Rustok Wallet

io.github.temrjan由 GitHub 帳號 temrjan 發布v0.2.2更新於 Oct 24, 2026

Self-custody Ethereum Agent Wallet. All chains enabled by default. User assumes all risks.

已驗證STDIO僅桌面金融安全與監控

概覽

AI 產生的概覽

一個本機 MCP 伺服器，為 AI 助理提供自託管以太坊代理錢包，支援多鏈餘額、轉帳以及簽名前交易安全分析。

可以做什麼
透過密碼解鎖管理自託管以太坊錢包，涵蓋以太坊、Arbitrum、Base、Optimism、zkSync 與 Sepolia 測試網，統一餘額與路由。查詢餘額並發送 ETH 或代幣，簽名前強制執行 txguard 安全檢查。簽名前分析交易：解碼 calldata、套用安全規則、模擬執行並以威脅情報補充發現。依讀取、預覽、執行三級能力控管，並提供從自主代理到主控台核准再到手機簽署的信任階梯。
適用情境
當你希望 AI 助理持有並操作跨多條鏈的自託管以太坊錢包，或需要對交易與地址做簽名前安全檢查時使用。適合每一步操作都應在簽名前驗證的代理驅動鏈上工作流程。
執行需求
透過 npm 套件 rustok-agent-mcp 以 stdio 作為本機程序執行。需要環境變數 RUSTOK_AGENT_PASSWORD 來解鎖代理錢包。僅限桌面端，不支援網頁執行。查詢餘額與轉帳需要連線至所支援鏈的網路。
安裝前請注意
此伺服器控制持有真實資金的自託管錢包，README 聲明使用者承擔全部風險。它透過 RUSTOK_AGENT_PASSWORD 索取錢包密碼，請謹慎保管該密鑰。發送交易會轉移資金且不可撤銷；請限制執行層級與信任階梯，並在核准前檢視 txguard 結果。地址檢查會將地址傳送給第三方威脅情報服務。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Rustok Wallet，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

Rustok

Ethereum wallet with chain abstraction and transaction security engine.

Status: Production — Phase 7 DONE — Android verified on Sepolia; iOS supported. React Native app with real on-chain transactions, full onboarding, and txguard live analysis.

Website: rustokwallet.com | X: @rustokwallet | Agent editions: github.com/rustok-org

What is this?

Rustok is a self-custody Ethereum wallet built around two ideas:

  1. Your keys, your chains — one seed phrase controls addresses across Ethereum, Arbitrum, Base, Optimism, and zkSync. Balance and routing are unified; you pick the chain, the wallet handles the rest.
  2. Trust but verify — every transaction is analyzed by txguard before signing. It decodes calldata, runs security rules, simulates execution via revm, and enriches findings with threat intelligence.

The mobile app (Android + iOS) is the primary interface. A public HTTP API and CLI are available for headless txguard analysis.

2026 evolution: the same self-custody core now ships as a wallet for AI agents — MCP tools with fail-closed capability gating (read / preview / execute) and a three-rung trust ladder (autonomous agent → console-approved → phone-signed). See rustokwallet.com and the rustok-org repositories (mcp, console, mobile, paraswap-mcp, uniswap).

Features

  • Multi-chain wallet — unified balance, send, and receive across 5 mainnet chains + Sepolia testnet
  • BIP39 seed phrase — MetaMask-compatible path (m/44'/60'/0'/0/0), cross-device recovery
  • txguard analysis — pre-sign security scan with risk badge and per-finding breakdown
  • PIN + Biometric lock — Argon2id-hashed PIN, Face ID / fingerprint unlock, background auto-lock
  • Onboarding — create wallet (4-step wizard + phrase quiz), import from seed phrase, or recover from lockout / biometric change
  • Activity history — real transaction feed with pending-state tracking and explorer links
  • Theme — light / dark / system with design-token consistency across the UI

Architecture

┌─────────────────────────────────────────────────────────────┐│                    Mobile App (Android / iOS)                ││  ┌─────────┐  ┌─────────┐  ┌─────────┐  ┌────────────────┐ ││  │ Wallet  │  │ Activity│  │ TxGuard │  │    Settings    │ ││  │  Tab    │  │  Tab    │  │  Tab    │  │  (Appearance,   │ ││  │         │  │         │  │         │  │   Biometric,   │ ││  │ • Hero  │  │ • TX    │  │ • Risk  │  │   Auto-lock,   │ ││  │   card  │  │   list  │  │   badge │  │   Network)     │ ││  │ • Send  │  │ • Pull  │  │ • Per-  │  │                │ ││  │ • QR    │  │   refresh│  │   finding│  │                │ ││  └─────────┘  └─────────┘  └─────────┘  └────────────────┘ ││  ┌─────────────────────────────────────────────────────────┐││  │  React Navigation v7  •  Zustand 5  •  NativeWind v4   │││  │  Reanimated 4  •  MMKV  •  Keychain  •  Argon2id       │││  └─────────────────────────────────────────────────────────┘│└───────────────────────────┬─────────────────────────────────┘                            │ JS ↔ Rust Bridge┌───────────────────────────▼─────────────────────────────────┐│          react-native-rustok-bridge                          ││          (uniffi-bindgen-react-native 0.31)                 │└───────────────────────────┬─────────────────────────────────┘                            │ FFI┌───────────────────────────▼─────────────────────────────────┐│                      Rust Workspace                          ││  ┌─────────────┐  ┌─────────────┐  ┌─────────────────────┐ ││  │ rustok-core │  │   txguard   │  │    rustok-api       │ ││  │             │  │             │  │                     │ ││  │ • keyring   │  │ • parser    │  │  Axum HTTP server   │ ││  │ • provider  │  │ • rules     │  │  /health            │ ││  │ • router    │  │ • simulator │  │  /check-address     │ ││  │ • send      │  │ • enrichment│  │  /decode            │ ││  │ • explorer  │  │             │  │                     │ ││  │ • explainer │  │ 8 security  │  │  Self-hosted        │ ││  │ • convert   │  │ rules       │  │  (see deploy/)      │ ││  └─────────────┘  └─────────────┘  └─────────────────────┘ ││  ┌─────────────┐  ┌─────────────┐  ┌─────────────────────┐ ││  │ rustok-cli  │  │ rustok-types│  │rustok-mobile-bindings│ ││  │             │  │             │  │                     │ ││  │  CLI binary │  │ Shared DTOs │  │  uniffi FFI exports │ ││  │  (decode,   │  │  (no crypto │  │  for iOS / Android  │ ││  │   analyze,  │  │   deps)     │  │                     │ ││  │   wallet,   │  │             │  │                     │ ││  │   send)     │  │             │  │                     │ ││  └─────────────┘  └─────────────┘  └─────────────────────┘ │└─────────────────────────────────────────────────────────────┘

Tech Stack

LayerTechnology
MobileReact Native 0.85.2, React 19.2.3, TypeScript 5.8
NavigationReact Navigation v7 (bottom-tabs, native-stack)
StylingNativeWind v4, TailwindCSS 3.4, design-token system
StateZustand 5, MMKV (persistent), React Native Keychain (secrets)
AnimationsReanimated 4.3, React Native Worklets, Gesture Handler
Bridgeuniffi-bindgen-react-native 0.31.0-2
LanguageRust (edition 2024)
EVMrevm v36, alloy-evm v0.30
Ethereumalloy-rs v1.8 (provider, signer, primitives, consensus)
CryptoBIP39 (m/44'/60'/0'/0/0), AES-256-GCM, Argon2id, secp256k1
HTTPAxum 0.8, Tower HTTP (CORS, trace)
AsyncTokio, Futures
SerializationSerde, Serde JSON
CLIclap v4
Loggingtracing, tracing-subscriber

Quick Start

Mobile App

Prerequisites: Node.js ≥ 22.11, Android SDK (for Android) or Xcode + CocoaPods (for iOS).

bash
# Install dependenciescd mobile && npm install
# Start Metro bundlernpx react-native start --port 8081
# Android (separate terminal)cd android && ./gradlew app:installDebug -PreactNativeDevServerPort=8081# Windows: .\gradlew.bat app:installDebug -PreactNativeDevServerPort=8081
# iOS (macOS only, separate terminal)cd ios && pod install && cd .. && npx react-native run-ios

For physical Android devices:

bash
adb reverse tcp:8081 tcp:8081

Detailed mobile docs: See mobile/README.md for onboarding flow, bridge surface, DEV escape hatches, and Android/Windows specifics.

Rust Workspace

bash
# Run all testscargo test --workspace
# Build CLIcargo build -p rustok --release
# Run API server locallycargo run -p rustok-api

CLI Examples

Transaction Security Analysis
bash
# Decode ERC-20 approve calldatarustok decode \  --to 0xdAC17F958D2ee523a2206206994597C13D831ec7 \  --data 0x095ea7b3000000000000000000000000000000000000000000000000000000000000dead00000000000000000000000000000000000000000000000000000000000f4240
# Full security analysis (parse + rules + verdict)# Exit codes: 0=allow, 1=warn, 2=blockrustok analyze \  --to 0xdAC17F958D2ee523a2206206994597C13D831ec7 \  --data 0x095ea7b3ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
Wallet Operations
bash
# Generate a new encrypted walletrustok wallet new --password "your-secure-password"
# Check unified balance across Ethereum, Arbitrum, Base, Optimism, zkSyncrustok wallet balance 0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045
# Show wallet info from keystore filerustok wallet info --keystore 0xabc...def.json --password "your-password"
# Send ETH (txguard security check mandatory, testnet by default)rustok wallet send --keystore wallet.json --password "pwd" --to 0xd8dA...6045 --amount 0.1

Security Rules (txguard)

RuleSeverityTrigger
unlimited_approvalWarningapprove(spender, type(uint256).max)
set_approval_for_allWarningsetApprovalForAll(operator, true)
permit_to_unknownDangerEIP-2612 permit to unknown spender
permit_unlimitedWarningPermit with value == U256::MAX
known_scamForbiddenAddress in scam database
unknown_functionWarningUnrecognized function selector
value_with_calldataWarningETH sent with contract call
send_to_contractInfoTransfer to contract address

Supported Chains

ChainIDStatus
Ethereum1Active
Arbitrum One42161Active
Base8453Active
Optimism10Active
zkSync Era324Active
Sepolia11155111Testnet

txguard API

Public API for transaction security analysis (rustok-api, Axum). Self-hosted — see deploy/.

EndpointMethodDescription
/healthGETHealth check
/check-addressPOSTAddress security check via GoPlus (malicious flag, risk level, risks)
/decodePOSTDecode and analyze raw EVM transaction (action, risk score, findings)
bash
# Check addresscurl -X POST https://your-rustok-api-host/check-address \  -H "Content-Type: application/json" \  -d '{"address": "0xdAC17F958D2ee523a2206206994597C13D831ec7"}'
# Decode transactioncurl -X POST https://your-rustok-api-host/decode \  -H "Content-Type: application/json" \  -d '{"to": "0xdAC17F958D2ee523a2206206994597C13D831ec7", "data": "0x095ea7b3000000000000000000000000000000000000000000000000000000000000dead00000000000000000000000000000000000000000000000000000000000f4240"}'

Deployed via Docker + Caddy on 185.197.195.191 (deploy/).

Tests

517 tests, 0 failures - Rust workspace: 231 tests (txguard, core, types, mobile-bindings) - Mobile (Jest):   286 tests (components, stores, hooks, screens)

Pre-commit gates:

bash
# Rustcargo fmt --all --checkcargo clippy --workspace --all-targets -- -D warningscargo test --workspace
# Mobilecd mobile && npm run typecheck && npm run lint && npm run test

Project Layout

rustok/├── mobile/                          # React Native app (primary UI)│   ├── src/│   │   ├── screens/                 # Wallet, Activity, TxGuard, Settings, Onboarding│   │   ├── components/              # Design system primitives│   │   ├── navigation/              # AppShell, navigators│   │   ├── stores/                  # Zustand + MMKV state│   │   ├── hooks/                   # Selectors and logic│   │   ├── lib/                     # Bridge, formatting, explorers│   │   └── theme/                   # Design tokens│   ├── android/                     # Gradle project│   └── ios/                         # Xcode project│├── packages/│   └── react-native-rustok-bridge/  # uniffi JS ↔ Rust bridge package│├── crates/                          # Rust workspace│   ├── txguard/                     # Transaction security engine│   ├── core/                        # Wallet logic (keyring, provider, router, send)│   ├── types/                       # Shared DTOs│   ├── api/                         # Axum HTTP server│   ├── cli/                         # CLI binary│   └── rustok-mobile-bindings/      # uniffi FFI exports│├── deploy/                          # Docker + Caddy deployment└── docs/                            # Architecture, phase handoffs, incident reports

License

Rustok is dual-licensed:

  • AGPL-3.0-or-later — open source. Free for any use that complies with AGPL terms, including making source code of derivative works and network-accessible services available to users.
  • Commercial License — available from the copyright holder for uses that cannot comply with AGPL-3.0 (e.g. closed-source Apple App Store or Google Play distribution, bundling into proprietary products).

See NOTICE.md for a summary of licensing, trademarks, and contribution terms.

Trademarks

"Rustok" and "txguard" are trademarks of Temrjan Khasenov. Source code is AGPL-3.0, but the marks are not — see TRADEMARK.md.

Visual assets

Logos, icons, and brand imagery are not under AGPL-3.0. See ASSETS-LICENSE.md.

Contributing

Contributions are accepted under the Developer Certificate of Origin (DCO). See CONTRIBUTING.md.

Copyright (c) 2025-2026 Temrjan Khasenov.

來源：README.md，提交 1e67041

工具

0
SourceWeft 尚未在沙箱中啟動過該軟體包，因此其工具未知。

版本歷史

1
  1. v0.2.2最新Sep 16, 2026

評分

已滿足適用檢查項的 50%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通25 分

    請保持端點能夠回應 MCP 握手；SourceWeft 每 30 天探測一次。

  • 已宣告認證方式10 分

    請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。

  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分