so.blackforge/mcp
NPM · @BLACKFORGE-SO/MCP
Crypto market data: order book depth, liquidity lifetimes and taker flow on the major spot venues
Available components
Last scanned (7 hours ago)
Scores higher than 62% of npm servers
Category Finance and Payments
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security81
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 30 of 93 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 5 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability77
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3368 tokens (~198/item across 17 items; 16 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
- Supports UI / widget rendering.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Nov 26 0
- Stability: 0.97 → pass security
- 2 Nov 26 0
- Stability: pass → 0.97 functional
- 31 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 30 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- Package version: 0.4.1 → 0.4.2 functional
- 29 Oct 26 +20
- Known CVEs: unverified → fail ▼ security
- Malware scan: unverified → pass ▲ security
- Dependency health: unverified → 0.86 ▲ functional
- 28 Oct 26 −20
- Known CVEs: fail → unverified ▼ security
- Malware scan: pass → unverified ▼ security
- Dependency health: 0.85 → unverified ▼ functional
- Package version: 0.4.0 → 0.4.1 functional
- 27 Oct 26 0
- Stability: 0.97 → pass security
- 26 Oct 26 0
- Stability: pass → 0.97 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/@blackforge-so/mcp@0.4.2
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-mrhx-c7xc-m3w5 | CVE-2023-54404 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 93 packages
| Packages resolved | 93 |
|---|---|
| Stale | 30 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
blackforge_alert_create Notify when a formula crosses a value ~320
Get notified when a saved live formula crosses a value you set. It is evaluated server-side every interval, whether or not anything is connected. direction: above (goes from at or below the threshold to above it), below (the reverse), or cross (either). After it fires it waits until the value is back on the other side by at least hysteresis and cooldownSeconds (60 to 86400, default 900) have passed. If the condition is already true when created, it starts disarmed and arms once the value is back across. It never fires on null or on a WARMING or stale value. Email goes to the account's verified address (default on); webhookUrl (https) optionally receives a signed POST. The response carries webhookSecret ONCE: store it to verify the x-blackforge-signature header (t=<unix>,v1=<hex HMAC-SHA256 of t.body>). Live formulas and notifications are part of the Ultra plan.
| Name | Type | Req | Description |
|---|---|---|---|
| cooldownSeconds | integer | – | Minimum seconds between notifications. Default 900. |
| direction | string | yes | above, below or cross. |
| boolean | – | Email the account's verified address. Default true. | |
| formulaId | string | yes | The saved formula id, fml_... |
| hysteresis | number | – | How far back across it must go to re-arm. Default 0. |
| threshold | number | yes | The value your formula must cross. |
| webhookUrl | string | – | Optional https URL that receives a signed JSON POST. |
No output schema declared.
No examples provided.
blackforge_alert_delete Delete a formula notification ~40
Delete a formula notification. The formula itself is kept. Cannot be undone.
| Name | Type | Req | Description |
|---|---|---|---|
| alertId | string | yes | The notification id, alr_... |
No output schema declared.
No examples provided.
blackforge_alert_list List formula notifications ~62
List the account's formula notifications ({ alerts, limits }). Each carries its formula, direction, threshold, status (active, paused, quota, plan), whether it is armed, and when it last fired. Live formulas and notifications are part of the Ultra plan.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
blackforge_book Live order book ~159
Read the live order book for one pair right now: the top levels on both sides as [price, quantity] pairs, when it was read (observedAtMs), whether the book is synced or crossed, and level counts. levels is 1 to 200, default 20. Charged 2 rows per level returned. Live order book reads need the Max or Ultra plan and are charged against the monthly row quota.
| Name | Type | Req | Description |
|---|---|---|---|
| exchange | string | yes | Venue from blackforge_catalog, e.g. binance. |
| levels | integer | – | Levels per side, 1 to 200. Default 20. |
| symbol | string | yes | Pair as blackforge_symbols spells it, e.g. BTCUSDT or BTC-USDT. |
No output schema declared.
No examples provided.
blackforge_catalog BlackForge catalog ~300
List every venue BlackForge covers (9 spot exchanges) and every column it measures (one wide row per (exchange, symbol) per minute, served at 1m, 5m, 1h and 1d: order-book depth and shape, resting-liquidity lifetimes, trade-explained vs book-implied volume, spreads, and market-wide context). `metricCount` is the exact number of columns available now. Each metric carries a precise measurement definition, unit, family, and the minimum plan that includes it, the `intervals` it is served at, and, where the 5m/1h/1d value is a rollup of minute values rather than a re-measurement, a one-sentence `rollupNote`. `availableFrom["1m"]` is when the one-minute rows start (null before). `availableFrom.bookOnBoundary` maps each venue to the first window end whose order book was read as it stood at that instant (such rows have `bookObservedAt` equal to `ts`, so venues line up), null before; the order book columns carry a one-sentence `bookTimingNote` on it. The `qualityFlags` metric also carries the `bits` table that decodes the per-row quality mask. This route needs no API key. CALL THIS FIRST to learn the exact `exchange` and `metric` identifiers the other tools accept.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
blackforge_fill Simulate a market order ~215
Walk the live order book to price a market order of a given size right now, without placing anything. Give usd (notional in USD) or size (base quantity). Returns { complete, bps, partialBps, levelsWalked, vwap, depthLimited, bookExhausted }: bps is the cost against the mid in basis points and is null unless the visible book could fill the whole order (then see partialBps, and do not quote it as the cost). Charged one row per level walked. Live order book reads need the Max or Ultra plan and are charged against the monthly row quota.
| Name | Type | Req | Description |
|---|---|---|---|
| exchange | string | yes | Venue, e.g. binance. |
| side | string | yes | buy walks the asks, sell walks the bids. |
| size | number | – | Order size in the base asset. Pass this or usd. |
| symbol | string | yes | Pair as blackforge_symbols spells it. |
| usd | number | – | Order notional in USD. Pass this or size. |
No output schema declared.
No examples provided.
blackforge_formula_create Save a live formula ~199
Save a live formula to the account so it can be streamed (blackforge_formula_watch) and carry notifications (blackforge_alert_create). Returns { formula: { id, name, expr, interval, pairs, horizonSeconds, ... } }. A refused formula comes back as an error with the same located, coded detail blackforge_formula_validate gives; validate first. Saving is free; a formula is charged one row per referenced pair per evaluation only while it is streamed or watched by a notification. Live formulas and notifications are part of the Ultra plan.
| Name | Type | Req | Description |
|---|---|---|---|
| ephemeral | boolean | – | true stores it for one hour only, outside the saved-formula count. Default false. |
| expr | string | yes | The formula source (see blackforge_formula_validate for the language). |
| interval | integer | – | Seconds between evaluations, 1 to 60. Default 1. |
| name | string | yes | A short name, 1 to 80 characters. |
No output schema declared.
No examples provided.
blackforge_formula_delete Delete a live formula ~47
Delete a saved live formula. Its notifications are deleted with it and listed in deletedAlerts. Cannot be undone.
| Name | Type | Req | Description |
|---|---|---|---|
| formulaId | string | yes | The formula id, fml_... |
No output schema declared.
No examples provided.
blackforge_formula_list List live formulas ~52
List the account's saved live formulas, with the plan's limits and current usage ({ formulas, limits, usage: { live, stored, connections } }). Live formulas and notifications are part of the Ultra plan.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
blackforge_formula_validate Check a live formula ~617
Check a live formula without saving it. Free and unmetered, so iterate on it freely. On success returns { ok: true, normalised, pairs, primitives, horizonSeconds, cost: { rowsPerEvaluation, rowsPer30Days } }. On a refusal returns { ok: false, error } where error carries a stable code, a message, the location (at, pointer under the source) and suggestions such as the correct pair spelling: apply them and check again. A formula is an arithmetic expression over live order book and trade data, evaluated server-side every interval (default 1 s). Pairs are written venue:SYMBOL exactly as blackforge_symbols spells them (binance:BTCUSDT, okx:BTC-USDT, coinbase:BTC-USD), and one formula may combine pairs on different venues. Durations are 1s to 60s, or 1m. Book state, read now: bid ask bidQty askQty mid spread spreadBps bidLevels askLevels quoteUsd last lastAge, each (pair). Book walk: bidDepth askDepth imbalance (pair, bps) with bps an integer 1 to 200 written as a number; buyCost sellCost (pair, usd) with usd 100 to 1000000, result in bps. Trades over a window: buyVol sellVol vol buyUsd sellUsd volUsd buyCount sellCount tradeCount netFlow buyShare vwap high low open close maxBuy maxSell (pair, duration); buyUsdAbove sellUsdAbove buyCountAbove sellCountAbove (pair, duration, usd) with usd one of 100, 1000, 10000, 100000. Book changes over a window: bidAdded askAdded bidRemoved askRemoved bidAddedNear askAddedNear bidRemovedNear askRemovedNear bookChanges (pair, duration). Scalar: abs sign sqrt ln log10 exp pow min max clamp round floor ceil if coalesce. Windows over any expression: avgOver minOver maxOver stdOver change pctChange (expr, duration). Operators + - * / ^, comparisons, and, or, not. A missing input gives null, never a made-up number. The sum of windows on any path (the horizon) is at most 60 s. Examples: mid(binance:BTCUSDT) - mid(okx:BTC-USDT); imbalance(binance:ETHUSDT, 50); buyVol(binance:SOLUSDT, 60s) / max(sellVol(binance:SOLUSDT, 60s), 1); avgOver(spreadB…
| Name | Type | Req | Description |
|---|---|---|---|
| expr | string | yes | The formula source, e.g. mid(binance:BTCUSDT) - mid(okx:BTC-USDT). |
| interval | integer | – | Seconds between evaluations, 1 to 60. Default 1. |
No output schema declared.
No examples provided.
blackforge_formula_watch Watch a live formula ~261
Stream a live formula for a few seconds and return what arrived: first, last, min, max, the number of samples, which value flags appeared (with a plain note for each), and the full series of { ts, value, flags? } with ts in epoch milliseconds. Pass formulaId for a saved formula, or expr to watch a formula once (it is saved as a one-hour formula first). seconds is 1 to 60, default 20. A value flagged WARMING is computed over less than its full window, because the formula is younger than its horizon; it settles by warmUntil. null means there was no number (for example no print in a trade window), never zero. Charged one row per referenced pair per evaluation. Live formulas and notifications are part of the Ultra plan.
| Name | Type | Req | Description |
|---|---|---|---|
| expr | string | – | A formula source to watch once. Pass this or formulaId. |
| formulaId | string | – | A saved formula id, fml_... Pass this or expr. |
| interval | integer | – | Only with expr: seconds between evaluations, 1 to 60. Default 1. |
| seconds | integer | – | How long to collect, 1 to 60 s. Default 20. |
No output schema declared.
No examples provided.
blackforge_latest BlackForge latest bucket ~289
Return the latest completed bucket for one (exchange, symbol), at the key plan's interval (1 minute on Ultra and PAYG, 5 minutes otherwise): a `values` object mapping each column key to its measured number (or null when not observed), plus the window END timestamp `ts` in epoch milliseconds. Omit `columns` to get every column your plan includes; pass a subset of column keys (from blackforge_catalog) to narrow the payload. Columns your plan does not cover are dropped and reported in `columnsOmitted` so you can see why a key is absent. WHEN PRESENT, a `quality` object reports the row's measurement quality: `flags` names what went wrong during the window and `contaminates` lists which figures it flags, with a plain-English `qualityNote` beside it. Read it before trusting an unusual value. A `quality.raw` of 32768 means the row predates the quality rail and was never assessed; that is unknown, not bad. When the key is absent, the row carries no quality assessment at all.
| Name | Type | Req | Description |
|---|---|---|---|
| columns | array | – | Optional subset of column keys from blackforge_catalog. Omit for all plan-included columns. |
| exchange | string | yes | Venue identifier, e.g. binance. |
| symbol | string | yes | Trading pair from blackforge_symbols, e.g. BTCUSDT. |
No output schema declared.
No examples provided.
blackforge_series BlackForge time series ~475
Return a time series for one column of one (exchange, symbol): `points` is an ascending array of { ts, value } where `ts` is epoch milliseconds and `value` is the measured number (or null). `from`/`to` are ISO-8601 datetimes; `interval` is one of 1m, 5m, 1h, 1d. 1m is on Ultra and PAYG (PAYG bills a 1m row at five times a 5m row); Max and below go down to 5m, and a finer interval than the plan allows is a 403. 1m rows exist only from the switch to one-minute rows on (see blackforge_catalog `availableFrom`); for earlier ranges use 5m, which covers all history. The server caps a response at 50,000 points (about 34 days at 1m) and keeps the NEWEST; `truncated: true` says the range was cut, so narrow it or use a coarser interval. If the requested `metric` is above your plan, `points` comes back empty and the column is listed in `columnsOmitted`, which is why it is empty. WHEN ANY BUCKET IS FLAGGED, a `qualitySummary` object reports how many of the buckets carry a quality flag and which flags they are (`{ flaggedBuckets, of, flags }`); per-bucket quality is deliberately not repeated on every point. No `qualitySummary` means no bucket in the range was flagged.
| Name | Type | Req | Description |
|---|---|---|---|
| exchange | string | yes | Venue identifier, e.g. binance. |
| from | string | yes | Start datetime, ISO-8601, e.g. 2026-07-01T00:00:00Z. |
| interval | string | yes | Bucket size: 1m (Ultra and PAYG), 5m, 1h, or 1d. |
| metric | string | yes | Column key from blackforge_catalog, e.g. spreadMean. |
| symbol | string | yes | Trading pair, e.g. BTCUSDT. |
| to | string | yes | End datetime, ISO-8601, e.g. 2026-07-02T00:00:00Z. |
No output schema declared.
No examples provided.
blackforge_spread_map Live spread across venues ~108
Best bid and best ask for one base/quote pair on every venue that lists it, all read within the same moment, so a difference between venues is a real difference rather than a timing artefact. Charged 2 rows per venue. Live order book reads need the Max or Ultra plan and are charged against the monthly row quota.
| Name | Type | Req | Description |
|---|---|---|---|
| base | string | yes | Base asset, e.g. BTC. |
| quote | string | yes | Quote asset, e.g. USDT. |
No output schema declared.
No examples provided.
blackforge_symbols BlackForge symbols ~119
List the trading pairs (symbols) a given venue trades, as an array of symbol strings. Use these values as the `symbol` argument to blackforge_latest and blackforge_series. Valid `exchange` values come from blackforge_catalog (e.g. binance, bybit, coinbase, kraken, okx). A venue outside the caller's plan returns HTTP 403 with the plan and an upgrade URL.
| Name | Type | Req | Description |
|---|---|---|---|
| exchange | string | yes | Venue identifier from blackforge_catalog, e.g. binance, okx, coinbase. |
No output schema declared.
No examples provided.
blackforge_usage BlackForge usage ~70
Report the calling key's recent usage: `days` is a per-day breakdown of request counts and the last request time, and `rowsRemaining` is the monthly row quota still available (omitted for usage-based plans that have no monthly ceiling). Use this to check headroom before a large pull.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
How do I install the so.blackforge/mcp server?
so.blackforge/mcp runs locally as an npm package, launched with npx -y @blackforge-so/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @blackforge-so/mcp
claude mcp add so-blackforge-mcp -- npx -y @blackforge-so/mcp
What is the so.blackforge/mcp server?
so.blackforge/mcp is listed in the public MCP registry as so.blackforge/mcp. Crypto market data: order book depth, liquidity lifetimes and taker flow on the major spot venues. This page covers its npm package (@blackforge-so/mcp).
Is the so.blackforge/mcp server safe to use?
so.blackforge/mcp scores 79 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the so.blackforge/mcp server expose?
so.blackforge/mcp exposes 16 tools: blackforge_catalog, blackforge_symbols, blackforge_latest, blackforge_series, blackforge_usage, and 11 more. Their descriptions and schemas cost roughly 3,333 tokens of context every time the server is loaded.
Is the so.blackforge/mcp server still maintained?
so.blackforge/mcp is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the so.blackforge/mcp server under?
so.blackforge/mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.