assetfare-mcpBLOCK
USDC bridge API for AI agents and agent-wallet funding: Solana to Base + 76 routes; validated provider paths; exact 1bp; server never signs/submits.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
USDC bridge API for AI agents and agent-wallet funding: 98 available routes across seventeen chains. Forty-four routes have a route-specific best-from amount and are price-recommended only at or above it. The other 54 have no current price recommendation. Economic guidance is advisory and never adds a prepare/session gate. Each available route has a validated ordered provider path and exact 1bp fee step. Caller approves and signs; the server never signs or submits. AssetFare service fee 1bp; Circle/provider/network fees additional; quote exposes total token-path cost and live availability.
Core 2.8.0 quotes also include strict continuation_v3. MCP 1.16.0 verifies the canonical full-quote hash, route-summary hash and fingerprint claim, exact path/providers, caller wallet-chain and event-signer requirements, base-unit bounds, allowed mode and TTL. Every quote remains unranked_candidate; no adapter selects it automatically, and caller_approved:true alone is not human-approval proof.
The portable quote hash removes continuation_v3, replaces duplicated raw base-unit numbers with the exact decimal strings in direct_route_summary, then hashes AssetFare typed-canonical-v1 bytes. That encoding preserves JSON type, uses exact IEEE-754 binary64 bytes for finite numbers, UTF-8 byte lengths and byte-sorted object keys, distinguishes -0 from 0, and rejects every non-substituted integral number outside JavaScript's safe-integer range. The required literal quote_payload_sha256_spec appears both on continuation_v3 and in its fingerprint claim, preventing numeric-string collisions and cross-language precision ambiguity.
[](https://github.com/assetfare/assetfare-mcp/actions/workflows/ci.yml) [](https://www.npmjs.com/package/assetfa
52a9bdfce923OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add assetfare-mcp --env ASSETFARE_MANIFEST_PUBLIC_KEY_URL=${ASSETFARE_MANIFEST_PUBLIC_KEY_URL} -- npx -y [email protected]{
"mcpServers": {
"assetfare-mcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"ASSETFARE_MANIFEST_PUBLIC_KEY_URL": "${ASSETFARE_MANIFEST_PUBLIC_KEY_URL}"
}
}
}
}Exposed tools (16)
14 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
ASSETFARE_GET_CAPABILITIES | read | Read AssetFare |
ASSETFARE_QUOTE_ROUTE | read | Request one fresh quote on AssetFare |
assetfare-route | read | Read-only AssetFare multichain route discovery and quote comparison for elizaOS. No wallet, signing, or submission authority. |
assetfare_create_session | write | Lock a fresh quote into one wallet-bound execution session. Creates no blockchain transaction. |
assetfare_finish_wallet_auth | read | Verify the exact wallet-login message and return a wallet-bound access token. The token is sensitive. |
assetfare_get_capabilities | read | Read AssetFare |
assetfare_observe_cctp | read | Observe an already-submitted CCTP burn and forwarded mint; never submits a transaction. |
assetfare_observe_destination | read | Verify an already-submitted destination UserOperation receipt; never submits a transaction. |
assetfare_prepare_cctp_action | read | Prepare an unsigned CCTP burn action. The caller owns signing and submission. |
assetfare_prepare_destination_action | read | Prepare an unsigned ERC-4337 settlement plan with bounded permit and deadline. |
assetfare_prepare_source_action | read | Prepare a bounded unsigned Solana source action. Verify it before the caller |
assetfare_quote_route | read | Request one fresh quote on AssetFare |
assetfare_read_session | read | Read a session, workflow, receipt, or current unsigned action without submitting anything. |
assetfare_start_wallet_auth | write | Create a signMessage-only wallet login challenge. It cannot authorize or submit a transaction. |
assetfare_verify_source_receipt | read | Verify a caller-submitted finalized Solana signature; never submits a transaction. |
get_capabilities | read | Read AssetFare |
Trust audit
BLOCKgrade D · trust 61/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (6 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (19)
The v2 prepare/session fields include `[caller_approved, from_chain, from_token, to_chain, to_token, amount_usd, wallets, event_signer_public, approval_v3]`; session also has `idempotency_key`. Econom
Environment=ASSETFARE_API_BASE_URL=http://127.0.0.1:8788
Environment=ASSETFARE_A2A_API_BASE_URL=http://127.0.0.1:8791
const handler=new JsonRpcTransportHandler(createAssetFareA2A({apiBaseUrl:"http://127.0.0.1:8791",fetch:fetchMock}).requestHandler);const a2a=new JsonRpcTransportHandler(createAssetFareA2A({apiBaseUrl:"http://127.0.0.1:8791",fetch:fetchMock}).requestHandler);origin = `http://127.0.0.1:${server.address().port}`;const PROGRAMS={system:"11111111111111111111111111111111",compute:"ComputeBudget111111111111111111111111111111",token:"TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA",token2022:"TokenzQdBNbLqP5VEhdkAS6EPconst NOW=Date.parse("2026-09-25T12:00:00.000Z"),SESSION="00000000-0000-4000-8000-000000000099",QUOTE="00000000-0000-4000-8000-000000000001",FROM="0x1111111111111111111111111111111111111111",TOKEN="0xconst directory=mkdtempSync(join(tmpdir(),"assetfare-standard-adapter-")),storePath=join(directory,"operations.json"),store=createMode0600JsonOperationStore(storePath),FROM="0x111111111111111111111111
portable-quote-payload-fixture.json
fs.writeFileSync(path,`${JSON.stringify({packageName,version,tag,tagCommit,mainCommit,artifact,sha256:crypto.createHash("sha256").update(bytes).digest("hex"),sha1:crypto.createHash("sha1").update(byteconst expected={packageName:name,version,tag,artifact:`${name.replace(/^@/,"").replaceAll("/","-")}-${version}.tgz`,sha256:crypto.createHash("sha256").update(bytes).digest("hex"),sha1:crypto.createHasfs.writeFileSync(path, `${JSON.stringify({packageName,version,tag,tagCommit,mainCommit,artifact,sha256:crypto.createHash("sha256").update(bytes).digest("hex"),sha1:crypto.createHash("sha1").update(bytconst expected={packageName:name,version,tag,artifact:`${name.replace(/^@/,"").replaceAll("/","-")}-${version}.tgz`,sha256:crypto.createHash("sha256").update(bytes).digest("hex"),sha1:crypto.createHas@types/node, typescript
@types/node, typescript
@types/node
@types/node, typescript
@types/node, typescript
Gates applied: critical_finding, no_behavioural_pass, undeclared_transfer.
52a9bdfce923full audit observations/trust-audit/mcp-server/assetfare__assetfare-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | 52a9bdfce923 | BLOCK | D | 61 | first audit |
Questions
What is the assetfare-mcp MCP server?
USDC bridge API for AI agents and agent-wallet funding: Solana to Base + 76 routes; validated provider paths; exact 1bp; server never signs/submits.
What tools does assetfare-mcp expose?
16 in total: 14 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is assetfare-mcp safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (61/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does assetfare-mcp need?
It reads ASSETFARE_MANIFEST_PUBLIC_KEY_URL from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does assetfare-mcp run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as assetfare-mcp at 1.16.0.
How current is this page?
The grade is for one exact copy of the source (52a9bdfce923), read on 2026-10-08. The repository is watched and re-audited when it changes.