Svalin

Read-only portfolio risk intelligence for AI agents.

Give Svalin a Solana wallet or a NEAR account. Get back a priced portfolio and a deterministic risk report: a 0-100 score, an A-F grade, exposure metrics, and findings with concrete next steps. Agents pay per call in USDC over x402 on Solana or NEAR. No API keys, no accounts, and no way to move funds.

Features · How it works · Use cases · Endpoints · Use it from an agent · Run locally · Trust and safety · Docs

Features

• Risk reports. A 0-100 score and A-F grade from concentration, stablecoin buffer and long-tail exposure, with findings that explain each risk in plain English and suggest a next step.

• Solana and NEAR. Solana wallets (7xKX…) and NEAR accounts (alice.near) go through the same engine and the same endpoints.

• Priced portfolios. Live balances and USD prices, with each token placed in a risk category: stablecoin, native, liquid staking, major, meme or long-tail. Staked SOL and NEAR count as staked.

• Briefs. A headline, a short summary and up to three actions for explaining a wallet to a person, written by Claude when configured and by a template otherwise.

• Pay per call. USDC over x402 on Solana or NEAR. No keys, no accounts, no subscription.

• MCP server. svalin-mcp brings the tools to Claude, Cursor and any MCP client, with a hard per-call price cap and a session budget.

• Read-only. Svalin never asks for keys, approvals or signatures from the wallet it analyses, and it has no code path that moves funds.

• Deterministic. Same holdings, same report. No LLM computes a number, and the methodology is public and versioned.

Related MCP server: obol

How it works

agent ── GET /v1/risk/{wallet} ──────────────▶ Svalin API
agent ◀── 402 Payment Required: $0.004 USDC on Solana or NEAR
agent ── retry with PAYMENT-SIGNATURE ───────▶ paywall ── verify / settle ──▶ facilitator
agent ◀── 200 risk report ───────────────────── engine ◀── Helius (Solana) · FastNEAR + Ref Finance (NEAR)

Invalid addresses are rejected before the paywall, and failed responses (4xx/5xx), such as a NEAR account that does not exist, are never settled, so a caller is never charged for an error.

A trimmed risk report:

{
  "wallet": "7xKXtg2CW87d97TXJSDpbD5jBkheTqA83TZRuJosgAsU",
  "chain": "solana",
  "score": 49,
  "grade": "C",
  "level": "moderate",
  "metrics": { "totalValueUsd": 17071.37, "stablecoinPct": 7.26, "memePct": 13.47, "effectivePositions": 3.54 },
  "findings": [
    {
      "severity": "medium",
      "title": "SOL (incl. staked) is 59.8% of the portfolio",
      "summary": "A single volatile exposure above 40% means one price move dominates the outcome.",
      "action": "Consider capping SOL exposure near 40% by rotating part into stablecoins or a second, uncorrelated major.",
      "confidence": 64
    }
  ],
  "methodologyVersion": "2026-10.2"
}

Use cases

Svalin is the read-only risk step in an agent workflow. Agents and people ask it how risky a wallet is before they act, and act somewhere else.

flowchart TB
    S(("Svalin"))
    S --> G & W & T & R & C

    subgraph G["Agent guardrails"]
        direction TB
        G1["Check risk before<br/>a swap or rebalance"] ~~~ G2["Ask a human<br/>on a poor grade"] ~~~ G3["Spend caps per call<br/>and per session"]
    end
    subgraph W["Wallet copilots"]
        direction TB
        W1["Explain a wallet<br/>in plain English"] ~~~ W2["Scheduled<br/>risk briefs"] ~~~ W3["Staking and<br/>stablecoin tips"]
    end
    subgraph T["Treasuries and DAOs"]
        direction TB
        T1["Concentration<br/>limits"] ~~~ T2["Stablecoin<br/>buffer checks"] ~~~ T3["One report per<br/>treasury wallet"]
    end
    subgraph R["Research and analytics"]
        direction TB
        R1["Score wallets<br/>in a batch"] ~~~ R2["Spot spam and<br/>long-tail tokens"] ~~~ R3["Solana and NEAR<br/>in one format"]
    end
    subgraph C["Agent tool catalogs"]
        direction TB
        C1["Pay per call<br/>over x402"] ~~~ C2["OpenAPI and<br/>llms.txt"] ~~~ C3["One-line<br/>MCP install"]
    end

Orchestration pattern: the risk gate

An orchestrator agent checks the wallet with Svalin before it hands a plan to an executor. Svalin only reads. Execution stays with a separate tool that you control, and you choose the grade thresholds.

flowchart LR
    O["Orchestrator agent<br/>(on a request or a schedule)"] -->|"svalin_risk_report<br/>$0.004"| G{"Grade?"}
    G -->|"A or B"| X["Executor agent<br/>(your own wallet tools)"]
    G -->|"C to F"| B["svalin_brief · $0.02<br/>headline and up to 3 actions"]
    B --> H{"Human<br/>approves?"}
    H -->|"yes"| X
    H -->|"no"| S(["Stop and report"])
    X -.->|"re-check the new grade"| O

Any orchestrator that can call MCP tools or make HTTP requests can use these patterns.

Endpoints

{address} is a Solana address or a NEAR account ID. Prices are the defaults and can be changed per deployment with the PRICE_* environment variables.

Use it from an agent

MCP (Claude Code, Claude Desktop, Cursor and any MCP client). The free scan works with no setup. Add a dedicated hot wallet holding a few dollars of USDC, on Solana or NEAR, to unlock the paid tools.

claude mcp add svalin -e SVALIN_API_URL=https://YOUR-SVALIN-API -- npx -y svalin-mcp

Tools, configuration and spend limits are documented in packages/mcp.

Any x402 client (TypeScript):

import { wrapFetchWithPayment, x402Client } from "@x402/fetch";
import { ExactSvmScheme } from "@x402/svm/exact/client";

const pay = wrapFetchWithPayment(fetch, new x402Client().register("solana:*", new ExactSvmScheme(signer)));
const report = await (await pay(`https://YOUR-SVALIN-API/v1/risk/${wallet}`)).json();

Run locally

Requires Node 20.18+ and pnpm 10.

pnpm install
cp .env.example .env      # works as-is: sample data, payments off
pnpm build
pnpm dev                  # API on :4000, website on :3000

Open http://localhost:3000 and scan any Solana address or NEAR account. Without HELIUS_API_KEY the API serves clearly labelled sample data, and it refuses to start in production that way. Add a free Helius key to .env for live data; NEAR data needs no key.

To try the paywall, set PAY_TO_SOLANA and/or PAY_TO_NEAR with X402_ENV=testnet and call a paid endpoint: you get a 402 with a PAYMENT-REQUIRED header offering Solana devnet and NEAR testnet USDC.

pnpm test        # risk engine, Helius and NEAR mapping, paywall, facilitators, rate limiting, narrator, MCP end-to-end payment
pnpm typecheck

The MCP end-to-end test runs the whole payment path offline: MCP tool call, x402 client signing a real NEAR USDC transfer, API paywall, facilitator verify and settle, handler, ledger entry.

Project structure

See ARCHITECTURE.md for the request pipeline and module boundaries.

Trust and safety

Found a security issue? Please report it privately through a security advisory rather than a public issue.

Deploy

• API: Render (New → Blueprint, using render.yaml, on the free plan, which sleeps when idle) or any container host using the root Dockerfile.

• Website: any Next.js host with the root directory set to apps/web; apps/web/vercel.json is ready for Vercel.

• MCP server: npm and the official MCP Registry.

Step-by-step instructions, with a test after each step, are in docs/DEPLOYMENT.md.

Limitations

• Wallet analysis covers Solana and NEAR.

• NEAR token prices come from Ref Finance, which also prices thinly traded tokens; those show up as long-tail exposure.

• The cache and the free-tier limits are held in memory, so the API runs as a single instance.

• Reports describe current holdings only.

Documentation

License

Apache License 2.0; see NOTICE. Svalin reports exposures; it is not financial advice and does not tell anyone what to buy.