pons-mcp

Model Context Protocol server for the Pons launchpad on Robinhood Chain (chainId 4663) — full 1:1 parity with the Pons v2 contracts, driven entirely from live chain state.

• 20 read tools — protocol parameters, launch configs, token/curve state, event scans (launches, graduations, creator history, curve trades), exact curve buy/sell quotes cross-checked against the chain, V4 pool quotes for graduated tokens (native- and ERC-20-quoted), supply/burn stats, claimable fee balances and buyback vesting, pending fee-recipient changes, V1 (legacy) launchpad reads, plus on-chain “interesting launch” scoring (pons_scan_interesting).

• 15 write tools (opt-in) — launch, curve buy/sell, graduation, creator fee-recipient transfer + owner timelock flow, curve controls, fee-escrow claims, buyback-vault release, factory admin surface, Uniswap V4 swaps. Every write tool dry-runs by default and only broadcasts when explicitly confirmed.

• 3 MCP resources + 3 prompts — live protocol/token state as readable resources (pons://protocol/overview, pons://launches/recent, pons://token/{address}) and guided workflows (launch-a-token, analyze-token, safe-trade).

Read-only by default. With no key configured the server performs eth_call, eth_getLogs, eth_blockNumber, eth_chainId, and eth_gasPrice only — no keys, no transactions, no code path that can spend funds. All reads are at the latest block (Robinhood Chain has no archive node).

No web3 framework anywhere: raw JSON-RPC over fetch, hand-rolled ABI codec and RLP, BigInt throughout, secp256k1 via @noble/curves. See docs/ARCHITECTURE.md for why.

Hosted server (no install)

A read-only instance runs at https://mcp.ponsmcp.ai/mcp (Streamable HTTP, stateless, no auth). It exposes the 20 read tools, 3 resources and 3 prompts; the write tools do not exist on it by construction, so nothing there can sign or send.

claude mcp add --transport http pons https://mcp.ponsmcp.ai/mcp

Any client that takes a remote MCP URL (Claude Desktop connectors, Cursor, Windsurf, VS Code, ChatGPT) works the same way. Rate limit: 60 requests per minute per IP. For write mode, run the server locally with PONS_PRIVATE_KEY, see below. Site and docs: https://ponsmcp.ai.

To host your own: npm run build && npm run start:http (env PORT, PONS_RPC_URL, PONS_HTTP_RATE_LIMIT, PONS_HTTP_PUBLIC_URL), or build the included Dockerfile.

Related MCP server: OpenHooks MCP

Quickstart

npm install
npm run build      # tsc → dist/
npm test           # 163 offline tests: ABI codec, curve math, RLP/signing, RPC policy, write gating
npm run smoke      # live-chain smoke test (chainId, factory params, log re-filtering)
npm start          # node dist/index.js (stdio MCP server)
npm run start:http # hosted read-only Streamable HTTP server on $PORT (dist/serve.js)

Node ≥ 20. The server asserts eth_chainId == 4663 at startup and exits if the RPC points at another chain.

The test suite (npm test) is fully offline — it covers the ABI codec, curve math (including the clamped-fill price bound), EIP-1559/Permit2 signing with address recovery, RPC retry and sanitization policy, log re-filtering and scan chunking, and the write-gating invariants (nothing broadcasts without dryRun=false + confirm=true, drift gates, caps, fake-curve rejection). The smoke test (npm run smoke) then verifies the decode contract against the live chain.

MCP client configuration

Claude Desktop (claude_desktop_config.json):

{
  "mcpServers": {
    "pons": {
      "command": "node",
      "args": ["/absolute/path/to/pons-mcp/dist/index.js"],
      "env": {
        "PONS_RPC_URL": "https://rpc.mainnet.chain.robinhood.com"
      }
    }
  }
}

Claude Code:

claude mcp add pons -- node /absolute/path/to/pons-mcp/dist/index.js
# with write mode:
claude mcp add pons --env PONS_PRIVATE_KEY=0x<32-byte-hex> -- node /absolute/path/to/pons-mcp/dist/index.js

Any stdio-capable MCP client can launch it the same way (node dist/index.js), or via the installed bin: pons-mcp.

Tools

Read tools (always registered)

Write tools (registered only when PONS_PRIVATE_KEY is set)

Write mode

Warning: use a dedicated hot wallet funded only with what you intend to spend. The key in PONS_PRIVATE_KEY can spend everything that wallet holds. Never reuse a wallet that stores anything else.

Setting PONS_PRIVATE_KEY (32-byte hex, 0x prefix optional) registers the 15 write tools. Only the derived signer address is ever logged (stderr). Every write tool follows the same discipline:

1. Dry-run (default): every step is simulated via eth_call — with state-diff overrides where the node enforces balances, so unfunded dry-runs still exercise contract logic — plus gas estimation, full cost preview, and the exact calldata. Nothing is broadcast.

2. Broadcast: re-call with dryRun=false, confirm=true. The server re-simulates, refuses if any step reverts, then signs (EIP-1559, hand-rolled RLP + secp256k1, byte-for-byte verified against viem) and broadcasts, waiting for each receipt. Multi-step flows (approve → sell, graduate → createGraduatedPool, approve → PERMIT2_PERMIT+V4_SWAP) are sent sequentially, each waiting for the prior receipt.

Additional safeguards: pons_buy/pons_sell only accept the factory-registered curve for a token; RPC-read contract addresses used as value destinations (launchForwarder, memeHook) are pinned and drift blocks broadcast unless acknowledged with acceptContractDrift; broadcast tx hashes are verified against the locally computed hash of the signed payload; and dry-runs never create signatures (the Permit2 permit in a swap sell is signed only at broadcast time).

Safety caps (fail closed — a malformed value stops startup, not the cap):

• PONS_MAX_DEV_BUY_ETH (default "0.05") — hard cap on a launch's opening buy.

• PONS_MAX_LAUNCHES_PER_DAY (default 5) — hard cap on launch broadcasts per rolling 24 h.

Details and per-tool mechanics: docs/TOOLS.md. Threat model: docs/SECURITY.md.

Environment variables

Errors

Every tool returns JSON. Failures are structured:

{ "error": { "code": "NOT_A_LAUNCH", "message": "…" } }

Design notes

• ~0.1 s blocks (~10 blocks/s): 500k blocks ≈ 14 h. Log scans are block-count based (10k-block chunks, newest chunk first, client-side re-filtered — node topic filters are never trusted).

• Retry policy: only network failures and HTTP 429/5xx retry (3 attempts, backoff, endpoint failover). Permanent errors — reverts included — fail immediately with their real message.

• All quantities are BigInt internally and formatted with unit labels ("0.0005 ETH") only at the output boundary. Pair tokens can be 6-decimal (e.g. USDG) — per-token decimals() is always used.

• ABI selectors and event topics are computed from canonical signatures via keccak-256 (@noble/hashes) at startup and asserted against hardcoded constants; a mismatch crashes the server rather than serving stale calldata.

• The contract assumptions are verified against ground truth: the factory and launchAndBuy router are Sourcify exact-matches on chain 4663, and every selector, tuple layout, event layout, and curve-math rule in this repo was cross-checked against that verified source.

Documentation

Smoke-test note: the PONS token

An obvious smoke check would use the PONS token (0x39dBED…4571) for the getLaunchedToken assertion (exists == true, phase == 2). Live chain state contradicts this: the v2 factory has no record of that token (getLaunchedToken → exists=false, and zero TokenLaunched/PoolGraduated events mention it across full chain history — it was presumably launched via an earlier factory). Following the "chain wins" rule, the smoke test probes the PONS address as a printed NOTE, and asserts the decode contract against a real graduated token taken from an actual PoolGraduated log (phase 2 PoolCreated, or 3 Rescued). The PONS address remains the default for pons_token_supply, which works (ERC-20 reads only).

Contracts: factory 0x7eD598BcEf8bd9Edd8C97A195C6d13f40801EC7e, launchAndBuy router 0xe33E9E479dF8802cb0866d5d05258bEc4cF62948, Uniswap v4 PoolManager 0x8366a39cc670b4001a1121b8f6a443a643e40951. Explorer: https://robinhoodchain.blockscout.com.

License

MIT