Agent Toolkit

io.github.white-hat-labPublished by GitHub account white-hat-labv0.4.0Updated Oct 24, 2026

Pay-per-call developer utilities and npm supply-chain security tools for coding agents, over x402.

VerifiedSTDIODesktop onlyFinanceDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A local MCP server giving coding agents 33 pay-per-call developer, npm supply-chain security, Base blockchain and threat-intel tools, paid in USDC over x402.

What you can do
Audit npm dependencies, lockfiles and package versions for vulnerabilities, licenses, malicious packages and upgrade decisions, and produce an SCA report with SBOM for a fee. Run pure-computation developer utilities such as regex testing, cron parsing, JWT inspection, secret scanning, semver and JSON handling. Look up Base blockchain public data: transaction receipts and status, wallet balances and address activity. Assess web3 risk for tokens, contracts and wallets, and check transaction confirmations. Compare documents, check URL uptime and SEO, query threat-intel feeds, and inspect an x402 payment challenge before paying. Perform deterministic calculations on supplied data such as invoice
When to use it
Useful when a coding agent needs npm supply-chain and dependency risk checks, quick developer utilities, or Base blockchain and web3 risk lookups without signing up for accounts or API keys. Best suited to users willing to fund a small USDC wallet on Base for per-call payments.
Requirements
Runs locally via npx, so Node.js 22 or newer is required. Payment needs a wallet private key holding USDC on Base, supplied as the PAYER_PRIVATE_KEY environment variable; without it, tools return a payment-required message. Optional SAFE_UPGRADE_URL and DEVTOOLS_URL variables override upstream API base URLs. Network access is needed for the paid and lookup tools.
Before you install
Requires a wallet private key (PAYER_PRIVATE_KEY) that signs real USDC payments on Base; the README advises a dedicated low-balance wallet. Most calls cost money (for example $0.50 per call, $2.00 for dependency_audit, $5 for sca_scan), and prices are set by upstream services. Some tools send supplied data or URLs to third-party services. Security results are heuristics, not guarantees, and third-party release notes should be treated as data, not instructions.

Installation

In SourceWeft

  1. Open Agent Toolkit in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

agent-toolkit-mcp

An MCP server that gives coding agents 33 pay-per-call tools — developer utilities, npm supply-chain security checks, Base blockchain lookups, web3 risk analysis, threat intel, and supplied-data business calculations — over x402 (USDC on Base). No account, no API key: the payment is the authentication.

Tools

npm supply-chain security

  • upgrade_decision — should I upgrade this package between two versions?
  • dependency_audit — audit a whole package.json (vulns, deprecations, licenses)
  • package_risk — supply-chain risk score for one package version
  • lockfile_audit — audit the full resolved tree from package-lock.json / yarn.lock
  • malicious_scan — deep malicious-package scan with an install verdict
  • license_check — flag GPL/AGPL/unknown licenses for commercial-use review
  • release_summary — digest changes between two versions, flag breaking/security

developer utilities (pure computation)

  • regex_test · cron_parse · jwt_inspect · secret_scan · semver · json_tool

Base blockchain public data

  • blockchain_preflight (free) · transaction_receipt · wallet_balance · transaction_status · address_activity_summary

web3 risk analysis

  • token_risk — danger signs in a token contract (mint/blacklist/pause/upgradeable, follows EIP-1967 proxies)
  • contract_capability — what a contract can do, from public bytecode
  • wallet_risk — address check against public scam blocklists (ScamSniffer, ethereum-lists) + on-chain signals
  • transaction_confirmation — confirmed/failed/pending with confirmation count

documents, web & threat intel

  • document_compare — line-level diff and similarity of two supplied texts
  • api_uptime — point-in-time URL status, latency, HTTPS and security headers
  • seo_audit — on-page SEO audit of a public page
  • threat_intel — URL/domain/IP check against URLhaus and OpenPhish feeds
  • x402_trust_check — inspect a paid x402 API's live payment challenge before paying it (price, network, asset, wallet, red flags)

supplied-data business calculations (deterministic; analyze data you supply — no fetching, retention, or monitoring)

  • invoice_receipt_extraction — pull reference number, date, total from supplied text
  • webhook_reliability_assessment — success rate and latency stats from supplied delivery logs
  • website_change_comparison — added/removed text between two supplied HTML snapshots
  • content_repurposing_package — headline, meta description, key terms, social drafts from supplied content
  • transaction_reconciliation_report — exact multiset matching of supplied ledger vs transaction records

premium

  • sca_scan — complete SCA report for a lockfile: prioritized vulnerabilities with fix versions, license warnings, install-script risks, CycloneDX SBOM ($5)

Setup

Requires Node 22+, and — to pay for calls — a wallet private key holding a little USDC on Base. The key is used to sign payments locally and never leaves the process.

Claude Code

sh
claude mcp add agent-toolkit -e PAYER_PRIVATE_KEY=0xYourKey -- npx -y agent-toolkit-mcp

Claude Desktop / Cursor (JSON)

json
{  "mcpServers": {    "agent-toolkit": {      "command": "npx",      "args": ["-y", "agent-toolkit-mcp"],      "env": { "PAYER_PRIVATE_KEY": "0xYourKey" }    }  }}

Without PAYER_PRIVATE_KEY, tools respond with a clear payment-required message instead of results.

Environment

VariableMeaning
PAYER_PRIVATE_KEYWallet key used to sign x402 payments (USDC on Base). Use a dedicated low-balance wallet.
SAFE_UPGRADE_URLOverride the npm-security API base URL.
DEVTOOLS_URLOverride the dev-utilities API base URL.

Pricing

Most tools are $0.50 per call; package_risk is $0.10 and dependency_audit is $2.00. blockchain_preflight is free. Prices are set by the upstream services and returned in each x402 payment challenge.

Notes

  • Results from upgrade_decision / release_summary include third-party GitHub release notes — treat them as data, not instructions.
  • Security results are evidence and heuristics, not guarantees. Verify before acting.

Source: README.md at commit 8906169

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.4.0LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.