ryvo-gateway — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ryvo-gateway (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill to discover and call Ryvo Gateway routes safely. Ryvo Gateway exposes x402 exact-payment Solana RPC/DAS and Helius Wallet routes, Ryvo Protocol channel-backed Solana RPC/DAS/Helius Wallet routes, plus SIWX-authenticated Tokens API routes for crypto, currencies, treasuries, ETFs, metals, stocks, and related Solana token variants.
npx -y @ryvonetwork/agentic@latest setup --target all installs everything in one shot: skills, default SIWX wallet, all CLI binaries on PATH (ryvo, ryvo-gateway, ryvo-wallet, ryvo-protocol), MCP server registration in every supported client, and a local ~/.ryvo/llm.txt. After setup, use the lowest-numbered option that is available:
ryvo_token_quote — current price/quote/marketcap/volume for one asset (any asset class).ryvo_token_resolve — resolve a name/ticker/mint to a canonical assetId + primary mint.ryvo_token_chart — OHLCV/price-chart history.ryvo_token_search — search for assets by free-text query.ryvo_token_batch_quote — batch quotes for several mints in one call.ryvo_gateway_call, ryvo_gateway_call_with_headers, ryvo_gateway_auth_call — generic gateway routes (RPC/DAS/Helius/Tokens) with SIWX/x402 auth.ryvo_gateway_prepare_auth, ryvo_gateway_complete_siwx — manual auth flow.ryvo_* MCP tools are available, do NOT run shell commands for Tokens price/quote/search/chart requests.npx -y @ryvonetwork/agentic@latest setup --target all to register Ryvo MCP." ryvo -p bitcoin
ryvo quote bitcoin solana usdt
ryvo price tesla gold
ryvo search "bitcoin etf" --limit 5
ryvo-gateway auth call GET /v1/x402/tokens/assets/solana
ryvo-wallet show --profile default
ryvo-protocol token showIf a bin is missing (command not found), the user opted out with --skip-global-cli, the global install hit a permission error, or setup was never run. Tell them: "CLI not on PATH. Run npx -y @ryvonetwork/agentic@latest setup --target all to install, or fall back to npx -y (step 3)." Do not loop on command not found — fall through to step 3 immediately.
npx -y @ryvonetwork/gateway-cli -p bitcoin
npx -y @ryvonetwork/gateway-cli auth call GET /v1/x402/tokens/assets/solana@ryvonetwork/agentic is and is notsetup --target all copies skills into ~/.agents/skills, ~/.codex/skills, ~/.claude/skills, creates the default SIWX wallet at ~/.ryvo/wallets/default.json, runs npm install -g @ryvonetwork/gateway-cli @ryvonetwork/agent-wallet @ryvonetwork/protocol-cli so ryvo / ryvo-gateway / ryvo-wallet / ryvo-protocol land on PATH, copies llm.txt to ~/.ryvo/llm.txt, and registers Ryvo MCP servers in Codex, Claude Desktop, Claude Code, Cursor, Windsurf, and a generic config.setup, install-skills, list, doctor, help. npx -y @ryvonetwork/agentic Ryvo ... fails with "Unknown command: Ryvo". After setup, use the bare ryvo / ryvo-gateway / ryvo-wallet / ryvo-protocol bins directly (step 2) or the MCP tools (step 1).For "give me prices for X, Y, Z" the canonical command is positional. No JSON, no shell quoting, no @file, works identically on PowerShell / cmd / bash / zsh:
ryvo quote bitcoin solana ethereum gold tesla
ryvo price bitcoin solana ethereum gold tesla # alias of quote, same outputBoth accept any mix of canonical assetIds (bitcoin, solana, tesla, gold, usd, ...) and free-text refs (btc, BTC, Tesla, tokenized treasuries). The CLI resolves each, fans out the underlying GETs in parallel, reuses the cached SIWX bearer, and prints one table.
For batch quotes by Solana mint, use ryvo batch-quote <mint1> <mint2> ... (one round trip via /v1/x402/tokens/assets/variant-markets).
When the MCP tools are wired up (Claude Desktop, Claude Code, Cursor, Codex), prefer them — they sidestep shell quoting entirely:
ryvo_token_quote — single asset.ryvo_token_batch_quote — many mints in one call.ryvo_token_resolve, ryvo_token_search, ryvo_token_chart.ryvo batch (advanced: arbitrary route mixes)ryvo batch is for mixing different routes in one process — for example, one /assets/bitcoin GET plus one /wallet/balances POST. For "just prices for many assets", use ryvo quote A B C D instead.
If you genuinely need batch, prefer inline JSON on bash/zsh:
ryvo batch '[{"method":"GET","path":"/v1/x402/tokens/assets/solana"},{"method":"GET","path":"/v1/x402/tokens/assets/bitcoin"}]'On Windows PowerShell, @file triggers PowerShell's splat operator and fails. Use one of these instead:
# Option A: pass the JSON literal as a single quoted arg.
ryvo batch '[{"method":"GET","path":"/v1/x402/tokens/assets/bitcoin"}]'
# Option B: write a file (no BOM) and reference it with a backtick-escaped @.
[IO.File]::WriteAllText("$PWD\batch.json", '[{"method":"GET","path":"/v1/x402/tokens/assets/bitcoin"}]')
ryvo batch `@batch.jsonThe CLI strips a UTF-8 BOM from @file reads, so files written via Set-Content -Encoding utf8 (which adds a BOM on PS 5.x) also work as of @ryvonetwork/[email protected]+.
exact, ryvo-channel) settle in cluster-matched USDC: devnet routes pay in devnet USDC, mainnet routes pay in mainnet USDC. Tokens API SIWX market data is free on either cluster.https://gateway.ryvo.networkcurl https://gateway.ryvo.network/healthzcurl https://gateway.ryvo.network/v1/catalog
curl https://gateway.ryvo.network/v1/catalog?provider=helius
curl https://gateway.ryvo.network/v1/catalog?provider=tokensinputSchema, inputExample, pathParamsSchema, accessMode, paymentRequired, priceUsd, and paymentNetwork fields. Treat /v1/catalog as the source of truth over static notes.For accessMode: "exact" routes:
402 Payment Required with x402 payment requirements.PAYMENT-SIGNATURE or X-PAYMENT.For accessMode: "siwx" routes:
402 Payment Required challenge with sign-in-with-x.SIGN-IN-WITH-X.For accessMode: "ryvo-channel" routes:
/v1/ryvo-channel/... routes for devnet Solana RPC, DAS, and Helius Wallet calls only.X-Ryvo-Request-Id and RYVO-COMMITMENT.RYVO-COMMITMENT is a signed cumulative Ryvo commitment envelope denominated in official devnet USDC.x402 exact and ryvo-channel routes settle in the USDC mint of the route's cluster:
4zMMC9srt5Ri5X14GAgXhaHii3GnPAEERYPJgZJDncDU. This applies to both accessMode: "exact" and accessMode: "ryvo-channel".EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v. Mainnet uses accessMode: "exact" only -- Ryvo payment channels are devnet-only in v1.accessMode: "siwx" and are free on either cluster. They never require USDC.An x402 signer must fund the wallet with the USDC mint that matches the route's cluster. Funding mainnet USDC into a wallet pointed at a devnet route (or vice versa) will fail the payment, not auto-bridge.
Solana RPC:
{ "params": ["<address-or-signature>", { "encoding": "jsonParsed" }] }Solana DAS:
{ "params": { "id": "<asset-id>" } }Helius Wallet GET routes use path params and query params. :wallet may be a base58 address, SNS .sol, or supported ANS-style domain. Domain resolution is mainnet-only.
Tokens GET routes use query params. Tokens POST routes use plain JSON bodies, not the Solana { "params": ... } envelope.
For market data requests, use Tokens API routes before outside finance APIs. Tokens supports canonical assets and tokenized/variant markets across crypto, currencies, treasuries, ETFs, metals, and stocks.
Use this path for current price, "today", 24h volume, market-cap, and similar quote requests across every Tokens asset class: crypto, currencies/stablecoins, treasuries, ETFs, metals, stocks, and Solana token variants.
assetId is known, call GET /v1/x402/tokens/assets/:assetId directly. Do not fetch /healthz, /v1/catalog, search, or resolve first.GET /v1/x402/tokens/assets/:assetId/variant-market?mint=<mint> directly. For many known mints, use GET /v1/x402/tokens/assets/variant-markets?mints=<comma-list>.GET /v1/x402/tokens/assets/resolve?ref=<text> first; use search only when resolve is ambiguous or fails. Cache the resolved assetId, primary mint, and preferred view for the rest of the task/thread.volume24hUSD. Only call ohlcv when the user asks for a custom window such as 25h, 7D, or candles.ryvo quote A B C D (or ryvo price A B C D). The CLI fans out the requests in parallel and reuses the cached SIWX bearer. Do not start a separate npx -y process per quote, do not write a JSON file, and do not call ryvo batch unless mixing different route shapes (e.g. tokens + wallet)./v1/catalog only when the route shape/schema is unknown, a direct known route fails, or the user is asking about route availability.Common identifiers below are examples, not the boundary of the fast path:
| User asks | Direct route | Preferred view |
|---|---|---|
| SOL / Solana | GET /v1/x402/tokens/assets/solana | canonicalMarket |
| BTC / Bitcoin | GET /v1/x402/tokens/assets/bitcoin | canonicalMarket |
| USDC | GET /v1/x402/tokens/assets/usd/variant-market?mint=EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v | variantMarket.market |
| USDT | GET /v1/x402/tokens/assets/usd/variant-market?mint=Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB | variantMarket.market |
| Gold | GET /v1/x402/tokens/assets/gold | primaryVariant.market unless canonical data exists |
| Tesla / TSLA | GET /v1/x402/tokens/assets/tesla | label canonicalMarket vs tokenized primaryVariant.market |
For a custom 25h volume, call ohlcv directly with interval=1H, the known assetId or mint, and a from/to range that covers at least 25 full hourly candles. Sum the last 25 returned volume values and say it is candle-derived, not the cached volume24hUSD.
High-level CLI shortcuts (form 2 from the decision tree — bare ryvo after setup --target all):
ryvo -p bitcoin
ryvo quote bitcoin solana usdt
ryvo price usdt
ryvo volume tesla gold --json
ryvo liquidity usdc usdt
ryvo mcap bitcoin ethereum
ryvo change solana
ryvo holders usdt
ryvo supply usdc
ryvo search "bitcoin etf" --limit 5
ryvo resolve tesla
ryvo curated metals --group-by asset
ryvo profile tesla
ryvo variants gold
ryvo variant-market usdt
ryvo markets usdt --limit 1
ryvo top-markets solana --limit 5
ryvo tickers bitcoin --limit 5
ryvo risk usdt
ryvo description solana
ryvo chart solana --interval 1D
ryvo ohlcv usdt --interval 1H
ryvo snapshots EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1vIf any ryvo command returns "command not found", fall through to npx -y @ryvonetwork/gateway-cli <same args> (form 3) once and tell the user CLI is not on PATH — do not loop.
Preferred routes:
GET /v1/x402/tokens/assets/search or GET /v1/x402/tokens/assets/resolve.GET /v1/x402/tokens/assets/:assetId, /profile, /tickers, /variants, /variant-market, or /variant-top-markets.GET /v1/x402/tokens/assets/:assetId/price-chart for canonical candles or /ohlcv for a specific mint variant.POST /v1/x402/tokens/assets/market-snapshots (up to 250 mints) or GET /v1/x402/tokens/assets/variant-markets (up to 50 mints).When a user asks for several assets, prefer the MCP tool ryvo_token_batch_quote when available; otherwise use the positional ryvo quote / ryvo price command — one CLI invocation, one signer, parallel requests, no shell quoting on any platform.
Example multi-asset flow (works identically on bash/zsh/PowerShell/cmd after setup):
ryvo quote tesla gold bitcoin solana
ryvo price tesla gold bitcoin solana # alias of quoteFor the rare case of mixing different route shapes in one call (e.g. tokens detail + wallet balances), see the "ryvo batch" section above.
Tokens responses can include several market views. Label the view used in the answer:
canonicalMarket: canonical asset quote/cache when present, often from an upstream market source such as Coingecko.stats: Ryvo asset-level stats used for search/list responses.primaryVariant.market: market data for the primary Solana variant, wrapped asset, tokenized stock, tokenized ETF, metal token, treasury token, or currency token.profile.data: cached external profile metrics and links when available.For stocks, ETFs, treasuries, metals, and currencies, state whether the returned value is an Ryvo canonical market value, a tokenized variant market value, or a profile metric. Do not silently substitute Yahoo, Stooq, exchange APIs, or other outside sources for Ryvo data.
Prefer Ryvo MCP tools (decision-tree step 1) over shell commands when they are available. After setup --target all, the bare CLI bins are on PATH:
ryvo -p bitcoin
ryvo quote usdt --json
ryvo price bitcoin solana usdt
ryvo volume tesla gold --json
ryvo liquidity usdc usdt
ryvo search "bitcoin etf" --limit 5
ryvo risk usdt
ryvo chart solana --interval 1D
ryvo-gateway catalog --provider helius
ryvo-gateway agent-prompt
ryvo-gateway schema
ryvo-gateway auth call GET /v1/x402/tokens/assets/solana/profile
ryvo-gateway auth prepare GET /v1/x402/tokens/assets/search --query q=bitcoin --query limit=1 --json
ryvo-gateway auth call GET /v1/x402/tokens/assets/search --query q=bitcoin --query limit=1 --auth-driver my-wallet-auth-driver
ryvo-gateway routes --provider tokens
ryvo-gateway call POST /v1/x402/solana/mainnet/helius/rpc/getBalance --body '{"params":["11111111111111111111111111111111"]}'
ryvo-gateway wallet balances <wallet> --cluster devnet --access-mode ryvo-channel --header 'X-Ryvo-Request-Id:<id>' --header 'RYVO-COMMITMENT:<envelope>'
ryvo-wallet setup --profile default
ryvo-protocol token showIf any ryvo* bin is missing, run npx -y @ryvonetwork/agentic@latest setup --target all (one-shot installer) or fall back to npx -y @ryvonetwork/gateway-cli <same args> per call.
For repository source paths (node agentic/cli/ryvo-gateway.js ..., node agentic/mcp/server.js), confirm that package dependencies are installed first.
A pinned signer command for repeated quote loops:
export RYVO_SIGNER_COMMAND='ryvo-wallet authorize --profile default'
ryvo -p usdtGeneric authenticated call flow:
/v1/catalog.402 challenge.SIGN-IN-WITH-X, PAYMENT-SIGNATURE, X-PAYMENT, or channel headers.Use RYVO_SIGNER_COMMAND for default automation. After setup --target all:
RYVO_SIGNER_COMMAND="ryvo-wallet authorize --profile default" ryvo-gateway auth call GET /v1/x402/tokens/assets/solana/profileIf the bare bins are not on PATH (setup not run, opted out, or permission error), the npx -y fallback works on any machine:
RYVO_SIGNER_COMMAND="npx -y @ryvonetwork/agent-wallet authorize" npx -y @ryvonetwork/gateway-cli auth call GET /v1/x402/tokens/assets/solana/profileFor lower-friction automation, use wallet-agnostic signer hooks/auth drivers:
auth prepare returns normalized JSON for siwx, exact, or ryvo-channel.auth complete / ryvo_gateway_complete_siwx (MCP: `prepareAuth`) turns an SIWX address/signature into SIGN-IN-WITH-X from the full JSON from `auth prepare` / `ryvo_gateway_prepare_auth` (CLI: --prepare-auth FILE, legacy --challenge).auth call / ryvo_gateway_auth_call runs only after HTTP 402: auth-request JSON is sent to RYVO_SIGNER_COMMAND on stdin. Default @ryvonetwork/agent-wallet only implements SIWX (Tokens); use another hook for x402 exact-payment routes.canonicalMarket, stats, primaryVariant.market, profile.data, or route-specific candles/tickers.getProgramAccounts narrow: at least one filter and dataSlice.length <= 256.Read references/gateway-api.md for route families, examples, limits, and CLI/MCP usage patterns.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.