io.github.LiquiHog/hogswap-mcp
NPM · HOGSWAP-MCP · 2 COMPONENTS · SCANNED AUG 17
Pay any Algorand x402 invoice with any asset, plus DEX swap quotes and unsigned builds.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 30 of 96 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 5 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability69
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 1753 tokens (~146/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management30
- Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage93
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 79% of tool parameters carry a description.Partial
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · hogswap-mcp
claude mcp add liquihog-hogswap-mcp -- npx -y hogswap-mcp
codex mcp add liquihog-hogswap-mcp -- npx -y hogswap-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"liquihog-hogswap-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"hogswap-mcp"
],
"enabled": true
}
}
} openclaw mcp add liquihog-hogswap-mcp --command npx --arg -y --arg hogswap-mcp
mcp_servers:
liquihog-hogswap-mcp:
command: "npx"
args: ["-y", "hogswap-mcp"] {
"mcpServers": {
"liquihog-hogswap-mcp": {
"command": "npx",
"args": [
"-y",
"hogswap-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 16 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Aug 26 +15
- Malware scan: unverified → pass ▲ security
- 11 Aug 26 −13
- Malware scan: pass → unverified ▼ security
- Package version: 0.3.0 → 0.4.0 functional
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 10 Aug 26 0
- Schema quality: 1503 → 1688 ▼ functional
- Package version: 0.2.0 → 0.3.0 functional
- 9 Aug 26 0
- Schema quality: pass → fail ▼ functional
- Tool coverage: 68% → 78% ▲ functional
- Stability: unverified → 0.03 ▲ functional
- Package version: 0.1.5 → 0.2.0 functional
- Package version: 0.1.5 → 0.1.6 functional
- 8 Aug 26 66
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 17 Aug 2026 · Analysed npm/hogswap-mcp@0.4.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Dependencies 96 packages
| Packages resolved | 96 |
|---|---|
| Stale | 30 |
| Tree resolution | Complete |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
build_swap ~99
Unsigned transaction group for a get_quote quote_id. Sign every txn with your own wallet and submit as one group. NEVER pass mnemonics or private keys to any tool — signing happens in YOUR wallet tooling, never on this server.
| Name | Type | Req | Description |
|---|---|---|---|
| api_key | string | – | hsk_ API key override; omit to use the HOGSWAP_API_KEY env config |
| quote_id | string | yes | – |
| user_address | string | yes | – |
No output schema declared.
No examples provided.
delete_watch ~53
Delete one of your watches by its client_key.
| Name | Type | Req | Description |
|---|---|---|---|
| api_key | string | – | hsk_ API key override; omit to use the HOGSWAP_API_KEY env config |
| client_key | string | yes | – |
No output schema declared.
No examples provided.
get_balance ~47
Current HOGSWAP credit balance for your API key.
| Name | Type | Req | Description |
|---|---|---|---|
| api_key | string | – | hsk_ API key override; omit to use the HOGSWAP_API_KEY env config |
No output schema declared.
No examples provided.
get_credit_offer ~128
Create a credit top-up and get the x402 offer (HTTP 402 IS the payment instruction, not an error). accepts[0] is a plain USDC transfer invoice — feed it straight into pay_x402_invoice (keep the note!) to pay with any asset. Credits land ~1 block after the payment confirms.
| Name | Type | Req | Description |
|---|---|---|---|
| api_key | string | – | hsk_ API key override; omit to use the HOGSWAP_API_KEY env config |
| usdc_micro | integer | yes | top-up size in µUSDC (1 USDC = 1,000,000) |
No output schema declared.
No examples provided.
get_quote ~262
HOGSWAP swap quote across every Algorand DEX. Give amount (exact input) OR amount_out (exact output — minimum input is solved). Amounts are base units (µ); asset 0 = ALGO. Returns expected_out, route legs, and a quote_id for build_swap. expected_out is NET of the 5 bps routing fee. Pass `sender` and the response also carries router_fee_* fields plus the wallet's HOG discount (hog_discount_pct, 100 = fee fully waived at 100 HOG), so you can tell the user what the trade cost and what it saved.
| Name | Type | Req | Description |
|---|---|---|---|
| amount | integer | – | exact input, base units |
| amount_out | integer | – | exact output, base units (exact-out mode) |
| asset_in | integer | yes | input asset id (0 = ALGO) |
| asset_out | integer | yes | output asset id |
| max_legs | integer | – | cap TOTAL route legs, parallel splits included — for replaying the route under your own resource budget (contract vaults, composed groups). Expect a slightly worse price at size; 404 if nothing fits.… |
| sender | string | – | optional wallet address for sender-aware fee discounts |
No output schema declared.
No examples provided.
list_payable_assets ~49
Assets accepted as payment inputs for pay_x402_invoice and credit top-ups (price-confidence gated; ALGO and USDC always included). Asset metadata is on get_quote responses or GET /assets.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_watches ~82
List your key's active watches (spec + arming/fired state), quota, and the latest event seq. Poll this from MCP to see fires; SSE at GET /watches/stream is the push alternative outside MCP.
| Name | Type | Req | Description |
|---|---|---|---|
| api_key | string | – | hsk_ API key override; omit to use the HOGSWAP_API_KEY env config |
No output schema declared.
No examples provided.
pay_x402_invoice ~234
Pay ANY Algorand-settled x402 invoice with any 1-4 routable assets you hold, even if you hold none of the demanded asset. Pass the `accepts` entry you picked from the 402 response as `invoice`, plus your inputs (single input with no amount = minimum is solved for you). Returns UNSIGNED groups — sign everything in one pass, then submit the groups IN ORDER (swap first; its on-chain floor guarantees the payment is funded; if you already hold the demanded asset it is a single direct payment). Works for HOGSWAP credit top-up offers too: feed accepts[0] of the 402 straight in. EVM-settled invoices are not supported (no bridge). NEVER pass mnemonics or private keys to any tool — signing happens in YOUR wallet tooling, never on this server.
| Name | Type | Req | Description |
|---|---|---|---|
| api_key | string | – | hsk_ API key override; omit to use the HOGSWAP_API_KEY env config |
| inputs | array | yes | – |
| invoice | object | yes | – |
| user_address | string | yes | YOUR address |
No output schema declared.
No examples provided.
register_agent ~98
Self-service HOGSWAP API key, step 1 of 2 — zero human, zero email. Returns a challenge string; sign its exact bytes with the Algorand address's key IN YOUR OWN wallet tooling, then call verify_registration. NEVER pass mnemonics or private keys to any tool — signing happens in YOUR wallet tooling, never on this server.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | Algorand address to bind the key to |
No output schema declared.
No examples provided.
set_watch ~417
Register a standing server-side watch (FREE, needs a key; idempotent upsert by client_key — re-registering replaces the watch and resets arming). kind='price': advisory µUSD threshold on an asset. kind='target': size-aware surrogate — "would swapping amount_in of asset_in→asset_out deliver ≥ min_out?" (estimated with a margin_bps haircut; NO quote is run). Edge-triggered one-shot; re-arms after a rearm_bps retreat + cooldown_s. TTL auto-expires — refresh by re-upserting. Fired events are numbers-only HINTS: re-quote with get_quote when one fires. Events push over SSE at GET /watches/stream (outside MCP); from MCP, poll list_watches.
| Name | Type | Req | Description |
|---|---|---|---|
| amount_in | integer | – | target: input size, base units |
| api_key | string | – | hsk_ API key override; omit to use the HOGSWAP_API_KEY env config |
| asset_id | integer | – | price: asset id to watch |
| asset_in | integer | – | target: input asset id (0 = ALGO) |
| asset_out | integer | – | target: output asset id |
| client_key | string | yes | your idempotent upsert key (e.g. vault:type:oid) |
| cooldown_s | integer | – | min seconds between fires (default 0) |
| kind | string | yes | – |
| margin_bps | integer | – | target: impact haircut on the estimate (default 30) |
| min_out | integer | – | target: fire when estimated output ≥ this |
| op | string | – | price: fire when µUSD price crosses gte/lte threshold |
| rearm_bps | integer | – | retreat needed before re-arming (default 25) |
| threshold_usd_micro | integer | – | price: threshold in µUSD (1 USD = 1,000,000) |
| ttl_s | integer | – | auto-expiry, seconds (default 86400) |
No output schema declared.
No examples provided.
value_lp_token ~185
Value a liquidity-provider position. Give the LP token's asset id (free, no key) and optionally `amount` in LP BASE units — what the wallet actually holds — to get its USD value and the redeemable amount of each underlying asset. Also identifies which pool/DEX (and STAMM tier) issued the token. Per-unit figures are per WHOLE LP token. Values are a proportional-share redemption at analytics prices: no slippage, no exit fee, NOT a market quote — fields come back null rather than guessed when supply or a price is missing, so check before reporting a number. Errors if the asset is not a known LP token.
| Name | Type | Req | Description |
|---|---|---|---|
| amount | integer | – | holding size in LP base units (1 whole token = 10^decimals, usually 1000000) |
| asset_id | integer | yes | the LP token's asset id |
No output schema declared.
No examples provided.
verify_registration ~99
Self-service key issuance, step 2 of 2. Returns your hsk_ API key ONCE — store it yourself (e.g. set HOGSWAP_API_KEY); it is not recoverable and this server does not keep it.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | – |
| challenge | string | yes | – |
| signature_b64 | string | yes | base64 ed25519 signature over the exact challenge bytes (algosdk util.sign_bytes) |
No output schema declared.
No examples provided.