Atlas / MCP servers / unifai-network / Unifai SDK

Unifai SDKBLOCK

Name: Unifai SDK
Author: unifai-network

mcp/unifai-network/unifai-sdk-1

MCP server by unifai-network · Audited 2026-10-07

unifai-sdk-js is the Javascript/Typescript SDK for Unifai, an AI native platform for dynamic tools and agent to agent communication.

Verdict

BLOCK

Grade

Trust score

69 /100

Exposed tools

2 2r · 0w · 0d

Transport

stdio

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://mseep.ai/app/unifai-network-unifai-sdk-js)

unifai-sdk-js is the JavaScript/TypeScript SDK for UnifAI, an AI native platform for dynamic tools and agent to agent communication.

Installation

npm install unifai-sdk

Getting your UnifAI API key

You can get your API key for free from UnifAI Console.

There are two types of API keys:

Agent API key: for using toolkits in your own agents.
Toolkit API key: for creating toolkits that can be used by other agents.

Using tools

To use tools in your agents, you need an agent API key. You can get an agent API key for free at UnifAI Console.

import { Tools } from 'unifai-sdk';

const tools = new Tools({ apiKey: 'xxx' });

Tool Types

UnifAI provides a flexible system for integrating AI tools in your applications:

Dynamic Tools

Dynamic tools are enabled by default, allowing agents to discover and use tools on-the-fly based on the task at hand. Tools will not be visible to agents directly. Instead, agents will see two functions only: one to search tools, one to use tools. Agents will be able to search for tools based on semantic query, get a list of relevant tools, and use tools dynamically.

// Enable dynamic tools (default behavior)
const dynamicTools = await tools.getTools({ dynamicTools: true });

Static Toolkits

Static toolkits allow you to specify entire toolkits to be exposed to agents so they can be used without search.

const staticTools = await tools.getTools({
dynamicTools: false,  // Optional: disable dynamic tools
staticToolkits: ["1", "2"]
});

You can find available toolkits at https://console.unifai.network/toolkits.

Static Actions

Static actions provide granular control, allowing you to specify individual act

Read from source at commit 74736fd13242OBSERVED · 2026-10-07

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add unifai-sdk --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env EVM_PRIVATE_KEY=${EVM_PRIVATE_KEY} --env SOLANA_PRIVATE_KEY=${SOLANA_PRIVATE_KEY} --env UNIFAI_AGENT_API_KEY=${UNIFAI_AGENT_API_KEY} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "unifai-sdk": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "EVM_PRIVATE_KEY": "${EVM_PRIVATE_KEY}",
        "SOLANA_PRIVATE_KEY": "${SOLANA_PRIVATE_KEY}",
        "UNIFAI_AGENT_API_KEY": "${UNIFAI_AGENT_API_KEY}"
      }
    }
  }
}

Exposed tools (2)

2 read · 0 write · 0 destructive.

Tool	Risk	Description
`EchoChamber`	read	What
`TestAction`	read	desc

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: none-observed
Network: declared (5 observation(s))
Shell: declared (1 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (13)

HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95

src/cli/config.ts:64

const parsed = yaml.load(content);

Why it matters. deserialises untrusted bytes into live objects

Fix. use json or yaml.safe_load

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/cli/__tests__/config.test.ts:5

import { BACKEND_API_ENDPOINT } from '../../common/const';

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/cli/__tests__/invoke.test.ts:2

import { ToolsAPI } from '../../tools/api';

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/cli/__tests__/invoke.test.ts:4

jest.mock('../../tools/api');

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/cli/__tests__/search.test.ts:1

import { ToolsAPI } from '../../tools/api';

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/cli/__tests__/search.test.ts:3

jest.mock('../../tools/api');

LOWObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94

src/toolkit/transaction/evm-handler.test.ts:299

'0xf86c8085012a05f200825208940000000000000000000000000000000000000000018025a0e74e8b1cd6cf28e89e0a32f4b8e74dac56c8c8e4c4f4d6f6c8d3e2f3c5b8a7d6a01a98f6f3a3eb05f6f9d2e9c7b3f8c1d4f9e7c2a5b8d1f4e6c3a9b2d8f