FirstKeyHQ/firstkey-mcp
github not analyzable deep scan unknown
not analyzable — repository too large to scan in full
FirstKey MCP: agent wallets, free cycles faucet, and one-command site deploys on ICP.
FirstKeyHQ/firstkey-mcp is an MCP server distributed on github, maintained by FirstKeyHQ, tracked here since September 2026. It has shipped 0 releases and exposes 7 tools. Tools include check_cycles, claim_faucet_grant, create_wallet, deploy_site, deploy_upload_chunk, get_fuel_link, and 1 more. No risk grade is shown: the source hasn't been analyzed deeply enough to stand behind one.
what we found
Reading the source raised one review prompt — exfiltration combo — each a pattern worth a human look rather than a finding of fault.
Since the previous scan on 2026-10-01: 1 tool added.
full security breakdown →tools
-
check_cyclesReads a principal's cycles balance on the cycles ledger. -
claim_faucet_grantClaims the one-time free 1T cycles grant from the FirstKey faucet for an agent principal. -
create_walletGenerates a fresh Ed25519 wallet (principal + PKCS#8 PEM private key). The key is returned once and never stored. -
deploy_siteCreates a site canister, installs the static host, uploads files, returns the live https://<canister>.icp.net URL. The agent becomes a cont… -
deploy_upload_chunkChunked upload of large files to an already-deployed agent site. -
get_fuel_linkReturns the FirstKey Fuel card-payment link to refuel an agent (https://firstkey.io/fuel?for=<principal>). -
get_swap_quoteLive read-only ICPSwap quote (on-chain factory→pool): pay token/amount → receive amount + implied price. Symbols or ledger principals; no t…
release cadence · 90d
No releases yet.
recent releases
No releases yet.