Atlas / MCP servers / nirholas / intel-mcp

intel-mcpSAFE

mcp/nirholas/intel-mcp

three.ws market intelligence from any AI agent — smart-money scoring, wallet intel, signal feeds, KOL leaderboards/trades, and the copy-trade Smart Money directory. Read-only over the live public API. No key, no signer, no payment.

Verdict
SAFE
Grade
B
Trust score
89 /100
Exposed tools
—
Transport
stdio
License
Apache-2.0
Stars
8
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

@three-ws/intel-mcp

Read the market the way the smart money does — smart-money scoring, wallet intel, signal feeds, KOL trades, and the copy-trade directory, from any AI agent.

A Model Context Protocol server that gives any AI assistant the three.ws market-intelligence surface over stdio. Judge a coin by who is buying it, pull a wallet's realized reputation, read a signal feed's proven accuracy, rank KOL traders, and browse the copy-trade Smart Money directory — all live, read-only, no key required.

Every score, signal, and ranking comes straight from the public three.ws API. No API key, no signer, no payment — point THREE_WS_BASE at a deployment and go.

Install

npm install @three-ws/intel-mcp

Or run with npx (no install):

npx @three-ws/intel-mcp

Quick start

Claude Code, one line:

claude mcp add intel -- npx -y @three-ws/intel-mcp

Claude Desktop / Cursor (claude_desktop_config.json or mcp.json):

{
"mcpServers": {
"intel": {
"command": "npx",
"args": ["-y", "@three-ws/intel
Read from source at commit 04d30eb1768dOBSERVED · 2026-10-10
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code (npm)
claude mcp add intel-mcp -- npx -y @three-ws/[email protected]
03

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (1 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (3)

LOWInventory / provenance · inv.hidden_file · CWE-1104
docs/.nojekyll
.nojekyll
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@modelcontextprotocol/sdk, zod
Why it matters. 2 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWInventory / provenance · mcp.no_tools_extracted · CWE-1104
server.json
Why it matters. the tool list is enumerated at runtime by tools/list, not declared in source
Fix. the page says so rather than showing an empty table

Gates applied: no_behavioural_pass.

Audited 2026-10-10 · audit v0.4.1 · source sha 04d30eb1768dfull audit observations/trust-audit/mcp-server/nirholas__intel-mcp.json · Report an issue / request a re-scan
04

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-1004d30eb1768dSAFEB89first audit
05

Questions

What is the intel-mcp MCP server?

three.ws market intelligence from any AI agent — smart-money scoring, wallet intel, signal feeds, KOL leaderboards/trades, and the copy-trade Smart Money directory. Read-only over the live public API. No key, no signer, no payment.

Is intel-mcp safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does intel-mcp need?

No credential environment variables were found in its source, so it appears to need none.

How does intel-mcp run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as @three-ws/intel-mcp at 0.1.3.

How current is this page?

The grade is for one exact copy of the source (04d30eb1768d), read on 2026-10-10. The repository is watched and re-audited when it changes.

Advertisement