MCP Server giving AI Agents metered access to the Hedera Network. 23 Tools. Pay per call in HBAR. No Registration
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio · streamable-http · http counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 322d68d · analyzer v28 · 3d ago
danger signals6
- suspicious endpoint t.me mountainmystic-hederatoolbox-322d68d/src/telegram.js :467
`Reply to them at: https://t.me/${msg.from?.username || chatId}` - credential in logs credential in log mountainmystic-hederatoolbox-322d68d/examples/dao-monitor-agent.mjs :201
console.log(` PROPOSAL_ID=${p.proposal_id} TOKEN_ID=${TOKEN_ID} TOPIC_ID=${TOPIC_ID} HEDERA_ACCOUNT_ID=${API_KEY} node examples/dao-monitor-agent.mjs --analyze`); - credential in logs credential in log mountainmystic-hederatoolbox-322d68d/examples/whale-alert-agent.mjs :149
console.log(` API key: ${API_KEY}`); - credential in logs credential in log mountainmystic-hederatoolbox-322d68d/src/db.js :282
console.error(`[Provenance] Write failed for ${toolName}/${apiKey}: ${e.message}`); - credential in logs credential in log mountainmystic-hederatoolbox-322d68d/src/server-entry.js :338
console.error(`[Access] Granted ${tool_name} to ${api_key}`); - credential in logs credential in log mountainmystic-hederatoolbox-322d68d/src/server.js :165
console.error(`[Tool] ${name} | key: ${args?.api_key || "none"}`);
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 36
filesystem 3
- fs mountainmystic-hederatoolbox-322d68d/src/consent.js :7
import { readFileSync } from "fs"; - fs mountainmystic-hederatoolbox-322d68d/src/modules/legal/tools.js :2
import { readFileSync } from "fs"; - fs mountainmystic-hederatoolbox-322d68d/src/server-entry.js :8
import { readFileSync } from "fs";
network 17
- net mountainmystic-hederatoolbox-322d68d/src/hbar-price.js :4
import axios from "axios"; - net mountainmystic-hederatoolbox-322d68d/src/modules/bridge/tools.js :2
import axios from "axios"; - net mountainmystic-hederatoolbox-322d68d/src/modules/compliance/tools.js :9
import axios from "axios"; - net mountainmystic-hederatoolbox-322d68d/src/modules/contract/tools.js :2
import axios from "axios"; - net mountainmystic-hederatoolbox-322d68d/src/modules/fixatum/tools.js :31
const res = await fetch(`${FIXATUM_BASE}${path}`, { signal: controller.signal, headers: extraHeaders }); - net mountainmystic-hederatoolbox-322d68d/src/modules/governance/tools.js :2
import axios from "axios"; - net mountainmystic-hederatoolbox-322d68d/src/modules/hcs/hedera.js :2
import axios from "axios"; - net mountainmystic-hederatoolbox-322d68d/src/modules/identity/tools.js :2
import axios from "axios"; - net mountainmystic-hederatoolbox-322d68d/src/modules/nft/tools.js :2
import axios from "axios"; - net mountainmystic-hederatoolbox-322d68d/src/modules/token/tools.js :2
import axios from "axios"; - net mountainmystic-hederatoolbox-322d68d/src/proxy.js :29
response = await fetch(url, { - net mountainmystic-hederatoolbox-322d68d/src/server-entry.js :19
import http from "http"; - net mountainmystic-hederatoolbox-322d68d/src/telegram.js :6
import https from "https"; - net mountainmystic-hederatoolbox-322d68d/src/visionforge.js :7
import https from "https"; - net mountainmystic-hederatoolbox-322d68d/src/watcher.js :7
import axios from "axios"; - net mountainmystic-hederatoolbox-322d68d/src/xagent.js :5
import https from "https"; - net mountainmystic-hederatoolbox-322d68d/step4-verify.mjs :2
import https from "https";
secrets 9
- secrets mountainmystic-hederatoolbox-322d68d/src/hbar-price.js :22
const headers = process.env.SAUCERSWAP_API_KEY - secrets mountainmystic-hederatoolbox-322d68d/src/modules/compliance/tools.js :21
PrivateKey.fromStringECDSA(process.env.HEDERA_PRIVATE_KEY) - secrets mountainmystic-hederatoolbox-322d68d/src/modules/fixatum/tools.js :9
const FIXATUM_ADMIN_SECRET = process.env.FIXATUM_ADMIN_SECRET; - secrets mountainmystic-hederatoolbox-322d68d/src/modules/hcs/intelligence.js :7
if (!anthropic) anthropic = new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY }); - secrets mountainmystic-hederatoolbox-322d68d/src/modules/token/tools.js :14
const key = process.env.SAUCERSWAP_API_KEY; - secrets mountainmystic-hederatoolbox-322d68d/src/server-entry.js :70
const secret = process.env.ADMIN_SECRET; - secrets mountainmystic-hederatoolbox-322d68d/src/telegram.js :10
const BOT_TOKEN = process.env.TELEGRAM_BOT_TOKEN; - secrets mountainmystic-hederatoolbox-322d68d/src/visionforge.js :9
const ADMIN_SECRET = process.env.ADMIN_SECRET; - secrets mountainmystic-hederatoolbox-322d68d/src/xagent.js :9
const XAGENT_KEY = process.env.XAGENT_API_KEY;
declared dependencies 6
- @modelcontextprotocol/sdk@^1.0.0
- @hashgraph/sdk@^2.46.0
- @anthropic-ai/sdk@^0.39.0
- axios@^1.7.7
- dotenv@^16.4.5
- ethers@^5.7.2