Blockrun MCP

Findings (41)

• highHigh. Something risky that needs a close look before you install.
  secrets issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @modelcontextprotocol/sdk@1.29.0: 6 known vulnerabilities

  GHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-f897-62hf-6gxq +1 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  axios@0.27.2: 24 known vulnerabilities

  GHSA-3g43-6gmg-66jw, GHSA-3p68-rc4w-qgx5, GHSA-43fc-jf86-j433, GHSA-5c9x-8gcm-mpgx, GHSA-62hf-57xw-28j9 +19 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  axios@1.18.1: 12 known vulnerabilities

  GHSA-3pq3-5fj3-cg6v, GHSA-44g4-m2mj-wpvx, GHSA-4hqw-qxg8-jxx2, GHSA-542g-h47m-68v8, GHSA-9fr6-4gfg-395g +7 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  bigint-buffer@1.1.5: 1 known vulnerability

  GHSA-3gc7-fjrx-p6mg

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  body-parser@2.3.0: 1 known vulnerability

  GHSA-27r3-jxmh-p828

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  fast-uri@3.1.5: 10 known vulnerabilities

  GHSA-333x-w4r6-6crp, GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-hrr3-gc8f-f4qj +5 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  follow-redirects@1.16.0: 3 known vulnerabilities

  GHSA-8r9p-f939-6h3c, GHSA-mrwp-f3q8-3g9p, GHSA-q3jh-wrc6-jgq8

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  sharp@0.34.5: 3 known vulnerabilities

  GHSA-f88m-g3jw-g9cj, GHSA-rgj7-g3m4-5g8c, GHSA-wq5f-xc86-pv6w

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  source-map-js@1.2.1: 1 known vulnerability

  GHSA-68fv-2mgg-jv7q

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  uuid@8.3.2: 1 known vulnerability

  GHSA-w5hq-g745-h8pq

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  vite@8.2.2: 6 known vulnerabilities

  GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22 +1 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  ws@8.18.0: 2 known vulnerabilities

  GHSA-58qx-3vcg-4xpx, GHSA-96hv-2xvq-fx4p

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@4.4.3: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  test/chat-settled-on-error.test.ts:23
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  skills/gentech-blockrun/SKILL.md:159
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  test/confirm-spend-coverage.test.ts:127
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  test/phone.test.ts:10
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  test/chain-keychain-probe.test.ts:35
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  test/polymarket-setup-verify.test.ts:14
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  test/polymarket-l1-auth.test.ts:16
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  test/realface-money-path.test.ts:41
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  test/rail-parity.test.ts:53
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  test/video-cost.test.ts:12
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  test/video-money-path.test.ts:21
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  test/video-models.test.ts:23
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  test/speech-money-path.test.ts:15
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  test/onramp.test.ts:8
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  test/music-cost.test.ts:10
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  test/auth-mode.test.ts:45
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  test/video-reference-media.test.ts:22
• lowLow. Minor, or common in normal tools. Shown for information.
  @hono/node-server@1.19.14: 2 known vulnerabilities

  GHSA-frvp-7c67-39w9, GHSA-rmxm-3fg6-px4f

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  elliptic@6.6.1: 1 known vulnerability

  GHSA-848j-6mx2-7j84

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  esbuild@0.27.7: 1 known vulnerability

  GHSA-g7r4-m6w7-qqqr

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  hono@4.12.27: 9 known vulnerabilities

  GHSA-54fx-42gc-7vw4, GHSA-5r4p-p66f-jhc7, GHSA-79qm-7rj5-m7r9, GHSA-8j4g-w8fx-2239, GHSA-crvj-82cr-hjcx +4 more

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  ip-address@10.5.0: 5 known vulnerabilities

  GHSA-2vr4-cq9g-pvrc, GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-rpw4-54j3-4h4q, GHSA-rxp7-6hxx-x8q5

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  qs@6.15.3: 3 known vulnerabilities

  GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-x5fp-wj9c-mxmx

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  stream-json@1.9.1: 3 known vulnerabilities

  GHSA-528h-pc64-c93x, GHSA-hqr4-qq8f-hg3x, GHSA-mjw6-4jj6-33hc

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  No manifest declaring network access and environment variables (agent.json)
• lowLow. Minor, or common in normal tools. Shown for information.
  Contacted these domains while starting up (no manifest to compare against)

  registry.npmjs.org

Network activity

Tools exposed (19)

• blockrun_wallet

  Call this tool to manage the BlockRun payment wallet and control agent spending budgets. Call this FIRST if any other blockrun_* tool returns a payment/balance error. Call this to check your current USDC balance before expensive operations. Call this to set spending limits before spawning child age

• blockrun_chat

  Get a second opinion from another AI model, or use a specialized model for a specific task. Notable modes: - mode:"powerful" → Claude Opus 5, Claude Opus 4.8, GPT-5.6-sol, Claude Fable 5 (frontier, 1M context) - mode:"reasoning" → Claude Opus 5, GPT-5.6-sol, Kimi K3, Grok 4.3, deepseek-v4-pro - mod

• blockrun_models

  List available AI models with pricing. Use to discover models and compare costs.

• blockrun_image

  Generate or edit images via BlockRun. Pays with USDC on the ACTIVE chain — Base, Solana or Arc (see blockrun_wallet) — no separate API keys needed. Actions: - generate (default): Create image from text prompt - edit: Transform an existing image using img2img Generation models (1024x1024 base price

• blockrun_music

  Generate music tracks via BlockRun x402 (async, client-polled). Generates a full-length ~3 minute MP3 track. Takes 1-3 minutes to complete. The tool submits the job and, for slower tracks, polls until it is ready. On the Base wallet payment settles only when a finished track is returned — if the jo

• blockrun_speech

  AI voice via BlockRun x402 — speak text aloud (ElevenLabs or ByteDance Seed Audio), generate sound effects, list voices. Actions: - speak (default): text-to-speech. E.g. "speak this with the sarah voice". Price = chars/1000 × rate (min $0.001), quoted before payment. - sound_effect: cinematic sound

• blockrun_video

  Generate short AI videos via BlockRun x402 on the active Base, Solana or Arc chain (async, client-polled). Turns a text prompt (and optional seed image) into a short video clip (MP4, or MOV on Seedance 2.5). The tool submits the job, then polls until the video is ready (typical total wall-time 60-1

• blockrun_realface

  Enroll a real person's face as a BytePlus RealFace asset, then drive Seedance 2.0 video with it (blockrun_video real_face_asset_id). A RealFace asset (ta_xxxx) lets Seedance 2.0 / 2.0-fast / 2.0-mini generate video of a SPECIFIC real person — not a generic seed image. Only those three models: seeda

• blockrun_search

  Grok Live Search — real-time web + news with AI-summarized results and citations. Flat $0.08 per call plus the gateway's network fee ($0.001 on Base today, none on Solana; we reserve $0.002) — the same price at any max_results, so ask for as many sources as the question needs. Common shape: - body:

• blockrun_exa

  Neural web search via Exa — understands meaning, not just keywords. Great for research. Common paths (all POST, body shapes documented in the exa-research skill): - search — body: { query, numResults?, category?, includeDomains?, excludeDomains? } ($0.010 base + tx fee) - answer — bod

• blockrun_markets

  Prediction market + derivatives data via Predexon aggregator. Flat $0.0075 base per call (every endpoint) plus the gateway's network fee — $0.001 on Base today, none quoted on Solana; the 402 header carries the exact charge (we reserve $0.0095). POLYMARKET (Tier 1): - polymarket/events, polymarket/

• blockrun_price

  Realtime quotes and OHLC history for crypto, FX and commodities (Pyth-backed), plus the ticker catalog for 12 stock markets. - action="price" — realtime quote for a symbol - action="history" — OHLC bars between from/to (unix seconds) - action="list" — discovery: list available symbols (free) Prici

• blockrun_dex

  Get real-time DEX data from DexScreener. FREE - no payment required. Use for: - Token prices and liquidity across chains - Trading volume and price changes - Finding token pairs and contracts Examples: blockrun_dex({ query: "SOL" }) -> Search for SOL pairs blockrun_dex({ token: "So11

• blockrun_modal

  Run isolated code in a BlockRun-hosted Modal sandbox — disposable remote container, optional GPU. Use when you need: a clean ephemeral environment, GPU access (T4/L4/A10G/A100/H100 — those five only), or a safer place for untrusted code. Prefer local tools for normal repo work. ⚠️ `timeout` IS THE

• blockrun_phone

  Phone-number intelligence, US/CA number provisioning, and outbound AI voice calls. Common paths (path = everything after /v1/): - phone/lookup POST body: { phoneNumber } ($0.01) - phone/lookup/fraud POST body: { phoneNumber } — SIM-swap

• blockrun_rpc

  Raw JSON-RPC against 40+ blockchains — one endpoint, no node, no API key. $0.002 base per call plus the gateway's flat tx fee ($0.001 today; we reserve $0.002, so budget/confirm show $0.004 per single call). A JSON-RPC batch charges $0.002 per element plus ONE fee — batch when you can. Use when you

• blockrun_defi

  DeFi fundamentals via DefiLlama — protocol TVL, chain TVL, yield pools (APY), token prices. Pays per call in USDC, no API key. Paths (GET only; price = base + the gateway's flat tx fee, $0.001 today — we reserve $0.002; the 402 header carries the exact charge): - protocols ($0.

• blockrun_polymarket_read

  Read or preview Polymarket state without signing or changing anything. Actions: - positions — holdings, current value, PnL, and redeemable status (free Data API) - orders — open CLOB orders, optionally filtered by condition_id - preview — build a live buy/sell order preview from the CLOB book. side

• blockrun_polymarket

  Trade on Polymarket prediction markets (CLOB V2, Polygon). REAL MONEY — orders spend pUSD held in your Polymarket deposit wallet, signed locally by your BlockRun key. Free tool (no BlockRun API charge); discover markets/prices/token IDs with blockrun_markets first. Run action:"setup" FIRST (and aga