Evernode MCP

evernode-mcp — Evernode AI Builder

A Model Context Protocol server that lets an AI agent build, check, cost, and deploy HotPocket dApps on Evernode / Xahau. Point any MCP-capable agent (Claude, etc.) at it and ask for a dApp — it scaffolds a contract from templates written to avoid the known consensus-breakers, lints contract code for non-deterministic patterns, estimates the EVR lease, ranks live Evernode hosts, generates the deploy commands, and — when the dApp moves value on Xahau — emits the commands to install a spend-limit Hook and prove its invariant with the Hooks toolchain.

HotPocket is Evernode's contract runtime: it runs your Node.js/WASM contract on every node

of a cluster and puts the output + state through consensus. The single biggest beginner

mistake is non-deterministic code (Date.now(), Math.random(), fetch(), …) — two nodes

compute different results and the ledger stalls. This server is built around catching the

common causes of that before deploy (heuristically — see what it does / doesn't catch).

It is advisory and read-only: it generates files + guidance, never holds keys, never spends EVR, never acquires a lease, never signs or submits, and it connects to the Offledger Cluster Manager rather than replacing its orchestration. No API keys or accounts are needed; the only network calls are read-only HTTPS GETs to the public OnLedger API from two tools (see Network access).

Where it fits — the layer-2 companion to the Hooks trifecta

The Hooks pipeline secures *layer-1* Hooks — write → simulate one tx → prove all inputs → watch live:

evernode-mcp is the *layer-2* companion: it builds the HotPocket dApps that run on Evernode hosts. Whenever a dApp settles value on Xahau through a Hook-guarded account, it hands off to the trifecta — it never re-asserts settlement safety itself (check_hook_compat / generate_settlement emit the trifecta's prove/install commands, not a safety verdict).

Tools

All twelve tools are read-only / advisory. Every tool sets readOnlyHint: true; only the two live OnLedger tools (recommend_hosts, host_diagnostics) set openWorldHint: true (they may reach a live external endpoint, OnLedger). Each tool publishes an output schema, so an agent gets a validated structuredContent shape (not just text) — no guessing field names.

Templates

generate_contract ships 10 templates. Each is written to avoid the known non-determinism sources (no wall-clock, no randomness, no network in the contract path; time is the consensus ledger seq ctx.lclSeqNo; state persists only through the contract's own consensused state file) and is lint-clean: the smoke test and the suite run every template through check_determinism (no HIGH findings) and check_contract_api. That is a heuristic check, not a proof of determinism — test on a multi-node cluster before mainnet.

Each generated file set carries notes including "before deploy: run check_determinism on src/index.js — HIGH findings break consensus."

Why the determinism check matters (and exactly what it does / doesn't catch)

HotPocket consensuses contract output across every node. If two nodes diverge — because you called Date.now(), Math.random(), fetch(), or read process.env, or iterated an unordered collection built in a non-consensused order — consensus breaks and the ledger stalls. check_determinism flags these before you deploy.

It is a heuristic linter, not a prover — a source scan (mostly per-line regex, plus a small cross-line alias pass), so it is *guidance*, never a guarantee. Design bias (deliberate): for this tool a false-negative (silently missing a real consensus breaker) is the worst outcome, so when a construct *could* iterate/serialize an unordered collection but can't be proven sorted, it is flagged. A false-positive (flagging safe code) only costs you a justification.

Now covered (each with a why + a concrete fix):

• Wall-clock — Date.now, performance.now, process.hrtime[.bigint], new Date() *(HIGH)*.
• Randomness — Math.random, crypto.randomBytes/randomUUID/randomInt/randomFill[Sync]/getRandomValues *(HIGH)*.
• Network I/O — fetch/axios/got/node-fetch, require('https'|'net'|'dns') *(HIGH)*.
• Per-node env — process.env/process.pid, os.hostname/networkInterfaces/cpus/freemem/loadavg/uptime/userInfo/platform/arch/tmpdir/endianness *(HIGH)*.
• Timers / race — setTimeout/setInterval/setImmediate, Promise.race/any *(MEDIUM)*.
• Filesystem