sborCAUTION
Benchmark lending rates for Bitcoin DeFi, read from contract state and posted on-chain on Arc, Base, Hyperliquid, Solana and Stacks. Published daily, free to use, built for agents.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Every lending venue in Bitcoin DeFi quotes its own rate. SBOR publishes the market rate, read from contract state on Ethereum, Base, Arc, Arbitrum, BNB Chain and Stacks.
A single venue's number cannot tell anyone, human or agent, whether the rate they are offered is fair. SBOR, the Stacks Bitcoin Offered Rate, is a benchmark for exactly that. On Stacks, where it started, it publishes one borrow and one supply rate per currency: the SBOR indices. Beyond Stacks, it publishes what it costs to borrow dollars against bitcoin: from the fixing of 14 October 2026 (methodology 1.13.0), the SBOR headline, BTC-COLLATERAL-USD, across every dollar stablecoin lent against plain bitcoin, with a rate per stablecoin; before that date, BTC-COLLATERAL-USDC, from Morpho on Base, Ethereum and Arc. All of it is read from contract state and published daily, beside the largest lending markets on Ethereum, Base, Solana and Hyperliquid for comparison. Free, no key, no rate limit, open to any agent on any chain.
Live at [sbor.xyz](https://sbor.xyz)
Stacks is a Bitcoin layer where smart contracts written in Clarity settle to Bitcoin. It is where sBTC, a bitcoin-backed asset, and USDCx, Circle's native USDC, are lent and borrowed.
What it is
Every lending market on Stacks prices money differently, so comparing them means opening each application by hand.
SBOR publishes one borrow rate and one supply rate per currency, weighted by market depth and read directly from lending contract state rather than from any venue's published figure. Each day's rates are also posted on-chain, on Arc, Base, Hyperliquid, Solana and Stacks.
The model is SOFR, not a yield aggregator. SBOR does not route capital, hold deposits, or recommend anything. It publishes a statistic.
Use it as a yardstick. Borrowing above SBOR means paying more than the market. Supplying below it means earning less.
Indices
61188f4b35a4OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add sbor-mcp -- npx -y [email protected]
Exposed tools (7)
7 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
SBOR | read | Stacks Bitcoin Offered Rate. Benchmark lending rates for Bitcoin DeFi, read from contract state on Stacks, Base, Ethereum and Arc. Public good, free to reference. |
compare_chains | read | |
compare_rate | read | |
get_history | read | |
get_methodology | read | |
get_rate | read | |
list_markets | read |
Trust audit
CAUTIONgrade C · trust 79/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (3 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (7)
{ chain: "Ethereum", asset: "USDC", token: "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48" },{ chain: "Ethereum", asset: "WBTC", token: "0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599" },{ chain: "Ethereum", asset: "cbBTC", token: "0xcbB7C0000aB88B473b1f5aFd9ef808440eed33Bf" },{ chain: "Base", asset: "USDC", token: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913" },{ chain: "Hyperliquid L1", asset: "USDC", token: "0xb88339CB7199b77E23DB6E890353E22632Ba630f" },@modelcontextprotocol/sdk, zod
**Missing:** SBOR is not yet a separate legal entity. Planned: a company to act as the administrator.
Gates applied: no_behavioural_pass.
61188f4b35a4full audit observations/trust-audit/mcp-server/sborxyz__sbor.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 61188f4b35a4 | CAUTION | C | 79 | first audit |
Questions
What is the sbor MCP server?
Benchmark lending rates for Bitcoin DeFi, read from contract state and posted on-chain on Arc, Base, Hyperliquid, Solana and Stacks. Published daily, free to use, built for agents.
What tools does sbor expose?
7 in total: 7 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is sbor safe to connect to an agent?
With care. The audit graded it C (79/100) and found 7 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does sbor need?
It reads ANTHROPIC_API_KEY, ARC_PUBLISHER_KEY, CLOUDFLARE_API_TOKEN and TELEGRAM_BOT_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does sbor run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as sbor at 1.3.0.
How current is this page?
The grade is for one exact copy of the source (61188f4b35a4), read on 2026-10-11. The repository is watched and re-audited when it changes.