io.github.p1xelapp/solana-nft-mcp
NPM · SOLANA-NFT-MCP · SCANNED SEP 25
Read-only Solana NFT data for AI: ownership history, custody rules, marketplace sales and floors.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 96 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 3 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability80
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 4382 tokens (~208/item across 21 items; 21 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage99
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 96% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 21 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 22 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
How do I install the io.github.p1xelapp/solana-nft-mcp server?
io.github.p1xelapp/solana-nft-mcp runs locally as an npm package, launched with npx -y solana-nft-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · solana-nft-mcp
claude mcp add p1xelapp-solana-nft-mcp -- npx -y solana-nft-mcp
{
"mcpServers": {
"p1xelapp-solana-nft-mcp": {
"command": "npx",
"args": [
"-y",
"solana-nft-mcp"
]
}
}
} {
"servers": {
"p1xelapp-solana-nft-mcp": {
"command": "npx",
"args": [
"-y",
"solana-nft-mcp"
]
}
}
} codex mcp add p1xelapp-solana-nft-mcp -- npx -y solana-nft-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"p1xelapp-solana-nft-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"solana-nft-mcp"
],
"enabled": true
}
}
} openclaw mcp add p1xelapp-solana-nft-mcp --command npx --arg -y --arg solana-nft-mcp
mcp_servers:
p1xelapp-solana-nft-mcp:
command: "npx"
args: ["-y", "solana-nft-mcp"] {
"McpServers": {
"p1xelapp-solana-nft-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"solana-nft-mcp"
]
}
}
} assistant mcp add p1xelapp-solana-nft-mcp -t stdio -c npx -a -y solana-nft-mcp
{
"mcpServers": {
"p1xelapp-solana-nft-mcp": {
"command": "npx",
"args": [
"-y",
"solana-nft-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 25 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 22 Sept 26 71
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 25 Sept 2026 · Analysed npm/solana-nft-mcp@1.17.2
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 96 packages
| Packages resolved | 96 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
explain_mechanics How NFTs are handled: escrow, freezing, delegates, royalties ~201
Plain-words explanation of how a standard or a marketplace actually handles an asset: why an NFT moved to an unknown wallet (escrow), whether a project can take it back (permanent delegates), why it cannot be listed (freeze), who gets paid on a sale and where royalties are enforced, why two sites show different floors, what a wash trade looks like, what changes in a standards migration. Covers Metaplex Core plugins, Token Metadata and programmable NFTs, compressed NFTs, and the Solana marketplaces (Magic Eden order book and pools, Tensor, OpenSea, Candy Digital, Collector Crypt). Every entry cites the documentation or program source it came from and says when observed behaviour differs from what is documented. Answers 'what does frozen mean', 'can they burn my card', 'is Magic Eden custodial'.
| Name | Type | Req | Description |
|---|---|---|---|
| topic | string | yes | A question or a term: 'escrow', 'royalties on Tensor', 'permanent transfer delegate' |
No output schema declared.
No examples provided.
find_in_group Hunt across a family of collections ~344
Search MANY collections at once for a specific edition number. DC comics on Candy are 272 separate collections, one per issue, so 'is any DC #1 or #100 listed, and how close to floor' cannot be asked of one collection - this asks a batch of them and hands back a cursor for the rest. Answers 'any #1 for sale across DC', 'cheapest low serial in the MLB set', 'which issues have a #100 listed under 1 SOL'. Each match names its collection, its ask, that collection's floor and how far above floor it is. Use groups from search_collections, or name the collections yourself.
| Name | Type | Req | Description |
|---|---|---|---|
| batch | integer | – | How many collections to read in this call. Each one costs a request or two, so a large batch is a long wait. |
| collections | array | – | Explicit collection names, ids or Magic Eden symbols, instead of a group |
| group | string | – | A family in the registry: DC, MLB or Other. Case-insensitive. |
| lowestOnly | boolean | – | Return the lowest serial listed in each collection instead of specific numbers. Default false. |
| maxPriceSol | number | – | Keep only asks at or below this price |
| pagesPerCollection | integer | – | Pages of 100 listings to read per collection, cheapest first. Default 2. |
| serials | array | – | Edition numbers to hunt, e.g. [1, 100]. Ignored when lowestOnly is true. Default [1, 100]. |
| startAt | integer | – | Where in the group to start; use nextStartAt from the previous call. Default 0. |
No output schema declared.
No examples provided.
find_listings Find listings and deals ~310
What is for sale in a collection right now, cheapest first, with optional trait filters, a name filter, and a lowest-serials mode that reads the whole book and sorts by edition number. Answers 'cheapest Rex', 'find #1390', 'is a #1 or #100 for sale', 'lowest serial I can buy and what it costs versus floor', 'is there a deal on a Judge card', 'what is listed under 1 SOL', 'which traits are cheap right now'. Several trait filters mean all of them. Rarity ranks appear when the marketplace publishes them (Core collections usually carry none). Prices are asks on Magic Eden, not what buyers pay; get_collection_sales shows that.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | How many listings to return. Default 20. |
| lowestSerials | boolean | – | Hunt low edition numbers: read up to 1,000 listings, parse the serial from each name (#9, 12/250) and return the lowest serials with their asks against the floor |
| nameContains | string | – | Keep only listings whose name contains this text, e.g. '#1390' or 'Judge' |
| openseaSlug | string | – | OpenSea collection slug; adds OpenSea's per-trait floor next to Magic Eden's on every deal. Registry entries that carry one are used automatically. |
| symbol | string | yes | Magic Eden collection symbol |
| traits | array | – | Trait filters, combined with AND |
No output schema declared.
No examples provided.
get_asset Asset lookup ~89
Everything known about one asset by mint address: marketplace metadata (name, image, collection, traits, listing state) plus the on-chain owner read from the Core account for Metaplex Core assets, and the chain's asset index for every other standard. Each reader's freshness is reported; the two owners are only called agreeing when both were read live.
| Name | Type | Req | Description |
|---|---|---|---|
| mint | string | yes | Asset mint address |
No output schema declared.
No examples provided.
get_asset_provenance Asset provenance (Core) ~316
BOUNDED on-chain ownership history of a Metaplex Core asset: mint -> transfers (with marketplace labels) -> current owner. Decoded from TransferV1 instruction accounts - data most NFT APIs return EMPTY for on Core assets. Ideal for Candy Digital cards and any Core collectible. This decodes at most `depth` transactions, so on a heavily traded asset the earliest ownership can be outside the result: ALWAYS read `historyComplete` before describing the trail as the whole story, and `skippedTransactions` for how much was left out. Raise `depth` to cover more. A bounded walk keeps the newest transactions and the mint and drops the middle, which is where a recently minted asset's sale usually sits: any hole appears in `events` as an `unread_gap` row IN ITS PLACE in the order, so never read across one as though the trail were continuous. Lowering `depth` to save time is how a 'who bought it' question gets the wrong answer. Ownership events only: traits live in get_asset (marketplace attributes) and get_asset_trust (the on-chain Attributes plugin), so an empty trait picture here means nothing.
| Name | Type | Req | Description |
|---|---|---|---|
| depth | integer | – | Max transactions to decode (each is one paced RPC call). historyComplete says whether this covered everything, and an unread_gap row in events shows where anything was left out. Lower it only to go f… |
| mint | string | yes | Core asset mint address |
No output schema declared.
No examples provided.
get_asset_trust What owning this actually means ~173
Decode the Metaplex Core plugins on an asset and translate them into custody facts: can the issuer move or burn it without the holder's signature (permanent delegates - normal on packs, a red flag on keepers), is it frozen, are royalties enforced by a program rule set or merely advisory, is the metadata mutable, is the serial an on-chain edition or just printed text. Plugins set on the COLLECTION apply to every asset in it and are read too, marked inherited. Marketplaces show the picture and the price; this shows the rules attached to the account. Use before a purchase, when a listing 'cannot transfer', or when someone asks whether a pack burns on open. Read-only, decoded from raw bytes, no indexer.
| Name | Type | Req | Description |
|---|---|---|---|
| mint | string | yes | Metaplex Core asset address |
No output schema declared.
No examples provided.
get_collection_holders Who holds every item in a collection ~391
CENSUS of a Core collection: every asset grouped under it, with its current owner, straight from the chain's asset index. This is the only tool that sees items NOBODY HAS LISTED - every other collection-wide tool reads a marketplace's listing book, so an unsold item is invisible to them. Answers 'who won the 36 packs from that drop', 'is one wallet holding half the supply', 'how many are still with the issuer', 'which wallets hold this set'. Filter to part of a collection with `trait`/`value` (e.g. Item Type = Pack) or `namePrefix` (e.g. 'Gold Series - Aces'). Returns the rows plus a holder count per address, largest first. Every holder row carries a ROLE: issuer (the collection's update authority, read from the chain: the issuer's key, which says nothing about how an item got there), venue-escrow (listed), wallet, or unknown (the collection account could not be read, so nobody could be checked against the issuer's key). An item currently listed for sale shows the MARKETPLACE'S ESCROW as its owner, not the seller: call get_asset_provenance on that mint to see who handed it over.
| Name | Type | Req | Description |
|---|---|---|---|
| collection | string | yes | Core collection ADDRESS. Use identify or search_collections to turn a name into one. |
| max | integer | – | Most assets to read from the index before truncating. Default 2000. |
| namePrefix | string | – | Keep only assets whose name starts with this, e.g. 'Gold Series - Aces'. Case-insensitive. |
| trait | string | – | Trait name to filter on, e.g. 'Item Type'. Case-insensitive. Needs `value` too. |
| value | string | – | Trait value to keep, e.g. 'Pack'. Case-insensitive. |
No output schema declared.
No examples provided.
get_collection_sales Sales over a period ~304
Sales for a collection over the last N days, as Magic Eden recorded them, with every sale named by the chain's asset index so it can be filtered and grouped by player, character or issue: how many sold, total volume, highest and lowest sale, median and average, unique buyers and sellers, the biggest buyers, a per-day series for charts, a per-name breakdown, and the split between the order book and Magic Eden's AMM pools. Answers 'how many sales this week', 'how many Ohtani cards sold', 'which player sold the most', 'what was the top sale', 'is volume up', 'chart the last month', 'who is buying'. The result says how far back the feed was read and whether older sales exist beyond the page budget; it never fills a gap with an estimate. Magic Eden's API feed only: each row carries the execution marketplace that feed reported, and fills it did not index are not here.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | Window ending now. Default 7. |
| maxPages | integer | – | Pages of 500 events to read; busy collections need more to cover long windows. Default 6. |
| nameContains | string | – | Keep only sales whose item name contains this text, e.g. 'Ohtani' or 'Batman'; names come from the chain's asset index |
| symbol | string | yes | Magic Eden collection symbol (search_collections resolves a name to one) |
No output schema declared.
No examples provided.
get_collection_stats Collection stats ~225
Market + supply stats for a collection. Accepts a registry id, a Magic Eden symbol, or a Metaplex Core collection ADDRESS. Addresses are decoded straight from the chain (name, minted, current size) - works for collections no marketplace indexes, e.g. Candy Digital drops. If OPENSEA_API_KEY is set, an OpenSea cross-marketplace view is added (pass openseaSlug, or rely on registry entries that carry one): OpenSea's floor, supply and royalty, plus its 7-day floor trend and the largest holders with their share of supply. Answers 'is the floor up or down this week', 'who holds the most', 'is one wallet holding half of it'.
| Name | Type | Req | Description |
|---|---|---|---|
| collection | string | yes | Registry id, ME symbol, or Core collection address |
| openseaSlug | string | – | Optional OpenSea slug for a cross-marketplace view. OpenSea is read with the key the server issues itself, or OPENSEA_API_KEY if set. The slug's collection is checked against this one before floors a… |
No output schema declared.
No examples provided.
get_floor_prices Floor prices (Magic Eden only) ~109
Current floor price in SOL for up to 10 collections, read from MAGIC EDEN ONLY - it takes Magic Eden symbols and returns Magic Eden rows, with no other marketplace and no other currency, whether or not an OpenSea key is configured. For a cross-marketplace floor comparison use get_collection_stats, which quotes each marketplace in its own currency and refuses to compare across them. Use search_collections first if you only know a human name.
| Name | Type | Req | Description |
|---|---|---|---|
| symbols | array | yes | Magic Eden collection symbols |
No output schema declared.
No examples provided.
get_integration_recipe Get a build recipe ~158
Use when the user wants to BUILD something with collectible data - a sales bot, a floor dashboard, a provenance page, a wallet tracker, a pack-pull watcher - rather than just look a number up. Returns the verified endpoints and their real rate limits, a runnable skeleton, the steady-state running cost, a pre-launch checklist, and the specific ways this kind of integration fails SILENTLY. The pitfalls come from production incidents on live trackers (a feed capped too low silently dropped 8,409 real records; an idle two-minute cron cost $180 in a month) and are not in any API documentation. Read this BEFORE writing integration code, not after it breaks.
| Name | Type | Req | Description |
|---|---|---|---|
| goal | string | yes | What the user is building |
No output schema declared.
No examples provided.
get_recent_sales Recent sales ~97
Most recent completed sales for a collection (price in SOL, buyer, seller, tx signature). Accepts a registry id or Magic Eden symbol. With OPENSEA_API_KEY set and an openseaSlug, OpenSea sales are included for a cross-marketplace picture.
| Name | Type | Req | Description |
|---|---|---|---|
| collection | string | yes | – |
| limit | integer | – | How many sales to return. Default 10. |
| openseaSlug | string | – | – |
No output schema declared.
No examples provided.
get_source_status Which sources are answering ~78
Live health of every data source this server reads, with tier, what each answers, what it cannot see, which need a key, and the fallback order. Answers 'is Magic Eden down', 'why is a number missing', 'what does this tool read', 'which sources need a key'. Use it when a result came back partial.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_top_traders Top traders of a collection ~111
The wallets with the most volume in a collection as Magic Eden counts it (its own fills, all time). Answers 'who are the whales', 'biggest buyers', 'is one wallet moving this market'. Volume on other marketplaces is invisible here, and a high-volume wallet can be a market maker or a wash trader; get_wallet_activity on a wallet shows which.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | How many traders to return. Default 10. |
| symbol | string | yes | Magic Eden collection symbol |
No output schema declared.
No examples provided.
get_trending What is hot on Magic Eden ~88
Magic Eden's own trending collections for a time range. Answers 'what is hot', 'top collections today', 'what is moving this week'. The marketplace has been observed to answer with an empty list; when that happens the result says so rather than implying the market is quiet. Ranking is the marketplace's, by its own volume.
| Name | Type | Req | Description |
|---|---|---|---|
| timeRange | string | – | Default 1d. |
No output schema declared.
No examples provided.
get_wallet_activity Wallet activity & behaviour ~214
How a wallet trades: buys and sells with SOL totals, net flow, listings and bids, which marketplace (Magic Eden order book vs AMM pools; OpenSea with a key), the collections it trades most, every flip (bought then sold: hold time and P&L before fees), a behaviour label (flipper / holder / mixed / lister / quiet) with the reason, and the first purchase inside the window. With OPENSEA_API_KEY set, plain transfers are included so 'was this airdropped, gifted or bought?' gets an evidence-based answer. Every figure says which feed it came from and what that feed cannot see. Read-only; needs no key.
| Name | Type | Req | Description |
|---|---|---|---|
| includeOpenSea | boolean | – | Add OpenSea sales and transfers when OpenSea can be read (self-issued key or OPENSEA_API_KEY). Default true. |
| pages | integer | – | Magic Eden activity pages of 100 events, newest first. Default 3. |
| wallet | string | yes | Wallet address |
No output schema declared.
No examples provided.
get_wallet_holdings Wallet holdings ~135
Collectibles held by a wallet, from two independent readers: Magic Eden's index (names, collections, images, listing state) and the chain's own asset index (every standard, including compressed and unlisted items a marketplace may not carry). Answers 'what does this wallet hold', 'what is in my wallet', 'does this address own anything'. The two counts are compared and any gap is named. Read-only - this server never asks for keys and cannot move anything.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | How many items to read from the marketplace index. Default 50. |
| wallet | string | yes | Wallet address |
No output schema declared.
No examples provided.
get_wallet_profile Wallet profile ~239
What a wallet holds and what that means: items grouped by collection with counts and share of the wallet, which collection dominates, how many are listed or compressed, the creator royalty each collection asks for, share of total supply where a supply is known, a floor-times-count CEILING (never called a value) for the largest holdings, and the wallet's age and transaction count from the chain. Answers 'what do they collect', 'how much of X do they own', 'how big a holder are they', 'is this a fresh wallet', 'what is it worth at floor' - with each number labelled for what it is. Read-only; needs no key.
| Name | Type | Req | Description |
|---|---|---|---|
| includeAge | boolean | – | Read the wallet's first/last transaction from the chain (up to 3 RPC calls). Default true. |
| maxItems | integer | – | Cap on items fetched (500 per request). Default 1000. |
| priceTop | integer | – | How many of the largest collections to price at floor (one paced Magic Eden request each; registry collections add one supply read). Default 5. |
| wallet | string | yes | Wallet address |
No output schema declared.
No examples provided.
identify Identify anything ~151
START HERE when you do not already know what an identifier is. Takes ANY string a user might paste - a Solana address, a marketplace symbol or slug, or a plain collection name - works out what it actually is, which marketplaces list it, and which tools to call next. Works on collections that launched today and are in no registry, because it probes live sources rather than matching a hardcoded list. Returns the evidence: every source checked INCLUDING the ones that found nothing, what was not checked and why, and a confidence rating. Never report 'this does not exist' from an empty result - report what was searched.
| Name | Type | Req | Description |
|---|---|---|---|
| query | string | yes | An address, marketplace symbol/slug, or collection name |
No output schema declared.
No examples provided.
search_collections Search collections ~91
Find digital-collectible collections by name (e.g. 'candy gold series', 'batman', 'mad lads'). Returns curated entries with the identifiers other tools need (Magic Eden symbol, Core collection address). Collections not in the registry still work: pass a Magic Eden symbol or a Metaplex Core collection address directly to the other tools.
| Name | Type | Req | Description |
|---|---|---|---|
| query | string | yes | Free-text name search |
No output schema declared.
No examples provided.
verify_claim Verify a claim against the chain ~208
Check whether something a user was TOLD is actually true. Use this whenever a claim about a collection or asset carries stakes - a project announcing a supply, a seller saying a card has never been traded, a post claiming a wallet holds something, a quoted floor price. Returns confirmed, contradicted, or unverifiable, together with the exact numbers observed, where they were read, and instructions to reproduce the check independently - so the answer does not require trusting this server either. Willingly answers UNVERIFIABLE rather than guessing; a tool that always returns true or false will eventually return false with confidence.
| Name | Type | Req | Description |
|---|---|---|---|
| claim | string | yes | What kind of statement is being checked |
| subject | string | yes | Collection address for supply, asset mint for never-traded/ownership, Magic Eden symbol for floor |
| value | number | – | The claimed number - required for supply (count) and floor (SOL) |
| wallet | string | – | The wallet said to own it - required for ownership claims |
No output schema declared.
No examples provided.
What is the io.github.p1xelapp/solana-nft-mcp server?
io.github.p1xelapp/solana-nft-mcp is listed in the public MCP registry as io.github.p1xelapp/solana-nft-mcp. Read-only Solana NFT data for AI: ownership history, custody rules, marketplace sales and floors. This page covers its npm package (solana-nft-mcp).
Is the io.github.p1xelapp/solana-nft-mcp server safe to use?
io.github.p1xelapp/solana-nft-mcp scores 71 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 25 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.p1xelapp/solana-nft-mcp server expose?
io.github.p1xelapp/solana-nft-mcp exposes 21 tools: identify, verify_claim, get_asset_trust, get_integration_recipe, search_collections, and 16 more. Their descriptions and schemas cost roughly 4,032 tokens of context every time the server is loaded.
Is the io.github.p1xelapp/solana-nft-mcp server still maintained?
io.github.p1xelapp/solana-nft-mcp is still listed as active in the MCP registry. We last reached this channel on 25 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.p1xelapp/solana-nft-mcp server under?
io.github.p1xelapp/solana-nft-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.