Octav Api Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Octav Api Mcp (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
██████╗ ██████╗████████╗ █████╗ ██╗ ██╗
██╔═══██╗██╔════╝╚══██╔══╝██╔══██╗██║ ██║
██║ ██║██║ ██║ ███████║██║ ██║
██║ ██║██║ ██║ ██╔══██║╚██╗ ██╔╝
╚██████╔╝╚██████╗ ██║ ██║ ██║ ╚████╔╝
╚═════╝ ╚═════╝ ╚═╝ ╚═╝ ╚═╝ ╚═══╝MCP (Model Context Protocol) server for the Octav cryptocurrency portfolio tracking API. This server enables LLM agents to query portfolio data, transaction history, net worth, and historical snapshots across 20+ blockchains.
The easiest way to use this MCP server is with npx (no installation required):
npx octav-api-mcpOr install globally:
npm install -g octav-api-mcp
# or
pnpm add -g octav-api-mcpClone the repository and build from source:
git clone https://github.com/Octav-Labs/octav-api-mcp.git
cd octav-api-mcp
pnpm install
pnpm buildCreate a .env file in the project root:
OCTAV_API_KEY=your-api-key-hereGet your API key from octav.fi.
Add to your Claude Desktop configuration (~/Library/Application Support/Claude/claude_desktop_config.json on macOS):
{
"mcpServers": {
"octav": {
"command": "npx",
"args": ["-y", "octav-api-mcp"],
"env": {
"OCTAV_API_KEY": "your-api-key-here"
}
}
}
}The -y flag automatically confirms package installation if not already cached.
Alternative (if installed globally):
{
"mcpServers": {
"octav": {
"command": "octav-api-mcp",
"env": {
"OCTAV_API_KEY": "your-api-key-here"
}
}
}
}For testing and debugging:
pnpm build
pnpm dlx @modelcontextprotocol/inspector node build/index.jsAll tools use the octav_ prefix for namespace clarity.
#### 1. octav_get_portfolio Get complete portfolio including wallet holdings and DeFi protocol positions.
Parameters:
addresses (required): Array of wallet addresses (max 10)Cost: 1 credit per address
#### 2. octav_get_wallet Get wallet holdings only (excludes DeFi protocols).
Parameters:
addresses (required): Array of wallet addresses (max 10)Cost: 1 credit per address
#### 3. octav_get_nav Get total net worth (NAV) in specified currency.
Parameters:
addresses (required): Array of wallet addresses (max 10)currency (optional): Currency code (usd, eur, gbp, jpy, cny, eth, btc). Default: usdCost: 1 credit per address
#### 4. octav_get_token_overview Get aggregated token distribution across all chains.
Parameters:
addresses (required): Array of wallet addresses (max 10)Cost: 1 credit per address
#### 5. octav_get_transactions Query transaction history with filtering and pagination.
Parameters:
addresses (required): Array of wallet addresses (max 10)chain (optional): Filter by specific chaintype (optional): Filter by transaction typestartDate (optional): Start date (YYYY-MM-DD)endDate (optional): End date (YYYY-MM-DD)offset (optional): Pagination offset. Default: 0limit (optional): Number of results (1-250). Default: 50Cost: 1 credit per address
#### 6. octav_sync_transactions Manually trigger transaction synchronization.
Parameters:
addresses (required): Array of wallet addresses (max 10)Cost: 1 credit per address
#### 7. octav_get_historical Get portfolio snapshot for a specific date in the past.
Parameters:
addresses (required): Array of wallet addresses (max 10)date (required): Date for snapshot (YYYY-MM-DD)Cost: 1 credit per address
#### 8. octav_subscribe_snapshot Subscribe to automatic portfolio snapshots.
Parameters:
addresses (required): Array of wallet addresses (max 10)frequency (required): Snapshot frequency (daily, weekly, monthly)Cost: 1 credit per address
#### 9. octav_get_status Check synchronization status across all chains.
Parameters:
addresses (required): Array of wallet addresses (max 10)Cost: FREE
#### 10. octav_get_credits Check API credit balance and usage.
Parameters: None
Cost: FREE
#### 11. octav_get_airdrop Check airdrop eligibility (Solana only).
Parameters:
address (required): Solana wallet addressCost: 1 credit
#### 12. octav_get_polymarket Get Polymarket prediction market positions.
Parameters:
address (required): Ethereum wallet addressCost: 1 credit
#### 13. octav_agent_wallet Get wallet holdings via x402 payment protocol (for AI agents).
Parameters:
addresses (required): Array of wallet addresses (max 10)Cost: Paid via HTTP 402 payment protocol
#### 14. octav_agent_portfolio Get full portfolio via x402 payment protocol (for AI agents).
Parameters:
addresses (required): Array of wallet addresses (max 10)Cost: Paid via HTTP 402 payment protocol
The server accepts two address formats:
0x followed by 40 hex characters (Ethereum, Polygon, Arbitrum, Base, etc.)All tools return dual-format responses:
octav_get_status and octav_get_credits are FREEThe server provides clear error messages for:
pnpm buildpnpm devpnpm testOnce configured with Claude Desktop, you can ask questions like:
Ethereum, Solana, Arbitrum, Base, Polygon, Optimism, BNB Chain, Avalanche, Fantom, Cronos, Gnosis, Celo, Moonbeam, Moonriver, Harmony, Aurora, Metis, Boba, Fuse, Evmos, Kava, and more.
MIT
For API issues or questions, visit octav.fi or check the API documentation.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.