Quidli Connect
NPM · @QUIDLI/CONNECT-MCP · 2 COMPONENTS
Resolve social handles to wallets, score onchain reputation, and make agent payments in USDC.
Available components
Last scanned (9 hours ago)
Scores higher than 38% of npm servers
Category Crypto and Web3
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 37 of 131 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability63
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 1804 tokens (~128/item across 14 items; 14 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage92
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 75% of tool parameters carry a description.Partial
Tool Safety92
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 2 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "connect_drop_balance" implies "drop" and declares readOnlyHint instead, contradicting what its own name says it does. See how to fix → Partial
- An AI judge read all 14 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 18 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 17 Oct 26 52
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 18 Oct 2026 · Analysed npm/@quidli/connect-mcp@0.6.12
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 131 packages
| Packages resolved | 131 |
|---|---|
| Stale | 37 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
connect_drop Send Tokens (Smart Send) ~768
Execute a Smart Send from the API key owner Connect embedded wallet. EVM: batch native or ERC-20 (need native gas plus the token). Solana (chainId 1399811149): SOL or SPL from the Solana embedded wallet; packs up to 20 native or 10 SPL recipients per transaction. Social recipient types: email, phone, telegram, discord, farcaster, twitter, github (id or username). linkedin and slack are not on /drop — use connect_lookup first, then type wallet. After connect_lookup, EVM payouts use ethWalletAddress (never solWalletAddress); Solana payouts use solWalletAddress (never ethWalletAddress). Social types on /drop resolve server-side; for type wallet, pass the resolved payout address for the target chain. Omit tokenContract or set it to null for the native token; pass an ERC-20 contract or SPL mint otherwise — do not use the zero address. Amounts are smallest-unit integer strings (ETH 18 decimals, SOL 9, USDC usually 6). Solana native (tokenContract null): no ATA. Sending to a recipient without an existing funded account requires amount ≥ 890880 lamports (rent-exempt minimum for a system account); that SOL stays with the recipient. Below that the tx fails. Sender also pays a ~5000-lamport fee. Solana SPL: tokens sit in Associated Token Accounts (ATA), not on the wallet pubkey. Recipients need not already hold the token — the API prepends CreateIdempotent. The sender (not the recipient) pays ~2039280 lamports (~0.002039 SOL) rent per newly created dest ATA, plus tx fees, on top of the token amount (which can be as small as 1 unit). A 400 "Insufficient funds" on SPL is often missing SOL for ATA rent, not missing USDC. Token-2022 is not supported; USDC mint is EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v. Always call connect_drop_balance first. Returns 201 when submitted or 202 when recipients still processing — retry with the same idempotencyKey.
| Name | Type | Req | Description |
|---|---|---|---|
| amountInWeiPerRecipient | – | – | Uniform amount in smallest units. Native ETH uses 18 decimals; SOL uses 9; ERC-20/SPL uses token decimals from connect_drop_balance (USDC usually 6). Omit when setting amountInWei on each recipient. |
| chainId | integer | yes | EVM chain ID or 1399811149 for Solana mainnet |
| idempotencyKey | string | yes | – |
| ignoreFailedRecipients | boolean | – | When true, send to recipients that resolved successfully and skip failed lookups. |
| recipients | array | yes | Wallet or social recipients (all wallet or all social, no mix). Social types: email, phone, telegram, discord, farcaster, twitter, github (numeric id or username). linkedin and slack are not supporte… |
| tokenContract | string|null | – | EVM ERC-20 contract or Solana SPL mint. Omit or null for the native token (ETH/POL/AVAX, or SOL on 1399811149). Do not use the zero address. |
| trustFilter | object | – | Keep only recipients in the sender EAS trust graph. |
No output schema declared.
No examples provided.
connect_drop_balance Check Smart Send Balance ~260
Get native and token balances for the API key owner embedded wallet. Accepts Smart Send chains and enabled delegation chains. Robinhood Chain (4663) returns ERC-20 balances from Blockscout. Monad (143) returns ERC-20 balances from Moralis; other delegation chains return native plus featured tokens. Always call before connect_drop. Zero balances are omitted, so a missing token means balance 0. EVM: confirm native gas plus the ERC-20 being sent. Solana (chainId 1399811149): SOL in this response is spendable lamports on the wallet pubkey (rent locked in existing token accounts is not included). Native SOL drop to a recipient without an existing funded account: amount itself must be ≥ 890880 lamports and sender SOL must cover amount + ~5000 lamports fee. SPL drop: token balance ≥ total amount, and SOL ≥ tx fee + ~2039280 lamports (~0.002039 SOL) per recipient that may need a new Associated Token Account — even when sending USDC. Insufficient SOL for ATA rent fails before the token transfer.
| Name | Type | Req | Description |
|---|---|---|---|
| chainId | integer | yes | EVM chain ID or 1399811149 for Solana mainnet (Smart Send) |
No output schema declared.
No examples provided.
connect_get_chains List Supported Chains ~61
List product chains with per-feature compatibility. lookup is true for EVM catalog chains and Solana; drop is true for Smart Send chains, enabled delegation chains, and Solana (chainId 1399811149 for connect_drop / connect_drop_balance).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
connect_get_price Get x402 Prices ~33
Get public x402 list prices for lookup and scores (reference only; live paywall amounts are in 402 responses).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
connect_lookup Resolve Handle to Wallet ~74
Resolve social identities to EVM and Solana wallet addresses. Resolving a recipient who has no wallet provisions one for them, so this is read-only for the caller but not for the recipient. If status is processing, retry the same payload.
| Name | Type | Req | Description |
|---|---|---|---|
| recipients | array | yes | Recipients to resolve to EVM/Solana wallets |
No output schema declared.
No examples provided.
connect_lookup_exposed List Exposed Accounts ~101
List platforms a recipient has exposed on Connect, with enriched profile, scores, and wallet addresses. Recipient may be a social account, an exposed wallet (EVM/Solana/smart wallet), or a Connect username. May require x402 payment when the profile owner charges for lookups.
| Name | Type | Req | Description |
|---|---|---|---|
| recipient | object | yes | Social identity, exposed wallet (EVM/Solana/smart wallet), or Connect username whose exposed linked accounts and Connect profile should be listed |
No output schema declared.
No examples provided.
connect_me Get My Connect Profile ~35
Get the Connect profile, scores, and all linked accounts for the API key owner. Use to identify which user the key belongs to.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
connect_scores_batch Score Identities (Batch) ~73
Batch scores for linked accounts or Connect usernames. One result per request user. Optional filter sets passedFilter (quidli 0–100, neynar/lens 0–1, ethos 0–2800).
| Name | Type | Req | Description |
|---|---|---|---|
| filter | object | – | – |
| users | array | yes | Users to fetch scores for |
No output schema declared.
No examples provided.
connect_scores_by_account Score a Linked Account ~33
Scores for a linked social account or wallet.
| Name | Type | Req | Description |
|---|---|---|---|
| identifier | string | yes | – |
| platform | string | yes | – |
No output schema declared.
No examples provided.
connect_scores_by_username Score a Connect Username ~23
Scores by Connect public username.
| Name | Type | Req | Description |
|---|---|---|---|
| username | string | yes | – |
No output schema declared.
No examples provided.
connect_trust_check Check Trust ~65
Check whether identities sit in a trust graph at depth 1. Omit context to match any context.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | If set, only this context matches |
| from | object | yes | Graph owner |
| targets | array | yes | Identities to test |
No output schema declared.
No examples provided.
connect_trust_create Create Trust Attestation ~127
Create a unidirectional trust attestation on Base (EAS) from the API key owner embedded wallet to a wallet or social identity. Identical active attestations are returned without a new transaction. Requires CONNECT_API_KEY, Smart Send attestation signer enrolled, and ETH on Base for gas.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | Optional context such as team:quidli |
| expiresIn | integer | – | Optional lifetime in seconds |
| level | integer | yes | Trust level 1–100 |
| to | object | yes | Identity to trust (wallet, social, or Connect username) |
No output schema declared.
No examples provided.
connect_trust_graph List Trust Edges ~74
List outgoing or incoming trust edges for an identity at depth 1.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | – |
| direction | string | – | out = who they trust (default); in = who trusts them |
| identifier | string | yes | – |
| platform | string | yes | Identity platform, or username for a Connect username |
No output schema declared.
No examples provided.
connect_trust_revoke Revoke Trust Attestation ~77
Revoke active trust attestations from the API key owner to a target. Optional context limits which attestations are revoked. Requires CONNECT_API_KEY and ETH on Base.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | Revoke only this context. Omit to revoke all contexts for the pair. |
| to | object | yes | Identity to untrust |
No output schema declared.
No examples provided.
How do I install the Quidli Connect MCP server?
Quidli Connect runs locally as an npm package, launched with npx -y @quidli/connect-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @quidli/connect-mcp
claude mcp add quidli-connect-mcp -- npx -y @quidli/connect-mcp
What is the Quidli Connect MCP server?
Quidli Connect is an MCP server listed in the public MCP registry as io.github.Quidli/connect-mcp. Resolve social handles to wallets, score onchain reputation, and make agent payments in USDC. This page covers its npm package (@quidli/connect-mcp).
Is the Quidli Connect MCP server safe to use?
Quidli Connect scores 67 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 18 October 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Quidli Connect MCP server expose?
Quidli Connect exposes 14 tools: connect_get_price, connect_get_chains, connect_lookup, connect_lookup_exposed, connect_scores_batch, and 9 more. Their descriptions and schemas cost roughly 1,804 tokens of context every time the server is loaded.
Is the Quidli Connect MCP server still maintained?
Quidli Connect is still listed as active in the MCP registry. We last reached this channel on 18 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Quidli Connect MCP server under?
Quidli Connect declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.