stelardigital-signalsCAUTION
MCP server for Stelar Digital crypto signal + AI utility APIs (RapidAPI-backed)
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
An MCP (Model Context Protocol) server that gives any MCP-compatible agent (Claude Code, Claude Desktop, Cursor, Windsurf, Codex ...) live crypto market signals and portfolio telemetry.
Six of its tools are pay-per-call over [x402](https://x402.org) — no signup, no account, and no API key. Your agent pays cents in USDC on Base from its own wallet and gets the data back in the same request.
Install
claude mcp add stelar -- npx -y stelar-signals-mcp
Or in any MCP client config:
{
"mcpServers": {
"stelar": { "command": "npx", "args": ["-y", "stelar-signals-mcp"] }
}
}The server starts and lists every tool with no environment variables set.
Paid tools — x402, USDC on Base, no key required
These call https://api.stelardigital.com, which answers HTTP 402 with a payment challenge. Any x402-capable client settles it and retries automatically. Assets covered: SOL, BTC, ETH, XRP, DOGE, LTC, ADA, XLM.
These are live production endpoints backed by real market data — not demo stubs.
Free-tier tools — these DO need a RapidAPI key
crypto_regime, crypto_sentiment, pricecheck, token_risk, summarize, factcheck are served through RapidAPI. Set RAPIDAPI_KEY to use them:
claude mcp add stela
f8c1b28e9cb6OBSERVED · 2026-10-14Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add stelar-signals-mcp --env RAPIDAPI_KEY=${RAPIDAPI_KEY} -- npx -y [email protected]Exposed tools (12)
12 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
crypto_regime | read | |
crypto_sentiment | read | |
factcheck | read | |
gridparams | read | |
price | read | |
pricecheck | read | |
regime | read | |
risk | read | |
sentiment | read | |
summarize | read | |
telemetry | read | |
token_risk | read |
Trust audit
CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (4 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (4)
console.log(`${req.method} ${url.pathname} has-key=${apiKey ? "yes" : "no"} mcpize-paid=${mcpizePaid ? "yes" : "no"}`);console.log(`MCP method=${mcpMethod} has-key=${apiKey ? "yes" : "no"}`);BASE_URL: "http://127.0.0.1:3003",
@modelcontextprotocol/sdk, zod
Gates applied: no_behavioural_pass.
f8c1b28e9cb6full audit observations/trust-audit/mcp-server/stelardigital__stelar-signals-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-14 | f8c1b28e9cb6 | CAUTION | B | 89 | first audit |
Questions
What is the stelardigital-signals MCP server?
MCP server for Stelar Digital crypto signal + AI utility APIs (RapidAPI-backed)
What tools does stelardigital-signals expose?
12 in total: 12 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is stelardigital-signals safe to connect to an agent?
With care. The audit graded it B (89/100) and found 4 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does stelardigital-signals need?
It reads MCPIZE_PROXY_SECRET, RAPIDAPI_KEY, RAPIDAPI_PROXY_SECRET and STELAR_MCP_TEST_PROXY_SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does stelardigital-signals run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as stelar-signals-mcp at 1.1.3.
How current is this page?
The grade is for one exact copy of the source (f8c1b28e9cb6), read on 2026-10-14. The repository is watched and re-audited when it changes.