Cryptoapis Mcp Signer — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Cryptoapis Mcp Signer (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server for local transaction signing across EVM, UTXO, Tron, XRP, Kaspa, Solana and Tezos. No Crypto APIs HTTP calls — signing happens entirely on your machine. No API key required.
privateKey / privateKeys / secret as parameters. Keys are never read from environment variables.npm install @cryptoapis-io/mcp-signerOr install all Crypto APIs MCP servers: npm install @cryptoapis-io/mcp
npx @cryptoapis-io/mcp-signerAdd to your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json on macOS, %APPDATA%\Claude\claude_desktop_config.json on Windows):
{
"mcpServers": {
"cryptoapis-signer": {
"command": "npx",
"args": ["-y", "@cryptoapis-io/mcp-signer"]
}
}
}Add to .cursor/mcp.json (project) or ~/.cursor/mcp.json (global):
{
"mcpServers": {
"cryptoapis-signer": {
"command": "npx",
"args": ["-y", "@cryptoapis-io/mcp-signer"]
}
}
}npx @modelcontextprotocol/inspector npx @cryptoapis-io/mcp-signerevm_signSign an EVM transaction (Ethereum, Ethereum Classic, BSC, Polygon, Avalanche (C-Chain), Arbitrum, Base, Optimism, Tron).
| Action | Description |
|---|---|
sign-from-details | Sign from structured transaction fields (to, value, gasLimit, etc.) |
sign-unsigned-hex | Sign a pre-built unsigned transaction hex |
sign-typed-data | Sign an EIP-712 typed-data message (the x402 gasless path — e.g. the EIP-3009 TransferWithAuthorization from the x402 buyer /authorize). Returns { signature }, not a tx. |
utxo_signSign a UTXO transaction (Bitcoin, Bitcoin Cash, Litecoin, Dogecoin, Dash, Zcash).
| Action | Description |
|---|---|
sign-from-details | Sign from a prepared transaction object (inputs, outputs) |
sign-unsigned-hex | Sign a raw unsigned transaction hex with input descriptors |
tron_signSign a Tron transaction using secp256k1 (no TronWeb dependency).
| Action | Description |
|---|---|
sign-from-details | Sign from a transaction object with raw_data_hex |
sign-unsigned-hex | Sign a pre-built unsigned transaction hex |
xrp_signSign an XRP transaction.
| Action | Description |
|---|---|
sign-from-details | Sign from structured XRP transaction fields |
sign-unsigned-hex | Sign a pre-built unsigned transaction hex |
kaspa_signSign a Kaspa transaction using schnorr (BIP340) via kaspa-wasm. Mainnet only.
| Action | Description |
|---|---|
sign-from-details | Sign a prepared Kaspa transaction (from the prepare-transaction API) |
svm_signPartial-sign a Solana (SVM) x402 payment transaction — the buyer's source-authority signature only (the facilitator's feePayer slot stays unsigned, signed at settle).
| Action | Description |
|---|---|
partial-sign | Deserialize the base64 unsigned TransferChecked tx from the x402 buyer /authorize (scheme svm-transaction), add the buyer signature, re-serialize to base64. Returns { transaction }. |
tezos_signSign a Tezos operation for tz1 (ed25519), tz2 (secp256k1) or tz3 (P-256) keys (edsk… / spsk… / p2sk…).
| Action | Description |
|---|---|
sign-forged-operation | Sign the forgedOperation hex from prepare_transactions_tezos. The operation is decoded first: only reveal/transaction ops from the key's own address are signed, and the optional expected (destination, amount in mutez, maxFee) must match. Returns { signedOperation, operationHash, signature, … }; broadcast signedOperation. |
Most tools return signedTransactionHex — ready to broadcast with @cryptoapis-io/mcp-broadcast. The x402 paths return { signature } (EVM typed-data) or { transaction } (SVM) instead.
| Package | Purpose |
|---|---|
ethers | EVM transaction signing |
bitcoinjs-lib + ecpair + tiny-secp256k1 | UTXO transaction signing |
elliptic | Tron transaction signing (secp256k1) |
xrpl | XRP transaction signing |
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.