blixtradeBLOCK
mcp/blixvip/blixtrade
Solana memecoin terminal with a public read API and an MCP server: live pump.fun feed, holder ledgers, Jupiter quotes.
Verdict
BLOCK
Grade
F
Trust score
38 /100
Exposed tools
20 20r · 0w · 0d
Transport
—
License
MIT
Stars
2
01
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
The open-source Solana memecoin trading terminal. Axiom / GMGN-style Pulse, live pump.fun feed, holder ledgers, real Jupiter quotes, Fomo one-tap buys, AI reads on every coin, smart-money tracking, and a track record that scores its own calls. Runs on your machine. Zero dependencies. MIT.
[](https://solana.com) [](https://pump.fun) [](https://nodejs.org) [](package.json) [](https://github.com/blixvip/blixtrade/actions/workflows/test.yml) [](LICENSE) [](CONTRIBUTING.md) [](https://github.com/blixvip/blixtrade/stargazers)
Quick start · Screenshots · Features · vs Axiom / GMGN / Photon · API · MCP · Architecture · Docs · Contributing
Why Blix
Every serious memecoin terminal on Solana is closed source, hosted by someone else, and paid for with a cut of your trades. Blix is the opposite:
- Open source, local-first. One
npm start, no account, no fee on anything. Your data lives in a SQLite file on your disk. - The Pulse you already know. New pairs → Final stretch → Migrated → Running now, with per-column P1 / P2 / P3 filters
Read from source at commit
b13b65397d13OBSERVED · 2026-10-13Advertisement
02
Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude-code
claude mcp add blix-web --env BLIX_BACKUP_KEY=${BLIX_BACKUP_KEY} --env BLIX_GOOGLE_TOKEN_URL=${BLIX_GOOGLE_TOKEN_URL} --env BLIX_KEY=${BLIX_KEY} --env BLIX_SINK_KEY=${BLIX_SINK_KEY} -- npx -y [email protected]claude-desktop
{
"mcpServers": {
"blix-web": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"BLIX_BACKUP_KEY": "${BLIX_BACKUP_KEY}",
"BLIX_GOOGLE_TOKEN_URL": "${BLIX_GOOGLE_TOKEN_URL}",
"BLIX_KEY": "${BLIX_KEY}",
"BLIX_SINK_KEY": "${BLIX_SINK_KEY}"
}
}
}
}03
Exposed tools (20)
20 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
blix_briefs | read | The latest market briefs written by the AI. |
blix_candles | read | Market-cap candles built from real trades, with volume. Returns the most recent candles. |
blix_coin | read | Everything on one coin: price history, safety report, holders summary, socials, research, signals. |
blix_coins | read | Search or rank tracked coins. A search also finds dead and flagged coins. |
blix_fomo | read | What Fomo app traders are buying, and the top Fomo traders. |
blix_health | read | Every dependency of the radar: working or not, last success, last failure, what to do. |
blix_holders | read | Live holder ledger for a coin: top holders tagged dev, sniper or bundle, and the top-10 share. |
blix_narratives | read | Narratives right now: themes with heat, launch share, lift, emerging words and lead coins. |
blix_overview | read | Market snapshot: launches per hour, coins tracked, signals in 24h, graduations, top movers, health issues. |
blix_paper_buy | read | Open a paper position at the real quote. Paper money only: nothing is ever bought. |
blix_paper_desk | read | The paper desk: open positions, today |
blix_paper_sell | read | Sell all or part of a paper position at the real quote. Paper money only. |
blix_picks | read | The AI picks scorecard: by stage, by call, by reason, by day, and the running result. |
blix_pulse | read | The live Pulse: new launches, final stretch, migrated and running coins, each with stats and the AI verdict. |
blix_quote | read | A real Jupiter quote for a buy or a sell: amount out, price impact, route. Nothing is traded. |
blix_research | read | The AI reads on one coin: first read, deep read, grade, thesis, plan, sources. |
blix_signals | read | Latest signals, newest first. |
blix_track_record | read | How past signals did, per signal type: up 20%+, down 50%+, unsellable, median, reached 2x. |
blix_wallet | read | Any Solana wallet, built from the chain: profile, holdings, latest swaps, positions, best closed trades, pump.fun leaderboard rank. |
blix_wallets | read | The smart-money ranking (wallets that bought past runners early, by record) and what Fomo traders are buying. |
04
Trust audit
BLOCKgrade F · trust 38/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (19 observation(s))
- Network
- declared (12 observation(s))
- Shell
- declared (6 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
CRITICALObfuscation / stealth · obf.decode_then_exec · CWE-506, CWE-94
scripts/repair-quote-history.py:19
b64decode( ... subprocess.
Why it matters. decodes a payload and executes it
CRITICALObfuscation / stealth · obf.decode_then_exec · CWE-506, CWE-94
server/browser.js:39
atob( ... eval(
Why it matters. decodes a payload and executes it
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
server/browser.js:39
const code = `await eval("(async () => {" + atob("${Buffer.from(script, "utf8").toString("base64")}") + "})()");`;Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
deploy/prepare-wallet-admin.mjs:17
const result = execFileSync('ssh', ['-i', 'C:/Users/kaigu/.ssh/model_radar_vm', '-o', 'BatchMode=yes', '[email protected]', 'sudo -n /usr/bin/node /opt/blix/data/hosted-wallet-release/provision-walWhy it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
deploy/pull-wallet-backup.mjs:7
const blob = execFileSync('ssh', ['-i', 'C:/Users/kaigu/.ssh/model_radar_vm', '-o', 'BatchMode=yes', '-o', 'ConnectTimeout=15', '[email protected]', 'sudo -n cat /var/backups/blix-wallets/latest.seWhy it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
scripts/feed-chat-live-check.mjs:7
const auth = JSON.parse(execFileSync('ssh', ['-i', 'C:/Users/kaigu/.ssh/model_radar_vm', '-o', 'BatchMode=yes', '-o', 'ConnectTimeout=15', '[email protected]', 'node'], { input: remote, encoding: 'Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
scripts/hosted-wallet-live-check.mjs:7
const auth = JSON.parse(execFileSync('ssh', ['-i', 'C:/Users/kaigu/.ssh/model_radar_vm', '-o', 'BatchMode=yes', '[email protected]', 'node'], { input: remote, encoding: 'utf8', windowsHide: true })Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
scripts/hosted-wallet-onboarding-live-check.mjs:9
const sshArgs = ['-i', 'C:/Users/kaigu/.ssh/model_radar_vm', '-o', 'BatchMode=yes', '-o', 'ConnectTimeout=15'];
Why it matters. touches a credential store
HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
bin/deploy-vm.mjs:195
ssh("sudo systemctl restart blix");Why it matters. asks for elevated privileges
HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
bin/deploy-vm.mjs:202
ssh(`cd ${REMOTE} && cp -rp ${bak}/. ${REMOTE}/ && for f in ${ship.join(" ")}; do [ -f ${bak}/$f ] || rm -f "$f"; done; sudo systemctl restart blix`);Why it matters. asks for elevated privileges
HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
bin/fomo-session.mjs:49
if (execSync("systemctl is-active blix 2>/dev/null || true").toString().trim() === "active") { console.error("Stop blix first, then import, then start it: sudo systemctl stop blix && node bin/fomo-sesWhy it matters. asks for elevated privileges
HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
bin/offsite-backup.mjs:122
} else log("rclone not installed: kept locally only (sudo apt install rclone)");Why it matters. asks for elevated privileges
HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
deploy/prepare-wallet-admin.mjs:17
const result = execFileSync('ssh', ['-i', 'C:/Users/kaigu/.ssh/model_radar_vm', '-o', 'BatchMode=yes', '[email protected]', 'sudo -n /usr/bin/node /opt/blix/data/hosted-wallet-release/provision-walWhy it matters. asks for elevated privileges
MEDIUMInventory / provenance · inv.binary · CWE-1104
worker/public/_pub/home/laptop-800.avif
laptop-800.avif
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
worker/public/_pub/home/laptop.avif
laptop.avif
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
scripts/feed-chat-check.mjs:125
console.log(`PASS chat identity, pause, follow, history cursor, token fallback, accessibility and layout ${width}px`);MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
scripts/feed-chat-live-check.mjs:59
console.log(`PASS deployed chat, frozen reading, token side panel and responsive layout ${width}px`);MEDIUMPrivilege escalation / persistence · fs.persistence · CWE-269, CWE-250
bin/fomo-session.mjs:49
if (execSync("systemctl is-active blix 2>/dev/null || true").toString().trim() === "active") { console.error("Stop blix first, then import, then start it: sudo systemctl stop blix && node bin/fomo-sesMEDIUMFilesystem / path · fs.system_paths · CWE-22, CWE-59
deploy/provision-wallets.mjs:7
if (fs.existsSync(home + '/config.json') || fs.existsSync('/etc/blix-wallet-recovery.pub')) throw Error('Already provisioned; refusing to replace recovery material');MEDIUMFilesystem / path · fs.system_paths · CWE-22, CWE-59
deploy/provision-wallets.mjs:20
fs.writeFileSync('/etc/blix-wallet-recovery.pub', input.publicKey, { mode: 0o644, flag: 'wx' });MEDIUMFilesystem / path · fs.system_paths · CWE-22, CWE-59
deploy/provision-wallets.mjs:21
fs.mkdirSync('/etc/systemd/system/blix.service.d', { recursive: true });MEDIUMFilesystem / path · fs.system_paths · CWE-22, CWE-59
deploy/provision-wallets.mjs:23
fs.writeFileSync('/etc/systemd/system/blix.service.d/wallets.conf', '[Service]\nEnvironment=BLIX_VAULT_CONFIG=/opt/blix/data/vault-client.json\nExecStartPre=\n');MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
bin/alertwatch.mjs:26
return get(`http://127.0.0.1:${cfg.port || 4470}${pathname}`, { host: `127.0.0.1:${cfg.port || 4470}`, authorization: `Bearer ${cfg.serviceToken}` }, 10000);MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
bin/alertwatch.mjs:34
["pages", 2, async () => { const r = await get("http://127.0.0.1:4421/api/health"); return r.status === 200 ? null : `The page server on the VM answered ${r.status || "nothing"}`; }],MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
bin/alertwatch.mjs:36
const r = await get("http://127.0.0.1:4420/api/health", { host: "localhost:4420" }, 30000);Gates applied: critical_finding, no_behavioural_pass.
Audited 2026-10-13 · audit v0.4.1 · source sha
b13b65397d13full audit observations/trust-audit/mcp-server/blixvip__blixtrade.json · Report an issue / request a re-scan05
Audit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-13 | b13b65397d13 | BLOCK | F | 38 | first audit |
06
Questions
What is the blixtrade MCP server?
Solana memecoin terminal with a public read API and an MCP server: live pump.fun feed, holder ledgers, Jupiter quotes.
What tools does blixtrade expose?
20 in total: 20 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is blixtrade safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (38/100) and found 13 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does blixtrade need?
It reads BLIX_BACKUP_KEY, BLIX_GOOGLE_TOKEN_URL, BLIX_KEY, BLIX_SINK_KEY, BLIX_VM_KEY, GSC_ACCESS_TOKEN and WALLET_SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (b13b65397d13), read on 2026-10-13. The repository is watched and re-audited when it changes.