io.github.tevfikefeaydin/agenttoll
NPM · AGENTTOLL-MCP
21 paid data tools plus free quote/budget inspection, with bounded USDC payments on Base.
Available components
Last scanned (12 hours ago)
Scores higher than 91% of npm servers
Category Crypto and Web3
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security81
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 30 of 112 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to tevfikefeaydin/agenttoll). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 51 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability81
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 1965 tokens (~85/item across 23 items; 23 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management70
- Stability observed for 21 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 23 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 23 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 67 to 70. That category is still filling its 30-day observation window: 20 days of observed history at the previous scan, 21 at this one. The score rises as the window fills, whether or not the server changes.
- 3 Nov 26 −5
- Stability: pass → 0.63 functional
- 29 Oct 26 0
- Dependency health: partial → 0.89 functional
- 28 Oct 26 +1
- Stability: 0.97 → pass security
- 27 Oct 26 −1
- Dependency health: 0.89 → partial functional
- Stability: pass → 0.97 functional
- 24 Oct 26 −5
- CVE-2023-54404 affects this package: high ▼ security
- Known CVEs: pass → fail ▼ security
- 21 Oct 26 0
- Stability: 0.97 → pass security
- 20 Oct 26 0
- Stability: pass → 0.97 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/agenttoll-mcp@0.14.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | tevfikefeaydin/agenttoll |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/tevfikefeaydin/agenttoll/.github/workflows/publish-mcp.yml@refs/tags/mcp-v0.14.0 |
| Rekor log index | 2833148569 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:fced093daf402840c6aa3da00dcf918ef26f8963e6ae214a7d692ad36960f1fc9c59c5ea291595e1d0d15cea74acf294a503416b66b627ac078bf3486 |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-mrhx-c7xc-m3w5 | CVE-2023-54404 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 112 packages
| Packages resolved | 112 |
|---|---|
| Stale | 30 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
check_token_safety ~135
Automated safety checks for a Base token: a simulated buy and sell to catch honeypots, buy/sell tax, contract verification, what the owner can still do, holder concentration, whether anyone can still withdraw the liquidity, and who deployed the contract - a token shipped from a wallet with a handful of transactions and dust in it is the shape most rugs share. The verdict is clear, caution, high-risk or insufficient-data — a token too new to check is never reported as clear. Costs $0.003 in USDC via x402.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | Token contract address on Base (0x...) |
No output schema declared.
No examples provided.
get_base_address_info ~50
Base address snapshot: ETH balance, tx count, contract or EOA. Costs $0.001 in USDC via x402.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | Address on Base (0x...) |
No output schema declared.
No examples provided.
get_base_gas ~84
Base network gas price and latest block. Pass gasLimit to also get what a transaction that size would cost in ETH and USD. Costs $0.001 in USDC via x402.
| Name | Type | Req | Description |
|---|---|---|---|
| gasLimit | integer | – | Gas units to price: 21000 a transfer, ~65000 an ERC-20 transfer, 150000-300000 a swap |
No output schema declared.
No examples provided.
get_base_portfolio ~115
Everything a Base address holds, valued in USD: ETH plus its ERC-20 tokens, largest first. The reply carries totals and says how many holdings fell below the floor or could not be priced. Costs $0.003 in USDC via x402.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | Address on Base (0x...) |
| limit | integer | – | How many holdings to list (default 20) |
| minValue | number | – | USD floor per holding, which keeps airdropped spam out (default 1) |
No output schema declared.
No examples provided.
get_base_token_price ~49
Onchain USD price for any Base token by contract address. Costs $0.001 in USDC via x402.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | Token contract address on Base (0x...) |
No output schema declared.
No examples provided.
get_base_trending_pools ~56
Trending DEX pools on Base: price, 24h volume, liquidity. Costs $0.002 in USDC via x402.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | How many pools to return (default 10) |
No output schema declared.
No examples provided.
get_fear_greed ~62
Crypto Fear & Greed index with yesterday comparison. Pass days to also get a daily history, which shows whether sentiment is turning. Costs $0.001 in USDC via x402.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | Days of daily history to include |
No output schema declared.
No examples provided.
get_fresh_pools ~167
Pools read straight off Base seconds after they exist, before any indexer has them - the earliest possible signal that a token launched. Returns the launched token address (ready for check_token_safety), whether anyone has funded it yet, and whether its Uniswap v4 hook belongs to a launchpad used by many pools or is bespoke code shipped with this one token. USD liquidity is deliberately not claimed here; use get_new_token_radar for that, minutes later. Costs $0.004 in USDC via x402.
| Name | Type | Req | Description |
|---|---|---|---|
| fundedOnly | boolean | – | Drop pools nobody has added liquidity to yet |
| limit | integer | – | How many pools to return, youngest first (default 15) |
| minutes | integer | – | How far back to look (default 10) |
No output schema declared.
No examples provided.
get_market_brief ~89
One-call market brief: prices, Base gas, Fear & Greed. Defaults to BTC/ETH/SOL; pass symbols to price whatever you actually track, at the same flat price. Costs $0.005 in USDC via x402.
| Name | Type | Req | Description |
|---|---|---|---|
| symbols | array | – | Tickers or CoinGecko ids to price instead of the majors, e.g. ['eth','degen'] |
No output schema declared.
No examples provided.
get_new_token_radar ~99
New token radar: pools created on Base in the last ~24h that already have real liquidity. The default floor is $10k; raise it to cut more spam, lower it to see everything new. Costs $0.003 in USDC via x402.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | How many pools to return (default 15) |
| minLiquidity | number | – | Liquidity floor in USD (default 10000) |
No output schema declared.
No examples provided.
get_payment_budget ~44
Free: inspect the session USDC limit, spent/reserved/remaining amounts, expected network and recipient. Ambiguous signed failures remain reserved. This tool never requests a payment.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_payment_quote ~84
Free: request and validate an unsigned x402 quote for a registered AgentToll endpoint path. Shows the quote and its price ceiling without using a private key or spending budget.
| Name | Type | Req | Description |
|---|---|---|---|
| path | string | yes | Concrete registered endpoint path with optional query, e.g. /api/price/eth or /api/base/fresh?minutes=5. Absolute URLs are not accepted. |
No output schema declared.
No examples provided.
get_price ~56
Spot price (USD) + 24h change for a crypto asset. Costs $0.001 in USDC via x402.
| Name | Type | Req | Description |
|---|---|---|---|
| symbol | string | yes | Ticker (eth, btc, sol...) or CoinGecko id |
No output schema declared.
No examples provided.
get_radar_history ~94
Read a published scout snapshot at an immutable git SHA, with provenance links and any recorded payment receipt. The SHA pins the published bytes; the receipt does not authenticate snapshot contents or prove capture time. Use this to inspect the observations behind get_radar_scorecard. Costs $0.002 in USDC via x402.
| Name | Type | Req | Description |
|---|---|---|---|
| date | string | – | Snapshot day as YYYY-MM-DD (default: the most recent one) |
No output schema declared.
No examples provided.
get_radar_scorecard ~120
Compare tokens in the latest published radar snapshots with current provider observations, grouped by their first observed safety verdict. Holding periods vary. Missing prices and outcomes remain null; liquidityGone means observed liquidity below $100, not proof that all liquidity disappeared. Coverage reports missing snapshots, unassessed tokens and unavailable quotes. Publication bytes are pinned to a git SHA. Costs $0.005 in USDC via x402.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | Number of latest published snapshot days, not a calendar lookback or fixed holding period (default 7) |
No output schema declared.
No examples provided.
get_trending ~42
Tokens trending across the market right now. Costs $0.002 in USDC via x402.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Return only the top N tokens |
No output schema declared.
No examples provided.
get_try_premium ~71
Turkish lira premium: implied vs official USD/TRY via a crypto cross-rate. USDT is the reading desks quote, because it is what actually changes hands. Costs $0.002 in USDC via x402.
| Name | Type | Req | Description |
|---|---|---|---|
| asset | string | – | Which asset carries the cross-rate (default btc) |
No output schema declared.
No examples provided.
get_try_spread ~77
Turkish exchange spread: BTCTurk and Paribu's TRY quotes converted back to USD via the official rate and compared against the global price, so you can see which local exchange is charging the bigger premium. Costs $0.002 in USDC via x402.
| Name | Type | Req | Description |
|---|---|---|---|
| asset | string | – | Which pair to check (default btc) |
No output schema declared.
No examples provided.
resolve_basename ~80
Resolve a Basename both ways: pass a name (agenttoll.base.eth, or just agenttoll) to get its address and text records, or pass a 0x address to get its primary basename. Costs $0.001 in USDC via x402.
| Name | Type | Req | Description |
|---|---|---|---|
| query | string | yes | A basename or a 0x address |
No output schema declared.
No examples provided.
scout_new_tokens ~124
The radar and the safety check in one call: today's new Base pools above your liquidity floor, each returned with a safety verdict already attached (honeypot simulation, taxes, owner powers, holder concentration). One call instead of N+1. A pool whose check could not run is returned with safety: null, never dropped. Costs $0.008 in USDC via x402.
| Name | Type | Req | Description |
|---|---|---|---|
| minLiquidity | number | – | Liquidity floor in USD (default 15000) |
| pools | integer | – | How many of the top pools to check (default 3) |
No output schema declared.
No examples provided.
watch_base_address ~94
Paginated Base address activity. Pass the previous reply's opaque cursor as since and drain pages while hasMore is true. partial and coverage describe incomplete scans; deduplicate overlapping/replayed transactions by hash. Costs $0.002 in USDC via x402.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | Address on Base (0x...) |
| since | string | – | Opaque cursor from the previous reply, or an initial ISO timestamp |
No output schema declared.
No examples provided.
watch_new_tokens ~82
Base pools in the current liquidity-filtered radar listing that appeared since a cursor. Pass the previous reply's cursor as since. The ranked listing is always partial; coverage.complete is false and older or late-indexed pools can be absent. Costs $0.003 in USDC via x402.
| Name | Type | Req | Description |
|---|---|---|---|
| since | string | – | ISO timestamp cursor from the previous reply |
No output schema declared.
No examples provided.
watch_price_alert ~91
Cheap poll: has an asset moved past a threshold from your reference price? Returns triggered true/false. Costs $0.001 in USDC via x402.
| Name | Type | Req | Description |
|---|---|---|---|
| pct | number | – | Threshold in percent (default 2) |
| ref | number | yes | Reference price in USD to compare against |
| symbol | string | yes | Ticker (eth, btc, sol...) or CoinGecko id |
No output schema declared.
No examples provided.
How do I install the io.github.tevfikefeaydin/agenttoll MCP server?
io.github.tevfikefeaydin/agenttoll runs locally as an npm package, launched with npx -y agenttoll-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · agenttoll-mcp
claude mcp add tevfikefeaydin-agenttoll -- npx -y agenttoll-mcp
What is the io.github.tevfikefeaydin/agenttoll MCP server?
io.github.tevfikefeaydin/agenttoll is an MCP server listed in the public MCP registry as io.github.tevfikefeaydin/agenttoll. 21 paid data tools plus free quote/budget inspection, with bounded USDC payments on Base. This page covers its npm package (agenttoll-mcp).
Is the io.github.tevfikefeaydin/agenttoll MCP server safe to use?
io.github.tevfikefeaydin/agenttoll scores 87 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.tevfikefeaydin/agenttoll MCP server expose?
io.github.tevfikefeaydin/agenttoll exposes 23 tools: get_payment_budget, get_payment_quote, get_price, get_base_gas, get_trending, and 18 more. Their descriptions and schemas cost roughly 1,965 tokens of context every time the server is loaded.
Is the io.github.tevfikefeaydin/agenttoll MCP server still maintained?
io.github.tevfikefeaydin/agenttoll is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.tevfikefeaydin/agenttoll MCP server under?
io.github.tevfikefeaydin/agenttoll declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.