Web3SAFE
1 MCP to rule all them chains
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A Model-Context-Protocol server for interacting with multiple blockchains including Solana, Ethereum, THORChain, XRP Ledger, TON (The Open Network), Cardano, and UTXO chains. This server provides simple RPC endpoints for common blockchain operations, allowing secure interactions with various blockchains through environment variables.
Features
Solana Operations:
- Check SOL account balances
- Get detailed account information
- Transfer SOL between accounts
- View SPL token balances
- Get your wallet address from private key
- Swap tokens using Jupiter (Best price routing across all Solana DEXs)
Ethereum & EVM Chain Operations:
- Check native token balances across multiple networks
- Check ERC-20 token balances
- Send native tokens (using private key from .env)
- Send ERC-20 tokens (using private key from .env)
- Approve ERC-20 token spending (using private key from .env)
Cardano Operations:
- Get network information and statistics
- Check address balances and transaction history
- View UTxOs for an address
- Explore stake pools and delegation information
- Get details about native assets
- View detailed transaction information
- Get statistics about the current epoch
THORChain Operations:
- Check RUNE balances
- Get detailed pool information
- Get swap quotes between any supported assets
- Cross-chain swaps via THORChain protocol
UTXO Chain Operations:
- Bitcoin (BTC)
- Check address balances
- View transaction history
- Validate addresses
- Get network info and fees
- Litecoin (LTC)
- Check address balances
- View transaction history
- Validate addresses
- Get network info and fees
- Dogecoin (DOGE)
- Check address balances
- View transaction history
- Validate addresses
- Get network info and fees
- Bitcoin Cash (BCH)
- Check address balances
- View t
274e528141aeOBSERVED · 2026-10-07Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add web3-mcp --env BLOCKFROST_API_KEY=${BLOCKFROST_API_KEY} --env COINGECKO_API_KEY=${COINGECKO_API_KEY} --env ETH_PRIVATE_KEY=${ETH_PRIVATE_KEY} --env SOLANA_PRIVATE_KEY=${SOLANA_PRIVATE_KEY} -- npx -y [email protected]{
"mcpServers": {
"web3-mcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"BLOCKFROST_API_KEY": "${BLOCKFROST_API_KEY}",
"COINGECKO_API_KEY": "${COINGECKO_API_KEY}",
"ETH_PRIVATE_KEY": "${ETH_PRIVATE_KEY}",
"SOLANA_PRIVATE_KEY": "${SOLANA_PRIVATE_KEY}"
}
}
}
}Exposed tools (55)
46 read · 9 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
approveEvmToken | read | Approve ERC-20 token spending on any supported EVM network (using private key from .env) |
createXrpTrustline | write | Create a trustline for a token on the XRP Ledger using private key from .env |
executeSwap | write | Execute a token swap using Jupiter DEX aggregator (using private key from .env) |
getAccountInfo | read | Get detailed account information for a Solana address |
getBCHNetworkInfo | read | Get current Bitcoin Cash network information |
getBCHTransactionHistory | read | Get transaction history for a Bitcoin Cash address |
getBTCNetworkInfo | read | Get current Bitcoin network information |
getBTCTransactionHistory | read | Get transaction history for a Bitcoin address |
getBalance | read | Get balance for a Solana address |
getBitcoinBalance | read | Get balance for a Bitcoin address |
getBitcoinCashBalance | read | Get balance for a Bitcoin Cash address |
getCardanoAddressBalance | read | Get balance and token holdings for a Cardano address |
getCardanoWalletInfo | read | Get the current wallet information, including balance and tokens |
getCoinGeckoPrices | read | Get current prices of tokens using their CoinGecko IDs. Must provide valid CoinGecko IDs (use searchCoinGecko to find IDs first). |
getCoinInfoByCoingeckoId | read | Look up contract addresses and chain information for a token using its CoinGecko ID. Use searchCoinGecko first to find the correct CoinGecko ID before using this tool. |
getDOGENetworkInfo | read | Get current Dogecoin network information |
getDOGETransactionHistory | read | Get transaction history for a Dogecoin address |
getDogeBalance | read | Get balance for a Dogecoin address |
getEvmBalance | read | Get native token balance for an EVM address on any supported network |
getEvmTokenBalance | read | Get ERC-20 token balance for an address on any supported EVM network |
getGasPrice | read | Get current gas price for any supported EVM network |
getLTCNetworkInfo | read | Get current Litecoin network information |
getLTCTransactionHistory | read | Get transaction history for a Litecoin address |
getLitecoinBalance | read | Get balance for a Litecoin address |
getMyAddress | read | Get your Solana public address from private key in .env |
getRubicBridgeQuote | read | Get the best cross-chain bridge route for swapping tokens between different blockchains. |
getRubicBridgeQuotes | read | Get all available cross-chain bridge routes for swapping tokens between different blockchains. |
getRubicBridgeStatus | read | Check the status of a cross-chain bridge transaction. |
getRubicSupportedChains | read | Get a list of all blockchains supported by Rubic for cross-chain bridging. |
getSplTokenBalances | read | Get SPL token balances for a Solana address |
getSwapQuote | read | Get best swap quote from Jupiter DEX aggregator |
getThorchainBalance | read | Get RUNE balance for an address |
getThorchainPoolInfo | read | Get information about a THORChain liquidity pool |
getThorchainSwapQuote | read | Get a quote for swapping assets on THORChain |
getTonBalance | read | Get balance for a TON address |
getTonNetworkInfo | read | Get current TON network information |
getTonTransactionHistory | read | Get transaction history for a TON address |
getXrpBalance | read | Get balance for an XRP address |
getXrpLedgerInfo | read | Get current XRP Ledger information |
getXrpTokenBalances | read | Get token balances for an XRP address |
getXrpTransactionHistory | read | Get transaction history for an XRP address |
searchCoinGecko | read | Search for coins by ticker symbol OR name to get their CoinGecko ID. IMPORTANT: Only search with one term - either ticker (e.g., |
sendCardanoAda | write | Send ADA from your wallet to a recipient address |
sendCardanoTokens | write | Send Cardano native tokens from your wallet to a recipient address |
sendEvmToken | write | Send ERC-20 tokens on any supported EVM network (using private key from .env) |
sendEvmTransaction | write | Send native tokens on any supported EVM network (using private key from .env) |
sendTonTransaction | write | Send TON from your wallet to another address using mnemonic from .env |
sendXrpTransaction | write | Send XRP from your wallet to another address using private key from .env |
transfer | write | Transfer SOL from your keypair (using private key from .env) to another address |
validateBCHAddress | read | Validate a Bitcoin Cash address format |
validateBTCAddress | read | Validate a Bitcoin address format |
validateDOGEAddress | read | Validate a Dogecoin address format |
validateLTCAddress | read | Validate a Litecoin address format |
validateTonAddress | read | Validate a TON address format |
validateXrpAddress | read | Validate an XRP address format |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (2)
const projectRoot = resolve(__filename, '../../../..');
@cosmos-client/core, @jup-ag/api, @modelcontextprotocol/sdk, @psf/bitcoincashjs-lib, @solana/spl-token, @solana/web3.js, @xchainjs/xchain-bitcoin, @xchainjs/xchain-bitcoincash
Gates applied: no_behavioural_pass.
274e528141aefull audit observations/trust-audit/mcp-server/strangelove-ventures__web3.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | 274e528141ae | SAFE | B | 89 | first audit |
Questions
What is the Web3 MCP server?
1 MCP to rule all them chains
What tools does Web3 expose?
55 in total: 46 read-only, 9 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Web3 safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Web3 need?
It reads BLOCKFROST_API_KEY, COINGECKO_API_KEY, ETH_PRIVATE_KEY, SOLANA_PRIVATE_KEY, TON_API_KEY and XRP_PRIVATE_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Web3 run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as web3-mcp at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (274e528141ae), read on 2026-10-07. The repository is watched and re-audited when it changes.