo for the invoice

### `get_invoice_status` (~41 tokens)

Check if a created invoice has been paid. Use the payment_hash from create_invoice.

Input parameters:

- `payment_hash` (string, required): Payment hash of the invoice to check

### `get_transactions` (~44 tokens)

Get the agent transaction history. Returns both incoming and outgoing payments.

Input parameters:

- `limit` (integer): Max transactions to return
- `offset` (integer): Number to skip for pagination

### `register_operator` (~44 tokens)

Register a new operator account. Returns API key and recovery code. SAVE THESE - they cannot be retrieved later!

Input parameters:

- `name` (string): Name for the operator account (optional)

### `get_deposit_invoice` (~46 tokens)

Create a Lightning invoice to fund your operator account. Pay this invoice to add sats to your balance.

Input parameters:

- `amount_sats` (integer, required): Amount in satoshis to deposit

### `create_agent` (~58 tokens)

Create a new agent under your operator account. Returns the agent API key.

Input parameters:

- `budget_limit_sats` (integer): Optional spending limit in sats
- `description` (string): Optional description
- `name` (string, required): Name for the agent

### `fund_agent` (~47 tokens)

Transfer sats from operator balance to an agent.

Input parameters:

- `agent_id` (integer, required): ID of the agent to fund
- `amount_sats` (integer, required): Amount in satoshis to transfer

### `list_agents` (~16 tokens)

List all agents under your operator account.

### `set_operator_key` (~43 tokens)

Switch to a different operator API key for subsequent requests. Use after register_operator to start using the new credentials.

Input parameters:

- `api_key` (string, required): The operator API key

### `set_agent_credentials` (~42 tokens)

Switch to an agent API key for subsequent requests. Use to operate as a specific agent after creating it.

Input parameters:

- `api_key` (string, required): The agent API key

### `whoami` (~32 tokens)

Get current context - returns whether you are operating as an operator or agent, along with ID, name, and balance.

### `register_webhook` (~58 tokens)

Register a webhook URL to receive payment notifications. Max 5 webhooks per agent. REQUIRES AGENT KEY.

Input parameters:

- `events` (array): Event types to subscribe to
- `url` (string, required): HTTPS webhook URL to receive events

### `list_webhooks` (~26 tokens)

List all registered webhooks for the current agent. REQUIRES AGENT KEY.

### `delete_webhook` (~35 tokens)

Delete a registered webhook. REQUIRES AGENT KEY.

Input parameters:

- `webhook_id` (integer, required): ID of the webhook to delete

### `test_webhook` (~42 tokens)

Send a test event to a webhook to verify it works. REQUIRES AGENT KEY.

Input parameters:

- `webhook_id` (integer, required): ID of the webhook to test

### `get_budget_status` (~49 tokens)

Get budget status for an agent - shows limit, spent, and remaining. Works with operator or agent keys.

Input parameters:

- `agent_id` (integer): Agent ID (operators only, omit for current agent)

### `set_budget` (~55 tokens)

Set or update budget limit for an agent. REQUIRES OPERATOR KEY.

Input parameters:

- `agent_id` (integer, required): Agent ID to update
- `budget_limit_sats` (integer, required): New budget limit in sats (0 for unlimited)

### `deactivate_agent` (~40 tokens)

Deactivate an agent - it cannot make payments until reactivated. REQUIRES OPERATOR KEY.

Input parameters:

- `agent_id` (integer, required): Agent ID to deactivate

### `reactivate_agent` (~37 tokens)

Reactivate a previously deactivated agent. REQUIRES OPERATOR KEY.

Input parameters:

- `agent_id` (integer, required): Agent ID to reactivate

### `recover_account` (~45 tokens)

Recover an operator account using the recovery code from registration. Returns a new API key. Triggers 60-min withdrawal cooldown.

Input parameters:

- `recovery_code` (string, required): Recovery code from registration

### `rotate_api_key` (~59 tokens)

Generate a new API key, invalidating the old one. For operators: triggers 60-min withdrawal cooldown. For agents: 30-min cooldown.

Input parameters:

- `agent_id` (integer): Agent ID (operators only). Omit to rotate operator key.

### `get_info` (~22 tokens)

Get service information including version, status, limits, and supported features.

### `decode_invoice` (~43 tokens)

Decode a BOLT11 invoice without paying it. Returns amount, description, expiry, and destination.

Input parameters:

- `bolt11` (string, required): BOLT11 invoice string to decode

### `get_rate_limits` (~21 tokens)

Get current rate limit status - requests remaining and reset time.

### `withdraw` (~44 tokens)

Withdraw funds from operator account to external Lightning invoice. REQUIRES OPERATOR KEY. Subject to security cooldown.

Input parameters:

- `invoice` (string, required): BOLT11 invoice to pay out to

### `sweep_agent` (~57 tokens)

Sweep funds from agent back to operator balance. REQUIRES OPERATOR KEY.

Input parameters:

- `agent_id` (integer, required): Agent ID to sweep funds from
- `amount_sats` (integer, required): Amount in sats (use large number for full balance)

### `pay_lightning_address` (~69 tokens)

Pay to a Lightning address (user@domain.com format). REQUIRES AGENT KEY.

Input parameters:

- `address` (string, required): Lightning address (user@domain.com)
- `amount_sats` (integer, required): Amount in satoshis to send
- `comment` (string): Optional payment comment

### `export_transactions` (~65 tokens)

Export transaction history in JSON or CSV format.

Input parameters:

- `end_date` (string): ISO date for end of range
- `format` (string): Export format
- `include_pending` (boolean): Include pending transactions
- `start_date` (string): ISO date for start of range

### `get_agent_analytics` (~42 tokens)

Get detailed spending analytics for an agent.

Input parameters:

- `agent_id` (integer): Agent ID (defaults to current agent)
- `period` (string): Time period

### `transfer_to_agent` (~68 tokens)

Transfer sats between agents or from operator to agent. REQUIRES OPERATOR KEY.

Input parameters:

- `amount_sats` (integer, required): Amount to transfer
- `from_agent_id` (integer): Source agent ID (omit to use operator balance)
- `to_agent_id` (integer, required): Destination agent ID

### `delete_agent` (~53 tokens)

Permanently delete an agent. Remaining balance is returned to operator. REQUIRES OPERATOR KEY.

Input parameters:

- `agent_id` (integer, required): Agent ID to delete
- `confirm` (boolean, required): Must be true to confirm deletion

### `lnurl_auth` (~41 tokens)

Authenticate to a service using LNURL-auth protocol. REQUIRES AGENT KEY.

Input parameters:

- `lnurl` (string, required): LNURL-auth string to authenticate with

### `claim_lnurl_withdraw` (~44 tokens)

Claim funds from an LNURL-withdraw link. REQUIRES AGENT KEY.

Input parameters:

- `lnurl` (string, required): LNURL-withdraw string to claim from

### `keysend` (~69 tokens)

Send a payment directly to a node without an invoice (keysend/spontaneous payment). REQUIRES AGENT KEY.

Input parameters:

- `amount_sats` (integer, required): Amount in satoshis
- `destination` (string, required): Destination node public key
- `message` (string): Optional TLV message

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/lightningfaucet-mcp-server/lightning-faucet-mcp#diagnostics

## Score history

- 2026-08-04: 62
- 2026-08-03: 59
- 2026-08-02: 59
- 2026-08-01: 16
- 2026-07-31: 16
- 2026-07-30: 22
- 2026-07-28: 40
- 2026-07-27: 40

## Links

- npm package: https://www.npmjs.com/package/lightning-faucet-mcp
- Socket report: https://socket.dev/npm/package/lightning-faucet-mcp
- Changelog RSS feed: https://verifymcp.io/servers/lightningfaucet-mcp-server/lightning-faucet-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/lightningfaucet-mcp-server/lightning-faucet-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/lightningfaucet-mcp-server/lightning-faucet-mcp