xsolana
Design, check, simulate and launch Solana game economies on loot, one shared program, no contract.
作者提供的说明(英文原文)
Self-custodial crypto portfolio: read EVM DeFi, sign on Ledger via WalletConnect.
这三项永远不会合并成一个分数:意见、测量和人气是不同的东西。
我们还没有为它写通俗的介绍。下面是我们从注册中心读取到的事实。
选择你使用的 AI 应用,然后复制设置。
ETHEREUM_RPC_URL, ARBITRUM_RPC_URL, POLYGON_RPC_URL, BASE_RPC_URL, RPC_PROVIDER, RPC_API_KEY, ETHERSCAN_API_KEY, ONEINCH_API_KEY, WALLETCONNECT_PROJECT_ID标为机密的值是你账户的钥匙。千万不要分享给别人,也不要粘贴到聊天里。
你需要
你用的是哪个应用?
在上方选择你的应用。我们会记住它,下次按钮会显示“安装到 …”。
打开 Claude Desktop → Settings → Developer → Edit Config,把下面的内容粘贴到 claude_desktop_config.json
{
"mcpServers": {
"recon-crypto": {
"command": "npx",
"args": [
"-y",
"recon-crypto-mcp"
],
"env": {
"ETHEREUM_RPC_URL": "your-value",
"ARBITRUM_RPC_URL": "your-value",
"POLYGON_RPC_URL": "your-value",
"BASE_RPC_URL": "your-value",
"RPC_PROVIDER": "your-value",
"RPC_API_KEY": "your-value",
"ETHERSCAN_API_KEY": "your-value",
"ONEINCH_API_KEY": "your-value",
"WALLETCONNECT_PROJECT_ID": "your-value"
}
}
}
}在终端中运行这条命令
claude mcp add recon-crypto --env ETHEREUM_RPC_URL=your-value --env ARBITRUM_RPC_URL=your-value --env POLYGON_RPC_URL=your-value --env BASE_RPC_URL=your-value --env RPC_PROVIDER=your-value --env RPC_API_KEY=your-value --env ETHERSCAN_API_KEY=your-value --env ONEINCH_API_KEY=your-value --env WALLETCONNECT_PROJECT_ID=your-value -- npx -y recon-crypto-mcp运行前请先填写空着的值。
粘贴到项目中的 .cursor/mcp.json,或 ~/.cursor/mcp.json
{
"mcpServers": {
"recon-crypto": {
"command": "npx",
"args": [
"-y",
"recon-crypto-mcp"
],
"env": {
"ETHEREUM_RPC_URL": "your-value",
"ARBITRUM_RPC_URL": "your-value",
"POLYGON_RPC_URL": "your-value",
"BASE_RPC_URL": "your-value",
"RPC_PROVIDER": "your-value",
"RPC_API_KEY": "your-value",
"ETHERSCAN_API_KEY": "your-value",
"ONEINCH_API_KEY": "your-value",
"WALLETCONNECT_PROJECT_ID": "your-value"
}
}
}
}浏览器会先询问是否打开应用,然后应用会显示设置并请你确认。密钥的值会留空,由你自己填写。
粘贴到项目中的 .vscode/mcp.json
{
"servers": {
"recon-crypto": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"recon-crypto-mcp"
],
"env": {
"ETHEREUM_RPC_URL": "your-value",
"ARBITRUM_RPC_URL": "your-value",
"POLYGON_RPC_URL": "your-value",
"BASE_RPC_URL": "your-value",
"RPC_PROVIDER": "your-value",
"RPC_API_KEY": "your-value",
"ETHERSCAN_API_KEY": "your-value",
"ONEINCH_API_KEY": "your-value",
"WALLETCONNECT_PROJECT_ID": "your-value"
}
}
}
}浏览器会先询问是否打开应用,然后应用会显示设置并请你确认。密钥的值会留空,由你自己填写。
这个服务器在你的电脑上运行,而 ChatGPT 只能连接互联网上的服务器。请选择其他应用。
你的选择通过 Cookie 保存在这台设备上,无需账户。
ETHEREUM_RPC_URL envARBITRUM_RPC_URL envPOLYGON_RPC_URL envBASE_RPC_URL envRPC_PROVIDER env这些设置是根据作者在注册中心的条目生成的。如果 README 的写法不同,请以 README 为准。
它在你的电脑上运行;安装后,工具列表会显示在你的 AI 应用中。
我们检查的是任何人都能看到的信息;我们没有阅读代码。不适用的检查项不计入总数。 · 检查于 2026年11月8日
注册名称已通过 GitHub 账户 szhygulin 验证,该账户拥有此仓库
我们还没有从 GitHub 读取这个仓库
我们还没有从 GitHub 读取这个仓库
它在你的电脑上运行,没有互联网端点
在你的电脑上运行,改用本地设置
它在你的电脑上运行;我们只能读取互联网端点的工具列表
与注册中心里这个分类中所有活跃的服务器比较。只有当发布者拥有该仓库时,星标数才计入。
它在 1 项适用的基础检查中通过了 1 项。我们没有阅读代码。在添加密钥或令牌之前,请先看看这个服务器要求哪些权限,并使用只具备所需权限的密钥。
你需要填写:RPC_API_KEY, ETHERSCAN_API_KEY, ONEINCH_API_KEY, WALLETCONNECT_PROJECT_ID
它在你的电脑上运行。你的 AI 应用会在需要时启动它,数据不会经过作者的服务器(除非它自己调用在线服务)。
GitHub 仓库最后更新于–,最新版本(0.3.1)于7个月前进入注册中心。
支持 MCP 的应用,例如 Claude Desktop、Claude Code、Cursor 和 VS Code。你的电脑上还需要有 Node.js。
同一分类中有:xsolana, CashPan, Agentwallet
同一分类中其他作者的服务器,按星标数排序。
如何看卡片:★ GitHub 星标i三大支柱:评价 · 检查 · 使用情况i更新 = 最新版本发布到注册中心的时间i
Design, check, simulate and launch Solana game economies on loot, one shared program, no contract.
Give your AI an allowance: pay approved people within on-chain spending limits.
Wallet infrastructure for Ai agents. EVM + Solana. x402 payments. No KYC.
按原文从作者的仓库复制。PopNx MCP 没有审查或背书其内容。HTML、图片和脚本已被移除。链接会离开本站。
Self-custodial DeFi for AI agents. The agent proposes, you approve on your Ledger — designed for the threat model where the agent, MCP, and host can all be compromised. Only the device is trusted; private keys never leave it.
Read on-chain positions and prepare transactions across Ethereum, Arbitrum, Polygon, Base, Optimism, TRON, Solana, Bitcoin, and Litecoin. Supported protocols: Aave V3, Compound V3, Morpho Blue, Uniswap V3 (swap + LP verbs), Curve, Lido, EigenLayer, Rocket Pool, Safe (Gnosis) multisig on EVM, MarginFi, Kamino, Marinade, Jito on Solana, SunSwap on TRON, plus LiFi (EVM + EVM↔Solana + TRON + BTC swap/bridge) and Jupiter v6 (Solana swap), with 1inch as an optional EVM quote cross-check. EVM signs over WalletConnect → Ledger Live; TRON, Solana, Bitcoin and Litecoin sign over USB HID directly to the device (Ledger Live's WalletConnect bridge does not support those namespaces today). Works with Claude Code (CLI/terminal), Cursor, and any MCP-compatible client over stdio. Claude.ai chat (web + native desktop app) needs a hosted MCP endpoint — on the roadmap, not yet shipped.
Agents: read [AGENTS.md](./AGENTS.md). One-line prompt to paste into Claude Code / Cursor / any MCP-capable agent:
`
Install VaultPilot MCP from https://github.com/szhygulin/vaultpilot-mcp following AGENTS.md.
`
mtd / ytd / 30d / 7d / 1d), daily briefingprepare_custom_call escape hatch for arbitrary verified-contract calls. Solana sends use a per-wallet durable-nonce account so Ledger review doesn't race the ~60s blockhash window; every Solana prepare runs a simulateTransaction gate so program-level reverts fail at prepare time, not on broadcast.verify_tx_decode for second-LLM bytes-vs-intent cross-check, signed on-disk contacts/address-bookresolve_token registry, token balances, allowance enumeration, tx status, explain_tx post-hoc decode, compare_yields across lending + LST adapterswhale / defi-degen / stable-saver / staking-maxi) for first contact with no RPC keys / Ledger / config fileCompromise model: the AI agent, MCP server, and host computer can all be attacker-controlled. Only the Ledger is trusted. Every transaction is cryptographically bound across each layer so tampering — a swapped recipient, a rewritten swap route, a smuggled approval — is tamper-evident on the device screen before signing.
user-intent ──► agent ──► MCP server ──► WalletConnect / USB-HID ──► Ledger Live / host ──► Ledger device
Defense in depth: server-side prepare↔send fingerprint, independent 4byte.directory selector check, agent-side ABI decode + pre-sign hash recompute, on-device clear-sign or blind-sign-hash match, WalletConnect session-topic cross-check, previewToken/userDecision gate, and get_verification_artifact for second-LLM cross-verification on high-value flows. See [SECURITY.md](./docs/SECURITY.md) for the full threat model, defenses table, residual risks, and verification recipes.
The MCP's own CHECKS PERFORMED directives can be silently omitted by a compromised server. Install the companion vaultpilot-security-skill so the agent enforces cryptographic-integrity invariants regardless of what the MCP says — bytes decode, dispatch-target allowlist, hash recompute, chain-must-be-explicit, bridge-recipient cross-check, approval-class surfacing, always-optional second-LLM offer surfaced on every preview, set-level intent verification, durable-binding source-of-truth:
git clone https://github.com/szhygulin/vaultpilot-security-skill.git \
~/.claude/skills/vaultpilot-preflight
Restart Claude Code. The skill file's SHA-256 is pinned in the server source; on-disk tamper or plugin collision surfaces as integrity check FAILED.
/setup (optional)For chat-driven onboarding that detects current config and only collects keys you actually need, install the companion vaultpilot-setup-skill:
git clone https://github.com/szhygulin/vaultpilot-setup-skill.git \
~/.claude/skills/vaultpilot-setup
Restart, then type /setup.
EVM — Ethereum, Arbitrum, Polygon, Base, Optimism. Lido reads on Ethereum + Arbitrum, Lido writes Ethereum-only. EigenLayer + Morpho Blue + Rocket Pool Ethereum-only. Compound V3 + Aave V3 + Uniswap V3 + LiFi + Safe multisig span all five chains; per-protocol address coverage varies — readers short-circuit cleanly where a protocol isn't deployed.
TRON — TRX + canonical TRC-20 stablecoins (USDT, USDC, USDD, TUSD); Stake 2.0 freeze/unfreeze/withdraw-expire-unfreeze + voting-reward claims; SunSwap (same-chain TRX↔TRC-20 swaps); LiFi-routed TRON↔EVM bridging. No lending/LP (Aave/Compound/Morpho/Uniswap aren't deployed). Pair once per session via pair_ledger_tron.
Solana — SOL + SPL balances, MarginFi + Kamino lending, Marinade / Jito / native stake-account reads with SOL-equivalent valuation, Jupiter v6 quotes, Helius DAS NFT portfolio. Writes cover SOL/SPL transfers, MarginFi + Kamino supply/withdraw/borrow/repay, Jupiter swaps, Marinade stake + immediate-unstake, Jito stake-pool deposit, native SOL delegate/deactivate/withdraw, and LiFi-routed EVM↔Solana bridging. Per-wallet durable-nonce account (~0.00144 SOL rent, reclaimable) protects sends from blockhash expiry during Ledger review (prepare_solana_nonce_init / _close). SPL / MarginFi / Kamino / Jupiter / Jito blind-sign against a Message Hash — enable Allow blind signing in the Solana app's Settings; SOL native transfers clear-sign. Pair once per session via pair_ledger_solana.
Bitcoin + Litecoin — balance, UTXO, fee-estimate, and tx-history readers via Esplora (mempool.space / litecoinspace.org). Native segwit + taproot sends, BIP-125 RBF fee-bumps, multisig PSBT (combine / sign / finalize), BIP-137 message signing, LiFi-routed BTC→EVM/Solana swaps. Optional Bitcoin Core / Litecoin Core JSON-RPC unlocks forensic tools that Esplora cannot serve (chain tips, block stats, mempool summary) — see INSTALL.md §9 for setup. Pair once via pair_ledger_btc / pair_ledger_ltc.
Ledger Live's WalletConnect bridge does not honor the tron: namespace (verified 2026-04-14) or expose Solana accounts (verified 2026-04-23) or expose BTC/LTC namespaces, which is why those paths use USB HID. Readers short-circuit cleanly on chains where a protocol isn't deployed.
ROADMAP.md.
~190 tools across read / pair-Ledger / prepare / sign+send / verify / diagnostic categories. Highlights below; each tool has a Zod input schema and verbose description — query the MCP server's tools/list for the canonical surface.
Portfolio + positions (read-only):
get_portfolio_summary, get_portfolio_diff, get_pnl_summary, get_daily_briefing — cross-chain USD aggregation; optional tronAddress / solanaAddress fold those chains inget_lending_positions (Aave), get_compound_positions, get_morpho_positions, get_marginfi_positions, get_kamino_positions, get_curve_positions, get_safe_positions — per-protocol positions + health factorsget_lp_positions — Uniswap V3 LP + IL estimateget_staking_positions, get_staking_rewards, estimate_staking_yield — Lido + EigenLayer + Rocket Poolget_solana_staking_positions — Marinade + Jito + native stake-account enumeration with activation status and SOL-equivalent valuationget_tron_staking, list_tron_witnesses — TRON Stake 2.0 state + SR listget_nft_portfolio (EVM + Solana DAS), get_nft_collection, get_nft_history, get_nft_listings (EVM)get_btc_balance / _balances / _account_balance / _multisig_balance / _multisig_utxos / _tx_history / _fee_estimates, get_ltc_balance — BTC + LTC reads via Esploraget_compound_market_info — wallet-less Comet snapshotget_health_alerts, simulate_position_change — multi-protocol liquidation-risk toolingcompare_yields — rank lending APRs across Aave / Compound / Morpho / Marinade / Jito / Kamino-lend / MarginFiget_marginfi_diagnostics — banks the bundled SDK skipped, with root causeTokens, prices, history:
get_token_balance, get_token_price, get_token_metadata, get_token_allowances, get_coin_price — balances + DefiLlama prices on EVM/TRON/Solana; get_token_metadata detects EIP-1967 proxiesget_transaction_history — merged tx reader (external / ERC-20 / internal / Solana program_interaction) with 4byte-decoded methods + historical USDget_transaction_status — poll inclusion by hashexplain_tx — post-hoc decode of a historical txresolve_token, resolve_ens_name, reverse_resolve_ensForensic chain reads (require Bitcoin/Litecoin Core RPC):
get_btc_block_tip / _block_stats / _blocks_recent / _chain_tips / _mempool_summary, get_ltc_* equivalentsbuild_incident_report, get_market_incident_status — Compound/Aave pause + utilization scan and BTC/LTC chain-tip / mempool-anomaly bundleQuotes + security signals:
get_swap_quote (LiFi, EVM), get_solana_swap_quote (Jupiter v6)check_contract_security, check_permission_risks, get_protocol_risk_score, get_contract_abi, read_contractsimulate_transaction — EVM eth_call preview (Solana equivalent runs inside preview_solana_send)verify_tx_decode, get_verification_artifact, get_tx_verification — second-LLM cross-verification + 15-min-TTL handle re-emit (details)Diagnostics:
get_solana_setup_status — probe nonce + MarginFi account PDAsget_vaultpilot_config_status — local config diagnostic (RPC sources, key presence, paired-account counts, WC topic suffix, skill state). Booleans / counts only — no secret values.get_ledger_device_info, get_ledger_status, verify_ledger_attestation / _firmware / _live_codesign — device + session discovery, on-device attestation, firmware-version pin**Contacts + r
只显示了开头部分;其余内容请在仓库中阅读