Skip to main content
Glama
RMAAPK

CryptoMCP

by RMAAPK
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Remote

🛡️ CryptoMCP: Ultra-Secure Model Context Protocol Crypto & Web3 Gateway

License: BSL 1.1 Organization: RMAA Holdings Framework: FastMCP Security: DMCPS Anti--Drainer

CryptoMCP (engineered by RMAA Holdings) is an ultra-hardened Model Context Protocol (MCP) Web3 gateway built with TypeScript and FastMCP.

It enables AI Agents (Claude Desktop, ChatGPT, Gemini, ForgeAI) to query multichain balances, inspect smart contracts, and draft DeFi interactions with 100x stronger anti-drainer security rails to prevent catastrophic wallet loss, honeypot scams, and prompt injection drainers.

🛡️ 100x Hardened Anti-Drainer Security Rails

On-chain cryptocurrency transactions are permanent and non-reversible. CryptoMCP implements mathematical defenses inspired by DMCPS:

+-------------------------------------------------------------------------------------------------+
|                               CRYPTOMCP ANTI-DRAINER ARCHITECTURE                               |
+-------------------------------------------------------------------------------------------------+
|   AI AGENT (Claude / GPT / Gemini)                                                              |
|         │                                                                                       |
|         ▼  JSON-RPC (FastMCP / Stdio / Stream)                                                  |
|   [CRYPTOMCP SECURITY INTERCEPTOR] ──► Emergency Freeze Active? ──────────► [INSTANT BLOCK]     |
|         │                                                                                       |
|         ├──► Infinite Token Allowance (type(uint256).max)? ───────────────► [INSTANT BLOCK]     |
|         ├──► Non-Whitelisted Contract / Wallet Address? ──────────────────► [INSTANT BLOCK]     |
|         ├──► Value Exceeds Single Tx Cap ($100 USD)? ─────────────────────► [INSTANT BLOCK]     |
|         ├──► Value Exceeds Cumulative Daily Cap ($500 USD)? ──────────────► [INSTANT BLOCK]     |
|         │                                                                                       |
|         ├──► Value >= $25 USD (Human Challenge Gate)? ────────────────────► [REQUIRES TOKEN]    |
|         │                                                                         │             |
|         │                                                                         ▼             |
|         │                                                           [DMCPS ANTI-DRAINER UI]     |
|         │                                                           Human Cryptographic Sign    |
|         │                                                                         │             |
|         ▼                                                                         │             |
|   [BLOCKCHAIN BROADCAST & SIGNING (ETH / Polygon / Solana / BTC)] ◄───────────────┘             |
+-------------------------------------------------------------------------------------------------+

1. Mathematical Anti-Drainer (Infinite Approval Blocker)

  • The Attack: 95% of phishing dApps trick users or agents into approving type(uint256).max (0xffffffff...), granting the smart contract unlimited permission to drain all ERC-20 tokens at any future point.

  • The Defense: CryptoMCP inspects the calldata selector (0x095ea7b3) and automatically drops any transaction attempting infinite or unbounded allowances.

2. Strict Destination Whitelisting

  • The AI cannot send funds or interact with unverified contract addresses extracted from untrusted web pages or prompts.

  • All target addresses (e.g. 1inch, Uniswap, Aave) must be explicitly registered and assigned a daily budget by the human owner in the Dashboard.

3. Human-In-The-Loop (HITL) Cryptographic Challenge Gate

  • Any transaction value greater than or equal to $25.00 USD triggers an unforgeable challenge token (CRYPTO_AUTH_...) with a 10-minute expiry.

  • The transaction cannot be broadcast to the blockchain until the human owner confirms the details in the Dashboard or passes the token back to submit_crypto_approval_token.

4. Cold Wallet Emergency Killswitch

  • One click on the Dashboard instantly freezes all signing operations and rejects any inbound agent tool calls.

Related MCP server: chain-signer

🛠️ MCP Tools Exposed to AI

Tool Name

Risk Level

Description

list_wallets

🟢 Safe (Read)

Lists managed public wallet addresses, chains, and token balances.

list_whitelisted_contracts

🟢 Safe (Read)

Lists authorized DEX routers, lending pools, and recipient entities.

transfer_crypto

🔴 High (Gated)

Initiates transfer or contract interaction; guarded by Anti-Drainer rules.

submit_crypto_approval_token

🟡 Auth (Commit)

Submits human challenge token to sign and broadcast high-value transaction.

get_crypto_security_status

🟢 Safe (Read)

Audits active USD spend caps, remaining daily budget, and freeze status.

🚀 Quickstart & Dashboard

1. Install & Build

npm install
npm run build

2. Configure Environment

cp .env.example .env

Edit .env credentials:

PORT=8090
ADMIN_USERNAME=admin
ADMIN_PASSWORD=your_secure_password_here
MAX_SINGLE_TX_USD=100
MAX_DAILY_TX_USD=500
HUMAN_APPROVAL_THRESHOLD_USD=25
BLOCK_INFINITE_ALLOWANCE=true

3. Run the Gateway

npm start

  • Anti-Drainer Control Dashboard: http://localhost:8090/dashboard

  • FastMCP Transport Gateway: Stdio or Stream mode ready for MCP clients.

4. Run the Security Test Suite

npm test
✔ CryptoSecurityGuard: Anti-Drainer blocks infinite allowance (type(uint256).max) (14.9ms)
✔ CryptoSecurityGuard: Blocks non-whitelisted contract/wallet targets (10.4ms)
✔ CryptoSecurityGuard: Demands Human-In-The-Loop Approval Above Threshold (11.0ms)
✔ CryptoSecurityGuard: Emergency Freeze Kills All Web3 Interactions (6.3ms)
ℹ tests 4 | pass 4 | fail 0

📜 License

Released under the Business Source License 1.1 (BSL 1.1) by RMAA Holdings & Contributors (matching DMCPS).

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityMaintained
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • ows-mcp-wallet

    Danmwihoti
    A
    license
    A
    quality
    D
    maintenance
    Enables AI agents to check balances and send transactions across multiple blockchains with automatic spending limit protection and policy enforcement.
    3
    MIT

  • chain-signer

    Kevthetech143
    A
    license
    A
    quality
    D
    maintenance
    Non-custodial agent wallet with a transaction preflight that decodes an unsigned EVM tx and flags drain patterns (unlimited/large approval, approve-all, token & NFT transferFrom, proxy upgrade, on-chain permit, approvals hidden in multicall) before signing.
    9
    41 PyPI
    1
    MIT

  • crypto-knowledge

    DerDoPhil
    A
    license
    Not graded
    quality
    C
    maintenance
    Enables AI agents to perform complex crypto operations like cross-chain routing, contract decoding, portfolio management, and anti-rug security checks, returning unsigned transactions for safe signing by the agent.
    MIT

  • WETH

    ayushkumar2601
    A
    license
    Not graded
    quality
    C
    maintenance
    Enables AI agents to analyze Ethereum wallets, simulate transactions, and draft transfers with deterministic policy and risk scoring, requiring human approval before on-chain execution.
    6 npm
    ISC