Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Model Context Protocol server that gives any MCP client (Claude Desktop, Cursor, your own agent) two economic-safety tools from [Plexa](https://getplexa.com) — the x402-native economic-safety layer for trading agents — paid per call in USDC, no accounts:
| Tool | Wraps | Price | Returns |
|---|---|---|---|
plexa_quote | POST /v1/quote | $0.02 | Executable fill price under size (not mid/spot), price impact (bps), realizable depth, per-leg route, worst-case slippage, confidence — from canonical on-chain quoters on Base, Polygon & Arbitrum. |
plexa_pretrade_check | POST /v1/pretrade/check | $0.05 | Economic-safety verdict ok / caution / avoid + reasons + confidence, plus an executable quote. (Base-only today.) |
It is a thin client of the public API (https://api.getplexa.com) — it pays a 402 automatically, signs the USDC authorization locally with your wallet, and never sees your key. The liquidity engine stays behind the API.
A generic wallet guard answers "can I sign this transaction?". It can't answer the economic question an automated trader actually needs: what price will this swap really fill at under my size, and is this token a trap (rug / honeypot / thin liquidity)? Plexa answers both. This package puts those answers one tool-call away inside any MCP-speaking agent.
Nothing to install — point your MCP client at the package via npx. It is fetched and run on demand.
Add to claude_desktop_config.json (Settings → Developer → Edit Config):
{
"mcpServers": {
"plexa": {
"command": "npx",
"args": ["-y", "@getplexa/mcp"],
"env": {
"PLEXA_BASE_URL": "https://api.getplexa.com",
"AGENT_WALLET_KEY": "0x<your funded wallet private key>",
"CHAIN": "base"
}
}
}
}Add to ~/.cursor/mcp.json (or Settings → MCP → Add) — the same mcpServers block as above.
Restart the client. You should see the plexa_quote and plexa_pretrade_check tools available.
All configuration is via environment variables (set in the env block of your MCP config):
| Variable | Default | Notes | ||
|---|---|---|---|---|
PLEXA_BASE_URL | https://api.getplexa.com | The public API. The real URL — not a secret. | ||
AGENT_WALLET_KEY | (none) | Required to pay. Funded wallet private key — pays per call and signs locally. Plexa never receives it. Without it, tools return a clear 402. | ||
CHAIN | base | base \ | polygon \ | arbitrum. The chain your wallet is funded on; quotes and payment default to it. plexa_pretrade_check is Base-only today. |
Funding. Use a dedicated, low-balance wallet with a little USDC on CHAIN to pay per call (quotes $0.02, checks $0.05). The wallet signs an EIP-3009 USDC authorization per request; Plexa returns the result only after the payment settles on-chain (settle-before-serve).
Your key is a secret. Prefer your MCP client's secret storage if it has one. Never commit it.
MCP has no native payment. This server acts as an x402 client: it wraps fetch, so when Plexa replies 402 Payment Required it reads the payment requirements, signs a USDC authorization with your wallet (locally), and retries. The signed authorization is the only thing that leaves your machine — never the key. Payment is made on CHAIN, so you fund one wallet on one chain.
If no AGENT_WALLET_KEY is set, the tools return an honest 402 error explaining a funded wallet is needed — they never fabricate a result.
Once configured, just ask your agent naturally — it will call the tools:
"Before I buy this token `0x…` on Base, check it with Plexa and get me an executable quote for $500."
The agent calls plexa_pretrade_check (verdict + reasons) and plexa_quote (executable price under $500), pays $0.05 + $0.02 in USDC automatically, and answers with real on-chain economics.
clean-looking empty result. An agent can always tell a failure from a pass.
@modelcontextprotocol/sdk +x402.
MIT — see LICENSE.
Questions: [[email protected]](mailto:[email protected]) · [getplexa.com](https://getplexa.com)
Informational on-chain data and heuristic economic signals, not financial advice. Absence of flags is not a guarantee of safety. Verify independently before trading.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.