token-tool-mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited token-tool-mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
TokenTool MCP gives AI agents a complete token issuance and lifecycle management API built on Bitbond TokenTool — 8,300+ deployments, CertiK-audited smart contracts, compliance features built in. Supports EVM (Ethereum, Polygon, BNB Chain, Arbitrum, Base, Optimism, Avalanche + testnets), Solana (SPL tokens), and Stellar (assets).
Pricing: Testnet deployments are free (gas only). Mainnet deployments cost a flat $299 fee paid in native token + gas.
Security: Private keys stay local (env vars only). The MCP server uses stdio transport — no network listener, no open ports. Keys are never logged or transmitted.
| Tool | Description |
|---|---|
list_chains | List all supported networks with IDs and aliases |
estimate_cost | Quote deployment cost (gas + fee) before committing |
deploy_token | Deploy a new token with optional compliance features |
get_token_info | Live on-chain token state (name, symbol, supply, paused, owner) |
list_deployed_tokens | Local deployment registry, filterable by chain |
transfer_tokens | Send tokens to any address |
mint_tokens | Mint additional supply (requires mintable=true) |
burn_tokens | Destroy tokens from your balance (requires burnable=true) |
pause_token | Emergency stop — halt all transfers (requires pausable=true) |
unpause_token | Resume transfers after a pause |
get_wallet_info | Deployer wallet address and native balance on a chain |
add_to_whitelist | Add addresses to token whitelist (batch supported) |
get_whitelist | View whitelist status and all whitelisted addresses |
add_to_blacklist | Block an address from token interactions |
remove_from_blacklist | Unblock a previously blacklisted address |
get_compliance_status | Check whitelist and blacklist configuration for a token |
list_chains to show options)estimate_cost with the target chain before deploying. Tell the user the cost in native token and USD equivalent. Mainnet = $299 flat + gas. Testnet = gas only (~free).deploy_token on mainnet. This costs real money.For post-deployment operations, you need the contract address and chain. If the user doesn't provide these:
list_deployed_tokens to find their tokensMinting: Call mint_tokens — only works if the token was deployed with mintable=true. Requires the recipient address and amount.
Burning: Call burn_tokens — only works if burnable=true. Burns from the deployer's balance.
Transferring: Call transfer_tokens with recipient address and amount.
Pausing/Unpausing: Call pause_token to halt all transfers (emergency stop). Call unpause_token to resume. Only works if pausable=true.
Checking status: Call get_token_info to see current on-chain state — supply, owner, paused status, etc.
Recommend compliance features based on the use case:
add_to_whitelist to approve addresses (batch supported) and get_whitelist to view current whitelist. Use get_compliance_status to check both whitelist and blacklist state at once.add_to_blacklist to block addresses and remove_from_blacklist to unblock them.For a typical security token / RWA issuance, recommend: whitelist + pausable + force_transfer + document_uri.
For a typical utility / governance token, recommend: mintable + burnable + pausable.
When a user is deciding between chains:
estimate_cost for each candidate chainget_wallet_info for each to check balances| Variable | Required For | Description |
|---|---|---|
BITBOND_PRIVATE_KEY | All EVM chains | Ethereum-format private key (0x...) |
BITBOND_SOLANA_KEYPAIR | Solana, Solana Devnet | Base58-encoded Solana secret key |
BITBOND_STELLAR_SECRET | Stellar, Stellar Testnet | Stellar secret key (starts with S...) |
At least one key must be set. The server works for read-only operations (list_chains, get_token_info on EVM) without keys, but all write operations require the appropriate key.
User: "Deploy a governance token called DAO Vote, 10M supply on Polygon, mintable and burnable."
→ Call estimate_cost with chain="polygon" → Show cost → Get confirmation → Call deploy_token with name="DAO Vote", symbol="DAOV", supply="10000000", chain="polygon", mintable=true, burnable=true → Return contract address + explorer link.
User: "How much would it cost to deploy on Base vs Arbitrum?"
→ Call estimate_cost with chain="base" and estimate_cost with chain="arbitrum" in parallel → Present comparison table with gas + fee in native token and USD.
User: "Pause all transfers on my token 0xabc123 on Base — we found a vulnerability."
→ Call pause_token with contract_address="0xabc123", chain="base" → Confirm pause succeeded → Suggest next steps (investigate, then unpause_token when ready).
User: "I want to create a security token for our real estate fund on Ethereum with full compliance."
→ Recommend: whitelist + pausable + force_transfer + document_uri → Ask for token name, symbol, supply, and document URI → Call estimate_cost on Ethereum → Warn about high Ethereum gas costs, suggest Base or Polygon as cheaper alternatives → Get confirmation → Deploy with all compliance flags.
User: "Show me what I've deployed."
→ Call list_deployed_tokens → Format as a readable list with chain, name, symbol, address, and explorer links.
User: "Create an SPL token on Solana with 1 billion supply."
→ Confirm name and symbol → Call deploy_token with chain="solana" → Note: requires BITBOND_SOLANA_KEYPAIR env var. If not set, the error will say so — tell the user how to configure it.
| Error | Cause | Fix |
|---|---|---|
BITBOND_PRIVATE_KEY env var not set | No EVM key configured | Set the env var in MCP client config with a funded wallet's private key |
BITBOND_SOLANA_KEYPAIR env var not set | No Solana key configured | Export base58 secret key from Phantom or solana-keygen |
BITBOND_STELLAR_SECRET env var not set | No Stellar key configured | Use a Stellar secret key starting with S |
Unknown chain "xyz" | Unrecognized chain name | Call list_chains to show valid options. Common aliases: eth, bnb, arb, avax, sol, xlm |
insufficient funds | Wallet balance too low for gas + fee | Call get_wallet_info to check balance. User needs to fund their wallet. Suggest testnet faucets for test chains |
execution reverted | Contract-level error | Usually means: trying to mint on non-mintable token, pausing already-paused token, or blacklisted address. Check token features with get_token_info |
| Timeout or no response | RPC node issue | Retry. If persistent, the chain's public RPC may be congested |
For detailed chain and compliance documentation, see references/:
references/chain-details.md — full chain registry with IDs, RPCs, explorers, aliases, and required env varsreferences/compliance-features.md — deep dive on each compliance feature with regulatory context and configuration examples~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.