Pulsechain MCP

Findings (22)

• highHigh. Something risky that needs a close look before you install.
  secrets issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @modelcontextprotocol/node@2.0.0: 1 known vulnerability

  GHSA-f897-62hf-6gxq

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @modelcontextprotocol/server@2.0.0: 4 known vulnerabilities

  GHSA-46jr-4wx8-v453, GHSA-f897-62hf-6gxq, GHSA-jm63-cq47-j5jp, GHSA-rvq5-wwqv-78pq

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  brace-expansion@2.1.4: 3 known vulnerabilities

  GHSA-6j4f-fj2g-mc7p, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  brace-expansion@5.0.8: 4 known vulnerabilities

  GHSA-6j4f-fj2g-mc7p, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-rgw5-rvv9-x895

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  nanoid@3.3.16: 1 known vulnerability

  GHSA-2v37-7h3g-55p8

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  source-map-js@1.2.1: 1 known vulnerability

  GHSA-68fv-2mgg-jv7q

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  vite@7.3.6: 5 known vulnerabilities

  GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@4.4.3: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  2 matches in this file

  tests/analytics-free.test.ts:48
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  2 matches in this file

  tests/multicall.test.ts:22
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  2 matches in this file

  tests/wallet-notional-intelligence.test.ts:18
• lowLow. Minor, or common in normal tools. Shown for information.
  @hono/node-server@1.19.15: 1 known vulnerability

  GHSA-rmxm-3fg6-px4f

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  @vitest/mocker@3.2.4: 2 known vulnerabilities

  GHSA-82fw-gwwq-j7x9, GHSA-qxg6-89mg-rqv8

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  glob@10.5.0: 1 known vulnerability

  GHSA-3g3m-2fjr-6pw4

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  hono@4.12.32: 9 known vulnerabilities

  GHSA-54fx-42gc-7vw4, GHSA-5r4p-p66f-jhc7, GHSA-79qm-7rj5-m7r9, GHSA-8j4g-w8fx-2239, GHSA-crvj-82cr-hjcx +4 more

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  minimatch@10.2.5: 1 known vulnerability

  GHSA-g3hv-75wg-m249

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  minimatch@9.0.9: 1 known vulnerability

  GHSA-g3hv-75wg-m249

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  package.json has a prepare script

  npm run build

  package.json
• lowLow. Minor, or common in normal tools. Shown for information.
  No manifest declaring network access and environment variables (agent.json)

Network activity

Tools exposed (80)

• pulsechain_health

  Report PulseChain MCP health: chain id, multi-RPC list and active endpoint, explorer/subgraph flags, agent wallet enabled. Never returns secrets.

• pulsechain_status

  Alias of pulsechain_health with optional verbose subgraph hosts and full RPC endpoint health (no secrets). Prefer get_rpc_health for dedicated RPC monitoring.

• get_rpc_health

  Report health of all configured PulseChain RPC endpoints: status (healthy | degraded | cool-down | unreachable | unknown), failure counts, last success/failure times, latency when known. primaryRpcUrl = configured first-priority URL (list order). activeRpcUrl = last successful request or probe — not

• get_balance

  Get native PLS balance for an address on PulseChain (wei + formatted).

• get_token_balance

  Get a single ERC-20 token balance plus on-chain metadata (name, symbol, decimals).

• get_portfolio

  Multi-token balances for an address via multicall. Defaults to core PulseChain tokens (WPLS, HEX, PLSX, INC, bridged DAI, USDC, USDT) plus native PLS. Symbol DAI is bridged stable only; forked pDAI is labeled when its address appears.

• get_transaction

  Fetch a transaction by hash from RPC, including receipt and status when available.

• get_transaction_history

  Recent native transactions for an address via BlockScout explorer API. For ERC-20 token transfers use get_token_transfers (not this tool).

• get_token_transfers

  Recent ERC-20 token transfers for an address via BlockScout explorer tokentx. Optional contractAddress filters to one token. Native txs: get_transaction_history.

• get_gas_price

  Current gas price and EIP-1559 fee data (maxFeePerGas / maxPriorityFeePerGas when available).

• estimate_gas

  Estimate gas for a prepared call (to / data / value / from).

• get_block

  Fetch a block by number (decimal string) or latest.

• read_contract

  Read a contract via viem readContract (eth_call). Provide ABI (JSON or human-readable fragment), function name, and args.

• prepare_transaction

  Build an unsigned transaction object (to, data, value, gas/fee estimates). NEVER signs or broadcasts. UNSIGNED ONLY: This tool builds a transaction payload and never signs or broadcasts. Nothing is submitted unless agent wallet tools are enabled (AGENT_WALLET_ENABLED=true, operator-trust when funded

• pulsex_quote

  Quote an exact-in swap via **PulseX router only** (getAmountsOut V1/V2). Not multi-DEX — prefer pulseswap_quote for cross-DEX routes. Uses WPLS hop when needed. Advisory size check; does not execute. Token symbols: DAI/USDC/USDT = bridged only; use addresses for identity-sensitive paths.

• prepare_swap

  Build unsigned PulseX exact-in swap calldata (swapExactTokensForTokens / ETH variants). NEVER signs or broadcasts. UNSIGNED ONLY: This tool builds a transaction payload and never signs or broadcasts. Nothing is submitted unless agent wallet tools are enabled (AGENT_WALLET_ENABLED=true, operator-trus

• get_token_allowance

  Read ERC-20 allowance(owner, spender). Does not approve or broadcast. Token may be a 0x address or an explicit catalog symbol. USDL and LOAN are Liquid Loans symbols, not aliases of DAI or USD. For Piteas swaps the spender is the Piteas router.

• get_token_price

  USD and PLS **price by token address** from PulseX subgraph (derivedUSD / derivedPLS). Prefer this over DexScreener search for size/price. Includes UTC calendar-day change from tokenDayData when available (not a rolling 24h window — see volume_window). Catalog origin labels attach for known addresse

• get_token_info

  Token metadata by **address** (identity-sensitive). Combines PulseX subgraph + BlockScout. Catalogued assets get display_symbol / token_origin (e.g. eUSDC, pHEX); never invented for unknowns. Pairs are quality-ranked (catalog rails preferred; ghost/polluted reserves demoted; junk rails excluded from

• get_token_history

  Historical daily price/volume/liquidity from PulseX tokenDayData (subgraph). Returns up to 90 days of public day candles.

• get_top_tokens

  Top PulseX tokens by volume, liquidity, or transaction count (subgraph orderBy). Public PulseX data. Catalogued addresses include display_symbol / token_origin (e.g. pHEX vs eHEX, pDAI vs DAI) — never invented for unknowns. liquidity_usd_estimate demotes absurd subgraph derivedUSD products (not inve

• get_top_pairs

  Top PulseX DEX pairs by volume, liquidity (reserveUSD), or tx count. Filters out dust pairs (reserveUSD & volumeUSD > 100). Catalogued token sides include token0/1_display_symbol and token0/1_origin (e.g. pHEX/eHEX, pDAI/DAI). IMPORTANT: token0_price and token1_price are pair-relative (token1 per to

• get_market_overview

  Aggregate PulseX market stats: TVL (totalLiquidityUSD), cumulative volume, pair/tx counts, recent daily volumes, PLS price. From public PulseX factory + day data.

• get_token_safety

  HEURISTIC token safety score (0–100, grade A–F) from public signals: contract verification, ownership renounce (owner()), liquidity, holder concentration, age, suspicious ABI patterns. NOT a full audit or guaranteed honeypot detector. Limitations clearly labeled in result.

• get_token_liquidity

  Pool liquidity breakdown for a token: all major PulseX pairs, reserves, and USD liquidity estimates.

• get_honeypots

  HEURISTIC list of recently suspicious / high-risk tokens from public PulseX + contract signals (low liquidity vs volume, suspicious ABI, transfer simulation). NOT a guarantee of honeypot status — labels confidence and method. For screening only.

• get_bridge_stats

  Best-effort PulseChain bridge / bridged-asset overview from public PulseX liquidity of major bridged tokens (DAI/USDC/USDT from Ethereum). LIMITED: daily inflow/outflow event series require bridge indexers (not available via public PulseX/BlockScout alone). Documents gaps.

• get_holder_leagues

  Holder distribution buckets (poseidon/whale/shark/dolphin/squid/turtle) for a core token or any address, using BlockScout top holders + PulseX price. USD tiers are approximate community-style leagues.

• check_address_risk

  Heuristic risk signals for a PulseChain address from public data only. Methodology: explorer txlist (age, fail rate, funders, contract creates) + known CORE_TOKENS/POPULAR_CONTRACTS allowlist. No private openpulsechain backend. Returns riskScore 0–100, signals[], confidence, and method. Heuristic/di

• get_deployer_reputation

  Best-effort contract creator reputation from public BlockScout data. Methodology: getcontractcreation for the contract → creator address history (txlist contract creates, age, fail rate). Outcomes are approximate (no private scam DB). confidence/method included.

• get_scam_alerts

  Recent suspicious PulseX tokens/pairs from public subgraph heuristics only. Signals: (1) young pairs with volume>>liquidity, (2) thin-reserve high-tx pairs, (3) large LP burns vs remaining reserves (liquidity-pull). Each alert includes confidence + method. Heuristic/directional only — not a definiti

• get_smart_money_feed

  High-signal PulseX swaps from the public subgraph. Default threshold: amountUSD > minUsd (default 10000). Methodology: GraphQL swaps where amountUSD_gt = threshold, newest first. 'Smart money' here means large USD-notional flow only — not labeled whale DB.

• get_recent_swaps

  Recent PulseX swaps with optional pair, token, or minUsd filters. Uses public graph.pulsechain.com PulseX subgraph. Token filter resolves top pairs (capped) then strict-filters swaps; partial results if some pair queries fail. Deep skip or pair-capped token pages set incomplete=true with a coverage

• get_wallet_balances

  Native PLS + ERC-20 portfolio for a wallet. Methodology: (1) explorer account/tokenlist (or tokentx sample) to discover tokens, (2) merge with CORE_TOKENS, (3) live balances via RPC multicall balanceOf + native getBalance. Explorer list may be incomplete for never-indexed tokens.

• get_wallet_swaps

  PulseX swap history for a wallet from the public subgraph. Methodology: swaps where sender == wallet OR to == wallet, merged & sorted by timestamp desc. Deep pages (skip+first>100) set incomplete=true; the merged page is approximate. Router-mediated swaps may attribute sender as the router — coverag

• get_funding_tree

  Depth-limited first-funder hop tree via public explorer native transfers. Methodology: for each node, take earliest inbound native tx (txlist sort=asc) as parent edge; BFS up to maxDepth (default 2) and maxNodes. Approximate; CEX/deposit roots common.

• get_holder_rank

  Rank of an address among ERC-20 holders via public BlockScout. Primary: API v2 /tokens/{addr}/holders (top holders). Fallback: module=token&action=getTokenHolders. If found on the returned page, rank = index + 1 (v2 top list) or (page-1)*offset + index + 1. Otherwise not-found with percentileEstimat

• dexscreener_search

  Search DexScreener pairs/tokens — **discovery-only** (defaults PulseChain-only). Upstream may return empty or spoof-dominated sets; always read catalog_coverage and recommended_address_followups (token and/or known major pair → dexscreener_pair). Never invent pairs from guidance. Catalogued addresse

• dexscreener_pair

  Get a single DexScreener pair by pair address. chainId defaults to pulsechain. Returns price, liquidity, volume, and origin labels on known tokens.

• dexscreener_token_pairs

  List DexScreener pools/pairs for a token address on PulseChain (default). Useful market overview for PLSX, HEX, bridged DAI, etc. Origin labels attached when known.

• dexscreener_tokens

  Get DexScreener pairs for one or more token addresses (comma-separated or array, max 30). chainId defaults to pulsechain.

• dexscreener_boosts_latest

  Latest DexScreener token boosts (promoted tokens). Defaults to PulseChain-only. Optional market-intel signal; not a recommendation. Fail-soft on upstream errors.

• dexscreener_profiles_latest

  Latest DexScreener token profiles. Defaults to PulseChain-only. Fail-soft on upstream errors.

• phiat_dashboard

  Read-only PHIAT token research dashboard by contract address. Combines PulseX subgraph, DexScreener, BlockScout, and optional user-labeled treasury/staking balance reads. Never resolves PHIAT by symbol, never writes to disk, and never prepares/signs/executes transactions. Treasury/staking classifica

• piteas_accumulation_plan

  Research-only eUSDC -> PHIAT accumulation planner using Piteas quote data only. Requires verified token addresses, checks quote coherence, and never prepares or submits transactions.

• blockscout_token_overview

  Richer BlockScout token overview for a PRC-20: metadata, supply/holders counters, and a top-holders sample when available. Public scan.pulsechain.com (v1+v2); fail-soft with source labels. Not a price oracle.

• blockscout_contract_abi

  Fetch verified contract ABI (+ light verification meta) from BlockScout. Fail-soft when unverified or explorer errors. source=blockscout.

• blockscout_address_activity

  Recent ERC-20 token transfers and internal transactions for an address (BlockScout samples). Fail-soft; paginated. Prefer over scraping HTML.

• blockscout_event_logs

  Query event logs via BlockScout explorer API (address/topics/blocks) with fail-soft envelope (source=blockscout). Prefer tight block ranges — wide scans may time out or soft-fail upstream. When the returned row count hits offset, truncated=true with a window object; this is not full history.

• defillama_pulsechain_tvl

  DefiLlama high-level PulseChain chain TVL snapshot (keyless api.llama.fi). Advisory third-party estimate; source=defillama. Fail-soft on upstream issues.

• defillama_pulsechain_protocols

  Top DefiLlama protocols with PulseChain exposure (chain key usually "Pulse"). Optional category filter (e.g. Dexs). Advisory; source=defillama; fail-soft.

• pulseswap_quote

  PulseSwap **multi-DEX** advisory quote on PulseChain (chainId 369). Prefer this over pulsex_quote when comparing routes across DEXes. Public quotes.pulseswap.io. Returns amountIn/amountOut (amountIn echoes request when upstream zeros it), platform, gasEstimate when available. quoteReady = advisory a

• piteas_quote

  Piteas **DEX aggregator** advisory quote on PulseChain (public sdk.piteas.io). Preferred aggregator assist for multi-hop routes — **not** a guaranteed best-price oracle. Use **PLS** (or native/0x0) for native token. Accepts 0x addresses or catalogued symbols (e.g. eUSDC). Returns expected/min out, P

• piteas_prepare_swap

  Turn a **successful** piteas_quote payload into an agent-ready **non-broadcast** tx intent: to = PiteasRouter, data = exact upstream methodParameters.calldata, intent.valueWei (wei) + intent.valuePls (human PLS for propose_agent_tx — never pass wei as valuePls). Includes review fields (tokenIn/out,

• switch_quote

  Switch.win **DEX aggregator** advisory quote on PulseChain (quote.switch.win). **Operator-gated auth:** requires **SWITCH_API_KEY** in server env (x-api-key). Public unauthenticated access returns HTTP 401. Key access is **not self-serve** for agents — the human operator must request a key at https:

• switch_prepare_swap

  Turn a **successful** switch_quote payload into an agent-ready **non-broadcast** tx intent: to = upstream tx.to (never hardcoded SwitchRouter), data = exact upstream tx.data, intent.valueWei (wei) + intent.valuePls (human PLS for propose_agent_tx — never pass wei as valuePls). Includes review fields

• pulsex_factory

  PulseX factory-level metrics (total pairs, cumulative volume/liquidity, txs) from public pulseXFactories. source=pulsex-subgraph. Fail-soft. Distinct from get_market_overview (no day series / gainers fan-out).

• pulsex_dex_day_data

  Protocol-level PulseX day history (pulsexDayDatas): daily volume, TVL, cumulative series. Richer dedicated history than get_market_overview's short sample. source=pulsex-subgraph. Fail-soft. For token/pair day series use pulsex_token_day_data / pulsex_pair_day_data.

• pulsex_lp_events

  Recent PulseX LP mint and burn events (optional pair filter). LP-oriented read for add/remove liquidity flow — not a wallet LP position ledger. source=pulsex-subgraph. Fail-soft. amountUSD can be noisy for junk pairs.

• hex_global_state

  On-chain HEX global stake state (currentDay, shareRate, lockedHeartsTotal, …) via multi-RPC. Default contract=phex (state-fork stakeable HEX). eHEX is bridged ERC-20 only — soft-fails with clear note. source=hex-rpc. Not a price oracle. Read-only; never starts/ends stakes.

• hex_stakes_for_address

  List on-chain HEX stakes for a staker address (stakeCount + stakeLists). Default contract=phex. eHEX soft-fails (no stake interface). Hearts use 8 decimals. source=hex-rpc. Advisory only — no price; no stake write. Fail-soft on RPC errors.

• hex_stake_summary

  Read-only summary of PulseChain pHEX stakes for one address (chain 369). pHEX stakes only — not Ethereum eHEX stakes. Reports days left, ending-soon, approximate T-shares (stakeShares/1e12), principal, and a share-rate yield estimate when current day and share rate are both available. Every yield fi

• liquid_loans_system

  Read-only Liquid Loans system snapshot on PulseChain mainnet: simulated PLS price, system collateral and USDL debt, total collateral ratio, recovery mode, borrowing and redemption rates, MCR/CCR, stability-pool USDL and its share of debt, active versus default pools, and the lowest-ICR vault. Uses t

• liquid_loans_vault

  Read-only Liquid Loans vault for an address. collateralPls and debtUsdl are entire amounts (recorded plus pending redistribution). debtUsdl includes the USDL gas reserve; netDebtUsdl subtracts it. collateralRatio is ICR as a percent. nominalIcr is PLS per USDL, not a percent. liquidation and debtInF

• liquid_loans_position

  Read-only Liquid Loans position for an address: vault summary, compounded stability-pool USDL (not the raw deposit), PLS and LOAN gains, LOAN stake with pending gains, claimable collateral surplus, and advisory debt in front. Mainnet only. Does not deposit, withdraw, stake, or liquidate. Not the old

• pulsex_buy_and_burn

  Read-only PulseX buy-and-burn status on chain 369. Reads the buyback proxy: paused() or enabled() when that view exists, PLSX balances of the dead address and the buyback, native PLS, and a capped fee-token list. Does not call buyAndBurn, convertLps, or any other write. Contract read, not financial

• pump_tires_coin

  Read-only Pump.tires coin status on chain 369. Answers whether this address is still on the bonding curve or has graduated. The platform PUMP token is labeled as the platform token and is not a launched coin. An address the creation-tx factory does not list is not marked graduated. Progress is bid P

• pulsex_subgraph_meta

  Fetch PulseX subgraph _meta (indexing status). Uses public graph.pulsechain.com endpoints by default.

• pulsex_token

  PulseX subgraph token entity by address.

• pulsex_pair

  PulseX subgraph pair/pool entity by pair address.

• pulsex_swaps

  Recent swaps from PulseX subgraph (optionally filtered by pair). Raw subgraph power tool: catalogued pair sides get display_symbol/token_origin. Prefer get_recent_swaps for filtered views; use addresses for identity.

• pulsex_token_day_data

  Daily volume/liquidity/price history for a token.

• pulsex_pair_day_data

  Daily volume/reserves history for a pair.

• pulsex_top_tokens

  Top tokens by volume, liquidity, or tx count (raw PulseX subgraph). Catalogued addresses get display_symbol/token_origin (e.g. pHEX, eUSDC) — never invented. Prefer get_top_tokens for free-tier ranking with liquidity demotion. Ranking is heuristic/directional — not settlement-grade.

• pulsex_top_pairs

  Top pairs by volume, liquidity (reserveUSD), or tx count (raw PulseX subgraph). Catalogued token sides get display_symbol/origin — never invented. Prefer get_top_pairs for free-tier ranking with sanitized liquidity. Ranking is heuristic/directional — not settlement-grade.

• agent_wallet_status

  Operator snapshot: wallets on/off, multiproc risk, writes blocked, funding-authorizes-spend, kill switch counts. Flow: inspect_tx_intent → propose_agent_tx → reviewSummary → execute_agent_tx. Does NOT return secrets or private keys. Not a distributed lock.

• inspect_tx_intent

  Decode a transaction intent (no signing, no chain I/O). Returns token-notional pattern/confidence, movement explanations, and decodeKnowledge. Does not block propose/execute. Covers ERC-20, WPLS wrap/unwrap, PulseX-style swaps, add/remove liquidity, one-level multicall. Not full EVM simulation. Does

• agent_wallet_check_policy

  Dry-run: would this wallet sign a native PLS amount? Blocks only when killed, disabled, or the amount is invalid. No spend caps. Prefer propose_agent_tx for a real destination.

• get_agent_wallet_info

  Return public agent wallet info: address, enabled/killed, balances, created_at, daily spend. Never returns private keys or encrypted blobs.

• list_agent_wallets

  List all agent wallets (public fields only: id, address, enabled/killed, daily spend).