# secondlayer (npm · @secondlayer/mcp)

Stacks chain data: contracts, events, transfers, subgraph scaffolds. Hosted with browser sign-in.

- Trust score: 73/100 (medium)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `api.secondlayer.tools`: 36/100, [markdown](https://verifymcp.io/servers/tools-secondlayer-secondlayer/api.md), [page](https://verifymcp.io/servers/tools-secondlayer-secondlayer/api)
- npm · `@secondlayer/mcp`: 73/100 (this document), [markdown](https://verifymcp.io/servers/tools-secondlayer-secondlayer/secondlayer-mcp.md), [page](https://verifymcp.io/servers/tools-secondlayer-secondlayer/secondlayer-mcp)

## Channel facts

- Registry: `npm`
- Package: `@secondlayer/mcp`
- Version: `11.2.4`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 99/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 30 of 146 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 2 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 84/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 5006 tokens (~96/item across 52 items; 47 tools + 5 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 98/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 93% of tool parameters carry a description.
- **Tool Safety**: 75/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - 0 of 4 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "subgraphs_delete" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default.
  - An AI judge read all 48 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the secondlayer MCP server?

secondlayer runs locally as an npm package, launched with npx -y @secondlayer/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add tools-secondlayer-secondlayer -- npx -y @secondlayer/mcp
```

### Cursor

```json
{
  "mcpServers": {
    "tools-secondlayer-secondlayer": {
      "command": "npx",
      "args": [
        "-y",
        "@secondlayer/mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "tools-secondlayer-secondlayer": {
      "command": "npx",
      "args": [
        "-y",
        "@secondlayer/mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add tools-secondlayer-secondlayer -- npx -y @secondlayer/mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "tools-secondlayer-secondlayer": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@secondlayer/mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add tools-secondlayer-secondlayer --command npx --arg -y --arg @secondlayer/mcp
```

### Hermes

```yaml
mcp_servers:
  tools-secondlayer-secondlayer:
    command: "npx"
    args: ["-y", "@secondlayer/mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "tools-secondlayer-secondlayer": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@secondlayer/mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add tools-secondlayer-secondlayer -t stdio -c npx -a -y @secondlayer/mcp
```

### Other

```json
{
  "mcpServers": {
    "tools-secondlayer-secondlayer": {
      "command": "npx",
      "args": [
        "-y",
        "@secondlayer/mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-03 (score 73, +1)

No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-01 (score 72, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-30 (score 71, +1)

No change was recorded against any check on this day. Stability & Change Management went from 0 to 3. That category is still filling its 30-day observation window: 0 days of observed history at the previous scan, 1 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-29 (score 70)

First indexed and scored.

## MCP tools (47)

### `subgraphs_scaffold` (~142 tokens)

Generate a subgraph from observed print events when available; ABI token transfers or public functions only when the contract has never printed. Review the TypeScript, run subgraphs_test until ok: true with written >= 1, read skipped, then subgraphs_deploy. dryRun is DDL only.

Input parameters:

- `contractId` (string, required): Fully qualified contract ID (e.g. SP102V8P0F7JX67ARQ77WEA3D3CFB5XW39REDT0AM.amm-pool-v2-01)
- `subgraphName` (string): Override the subgraph name (defaults to contract name)

### `subgraphs_list` (~27 tokens)

List all deployed subgraphs. Returns summary fields only; read rows with subgraphs_query.

### `subgraphs_status` (~48 tokens)

Get full details of a subgraph including schema, health (incl. health.emptyMapping when processed events wrote 0 rows), and table columns.

Input parameters:

- `name` (string, required): Subgraph name

### `subgraphs_spec` (~124 tokens)

Fetch a subgraph's self-describing spec — the tables, columns, filters, and read URLs a consumer needs, without guessing. `agent` (default) returns the compact JSON schema built for tool use, `openapi` the OpenAPI document for the subgraph's read routes, `markdown` human-readable docs. Read it before writing queries against an unfamiliar subgraph.

Input parameters:

- `format` (string): agent = JSON schema for tool use (default), openapi = OpenAPI JSON, markdown = docs.md
- `name` (string, required): Subgraph name

### `subgraphs_query` (~328 tokens)

Query rows from a subgraph table (max 200 rows), reading the open /v1 surface — { rows, next_cursor, tip } envelope, cursor-paginated (no offset). Filters support operators: "amount.gte": "1000", "sender.neq": "SP...", "name.like": "%token%". Available operators: eq, neq, gt, gte, lt, lte, like. Every page with rows returns next_cursor (null only when empty): pass it back as `cursor` to read the next page. To TAIL new rows (no streaming over MCP), poll with cursor = next_cursor ?? the cursor you sent. Fetch one row by id with {"_id": "<id>"}. The same rows are readable over HTTP at GET /v1/subgraphs/<name>/<table>; hand that URL to third parties.

Input parameters:

- `count` (boolean): If true, return row count instead of rows
- `cursor` (string): Resume from a previous response's nextCursor
- `fields` (string): Comma-separated column list to return (e.g. "sender,amount")
- `filters` (object): Column filters — plain values or with operators (e.g. {"amount.gte": "1000", "sender": "SP..."})
- `limit` (number): Max rows (default 50, max 200)
- `name` (string, required): Subgraph name
- `order` (string): Sort order
- `sort` (string): Column to sort by
- `table` (string, required): Table name

### `subgraphs_reindex` (~81 tokens)

Reindex a subgraph: drops and rebuilds the whole subgraph from its start block to chain tip. Takes no block range — use subgraphs_backfill to process a specific range. Returns an operationId — check subgraphs_status (health) or the REST operations endpoint to track progress to completion.

Input parameters:

- `name` (string, required): Subgraph name

### `subgraphs_backfill` (~116 tokens)

Backfill a subgraph over a block range. Non-destructive forward fill (does not drop existing data) — unlike subgraphs_reindex, and the only data-fill path for BYO subgraphs (reindex is blocked there). Both blocks required. Returns an operationId — check subgraphs_status (health) or the REST operations endpoint to track progress.

Input parameters:

- `fromBlock` (integer, required): Start block (inclusive)
- `name` (string, required): Subgraph name
- `toBlock` (integer, required): End block (inclusive)

### `subgraphs_stop` (~60 tokens)

Cancel an in-flight reindex or backfill operation for a subgraph. Returns the stop request status; check subgraphs_status (health) or the REST operations endpoint to confirm it reaches a terminal state.

Input parameters:

- `name` (string, required): Subgraph name

### `subgraphs_gaps` (~105 tokens)

List indexing gaps (missing block ranges) for a subgraph. Each gap reports start/end/size, reason, and detected/resolved timestamps. Feed an unresolved gap's range into subgraphs_backfill to fill it. Defaults to unresolved gaps.

Input parameters:

- `limit` (integer): Max gaps to return
- `name` (string, required): Subgraph name
- `offset` (integer): Pagination offset
- `resolved` (boolean): Filter by resolved state (omit for unresolved only)

### `subgraphs_operations` (~138 tokens)

Operation history for a subgraph (deploy/reindex/backfill/stop), newest first — status, block range, progress, and error. THIS IS THE VERIFY CALL: after subgraphs_deploy, subgraphs_reindex, subgraphs_backfill, or subgraphs_stop, poll it with the returned operationId until `status` is terminal (completed/failed/cancelled) before reporting success. Omit operationId for the recent history.

Input parameters:

- `name` (string, required): Subgraph name
- `operationId` (string): Fetch one operation by id (the operationId returned by reindex/backfill/stop); omit for recent history

### `subgraphs_delete` (~25 tokens)

Delete a subgraph permanently.

Input parameters:

- `name` (string, required): Subgraph name

### `subgraphs_deploy` (~159 tokens)

Deploy a subgraph from TypeScript code. Pass the full defineSubgraph() source — it will be bundled, validated, and deployed. Optional startBlock overrides the source definition for this deploy. dryRun validates schema/DDL only and does not run handlers — call subgraphs_test first and deploy only when it returns ok: true with written >= 1. Call subgraphs_reindex separately if you need a forced reindex.

Input parameters:

- `code` (string, required): TypeScript source code containing a defineSubgraph() call
- `dryRun` (boolean): Validate schema/DDL only — does not run handlers. Use subgraphs_test to prove a mapping writes rows.
- `startBlock` (integer): Override the definition startBlock for this deploy

### `subgraphs_test` (~160 tokens)

Prove a subgraph mapping writes rows against Index data before deploy. Pass full defineSubgraph() source plus a height range. Returns ok/written/tables; EMPTY_MAPPING means events matched but 0 rows were written — read hint for observed event.data keys and do not invent fields. subgraphs_deploy dryRun is DDL only; do not deploy until ok: true with written >= 1.

Input parameters:

- `code` (string, required): TypeScript source containing a defineSubgraph() call
- `fromHeight` (integer, required): Start block height (inclusive)
- `limit` (integer): Max Index rows per source (default 50, max 200)
- `toHeight` (integer): End block height (inclusive); default fromHeight+100

### `webhooks_list` (~25 tokens)

List all webhooks for the current account. Returns summary fields (no secrets).

### `webhooks_get` (~37 tokens)

Get full detail for a webhook (triggers, auth, retry config, circuit state).

Input parameters:

- `id` (string, required): Webhook id

### `webhooks_create` (~176 tokens)

Create a webhook that fires on raw chain events (set triggers). Returns `signingSecret` ONCE — forward it to the user so they can wire it into their receiver.

Input parameters:

- `authConfig` (object): Receiver auth sent with each delivery, e.g. {"type": "bearer", "token": "..."}
- `format` (string): Wire format (default standard-webhooks)
- `name` (string, required): Human-readable name, unique per account
- `triggers` (array, required): Chain triggers. Each targets a raw chain event/tx; string fields accept `*` wildcards, `trait` scopes to a SIP/trait. Per-type accepted fields: see the secondlayer://chain-triggers resource. Forward-…
- `url` (string, required): Webhook URL

### `webhooks_update` (~100 tokens)

Patch a webhook (name, url, authConfig, format, retry, timeout, concurrency).

Input parameters:

- `authConfig` (object): Receiver auth sent with each delivery (bearer/etc.)
- `concurrency` (integer)
- `format` (string)
- `id` (string, required)
- `maxRetries` (integer)
- `name` (string): Rename the webhook
- `timeoutMs` (integer)
- `url` (string)

### `webhooks_delete` (~29 tokens)

Delete a webhook. Pending outbox rows are cascade-deleted.

Input parameters:

- `id` (string, required)

### `webhooks_test` (~63 tokens)

Send a one-off test webhook to a webhook's URL (built for its format, SSRF-guarded). Logged as a delivery row. Returns {ok, statusCode, error, durationMs, deliveryId}.

Input parameters:

- `id` (string, required): Webhook id

### `webhooks_pause` (~55 tokens)

Pause a webhook: stops delivery attempts and stops queueing new ones. Nothing is deleted — resume picks the webhook back up from the tip. Verify with webhooks_get (status).

Input parameters:

- `id` (string, required): Webhook id

### `webhooks_resume` (~60 tokens)

Resume a paused webhook (also clears a tripped circuit breaker). Deliveries restart from the current tip — use webhooks_replay for the blocks missed while paused. Verify with webhooks_get (status).

Input parameters:

- `id` (string, required): Webhook id

### `webhooks_rotate_secret` (~65 tokens)

Rotate a webhook's signing secret. Returns the NEW `signingSecret` ONCE — forward it to the user; deliveries signed with the old secret stop verifying as soon as this returns, so the receiver must be updated.

Input parameters:

- `id` (string, required): Webhook id

### `webhooks_deliveries` (~89 tokens)

List recent delivery attempts for a webhook — status code, attempt count, error, duration, timestamps. THIS IS THE VERIFY CALL: after webhooks_create, webhooks_test, or webhooks_replay, read it to confirm the webhook actually landed (and to see the receiver's response when it didn't) instead of trusting the enqueue result.

Input parameters:

- `id` (string, required): Webhook id

### `webhooks_dead` (~76 tokens)

List a webhook's dead-letter queue — deliveries that exhausted their retries, with the outbox id, payload, and last error. Diagnose the receiver first (webhooks_get for the URL/auth, webhooks_test for a live probe), then requeue rows with webhooks_requeue.

Input parameters:

- `id` (string, required): Webhook id

### `webhooks_requeue` (~88 tokens)

Requeue ONE dead-lettered delivery for another attempt, by its outbox id from webhooks_dead. Fix the receiver first — a requeue against a still-broken endpoint just dies again. Verify with webhooks_deliveries.

Input parameters:

- `id` (string, required): Webhook id
- `outboxId` (string, required): Outbox id of the dead delivery (from webhooks_dead)

### `webhooks_replay` (~98 tokens)

Replay a block range for a webhook. Replays run at 10% of batch capacity — use sparingly. Pass `force` (a short idempotency suffix) to re-run a range that was already replayed.

Input parameters:

- `force` (string): Idempotency suffix to force a duplicate replay of the range
- `fromBlock` (integer, required)
- `id` (string, required)
- `toBlock` (integer, required)

### `index_ft_transfers` (~175 tokens)

List decoded SIP-010 fungible-token transfers from Index. Reads are keyless.

Input parameters:

- `assetIdentifier` (string): Filter by asset identifier (contract::asset), e.g. SP…sbtc-token::sbtc-token
- `contractId` (string): Filter by contract id
- `cursor` (string): Opaque cursor from a prior response's next_cursor
- `fromHeight` (number): Start block height (inclusive)
- `limit` (number): Max rows for this page
- `order` (string): asc (default) reads oldest first; desc reads newest first. A cursor only resumes under the order that issued it.
- `recipient` (string): Filter by recipient principal
- `sender` (string): Filter by sender principal
- `toHeight` (number): End block height (inclusive)

### `index_nft_transfers` (~165 tokens)

List decoded SIP-009 non-fungible-token transfers from Index. Reads are keyless.

Input parameters:

- `assetIdentifier` (string): Filter by asset identifier (contract::asset)
- `contractId` (string): Filter by contract id
- `cursor` (string): Opaque cursor from a prior response's next_cursor
- `fromHeight` (number): Start block height (inclusive)
- `limit` (number): Max rows for this page
- `order` (string): asc (default) reads oldest first; desc reads newest first. A cursor only resumes under the order that issued it.
- `recipient` (string): Filter by recipient principal
- `sender` (string): Filter by sender principal
- `toHeight` (number): End block height (inclusive)

### `index_events` (~334 tokens)

List decoded chain events from the Index by event type. Use this for event types without a dedicated tool (stx_*, ft_mint/burn, nft_mint/burn, print), and for trait-scoped queries: set `trait` (e.g. sip-010) to match all contracts conforming to a standard — pair with contracts_find to discover traits. For ft/nft transfers without a trait prefer index_ft_transfers / index_nft_transfers.

Input parameters:

- `assetIdentifier` (string): Filter by asset identifier where applicable
- `contractId` (string): Filter by contract id
- `cursor` (string): Opaque cursor from a prior response's next_cursor
- `eventType` (string, required): Required. Decoded event type to list.
- `fromHeight` (number): Start block height (inclusive)
- `limit` (number): Max rows for this page
- `order` (string): asc (default) reads oldest first; desc reads newest first. A cursor only resumes under the order that issued it.
- `recipient` (string): Filter by recipient principal
- `sender` (string): Filter by sender principal
- `toHeight` (number): End block height (inclusive)
- `trait` (string): Match contracts conforming to a trait/standard (e.g. sip-010). Mutually exclusive with contractId; contract-keyed event types only.
- `txContext` (boolean): Join the submitting transaction into each event (tx_sender, tx_type, tx_status, tx_contract_id, tx_function_name). For print events it's the only source of the submitting sender.

### `index_contract_calls` (~192 tokens)

List decoded contract calls from the Index (function name, args, result). Set `trait` (e.g. sip-010) to match calls to all contracts conforming to a standard. Note: contract-call cursors are a SEPARATE keyspace from event cursors — they are not interchangeable.

Input parameters:

- `contractId` (string): Filter by contract id
- `cursor` (string): Opaque cursor from a prior response's next_cursor
- `fromHeight` (number): Start block height (inclusive)
- `functionName` (string): Filter by called function name
- `limit` (number): Max rows for this page
- `sender` (string): Filter by caller principal
- `toHeight` (number): End block height (inclusive)
- `trait` (string): Match contracts conforming to a trait/standard (e.g. sip-010). Mutually exclusive with contractId.

### `index_blocks` (~74 tokens)

List decoded blocks from Index. Reads are keyless.

Input parameters:

- `cursor` (string): Opaque cursor from a prior response's next_cursor
- `fromHeight` (number): Start block height (inclusive)
- `limit` (number): Max rows for this page
- `toHeight` (number): End block height (inclusive)

### `index_transactions` (~117 tokens)

List decoded transactions from Index. Filter by type, sender, or contract. Reads are keyless.

Input parameters:

- `contractId` (string): Filter by contract id
- `cursor` (string): Opaque cursor from a prior response's next_cursor
- `fromHeight` (number): Start block height (inclusive)
- `limit` (number): Max rows for this page
- `sender` (string): Filter by sender principal
- `toHeight` (number): End block height (inclusive)
- `type` (string): Filter by transaction type

### `index_print_schema` (~88 tokens)

Empirical per-topic print payload schemas for a contract, inferred from sampled on-chain events: each topic's fields with observed Clarity types, decoded TS types, subgraph column types, and presence rates. Use before writing print_event subgraph handlers to learn what's on e.data. Anonymous read.

Input parameters:

- `contractId` (string, required): Contract id (SP….name) whose print events to profile

### `index_discover` (~54 tokens)

Discover the Index vocabulary: every event type and its columns, allowed/equality filters, and required-non-null fields (and which types accept `trait`). Read this before building Index queries instead of guessing filters. Anonymous read.

### `batch_query` (~91 tokens)

Run up to 10 public /v1 reads in one round trip (POST /v1/batch). Each item keeps its own auth/quota/pay-per-call semantics; results return in order with per-item status. Paths must start with /v1/index, /v1/subgraphs, /v1/streams, or /v1/contracts.

Input parameters:

- `requests` (array, required): Read descriptors, executed concurrently

### `streams_tip` (~66 tokens)

Current canonical chain tip as Streams sees it: block height/hash, burn height, finalized_height, lag_seconds, and the oldest seekable height/cursor for this key's retention window. Call it before a cursor walk to know where the stream ends, and after an ingest to check lag.

### `streams_dumps` (~108 tokens)

List the Streams bulk parquet dumps manifest — coverage range, latest_finalized_cursor, and per-file metadata (block range, row count, size, sha256, signed URL). This is the cold backfill path for downloading all raw data; fetch the file URLs directly (e.g. with DuckDB). Requires the dumps base URL to be configured (SL_STREAMS_DUMPS_URL). For live reads use REST GET /v1/streams/events; for tip/lag use streams_tip.

### `contracts_find` (~150 tokens)

Discover deployed Stacks contracts conforming to a trait (e.g. "sip-010", "sip-009", "sip-013"). The discovery endpoint for "which contracts implement X". Reads are public.

Input parameters:

- `conformance` (string): declared = parsed from source, inferred = ABI shape-match, any = either (default)
- `cursor` (string): Opaque cursor from a prior response's next_cursor
- `include` (string): Set to "abi" to include each contract's full ABI
- `limit` (number): Page size, 1–500 (default 100)
- `trait` (string, required): Required. Trait to match (e.g. "sip-010").

### `contracts_get_abi` (~95 tokens)

Fetch a single deployed contract's ABI from the registry (prod-safe). Returns the contract's metadata + full ABI (functions, maps, variables, fungible/non-fungible tokens). Returns not_found if the contract isn't in the registry. Use it to inspect a contract before subgraphs_scaffold.

Input parameters:

- `contractId` (string, required): Fully qualified contract id (e.g. SP….amm-pool-v2-01)

### `codegen_index_schema` (~131 tokens)

Generate an ORM schema for the Index tables (blocks, transactions, decoded_events, …) — the same output as `sl codegen index`. Returns the file contents as text; write it wherever your project keeps its schema. Use `tables` to emit only what you read.

Input parameters:

- `datasourceEnv` (string): Prisma only: datasource url env var (default DATABASE_URL)
- `schemaName` (string): Postgres schema to qualify table names with
- `tables` (array): Restrict to these Index tables (default: all)
- `target` (string): Output flavor (default kysely)

### `instance_status` (~68 tokens)

Decoder health and empty-index diagnosis from GET /public/status. If state is empty-index, next tool is archive_bootstrap. Poll until index.decoders are ok before treating Index as ready — do not start decoders. Then archive_verify, then codegen_index_schema. Do not download parquet.

### `archive_verify` (~119 tokens)

Read-only, free compare of this instance against a signed archive (POST /v1/archive/verify). unanchored means pin a key or check the URL — not that the instance is fine. After bootstrap, poll instance_status until decoders ok, then this, then codegen_index_schema. Do not download parquet.

Input parameters:

- `against` (string, required): Archive manifest URL
- `fromBlock` (integer): First height (inclusive)
- `target` (string): Verify target (default raw)
- `toBlock` (integer): Last height (inclusive)

### `archive_latest` (~67 tokens)

Signed pointer to the official archive tree (hosted). Needs SECONDLAYER_API_KEY (sk-sl_*), not INSTANCE_TOKEN. Use the returned origin as --against for archive_bootstrap. Do not download parquet.

Input parameters:

- `against` (string): Override latest.json URL (default official tree)

### `archive_quote` (~72 tokens)

Price a hosted archive fetch (metered). Needs SECONDLAYER_API_KEY (sk-sl_*), not INSTANCE_TOKEN. Quote happens here; bootstrap/repair also quote inside the CLI. Do not download parquet.

Input parameters:

- `flow` (string, required): bootstrap or repair
- `paths` (array, required): Partition paths to price

### `credits_balance` (~35 tokens)

Archive credits balance at api.secondlayer.tools. Needs SECONDLAYER_API_KEY (sk-sl_*); INSTANCE_TOKEN is the instance.

### `archive_bootstrap` (~108 tokens)

Restore verified history into this instance (secondlayer bootstrap --against … --yes --json). Metered against the official archive; quote happens inside the CLI. After bootstrap, poll instance_status until decoders ok, then archive_verify, then codegen_index_schema. Do not download parquet.

Input parameters:

- `against` (string, required): Archive manifest URL
- `fromBlock` (integer): Restore from this height instead of genesis
- `toBlock` (integer): Stop at this height instead of the archive tip

### `archive_repair` (~105 tokens)

Plan (default) or apply a repair of local chain data against a signed archive. Metered when apply fetches from the official archive. After apply, poll instance_status until decoders ok, then archive_verify. Do not download parquet.

Input parameters:

- `against` (string, required): Archive manifest URL
- `apply` (boolean): Write the repair (default plan-only)
- `fromBlock` (integer): First height to consider
- `toBlock` (integer): Last height to consider

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/tools-secondlayer-secondlayer/secondlayer-mcp#diagnostics

## Score history

- 2026-11-05: 73
- 2026-11-04: 73
- 2026-11-03: 73
- 2026-11-02: 72
- 2026-11-01: 72
- 2026-10-31: 71
- 2026-10-30: 71
- 2026-10-29: 70

## Common questions

### What is the secondlayer MCP server?

secondlayer is an MCP server listed in the public MCP registry as tools.secondlayer/secondlayer. Stacks chain data: contracts, events, transfers, subgraph scaffolds. Hosted with browser sign-in. This page covers its npm package (@secondlayer/mcp).

### Is the secondlayer MCP server safe to use?

secondlayer scores 73 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the secondlayer MCP server expose?

secondlayer exposes 47 tools: subgraphs_scaffold, subgraphs_list, subgraphs_status, subgraphs_spec, subgraphs_query, and 42 more. Their descriptions and schemas cost roughly 4,888 tokens of context every time the server is loaded.

### Is the secondlayer MCP server still maintained?

secondlayer is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the secondlayer MCP server under?

secondlayer declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/@secondlayer/mcp
- Socket report: https://socket.dev/npm/package/@secondlayer/mcp
- Repository: https://github.com/ryanwaits/secondlayer
- Website: https://www.secondlayer.tools/docs/mcp
- Changelog RSS feed: https://verifymcp.io/servers/tools-secondlayer-secondlayer/secondlayer-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/tools-secondlayer-secondlayer/secondlayer-mcp.json
- HTML version of this page: https://verifymcp.io/servers/tools-secondlayer-secondlayer/secondlayer-mcp