# Tollbooth Swap API (npm · tollboothswap-mcp)

Token swaps and honeypot/rug checks for AI agents on 8 chains, paid per-call in USDC via x402.

- Trust score: 66/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-06

## Components

- remote · `api.tollboothswap.xyz`: 64/100, [markdown](https://verifymcp.io/servers/xyz-tollboothswap-api-tollbooth/api.md), [page](https://verifymcp.io/servers/xyz-tollboothswap-api-tollbooth/api)
- npm · `tollboothswap-mcp`: 66/100 (this document), [markdown](https://verifymcp.io/servers/xyz-tollboothswap-api-tollbooth/tollboothswap-mcp.md), [page](https://verifymcp.io/servers/xyz-tollboothswap-api-tollbooth/tollboothswap-mcp)

## Channel facts

- Registry: `npm`
- Package: `tollboothswap-mcp`
- Version: `1.0.3`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-06.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Known CVEs were checked across the 113 of 117 dependencies we could resolve, so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Dependency health was assessed across the 113 of 117 dependencies we could resolve, so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 1 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 78/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 765 tokens (~127/item across 6 items; 6 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add xyz-tollboothswap-api-tollbooth -- npx -y tollboothswap-mcp
```

### Codex

```bash
codex mcp add xyz-tollboothswap-api-tollbooth -- npx -y tollboothswap-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "xyz-tollboothswap-api-tollbooth": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "tollboothswap-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add xyz-tollboothswap-api-tollbooth --command npx --arg -y --arg tollboothswap-mcp
```

### Hermes

```yaml
mcp_servers:
  xyz-tollboothswap-api-tollbooth:
    command: "npx"
    args: ["-y", "tollboothswap-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "xyz-tollboothswap-api-tollbooth": {
      "command": "npx",
      "args": [
        "-y",
        "tollboothswap-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-05 (score 66, +22)

- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [functional improvement] Dependency health: unverified → partial

### 2026-08-04 (score 44)

First indexed and scored.

## MCP tools (6)

### `get_service_info` (~27 tokens)

Get service info

Get Tollbooth service metadata: supported chains, swap fee, x402 toll pricing.

Output parameters:

- `description` (string): What the service does
- `endpoints` (object): HTTP endpoints exposed by the service
- `name` (string): Service name
- `payment` (object): x402 payment networks and pricing

### `resolve_token` (~109 tokens)

Resolve token symbol

Resolve a token ticker symbol (e.g. PEPE, WIF, USDC) to contract addresses on a chain, free. Curated majors return one verified match; others return live DEX matches ranked by liquidity so you can pick the real token over imitations. Use before get_quote when you only know the symbol.

Input parameters:

- `chain` (string, required): Chain to swap on
- `symbol` (string, required): Ticker symbol to resolve, e.g. USDC, PEPE, WIF

Output parameters:

- `chain` (string): Chain searched
- `matches` (array): Matching tokens, best first
- `next` (object): Suggested follow-up calls
- `symbol` (string): Symbol searched

### `get_quote` (~139 tokens)

Get swap quote

Get a free indicative swap quote (output amount includes Tollbooth's fee). Use before build_swap to decide whether to trade.

Input parameters:

- `amount` (string, required): Sell amount as an integer string in the input token's base units
- `chain` (string, required): Chain to swap on
- `inputToken` (string, required): Token being sold: mint address (solana) or ERC-20 address (EVM chains)
- `outputToken` (string, required): Token being bought: mint address (solana) or ERC-20 address (EVM chains)
- `slippageBps` (integer): Max slippage in bps (default 100)

Output parameters:

- `chain` (string)
- `feeBps` (number): Tollbooth fee in basis points
- `inputAmount` (string): Sell amount in base units
- `inputToken` (string)
- `next` (object): How to build the swap transaction
- `outputAmount` (string): Estimated buy amount in base units, after fees
- `outputToken` (string)
- `slippageBps` (number)

### `build_swap` (~202 tokens)

Build swap transaction

Build an unsigned swap transaction for the taker wallet to sign and submit. Costs an x402 toll (paid automatically when TOLLBOOTH_PAYER_KEY is set). Returns the transaction, the quote, and a signed receipt.

Input parameters:

- `amount` (string, required): Sell amount as an integer string in the input token's base units
- `chain` (string, required): Chain to swap on
- `inputToken` (string, required): Token being sold: mint address (solana) or ERC-20 address (EVM chains)
- `outputToken` (string, required): Token being bought: mint address (solana) or ERC-20 address (EVM chains)
- `safeMode` (boolean): Screen both tokens first; refuses the build if either is critical-risk (honeypot etc.)
- `slippageBps` (integer): Max slippage in bps (default 100)
- `taker` (string, required): Wallet address that will sign and send the swap

Output parameters:

- `accepts` (array): x402 payment options when unpaid
- `chain` (string)
- `error` (string): Present when the request failed or payment is required
- `next` (object): Suggested follow-up calls
- `quote` (object): Quote the transaction was built from
- `receipt` (object): Signed receipt for this build
- `safety` (object): Safety reports when safeMode was requested
- `transaction` (object): Unsigned transaction for the taker to sign

### `check_token` (~103 tokens)

Check token safety

Token safety screen before trading: honeypot, rug-pull, freeze/mint authority, transfer hooks, sell tax, blacklists. Returns verdict (ok/warn/critical/unknown), a 0-100 risk score, and itemized findings. Costs an x402 toll.

Input parameters:

- `chain` (string, required): Chain to swap on
- `token` (string, required): Token to screen: mint address (solana) or ERC-20 address (EVM chains)

Output parameters:

- `accepts` (array): x402 payment options when unpaid
- `chain` (string)
- `error` (string): Present when the request failed or payment is required
- `findings` (array): Individual risk findings
- `next` (object): Suggested follow-up calls
- `riskScore` (number): 0 (safe) to 100 (critical)
- `source` (string): Data source used for the screen
- `token` (string)
- `verdict` (string): ok, warn, critical, or unknown

### `get_receipt` (~36 tokens)

Get signed receipt

Fetch a signed Tollbooth receipt by id and verify its signature.

Input parameters:

- `id` (string, required): Receipt id returned by build_swap

Output parameters:

- `error` (string): Present when the receipt was not found
- `id` (string): Receipt id
- `receipt` (object): Receipt payload
- `signature` (string): Server signature over the receipt
- `valid` (boolean): Whether the signature verified

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/xyz-tollboothswap-api-tollbooth/tollboothswap-mcp#diagnostics

## Score history

- 2026-08-06: 66
- 2026-08-05: 66
- 2026-08-04: 44

## Links

- npm package: https://www.npmjs.com/package/tollboothswap-mcp
- Socket report: https://socket.dev/npm/package/tollboothswap-mcp
- Repository: https://github.com/soundsparkaudiolab/tollboothswap-mcp
- Website: https://api.tollboothswap.xyz/
- Changelog RSS feed: https://verifymcp.io/servers/xyz-tollboothswap-api-tollbooth/tollboothswap-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/xyz-tollboothswap-api-tollbooth/tollboothswap-mcp.json
- HTML version of this page: https://verifymcp.io/servers/xyz-tollboothswap-api-tollbooth/tollboothswap-mcp