io.github.Timothymycompc/solana-pulse-gateway

Est-ce que io.github.Timothymycompc/solana-pulse-gateway est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.Timothymycompc/solana-pulse-gateway » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 15 outils

• balance≈ 235 tokens

  Run before sending SOL or paying fees, to confirm the wallet has enough. Never trust a remembered balance. A wallet's SOL balance, read from the chain. Example: {"wallet": "<address>"}. Cost: 25 free calls a day, then $0.01 USDC per call (x402). Outputs explained: GET /api/tools/balance.

  Paramètres, retour & exemple (2)

  Paramètres

  • wallet · string · requis
    The wallet to read the SOL balance of. The user's address (from their wallet app) or your agent's public key. Not a .sol name or ticker.
  • network · string · optionnel · mainnet-beta | devnet
    Default "mainnet-beta" (real money). "devnet" only for test wallets.

  Exemple d'appel

  {"name": "balance", "arguments": {"wallet": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• blockhash≈ 193 tokens

  Run just before building a transaction to sign. Blockhashes expire in about 60-90 seconds; this says how long is left. A fresh blockhash and how many blocks (and about how many seconds) are left before it expires. Example: {}. Cost: 25 free calls a day, then $0.01 USDC per call (x402). Outputs explained: GET /api/tools/blockhash.

  Paramètres, retour & exemple (1)

  Paramètres

  • network · string · optionnel · mainnet-beta | devnet
    Default "mainnet-beta" (real money). "devnet" only for test wallets.

  Exemple d'appel

  {"name": "blockhash", "arguments": {"network": "mainnet-beta"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• check_tx≈ 290 tokens

  Run on every transaction before signing. Shows what each wallet gains and loses, blocks drainer tricks, and catches failures and expired blockhashes before you pay a fee. Decodes each step, dry-runs it on live mainnet, finds each wallet's SOL and token changes, and answers OK, REVIEW or BLOCK with reasons. Example: {"tx": "<base64, before signing>"}. Cost: 25 free calls a day, then $0.02 USDC per call (x402). Outputs explained: GET /api/tools/check_tx.

  Paramètres, retour & exemple (2)

  Paramètres

  • tx · string · requis
    Base64 transaction, signed or not, legacy, v0 or v1. Before signing: Buffer.from(tx.serialize({ requireAllSignatures: false })).toString('base64'), or an aggregator's swap tx.
  • network · string · optionnel · mainnet-beta | devnet
    Default "mainnet-beta" (real money). "devnet" only for test wallets.

  Exemple d'appel

  {"name": "check_tx", "arguments": {"tx": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• convert≈ 352 tokens

  Run before putting any token amount in a transaction. "5 USDC" is 5,000,000 raw units; wrong decimals send 1,000x too much or too little. Converts between normal amounts and raw units with the token's real on-chain decimals. Example: {"token": "SOL", "amount": "0.5"} gives 500000000. Cost: 25 free calls a day, then $0.01 USDC per call (x402). Outputs explained: GET /api/tools/convert.

  Paramètres, retour & exemple (4)

  Paramètres

  • to · string · optionnel · raw | readable | to_base_units | to_ui
    Direction. "raw" turns 5 into 5000000 (for transactions); "readable" turns raw units back. Default "raw". "readable" for amounts read from chain data.
  • token · string · requis
    The token, or "SOL" for SOL (9 decimals). From find_token or tokens.
  • amount · string · requis
    The amount, as a string: "5" or "0.25". The user's amount. A string avoids rounding errors.
  • network · string · optionnel · mainnet-beta | devnet
    Default "mainnet-beta" (real money). "devnet" only for test wallets.

  Exemple d'appel

  {"name": "convert", "arguments": {"token": "texte", "amount": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• explain_tx≈ 266 tokens

  Run after a transaction lands or fails, to report what happened instead of guessing from logs. For failures it names the failing program and the fix. Reads a confirmed transaction: whether it worked, the fee, each wallet's SOL and token changes, the programs used, and why it failed. Example: {"tx_id": "<signature>"}. Cost: 25 free calls a day, then $0.01 USDC per call (x402). Outputs explained: GET /api/tools/explain_tx.

  Paramètres, retour & exemple (2)

  Paramètres

  • tx_id · string · requis
    The transaction's signature. Returned when you send, or from history. Never make one up.
  • network · string · optionnel · mainnet-beta | devnet
    Default "mainnet-beta" (real money). "devnet" only for test wallets.

  Exemple d'appel

  {"name": "explain_tx", "arguments": {"tx_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• fee≈ 296 tokens

  Run before setting a priority fee. Gives the price in the unit Compute Budget expects (micro-lamports per compute unit) and the total in SOL, so a unit mix-up never overpays. Turns recent priority fees into three prices: cheap, normal, fast. Pass your transaction to get its compute limit and exact cost at each. Example: {} for network prices, or {"tx": "<base64>"} for your own. Cost: 25 free calls a day, then $0.01 USDC per call (x402). Outputs explained: GET /api/tools/fee.

  Paramètres, retour & exemple (2)

  Paramètres

  • tx · string · optionnel
    Your transaction, so fees match its accounts and compute comes from a dry run. Before signing: Buffer.from(tx.serialize({ requireAllSignatures: false })).toString('base64'), or an aggregator's swap tx.
  • network · string · optionnel · mainnet-beta | devnet
    Default "mainnet-beta" (real money). "devnet" only for test wallets.

  Exemple d'appel

  {"name": "fee", "arguments": {"tx": "texte", "network": "mainnet-beta"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• find_token≈ 211 tokens

  Run whenever a user names a token ("buy BONK"). Tickers aren't unique; copycats reuse them. Never take an address from memory. Finds the real address for a ticker or name, ranks matches by verification and liquidity, and warns when copycats share the ticker. Example: {"name": "BONK"}. Cost: 25 free calls a day, then $0.01 USDC per call (x402). Outputs explained: GET /api/tools/find_token.

  Paramètres, retour & exemple (1)

  Paramètres

  • name · string · requis
    Ticker, name or address: "BONK", "Jupiter", "USDC". Exactly as the user wrote it.

  Exemple d'appel

  {"name": "find_token", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• history≈ 286 tokens

  Run to see a wallet's recent activity or get a real transaction ID. Never make one up. Lists a wallet's latest transactions, newest first, whether each worked, and a plain error name for failures. Example: {"wallet": "<address>", "how_many": 5}. Cost: 25 free calls a day, then $0.01 USDC per call (x402). Outputs explained: GET /api/tools/history.

  Paramètres, retour & exemple (3)

  Paramètres

  • wallet · string · requis
    The wallet to read the transactions of. The user's address (from their wallet app) or your agent's public key. Not a .sol name or ticker.
  • network · string · optionnel · mainnet-beta | devnet
    Default "mainnet-beta" (real money). "devnet" only for test wallets.
  • how_many · integer · optionnel
    How many transactions to return. Default 10.

  Exemple d'appel

  {"name": "history", "arguments": {"wallet": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• token_account≈ 304 tokens

  Run before sending a token. Tokens go to the recipient's token account, not their wallet, and models can't work that address out. Finds the token account (ATA) for a wallet and token with the token's real program, says if it exists, and prices creating it. Example: {"wallet": "<recipient>", "token": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v"} finds where their USDC goes. Cost: 25 free calls a day, then $0.01 USDC per call (x402). Outputs explained: GET /api/tools/token_account.

  Paramètres, retour & exemple (3)

  Paramètres

  • token · string · requis
    The token's address. From find_token or tokens. Not a ticker.
  • wallet · string · requis
    The wallet that will own it (usually the recipient). The recipient's wallet address.
  • network · string · optionnel · mainnet-beta | devnet
    Default "mainnet-beta" (real money). "devnet" only for test wallets.

  Exemple d'appel

  {"name": "token_account", "arguments": {"token": "texte", "wallet": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• token_safety≈ 288 tokens

  Run before buying, accepting or recommending a token. Answers SAFE, CAUTION or AVOID with exact reasons from chain and market data. Simulates a real holder selling, then checks if liquidity can be pulled, the creator's record, insider wallet networks, issuer powers (mint, freeze, Token-2022 traps), verification, liquidity, holders and age, for one verdict. Example: {"token": "DezXAZ8z7PnrnRJjz3wXBoRgixCa6xjnB7YaB1pPB263"} checks BONK. Cost: 25 free calls a day, then $0.02 USDC per call (x402). Outputs explained: GET /api/tools/token_safety.

  Paramètres, retour & exemple (2)

  Paramètres

  • token · string · requis
    The token's address. From find_token (for a ticker) or tokens (for a wallet's tokens).
  • network · string · optionnel · mainnet-beta | devnet
    Default "mainnet-beta" (real money). "devnet" only for test wallets.

  Exemple d'appel

  {"name": "token_safety", "arguments": {"token": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• tokens≈ 352 tokens

  Run to learn which tokens a wallet holds and how much. Ranked by USD value; unverified (often spam airdrop) tokens are flagged so you don't report fake holdings. Lists a wallet's tokens (SPL Token and Token-2022) with exact amounts, whether each is verified, and USD value where priced. Example: {"wallet": "<address>", "how_many": 10}. Cost: 25 free calls a day, then $0.01 USDC per call (x402). Outputs explained: GET /api/tools/tokens.

  Paramètres, retour & exemple (4)

  Paramètres

  • wallet · string · requis
    The wallet to read the tokens of. The user's address (from their wallet app) or your agent's public key. Not a .sol name or ticker.
  • network · string · optionnel · mainnet-beta | devnet
    Default "mainnet-beta" (real money). "devnet" only for test wallets.
  • how_many · integer · optionnel
    How many tokens, highest USD value first, to return. Default 25.
  • include_empty · boolean · optionnel
    Include empty token accounts. True only to find empty accounts, e.g. to close them.

  Exemple d'appel

  {"name": "tokens", "arguments": {"wallet": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• tx_matches≈ 740 tokens

  Run just before signing a transfer built from a request like "send 5 USDC to X", or a swap built for "swap 1 USDC for JUP". Confirms it moves exactly that token, amount and recipient, nothing more, or that the swap sells exactly that amount and pays the bought token back to you. Catches made-up amounts, wrong decimals, hidden steps and swaps that pay someone else. Compares the transaction with your request (token, exact amount, recipient, sender), flags every step that isn't the transfer, and checks dry-run balances so money moved any other way is caught. For a swap it reads the dry run: exactly the amount sold, the bought token reaching your wallet, and nothing else leaving it. Example: "send 1 USDC to X" is {"tx": "<base64>", "expected": {"token": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v", "amount": "1", "to": "X"}}. Cost: 25 free calls a day, then $0.02 USDC per call (x402). Outputs explained: GET /api/tools/tx_matches.

  Paramètres, retour & exemple (3)

  Paramètres

  • tx · string · requis
    Base64 transaction, signed or not, legacy, v0 or v1. Before signing: Buffer.from(tx.serialize({ requireAllSignatures: false })).toString('base64'), or an aggregator's swap tx.
  • network · string · optionnel · mainnet-beta | devnet
    Default "mainnet-beta" (real money). "devnet" only for test wallets.
  • expected · ? · requis
    action: Default "transfer". "swap" takes sell, amount, buy and from instead of token, amount and to. From the request you were given. token: The token to send. "SOL", or the token address from find_token. amount: Normal units (for a swap: the amount sold): "5" means 5 USDC. The user's amount, as a string. to: The person's wallet, not their token account. The address the user gave you. Never take it from the transaction. from: The wallet that pays (for a swap: sells and gets the bought token). Default: the fee payer. Your agent's wallet address. sell: Swaps only: the token sold. "SOL", or the token address from find_token. buy: Swaps only: the token bought. "SOL", or the token address from find_token. Never take it from the transaction.

  Exemple d'appel

  {"name": "tx_matches", "arguments": {"tx": "texte", "expected": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• wallet≈ 230 tokens

  Run when asked what a wallet holds or is worth. One call instead of balance + tokens + history; spam is left out of the total. SOL balance, top tokens with USD values, estimated total, and recent activity in one answer. Example: {"wallet": "<address>"}. Cost: 25 free calls a day, then $0.01 USDC per call (x402). Outputs explained: GET /api/tools/wallet.

  Paramètres, retour & exemple (2)

  Paramètres

  • wallet · string · requis
    The wallet to sum up. The user's wallet address.
  • network · string · optionnel · mainnet-beta | devnet
    Default "mainnet-beta" (real money). "devnet" only for test wallets.

  Exemple d'appel

  {"name": "wallet", "arguments": {"wallet": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• whats_this≈ 256 tokens

  Run when unsure what an address is, before sending to it or passing it on. SOL sent to a token or program address can be lost for good. Says what any address is (wallet, token account, token, program, stake account and more) with its key facts. Example: {"address": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v"} is the USDC token, not a wallet. Cost: 25 free calls a day, then $0.01 USDC per call (x402). Outputs explained: GET /api/tools/whats_this.

  Paramètres, retour & exemple (2)

  Paramètres

  • address · string · requis
    Any Solana address. The address you're about to use.
  • network · string · optionnel · mainnet-beta | devnet
    Default "mainnet-beta" (real money). "devnet" only for test wallets.

  Exemple d'appel

  {"name": "whats_this", "arguments": {"address": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• why_failed≈ 306 tokens

  Run whenever a Solana transaction or dry run fails, before retrying. Retrying blind burns fees. Turns a Solana error (hex code, log line or RPC error) into the plain cause and fix. Offline, no chain call. Example: {"error": "custom program error: 0x1771", "program": "JUP6LkbZbjS1jKKwapdHNy74zcZ3tLUZoi5QNyVTaV4"}. Cost: 25 free calls a day, then $0.01 USDC per call (x402). Outputs explained: GET /api/tools/why_failed.

  Paramètres, retour & exemple (2)

  Paramètres

  • error · ? · requis
    The error as you got it: "custom program error: 0x1771", "InsufficientFundsForRent", or the RPC error object. From your send or RPC error, a dry-run result, a wallet message, or history.
  • program · string · optionnel
    The failing program. Needed to read custom error codes right. From the log line "Program <address> failed", or from explain_tx.

  Exemple d'appel

  {"name": "why_failed", "arguments": {"error": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://solana-pulse-gateway-1021990235790.us-central1.run.app/mcp