Bca Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Bca Mcp (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The canonical crypto MCP server for AI agents. 105 tools spanning 3,800+ editorial articles, 150+ entity dossiers, 38 academy lessons in 8 courses, aggregated market + on-chain data, proprietary indicators, and async agent-backed generation, all exposed as MCP tools your AI agent can call natively.
| Category | Count | Examples |
|---|---|---|
| Content & corpus | 7 | search_news, get_article, get_entity, get_explainer, list_entity_mentions, get_as_of_snapshot |
| Market data | 4 | get_price, get_ohlc, get_market_overview, get_pair_data |
| On-chain | 4 | get_wallet_profile, get_tx, get_token_holders, get_defi_protocol |
| Sentiment + crypto Twitter | 6 | get_sentiment, get_social_pulse, get_fear_greed, get_ct_pulse, get_x_signals, get_kol_consensus |
| Proprietary indicators | 6 | get_coverage_index, get_narrative_strength, get_sentiment_velocity, get_editorial_premium, get_kol_influence, get_risk_score |
| Agent-backed (async, Pro+) | 6 | generate_due_diligence, generate_tokenomics_model, summarize_whitepaper, translate_contract, monitor_keyword, get_agent_job |
| Directories | 16 | list_stablecoins, list_yields, list_aggregators, list_mcps, list_vcs, list_jobs, get_job, search_grants, get_grant, build_custom_indicator, … |
| Fundamentals | 6 | get_tokenomics, get_audit_reports, get_team_info, compare_protocols, check_rugpull_risk |
| Chain-specific | 4 | get_solana_ecosystem, get_l2_comparison, get_bitcoin_l2_status, get_ton_ecosystem |
| Markets microstructure | 5 | get_funding_rates, get_options_flow, get_liquidation_heatmap, get_exchange_flows, predict_listing |
| Narrative / meta | 5 | track_narrative, get_ai_agent_tokens, get_depin_projects, get_rwa_tokens, get_prediction_markets |
| Regulatory | 4 | get_regulatory_status, track_sec_filings, get_mica_status, get_tax_rules |
| Security | 4 | check_exploit_history, check_phishing_domain, get_bug_bounty_programs, scan_contract |
| Memes / degen | 4 | track_pumpfun, track_bonkfun, check_memecoin_risk, get_degen_leaderboard |
| Services (revenue) | 3 | book_kol_campaign, request_custom_research, submit_listing |
| History time-series | 4 | get_history_prices, get_history_sentiment, get_history_correlation, get_history_coverage |
| Compute / AI crypto | 2 | get_compute_pricing, get_ai_crypto_metrics |
| Corpus meta | 7 | list_entities, get_topic, search_academy, get_trending, get_unified_feed, list_sources, get_recent_stories |
| Memos + theses + social | 6 | list_memos, get_memo, list_theses, get_thesis, get_social_signals, get_social_signals_detail |
| Currencies | 2 | list_currencies, get_currency_feed |
Every tool response carries attribution.citations[] (each entry a cite_url, an as_of time and a source_hash) and a meta.status that says how complete the answer is (see Response status).
Tools whose data source is not connected yet (bonk.fun, CoinGlass liquidations and exchange flows, the degen leaderboard, the memecoin analyzer, among others) answer with meta.status: "unseeded" and a reason instead of failing, and their descriptions say so.
LLMs hallucinate about crypto. BCA ships ground-truth editorial content with full attribution. Plug this MCP server into Claude Desktop, LangChain, Eliza, or any MCP-compatible agent and your model queries the BCA corpus like any other tool, with citations, timestamps, and source hashes on every response.
The package ships with a public demo key baked in. No signup needed to try it. Add to claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/claude_desktop_config.json):
{
"mcpServers": {
"blockchainacademics": {
"command": "npx",
"args": ["-y", "@blockchainacademics/mcp"]
}
}
}Restart Claude Desktop. 17 tools work without a key, with real data and real citations:
get_price, get_trending, get_fear_greed, get_market_overview, search_news, get_article, get_sentiment, get_entity, get_explainer, get_recent_stories, get_topic, search_grants, get_grant, list_jobs, get_job, search_academy, get_as_of_snapshot
get_entity works by slug without a key; its ticker form needs one. Every other tool answers with a clean upgrade message (BCA_TIER_LOCKED) that links to the free signup. Demo calls share a daily cap: 100 calls a day across all demo users, and 20 a day per IP.
Get a free key at blockchainacademics.com/crypto-api/signup (2,000 calls/month per user) and add the env block:
{
"mcpServers": {
"blockchainacademics": {
"command": "npx",
"args": ["-y", "@blockchainacademics/mcp"],
"env": { "BCA_API_KEY": "bca_live_xxxxxxxxxxxxxxxx" }
}
}
}Restart Claude Desktop. All 105 tools appear in the tool picker: a free key opens 52 of them, and paid plans open the rest (see API Key).
npm install @blockchainacademics/mcpimport { Client } from "@modelcontextprotocol/sdk/client/index.js";
import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
const transport = new StdioClientTransport({
command: "npx",
args: ["-y", "@blockchainacademics/mcp"],
env: { BCA_API_KEY: process.env.BCA_API_KEY! },
});
const client = new Client({ name: "my-agent", version: "0.0.1" }, { capabilities: {} });
await client.connect(transport);
const res = await client.callTool({
name: "search_news",
arguments: { query: "stablecoin regulation", limit: 5 },
});
console.log(res.content);See examples/research-agent.ts for a full tool-chaining loop.
search_newsFull-text search across 3,800+ editorial crypto articles.
| arg | type | required | description |
|---|---|---|---|
query | string (1-512) | yes | Search query |
entity | string | no | Entity slug filter (e.g. ethereum) |
ticker | string | no | Ticker filter (e.g. ETH) |
since | ISO 8601 | no | Earliest publish date |
topic | string | no | Topic filter (e.g. regulation) |
limit | number (1-50) | no | Default 10 |
offset | number | no | Results to skip, for paging (default 0) |
Example: { "query": "circle IPO", "since": "2026-01-01T00:00:00Z", "limit": 5 }
get_entityFetch an entity dossier. Provide exactly one of:
| arg | type | description |
|---|---|---|
slug | string | e.g. "vitalik-buterin", "circle"; works without a key |
ticker | string | e.g. "ETH", "SOL" (case-insensitive); returns every matching entity and needs an API key |
Aliases in slug form resolve to the canonical entity (cz → changpeng-zhao, maker → makerdao, bsc → bnb-chain, …).
get_explainerFetch BCA Academy material (38 lessons in 8 courses). Provide exactly one of:
| arg | type | description |
|---|---|---|
slug | string | Course slug (e.g. "defi-fundamentals", "understanding-bitcoin") for the course and its lesson index, or lesson slug (e.g. "decentralized-exchanges") for the lesson with its full text |
topic | string | Topic keyword that resolves to matching academy material, e.g. "defi" |
meta.status says how complete an answer is. Branch on it before you trust data:
meta.status | Meaning | Where the detail is |
|---|---|---|
complete | A full, fresh answer. | no meta.diagnostic |
partial | Data is returned, but some inputs or sections are missing or defaulted, or one upstream source failed. | meta.diagnostic.reason, plus meta.diagnostic.missing (what is absent) or, for a failed source, vendor and upstream_status |
stale | Data is returned, but it is older than the tool promises. | meta.diagnostic.reason, meta.diagnostic.as_of (when the data was produced) and meta.diagnostic.age_seconds |
unseeded | There is no real data yet: nothing matched, the table is empty, or the source is not connected. data may still carry the echoed query or placeholders. | meta.diagnostic.reason and meta.diagnostic.eta |
Lists that page by offset (search_news, search_grants, list_entities, list_entity_mentions, search_academy) set meta.pageInfo.hasNextPage when more results exist.
Every response includes a structured attribution block with a citations array:
{
"data": { ... },
"attribution": {
"citations": [
{
"cite_url": "https://www.coingecko.com/en/coins/bitcoin",
"as_of": "2026-11-01T12:34:56Z",
"source_hash": "sha256:..."
},
{
"cite_url": "https://blockchainacademics.com/...?src=...",
"as_of": "2026-11-01T12:34:56Z",
"source_hash": "sha256:..."
}
]
},
"meta": { "status": "complete", "request_id": "...", "pageInfo": { ... } }
}citations[0] is the primary source: the upstream page when the data has one (the original article, CoinGecko, Etherscan, DefiLlama, a regulator), otherwise the BCA page for the record, otherwise the tool's entry in the API reference. A BCA link follows the upstream one only where the site has a page for the data. When your agent surfaces BCA content to a user, attribute via citations[0].cite_url. Fields are preserved as null when upstream omits them so downstream agents can detect missing provenance.
Not required to try it. When BCA_API_KEY is unset, the server falls back to a baked-in public demo key: the 17 tools listed under Install work, and every other tool answers with a clean upgrade message.
For more, get a free key at blockchainacademics.com/crypto-api/signup (2,000 calls/month): it opens the 52 free-tier tools. Paid tiers unlock the rest, such as agent-backed research generation, crypto Twitter intelligence and the proprietary indicators; each tool's description names its tier when it is not free.
Set BCA_API_KEY in your MCP client env. Optionally override BCA_API_BASE (default https://api.blockchainacademics.com). BCA_API_BASE_URL is also accepted for backward compatibility.
Every failed tool call returns an MCP tool result with isError: true and a JSON body:
{ "error": { "code": "BCA_AUTH", "message": "..." } }A request that is not a valid MCP call at all (arguments that are not an object, for example) is answered by the MCP SDK with a JSON-RPC error instead.
| Code | Meaning |
|---|---|
BCA_AUTH | Invalid BCA_API_KEY (HTTP 401/403), or a key that cannot be sent as a header value (a line break inside it); the key itself is never repeated in the message |
BCA_TIER_LOCKED | Tool not in your current tier's allowlist (HTTP 403). Without a key this applies to 88 of the 105 tools; the message includes the signup URL. |
BCA_RATE_LIMIT | Rate limit exceeded (HTTP 429; honor Retry-After) |
BCA_UPSTREAM | BCA API returned an error status or malformed JSON. For a 4xx the message carries the API's own detail (up to 500 characters) inside an <untrusted_content> fence; a 5xx stays generic. |
BCA_NETWORK | Network failure or 20s timeout exceeded |
BCA_BAD_REQUEST | Invalid tool arguments, caught before any request is sent. The message lists each problem as field: problem, e.g. Invalid arguments for search_news: limit: Number must be less than or equal to 50. |
npm install
npm run build # tsc -> dist/
npm test # node:test smoke suite
npm run dev # tsx src/index.ts (stdio)This repo uses pre-commit to enforce formatting, lint, secret scanning, and large-file caps before every commit. Install once per clone:
pip install pre-commit # or: brew install pre-commit
pre-commit install # wires .git/hooks/pre-commit
pre-commit run --all-files # optional: lint the full tree nowHooks configured in .pre-commit-config.yaml: prettier --check, eslint, gitleaks, detect-private-key, check-added-large-files (500KB cap).
SECURITY.md, never a public issue.Never post a full API key. If we need to know which key, share only the key prefix, the part before the dots on your dashboard (for example bca_1a2b3c4d). Our team will never ask for your key or a seed phrase. Response times by plan are in How to get help.
See SECURITY.md for vulnerability reporting, supported versions, and our 90-day coordinated disclosure policy.
MIT © 2026 Blockchain Academics
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.