# io.github.LiquiHog/hogswap-mcp (npm · hogswap-mcp)

Pay any Algorand x402 invoice with any asset, plus DEX swap quotes and unsigned builds.

- Trust score: 71/100 (medium)
- Change this week: +5
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-17

## Components

- remote · `hogswap-v1.liquihog.dev`: 59/100, [markdown](https://verifymcp.io/servers/liquihog-hogswap-mcp/hogswap-v1.md), [page](https://verifymcp.io/servers/liquihog-hogswap-mcp/hogswap-v1)
- npm · `hogswap-mcp`: 71/100 (this document), [markdown](https://verifymcp.io/servers/liquihog-hogswap-mcp/hogswap-mcp.md), [page](https://verifymcp.io/servers/liquihog-hogswap-mcp/hogswap-mcp)

## Channel facts

- Registry: `npm`
- Package: `hogswap-mcp`
- Version: `0.4.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-17.

- **Supply Chain Security**: 98/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 30 of 96 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 5 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 69/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 1753 tokens (~146/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 30/100
  - Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 93/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 79% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add liquihog-hogswap-mcp -- npx -y hogswap-mcp
```

### Codex

```bash
codex mcp add liquihog-hogswap-mcp -- npx -y hogswap-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "liquihog-hogswap-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "hogswap-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add liquihog-hogswap-mcp --command npx --arg -y --arg hogswap-mcp
```

### Hermes

```yaml
mcp_servers:
  liquihog-hogswap-mcp:
    command: "npx"
    args: ["-y", "hogswap-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "liquihog-hogswap-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "hogswap-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-16 (score 71, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-14 (score 70, +1)

No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-13 (score 69, +1)

No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-12 (score 68, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-08-11 (score 53, −13)

- [security regression] Malware scan: pass → unverified
- [functional] Package version: 0.3.0 → 0.4.0
- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-08-10 (score 66, 0)

- [functional regression] Schema quality: 1503 → 1688
- [functional] Package version: 0.2.0 → 0.3.0

### 2026-08-09 (score 66, 0)

- [functional regression] Schema quality: pass → fail
- [functional improvement] Tool coverage: 68% → 78%
- [functional improvement] Stability: unverified → 0.03
- [functional] Package version: 0.1.5 → 0.2.0
- [functional] Package version: 0.1.5 → 0.1.6

### 2026-08-08 (score 66)

First indexed and scored.

## MCP tools (12)

### `list_payable_assets` (~49 tokens)

Assets accepted as payment inputs for pay_x402_invoice and credit top-ups (price-confidence gated; ALGO and USDC always included). Asset metadata is on get_quote responses or GET /assets.

### `get_quote` (~262 tokens)

HOGSWAP swap quote across every Algorand DEX. Give amount (exact input) OR amount_out (exact output — minimum input is solved). Amounts are base units (µ); asset 0 = ALGO. Returns expected_out, route legs, and a quote_id for build_swap. expected_out is NET of the 5 bps routing fee. Pass `sender` and the response also carries router_fee_* fields plus the wallet's HOG discount (hog_discount_pct, 100 = fee fully waived at 100 HOG), so you can tell the user what the trade cost and what it saved.

Input parameters:

- `amount` (integer): exact input, base units
- `amount_out` (integer): exact output, base units (exact-out mode)
- `asset_in` (integer, required): input asset id (0 = ALGO)
- `asset_out` (integer, required): output asset id
- `max_legs` (integer): cap TOTAL route legs, parallel splits included — for replaying the route under your own resource budget (contract vaults, composed groups). Expect a slightly worse price at size; 404 if nothing fits.…
- `sender` (string): optional wallet address for sender-aware fee discounts

### `build_swap` (~99 tokens)

Unsigned transaction group for a get_quote quote_id. Sign every txn with your own wallet and submit as one group. NEVER pass mnemonics or private keys to any tool — signing happens in YOUR wallet tooling, never on this server.

Input parameters:

- `api_key` (string): hsk_ API key override; omit to use the HOGSWAP_API_KEY env config
- `quote_id` (string, required)
- `user_address` (string, required)

### `pay_x402_invoice` (~234 tokens)

Pay ANY Algorand-settled x402 invoice with any 1-4 routable assets you hold, even if you hold none of the demanded asset. Pass the `accepts` entry you picked from the 402 response as `invoice`, plus your inputs (single input with no amount = minimum is solved for you). Returns UNSIGNED groups — sign everything in one pass, then submit the groups IN ORDER (swap first; its on-chain floor guarantees the payment is funded; if you already hold the demanded asset it is a single direct payment). Works for HOGSWAP credit top-up offers too: feed accepts[0] of the 402 straight in. EVM-settled invoices are not supported (no bridge). NEVER pass mnemonics or private keys to any tool — signing happens in YOUR wallet tooling, never on this server.

Input parameters:

- `api_key` (string): hsk_ API key override; omit to use the HOGSWAP_API_KEY env config
- `inputs` (array, required)
- `invoice` (object, required)
- `user_address` (string, required): YOUR address

### `register_agent` (~98 tokens)

Self-service HOGSWAP API key, step 1 of 2 — zero human, zero email. Returns a challenge string; sign its exact bytes with the Algorand address's key IN YOUR OWN wallet tooling, then call verify_registration. NEVER pass mnemonics or private keys to any tool — signing happens in YOUR wallet tooling, never on this server.

Input parameters:

- `address` (string, required): Algorand address to bind the key to

### `verify_registration` (~99 tokens)

Self-service key issuance, step 2 of 2. Returns your hsk_ API key ONCE — store it yourself (e.g. set HOGSWAP_API_KEY); it is not recoverable and this server does not keep it.

Input parameters:

- `address` (string, required)
- `challenge` (string, required)
- `signature_b64` (string, required): base64 ed25519 signature over the exact challenge bytes (algosdk util.sign_bytes)

### `get_credit_offer` (~128 tokens)

Create a credit top-up and get the x402 offer (HTTP 402 IS the payment instruction, not an error). accepts[0] is a plain USDC transfer invoice — feed it straight into pay_x402_invoice (keep the note!) to pay with any asset. Credits land ~1 block after the payment confirms.

Input parameters:

- `api_key` (string): hsk_ API key override; omit to use the HOGSWAP_API_KEY env config
- `usdc_micro` (integer, required): top-up size in µUSDC (1 USDC = 1,000,000)

### `get_balance` (~47 tokens)

Current HOGSWAP credit balance for your API key.

Input parameters:

- `api_key` (string): hsk_ API key override; omit to use the HOGSWAP_API_KEY env config

### `value_lp_token` (~185 tokens)

Value a liquidity-provider position. Give the LP token's asset id (free, no key) and optionally `amount` in LP BASE units — what the wallet actually holds — to get its USD value and the redeemable amount of each underlying asset. Also identifies which pool/DEX (and STAMM tier) issued the token. Per-unit figures are per WHOLE LP token. Values are a proportional-share redemption at analytics prices: no slippage, no exit fee, NOT a market quote — fields come back null rather than guessed when supply or a price is missing, so check before reporting a number. Errors if the asset is not a known LP token.

Input parameters:

- `amount` (integer): holding size in LP base units (1 whole token = 10^decimals, usually 1000000)
- `asset_id` (integer, required): the LP token's asset id

### `set_watch` (~417 tokens)

Register a standing server-side watch (FREE, needs a key; idempotent upsert by client_key — re-registering replaces the watch and resets arming). kind='price': advisory µUSD threshold on an asset. kind='target': size-aware surrogate — "would swapping amount_in of asset_in→asset_out deliver ≥ min_out?" (estimated with a margin_bps haircut; NO quote is run). Edge-triggered one-shot; re-arms after a rearm_bps retreat + cooldown_s. TTL auto-expires — refresh by re-upserting. Fired events are numbers-only HINTS: re-quote with get_quote when one fires. Events push over SSE at GET /watches/stream (outside MCP); from MCP, poll list_watches.

Input parameters:

- `amount_in` (integer): target: input size, base units
- `api_key` (string): hsk_ API key override; omit to use the HOGSWAP_API_KEY env config
- `asset_id` (integer): price: asset id to watch
- `asset_in` (integer): target: input asset id (0 = ALGO)
- `asset_out` (integer): target: output asset id
- `client_key` (string, required): your idempotent upsert key (e.g. vault:type:oid)
- `cooldown_s` (integer): min seconds between fires (default 0)
- `kind` (string, required)
- `margin_bps` (integer): target: impact haircut on the estimate (default 30)
- `min_out` (integer): target: fire when estimated output ≥ this
- `op` (string): price: fire when µUSD price crosses gte/lte threshold
- `rearm_bps` (integer): retreat needed before re-arming (default 25)
- `threshold_usd_micro` (integer): price: threshold in µUSD (1 USD = 1,000,000)
- `ttl_s` (integer): auto-expiry, seconds (default 86400)

### `list_watches` (~82 tokens)

List your key's active watches (spec + arming/fired state), quota, and the latest event seq. Poll this from MCP to see fires; SSE at GET /watches/stream is the push alternative outside MCP.

Input parameters:

- `api_key` (string): hsk_ API key override; omit to use the HOGSWAP_API_KEY env config

### `delete_watch` (~53 tokens)

Delete one of your watches by its client_key.

Input parameters:

- `api_key` (string): hsk_ API key override; omit to use the HOGSWAP_API_KEY env config
- `client_key` (string, required)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/liquihog-hogswap-mcp/hogswap-mcp#diagnostics

## Score history

- 2026-08-17: 71
- 2026-08-16: 71
- 2026-08-15: 70
- 2026-08-14: 70
- 2026-08-13: 69
- 2026-08-12: 68
- 2026-08-11: 53
- 2026-08-10: 66
- 2026-08-09: 66
- 2026-08-08: 66

## Links

- npm package: https://www.npmjs.com/package/hogswap-mcp
- Socket report: https://socket.dev/npm/package/hogswap-mcp
- Repository: https://github.com/LiquiHog/hogswap-mcp
- Changelog RSS feed: https://verifymcp.io/servers/liquihog-hogswap-mcp/hogswap-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/liquihog-hogswap-mcp/hogswap-mcp.json
- HTML version of this page: https://verifymcp.io/servers/liquihog-hogswap-mcp/hogswap-mcp