Axon CLI — local non-custodial trading terminal for AI agents (Claude Code, Claude Desktop, Cursor, Codex, Cline, Continue, Windsurf, Hermes, OpenClaw). Boots the daemon + dashboard + MCP server. Trade Hyperliquid perps, Uniswap V3 spot, Aave V3 lending,
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio · http counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
no tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed v1.15.1 · analyzer v18 · 10h ago
danger signals2
- suspicious endpointapi.telegram.orgpackage/dist/index.js:6540
const url = `https://api.telegram.org/bot${this.cfg.botToken}/sendMessage`; - credential in logscredential in logpackage/dist/index.js:19345
console.error(pc5.red(`Password must be at least ${MIN_PASSWORD_LEN} characters.`));
evidence-backed
findings quoted directly from the published source artifact — not inferred
filesystem 1
- fs package/dist/index.js :247
import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync } from "node:fs";
shell / exec 1
- shell package/dist/index.js :5853
import { execSync } from "node:child_process";
network 7
- net package/assets/dashboard/assets/ccip-Cdl6rWKn.js :1
import{B as u,a7 as b,aQ as k,G as R,ak as M,aq as $,ap as S,t as A,w as G,N as T,$ as g,ai as E,H as p,am as C}from"./index-Sw_MKjhx.js";class D extends u{constructor({callbackSelector:a,cause:t,data - net package/assets/dashboard/assets/core-CRf6zjVD.js :2
import{D as Gp,T as Jp,i as Yp,W as Zp,f as Xp,b1 as Qp,Z as ef,_ as _a,ag as xn,aS as zc}from"./index-Sw_MKjhx.js";import{I as bi,V as it,g as q,h as $t,C as tf,t as Et,m as sf,j as Gi,T as Sa,i as P - net package/assets/dashboard/assets/index-BslG9MlP.js :1
import{a2 as rr,v as ot,aU as zh,aF as Gh,a5 as Jh}from"./index-Sw_MKjhx.js";import{p as Zh,a as Kh}from"./hooks.module-CRTr1Ar6.js";import{r as mn}from"./events-DQ172AOg.js";function Qh(e,r){for(var - net package/assets/dashboard/assets/index-FcC6TndU.js :4
`,n&&`factory: ${n}`,r&&`factoryData: ${r}`,i&&`initCode: ${i}`,a&&`sender: ${a}`].filter(Boolean),name:"InitCodeMustReturnSenderError"})}}Object.defineProperty(Un,"message",{enumerable:!0,configurabl - net package/assets/dashboard/assets/index.es-C5t9qo-1.js :17
${r.length}`,t=new TextEncoder().encode(e+r);return"0x"+Buffer.from(ob(t)).toString("hex")}async function cb(r,e,t,i,s,n){switch(t.t){case"eip191":return await ub(r,e,t.s);case"eip1271":return await l - net package/assets/dashboard/assets/metamask-sdk-qYWjRzEo.js :38
`)}toSVG(){let e=`<svg xmlns:svg="http://www.w3.org/2000/svg" viewBox="0 0 ${this.width} ${this.height}" version="1.1" xmlns="http://www.w3.org/2000/svg">`;return this.rectRead(0,1/0,({x:n,y:r},i)=>{i - net package/dist/index.js :1858
// browsers silently strip it from fetch() requests. We duplicate
secrets 1
- secrets package/dist/index.js :2415
this.staticKey = opts.apiKey && opts.apiKey.length > 0 && opts.apiKey || process.env.AXON_PRISM_KEY && process.env.AXON_PRISM_KEY.length > 0 && process.env.AXON_PRISM_KEY || PUBLISHED_PRISM_KEY.length
database 1
- db package/dist/index.js :5987
import Database from "better-sqlite3";
declared dependencies 31
- @clack/prompts@1.4.0
- @fastify/cors@10.1.0
- @nktkas/hyperliquid@0.32.2
- @scure/bip32@1.7.0
- @scure/bip39@1.6.0
- @zerodev/ecdsa-validator@5.4.9
- @zerodev/sdk@5.5.10
- better-sqlite3@11.10.0
- commander@12.1.0
- fastify@5.8.5
- ink@5.2.1
- ink-spinner@5.0.0
- ink-text-input@6.0.0
- open@10.2.0
- permissionless@0.3.5
- picocolors@1.1.1
- posthog-node@4.13.0
- prompts@2.4.2
- react@18.3.1
- tslib@2.8.1
- viem@2.50.4
- @types/better-sqlite3@7.6.13
- @types/node@22.19.17
- @types/prompts@2.4.9
- @types/react@18.3.12
- esbuild@0.28.0
- typescript@5.9.3
- vitest@3.2.4
- @axon-trading/backtest-engine@0.1.0
- @axon-trading/mcp@1.15.1
- @axon-trading/sdk@1.15.1