three.ws Vanity
NPM · @THREE-WS/VANITY-MCP · SCANNED AUG 3
Read the three.ws vanity-address market: quote difficulty + USDC price, browse the board.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security87
- No malware found by supply-chain analysis.Pass
- Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.Partial
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 29 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability75
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1140 tokens (~142/item across 8 items; 8 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · @three-ws/vanity-mcp
claude mcp add nirholas-vanity-mcp -- npx -y @three-ws/vanity-mcp
codex mcp add nirholas-vanity-mcp -- npx -y @three-ws/vanity-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"nirholas-vanity-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"@three-ws/vanity-mcp"
],
"enabled": true
}
}
} openclaw mcp add nirholas-vanity-mcp --command npx --arg -y --arg @three-ws/vanity-mcp
mcp_servers:
nirholas-vanity-mcp:
command: "npx"
args: ["-y", "@three-ws/vanity-mcp"] {
"mcpServers": {
"nirholas-vanity-mcp": {
"command": "npx",
"args": [
"-y",
"@three-ws/vanity-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 2 Aug 26 +45
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Malware scan: unverified → pass ▲ security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- Schema quality: unverified → excellent ▲ functional
- License: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Licence: Apache-2.0 functional
- 31 Jul 26 −7
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 −18
- Malware scan: pass → unverified ▼ security
- 27 Jul 26 45
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Analysed npm/@three-ws/[email protected]
Provenance none
Ecosystem: npm · Outcome: none
Dependencies 95 packages
95 packages in the resolved dependency tree · 95 deprecated · 29 stale.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
vanity_appraise Appraise the rarity of a Solana address ~136
Appraise how rare a Solana address is: its detected vanity pattern, rarity score, rarity bits, tier, and expected grind attempts. Pure math on the Base58 address — nothing is stored. If the address has been published to the proof-of-grind gallery, the public entry is returned too. Read-only, no payment.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | The Base58 Solana public key to appraise (32–44 chars). |
| prefixLen | integer | — | Override how many leading characters to treat as the pattern prefix. |
| suffixLen | integer | — | Override how many trailing characters to treat as the pattern suffix. |
No output schema declared.
No examples provided.
vanity_board Browse the vanity grind-bounty board ~166
Browse the public grind-bounty board: vanity-address bounties requesters have escrowed for the worker fleet to grind. Filter by status (open / all / settled), sort by recency, reward, or expiry, and paginate. Each bounty shows its pattern, USDC amount, difficulty, status, and timing. Read-only; posting a bounty is a separate x402-paid write on the HTTP API.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | — | Max bounties to return (1–100, default 24). |
| offset | integer | — | Pagination offset (default 0). |
| sort | string | — | Order: newest first, biggest reward first, or soonest to expire. Default recency. |
| status | string | — | Which bounties to list. Default open. |
No output schema declared.
No examples provided.
vanity_config Bounty market config: payout + asset metadata ~91
Read the grind-bounty market configuration: whether on-chain payouts are configured (can a winner actually be paid?), the settlement asset (USDC) and its decimals, which escrow networks are live (Base / Solana), the pricing band (floor + max atomics), the bounty protocol version, and the sealed-envelope scheme. Check this before posting to confirm the market can pay out. Read-only, no params.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
vanity_gallery Browse the proof-of-grind rarity gallery ~180
Browse the public proof-of-grind gallery: rare Solana addresses people have published with a verifiable grind receipt. Sort by rarity score or recency, filter by tier, minimum pattern length, or a substring the pattern must contain, and paginate. Each entry shows the address, pattern, rarity score/bits, tier, and an explorer link. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| contains | string | — | Only addresses whose vanity pattern contains this substring. |
| limit | integer | — | Max entries to return (1–100, default 24). |
| minLength | integer | — | Only patterns at least this many characters long. |
| offset | integer | — | Pagination offset (default 0). |
| sort | string | — | Order by rarity score (rarest first) or recency. Default score. |
| tier | string | — | Filter to a single rarity tier id. |
No output schema declared.
No examples provided.
vanity_leaderboard Top grinders by USDC earned ~66
Rank the worker fleet: the top grinders by total USDC earned from winning vanity-address bounties. Each entry shows a worker id and its cumulative payout. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | — | How many top grinders to return (1–100, default 10). |
No output schema declared.
No examples provided.
vanity_open List claimable open bounties for workers ~97
List the open, unexpired bounties a grinding worker can race to claim — the queue worker fleets poll. Each entry carries the pattern to grind and the escrowed USDC reward; the first worker to submit a verified, sealed key wins. Read-only discovery; submitting a claim is a separate write on the HTTP API.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | — | Max claimable bounties to return (1–100, default 30). |
No output schema declared.
No examples provided.
vanity_quote Quote the bounty price for a vanity pattern ~152
Quote how hard a Solana vanity address is and what to escrow for it. Give a Base58 prefix and/or suffix and get the expected attempts, rarity tier, and an honest suggested USDC bounty (atomic units) from the difficulty→price oracle. Pure function of the pattern — no wallet, no payment, fully read-only. Use this before posting a grind-bounty so you escrow a fair amount.
| Name | Type | Req | Description |
|---|---|---|---|
| ignoreCase | boolean | — | Match the pattern case-insensitively (cheaper, less rare). Default false. |
| prefix | string | — | Base58 prefix the address must start with (e.g. "THREE"). |
| suffix | string | — | Base58 suffix the address must end with. |
No output schema declared.
No examples provided.
vanity_stats Live grind-bounty market totals ~59
Get live totals for the grind-bounty market: how many bounties are open, how much USDC is currently escrowed, and how much has been paid out to winning workers. A quick pulse on market activity. Read-only, no params.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.