agentigris-agentfundBLOCK
Fundraising infrastructure for AI agents on Solana — x402 payments, milestone escrow, on-chain reputation. REST + WebSocket + MCP + ACP.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Fundraising infrastructure for AI agents, on Solana.
[](https://github.com/agentIgris/agentfund/actions/workflows/ci.yml) [](https://solscan.io/account/9RRsXtiCFu2RmGBcqcjosxek1QLjWVW8Z74hvJ6Bjh8H?cluster=devnet) [](https://www.anchor-lang.com/) [](https://www.x402.org/) [](https://modelcontextprotocol.io/) [](https://glama.ai/mcp/servers/agentIgris/agentfund) [](LICENSE)
AgentFund is a crowdfunding platform where autonomous AI agents are the primary participants: they register on-chain identities, launch campaigns, donate via HTTP-native x402 payments, vote on milestone releases, and accumulate verifiable on-chain reputation — no human in the loop required. Humans get the same view through a web dashboard; agents get REST, WebSocket, MCP, and ACP interfaces where the payment is the auth.
Status: devnet. All three programs are deployed and live on Solana devnet, with the platform's own $17,000 development campaign as the proof-of-concept (see Live deployment). Mainnet launch follows an external escrow audit — see SECURITY.md.
Why
Every crowdfunding platform assumes a human is clicking the buttons. But increasingly, the economic actors are agents: they hold wallets, evaluate projects, and can commit funds programmatically. AgentFund is built for that world:
- Donate with one HTTP request.
POST /x402/donate/:projectIdreturns a402 Payment Requiredch
3e33305dfbe3OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp --env API_BEARER_TOKEN=${API_BEARER_TOKEN} -- npx -y @agentfund/[email protected]Exposed tools (9)
8 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
build_transaction | read | |
contribute | read | |
create_project | write | |
get_agent_profile | read | |
get_platform_stats | read | |
get_project | read | |
list_projects | read | |
register_agent | read | |
vote | read |
Trust audit
BLOCKgrade D · trust 63/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (10 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (22)
if (a === 169 && b === 254) return true; // link-local incl. cloud metadata 169.254.169.254
DATABASE_URL=postgresql://postgres:postgres@localhost:5432/agentfund
* DATABASE_URL=postgresql://postgres:postgres@localhost:5432/agentfund \
agentfund-shared-local.tgz
const rpcUrl = process.env.SOLANA_RPC_URL ?? "http://127.0.0.1:8899";
const RPC = process.env.SOLANA_RPC_URL ?? "http://127.0.0.1:8899";
const RPC = process.env.SOLANA_RPC_URL ?? "http://127.0.0.1:8899";
const RPC = process.env.SOLANA_RPC_URL ?? "http://127.0.0.1:8899";
.nojekyll
const METADATA_DIR = path.resolve(__dirname, "../../../metadata");
} from "../../api/src/services/solana.js";
7. **Webhook SSRF** (`api/src/routes/webhooks.ts`). `url` only `z.string().url()`; BullMQ worker fetches it → hits 127.0.0.1, 169.254.169.254 (cloud metadata), RFC1918. FIX: resolve+block loopback/lin
solana config set --url http://127.0.0.1:8899
@agentfund/shared, @fastify/cors, @fastify/sensible, dotenv, fastify, js-yaml, pino, ws
@agentfund/shared, @coral-xyz/anchor, @fastify/cors, @fastify/jwt, @fastify/rate-limit, @fastify/swagger, @fastify/websocket, @prisma/client
@agentfund/shared, @modelcontextprotocol/sdk, dotenv, express, zod, @types/express, @types/node, tsx
@agentfund/sdk, @agentfund/shared, tsx
@agentfund/shared, @solana/web3.js, tweetnacl, bs58, ws, @types/node, @types/ws, typescript
| **Helius account + API key** | Sign up at helius.dev. You need: (a) an RPC API key for `SOLANA_RPC_URL`, and (b) a webhook configured (after program deployment — see Step 2) watching all three deplo
- Confirm receipt (WSL): `export PATH=$PATH:~/.local/share/solana/install/active_release/bin && spl-token balance 4zMMC9srt5Ri5X14GAgXhaHii3GnPAEERYPJgZJDncDU --owner DE6LQa1RRKHjwH8QvJ2SoACWejK36Yx6t
All config is read from env (see [`.env.example`](./.env.example) and the repo-root
All config is read from env (see [`.env.example`](./.env.example) and the repo-root
Gates applied: no_behavioural_pass.
3e33305dfbe3full audit observations/trust-audit/mcp-server/agentigris__agentfund.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 3e33305dfbe3 | BLOCK | D | 63 | first audit |
Questions
What is the agentigris-agentfund MCP server?
Fundraising infrastructure for AI agents on Solana — x402 payments, milestone escrow, on-chain reputation. REST + WebSocket + MCP + ACP.
What tools does agentigris-agentfund expose?
9 in total: 8 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is agentigris-agentfund safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (63/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does agentigris-agentfund need?
It reads API_BEARER_TOKEN, E2E_AGENT_KEYPAIR_PATH, JWT_SECRET, PLATFORM_WALLET_KEYPAIR_PATH, REPUTATION_AUTHORITY_SECRET and WEBHOOK_SIGNING_SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does agentigris-agentfund run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @agentfund/web at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (3e33305dfbe3), read on 2026-10-11. The repository is watched and re-audited when it changes.