vaultpilot-mcp

Fetch all Aave V3 lending/borrowing positions for a wallet. Returns collateral, debt (both in USD and per-asset), health factor, LTV, and liquidation threshold across Ethereum and Arbitrum.

Fetch all Uniswap V3 liquidity-provider positions for a wallet. Returns token pair, current token amounts, fee tier, in-range status, uncollected fees (lower bound), and an approximate impermanent-loss estimate.

Check for Aave V3 lending positions approaching liquidation. Returns positions whose health factor is below the given threshold (default 1.5).

Simulate the effect of adding or removing collateral, or borrowing/repaying debt on an Aave V3 position. Returns the projected health factor and collateral/debt totals. No transaction is sent.

Check Etherscan verification status, EIP-1967 proxy pattern, implementation/admin slots, and the presence of dangerous admin functions (mint, pause, upgradeTo, etc.) for a given contract.

Enumerate privileged roles on a contract (Ownable.owner, AccessControl hints) and classify holders as EOA, Gnosis Safe multisig, or TimelockController.

Return a 0-100 risk score for a DeFi protocol, combining TVL size, 30-day TVL trend, contract age, audit count (DefiLlama), and Immunefi bug-bounty status. Higher = safer.

Fetch Lido (stETH/wstETH) and EigenLayer staking positions for a wallet across supported chains. Returns per-protocol staked amounts, USD value, APR, and EigenLayer delegation target.

Estimate staking rewards earned over a given period (7d/30d/90d/1y) using the current APR as a proxy. This is an estimate, not an on-chain rewards query.

Project annual yield on a hypothetical staking amount for Lido or EigenLayer using current APRs. Use this for 'what would I earn if I staked X ETH?' questions before the user commits capital. Returns the protocol, input amount, APR used, and projected annual rewards denominated in the same asset. Purely forward-looking — does NOT read any wallet or on-chain position; pair with get_staking_positions for actual holdings.

One-shot cross-chain portfolio aggregation for one or more wallets. Fans out across Ethereum/Arbitrum/Polygon/Base (unless chains narrows it) and assembles: native ETH/MATIC balances, top ERC-20 holdings, Aave V3 and Compound V3 lending positions, Uniswap V3 LP positions, and Lido/EigenLayer staking — each valued in USD via DefiLlama. Pass tronAddress (base58, prefix T) alongside a single wallet to fold TRX + TRC-20 balances plus TRON staking into the same totals; breakdown.tron holds the TRON slice, tronUsd the subtotal, and tronStakingUsd the staking portion. Returns a totalUsd, a breakdown by category and by chain, and the raw per-protocol position arrays. Default tool for 'what's in my portfolio?' / 'total value' questions; prefer it over calling each per-protocol reader separately.

Get a LiFi aggregator quote for a token swap (same-chain) or bridge (cross-chain). Returns expected output, fees, execution time, and the underlying tool selected. No transaction is built.

Prepare an unsigned swap or bridge transaction via LiFi aggregator. Same-chain swaps use the best DEX route; cross-chain swaps use a bridge + DEX combo. The returned tx can be sent via send_transaction.

Initiate a WalletConnect v2 pairing session with Ledger Live. Returns a URI and ASCII QR code — paste into Ledger Live's WalletConnect screen to complete pairing. The session persists for future transactions. EVM chains only; for TRON use pair_ledger_tron instead.

Pair the host's directly-connected Ledger device for TRON signing. REQUIREMENTS: Ledger plugged into the machine running this MCP (USB, not WalletConnect), device unlocked, and the 'Tron' app open on-screen. Ledger Live's WalletConnect relay does not currently honor the tron: CAIP namespace, so TRON signing goes over USB HID via @ledgerhq/hw-app-trx. Reads the device address at m/44'/195'/'/0/0 (default accountIndex=0) and caches it so get_ledger_status can report it. Call multiple times with different accountIndex values (0, 1, 2, …) to pair additional TRON accounts — each call adds to the cache; subsequent calls for the same index refresh in place. Call this once per session (per account) before calling any prepare_tron_* tool or send_transaction with a TRON handle. If the TRON app isn't open, or the device is locked, returns an actionable error describing what to fix.

Report whether a WalletConnect session with Ledger Live is active (EVM chains) AND whether any TRON Ledger pairings are cached (USB HID — see pair_ledger_tron). Returns accounts: 0x…[] — the list of EVM wallet addresses the user has connected — and optionally tron: [{ address, path, appVersion, accountIndex }, …] (one entry per paired TRON account, ordered by accountIndex) if pair_ledger_tron has been run at least once. Call this FIRST whenever the user refers to their wallet(s) by position or nickname instead of by address — e.g. "my wallet", "my TRON wallet", "the first address", "account 2", "second wallet", "second TRON account" — so you can resolve the reference to a concrete 0x… / T… before invoking any prepare_* / swap / send / portfolio tool that takes a wallet / tronAddress argument. Do NOT ask the user to paste an address if it's already in accounts or a tron[*].address here. SECURITY: the returned wallet/peerUrl (EVM) are self-reported by the paired WC app. Before the FIRST send_transaction of a session, state the paired wallet name + URL back to the user and ask them to confirm it matches their Ledger Live install — any WalletConnect peer can claim to be 'Ledger Live'. The physical Ledger device's on-screen confirmation is the final check. The tron array is read from the cache populated by pair_ledger_tron; send_transaction re-probes USB on every TRON sign, so the cache cannot be spoofed into approving a tx for the wrong account.

Build an unsigned Aave V3 supply transaction. If an ERC-20 approve() is required first, it is returned as the outer tx and the supply tx is embedded in .next. Both must be signed for the supply to succeed.

Build an unsigned Aave V3 withdraw transaction. Pass amount: "max" to withdraw the entire aToken balance.

Build an unsigned Aave V3 borrow transaction (variable rate — stable rate is deprecated and reverts on production markets). The borrower must already have sufficient collateral supplied.

Build an unsigned Aave V3 repay transaction. If an ERC-20 approve() is required first, it is returned as the outer tx and repay is in .next. Pass amount: "max" to repay the full debt.

Build an unsigned Lido stake transaction (wraps ETH into stETH via stETH.submit). The tx's value field is the ETH amount to stake.

Build an unsigned Lido withdrawal request transaction. Wraps requestWithdrawals on the Lido Withdrawal Queue and includes an approve step if needed.

Build an unsigned EigenLayer StrategyManager.depositIntoStrategy transaction. Includes an ERC-20 approve step if needed.

Forward an already-prepared transaction to the Ledger device for user signing. Routes on the handle's origin: EVM handles (prepare_aave_, prepare_compound_, prepare_swap, prepare_native_send, ...) go through Ledger Live via WalletConnect; TRON handles (prepare_tron_*) go through the directly-connected Ledger over USB HID and are broadcast via TronGrid. In both cases the user must review and physically approve the tx on the Ledger screen; this call blocks until the user signs or rejects. You MUST pass confirmed: true — the agent is affirming that the user has seen and acknowledged the decoded preview. For TRON handles, pair_ledger_tron must have been called at least once per session (so the TRON app has been opened on the device) and the Ledger must still be plugged in with the TRON app open at send time.

Poll a transaction's status via the chain's RPC. Returns pending / success / failed, or unknown if the node hasn't seen it yet.

Run an eth_call against the chain's RPC to simulate a transaction without signing or broadcasting it. Returns { ok, returnData?, revertReason? }. Use this BEFORE prepare_*/send_transaction to verify a contract call does what you expect — e.g. does wrapping ETH by sending to WETH9's fallback succeed, does a custom calldata revert, what selector gets hit. For state-dependent calls (WETH deposit credits msg.sender, ERC-20 transfer debits msg.sender), pass the user's wallet as from. Prepared transactions are also re-simulated automatically at send_transaction time — this tool lets the agent check ahead. NEVER call this on a tx that depends on an approval you just submitted but haven't yet waited on: the approval must be included on-chain (poll get_transaction_status until confirmed) before the dependent tx will simulate correctly — otherwise you get a misleading 'insufficient allowance' revert.

Fetch a wallet's balance of any ERC-20 token or the chain's native coin. Pass token: "native" for ETH (or chain-native asset) or an ERC-20 contract address. Returns amount, decimals, symbol, and USD value. For TRON, pass chain: "tron" with a base58 wallet (prefix T) and either token: "native" for TRX or a base58 TRC-20 address; returns a TronBalance (same fields, base58 token id).

Fetch the USD price of a token via DefiLlama. Pass token: "native" for the chain's native asset (ETH on ethereum/arbitrum, MATIC on polygon) or an ERC-20 contract address. Prefer this over get_swap_quote for pure price lookups — no wallet or liquidity simulation needed.

Resolve an ENS name (e.g. vitalik.eth) to an Ethereum address via mainnet ENS resolver. Returns null if unregistered.

Reverse-resolve an Ethereum address to its primary ENS name. Returns null if no primary name is set.

Read TRON staking state for a base58 address: claimable voting rewards (WithdrawBalance-ready), frozen TRX under Stake 2.0 (bandwidth + energy), and pending unfreezes with their unlock timestamps. Returns raw SUN + formatted TRX + USD values, plus a totalStakedUsd rollup. Read-only; pair with prepare_tron_claim_rewards to actually withdraw the accumulated reward.

Build an unsigned TRON native TRX send transaction via TronGrid's /wallet/createtransaction. Returns a human-readable preview + opaque handle. Forward the handle via send_transaction to sign on the directly-connected Ledger (USB HID via @ledgerhq/hw-app-trx) and broadcast to TronGrid. Run pair_ledger_tron once per session first so the TRON app is open and the device address is verified.

Build an unsigned TRC-20 transfer transaction (canonical set only: USDT, USDC, USDD, TUSD) via TronGrid's /wallet/triggersmartcontract. Decimals are resolved from the canonical table — unknown TRC-20s are rejected with an explicit error. Default fee_limit is 100 TRX (TronLink/Ledger Live default); override with feeLimitTrx if energy pricing has moved. Returns a preview + opaque handle. Forward via send_transaction for USB-HID signing on the paired Ledger. USDT renders natively on the TRON app; other TRC-20s may display raw hex on-device (the contract address and amount are still shown, so the user can verify against the preview).

Build an unsigned TRON WithdrawBalance transaction that claims accumulated voting rewards to the owner's balance. TRON enforces a 24-hour cooldown between claims — TronGrid will reject (surfaced as an error) if the previous claim was inside the window. Pair with get_tron_staking first to read claimableRewards and avoid empty-claim tx builds. Returns a preview + opaque handle; forward via send_transaction for USB-HID signing on the paired Ledger.

Build an unsigned TRON Stake 2.0 FreezeBalanceV2 transaction. Locks TRX to earn bandwidth (fuels plain transfers) or energy (fuels smart-contract calls) and gains proportional voting power. IMPORTANT: freezing alone does NOT accrue TRX rewards — claimableRewards (see get_tron_staking) only grows after the user also votes for a Super Representative. Pair this tool with list_tron_witnesses + prepare_tron_vote for the full reward-earning flow. Unlocking requires a 14-day cooldown via prepare_tron_unfreeze + prepare_tron_withdraw_expire_unfreeze. Returns a preview + opaque handle; forward via send_transaction for USB-HID signing on the paired Ledger.

Build an unsigned TRON Stake 2.0 UnfreezeBalanceV2 transaction — begins the 14-day cooldown on a previously-frozen slice. The amount must not exceed what's currently frozen for that resource (query get_tron_staking first; TronGrid rejects otherwise with 'less than frozen balance'). After 14 days the slice shows up in pendingUnfreezes with an elapsed unlockAt; call prepare_tron_withdraw_expire_unfreeze to sweep it back to liquid TRX. Returns a preview + opaque handle; forward via send_transaction for USB-HID signing on the paired Ledger.

Build an unsigned TRON WithdrawExpireUnfreeze transaction — sweeps every matured unfreeze slice (those whose 14-day cooldown elapsed) back to liquid TRX. No amount needed; the chain drains all eligible slices in one call. Inspect pendingUnfreezes from get_tron_staking first — if every entry's unlockAt is still in the future, TronGrid returns 'no expire unfreeze' and this tool errors. Returns a preview + opaque handle; forward via send_transaction for USB-HID signing on the paired Ledger.

List TRON Super Representatives (SRs) + SR candidates, ranked by total vote count. Active SRs (rank ≤ 27, isActive: true) produce blocks and distribute the 160 TRX/block voter-reward pool pro-rata to their voters; every witness in the top 127 shares the same APR estimate (pro-rata split of the pool); witnesses ranked > 127 get estVoterApr: 0. APR estimates assume current mainnet constants (3-second blocks, 27 active SRs, 365 days/year) and are best-effort — actual rewards depend on missed blocks and competing voters shifting between your vote tx and reward claim. When address is passed, also returns userVotes, totalTronPower, totalVotesCast, and availableVotes so you can diff against a target allocation before calling prepare_tron_vote. Defaults to top-27 only; pass includeCandidates: true for the long tail.

Build an unsigned TRON VoteWitnessContract transaction — casts votes for Super Representatives to earn voting rewards on frozen TRX. IMPORTANT: VoteWitness REPLACES the wallet's entire prior vote allocation atomically. Pass every SR you intend to back (not just a delta); an empty votes array clears all votes. Sum of count values must not exceed the wallet's available TRON Power — check list_tron_witnesses(address) → availableVotes first. count is an integer (1 vote = 1 TRX of TRON Power). Rewards accrue per block and are harvested via prepare_tron_claim_rewards (24h cooldown). Returns a preview + opaque handle; forward via send_transaction for USB-HID signing on the paired Ledger.

Build an unsigned native-coin send transaction (ETH on Ethereum/Arbitrum). Pass a human-readable amount like "0.5".

Build an unsigned ERC-20 transfer transaction. Pass amount: "max" to send the full balance (resolved at build time).

Fetch Compound V3 (Comet) positions for a wallet across all known markets on the selected chains (cUSDCv3, cUSDTv3, cWETHv3, etc.). For each market the wallet touches, returns the base-token supply or borrow balance, per-asset collateral deposits, and USD valuations. Use this to answer 'my Compound positions' or before preparing a prepare_compound_* action so you have the right market address. Returns an empty list if the wallet has no Compound V3 exposure on the requested chains.

Build an unsigned Compound V3 supply transaction (base token or collateral). If an ERC-20 approve() is required first, it is returned as the outer tx with supply in .next.

Build an unsigned Compound V3 withdraw transaction. Pass amount: "max" to withdraw the full supplied balance.

Build an unsigned Compound V3 borrow transaction. Compound V3 encodes a borrow as withdraw(baseToken) drawn beyond the wallet's supplied balance — the base token is resolved on-chain from the Comet market so you only pass the market address and amount. Requires the wallet to have already supplied enough collateral in that market; get_compound_positions shows the current collateral mix. Returns a handle + human-readable preview for the user to sign on Ledger; no approval step is needed (borrowing doesn't pull tokens from the wallet).

Build an unsigned Compound V3 repay transaction — encoded as supply(baseToken) against an outstanding borrow. Includes an approve step if needed. Pass amount: "max" for a full repay.

Fetch Morpho Blue positions for a wallet. If marketIds is omitted, the server auto-discovers the wallet's markets by scanning Morpho Blue event logs (may take several seconds on a cold call). Pass explicit marketIds (bytes32 each, keccak256 of MarketParams) as a fast path. Returns per-market supplied/borrowed assets and collateral.

Build an unsigned Morpho Blue supply transaction — deposits the market's loan token to earn lending yield. Market params (loan/collateral tokens, oracle, IRM, LLTV) are resolved on-chain from the market id, so only wallet/marketId/amount are required. If the wallet's current allowance is insufficient, an ERC-20 approve tx is emitted first (chainable via .next); control the cap with approvalCap (defaults to unlimited for UX, pass 'exact' or a decimal ceiling to scope it). Returns a handle + preview for Ledger signing.

Build an unsigned Morpho Blue withdraw transaction (withdraws supplied loan token). Explicit amount only — "max" is not supported; query your position first.

Build an unsigned Morpho Blue borrow transaction. Requires pre-existing collateral in the market.

Build an unsigned Morpho Blue repay transaction. Includes an approve step if needed. Explicit amount only — "max" is not supported.

Build an unsigned Morpho Blue supplyCollateral transaction — adds collateral to a market. Includes an approve step if needed.

Build an unsigned Morpho Blue withdrawCollateral transaction — removes collateral from a market to send back to the wallet. Only withdraws the exact amount specified; "max" is NOT supported because Morpho's isolated-market accounting doesn't expose a clean max-safe value without simulating against the market's oracle/LLTV (query get_morpho_positions first to know your deposited collateral). Will revert on-chain if the withdrawal would push the position below the liquidation threshold. No approval step needed. Returns a handle + preview for Ledger signing.

File a capability request against the vaultpilot-mcp GitHub repository when the user asks for something this server cannot do (e.g. an unsupported protocol, chain, token, or missing tool). USE ONLY AFTER confirming no existing tool can accomplish the task. By default this returns a pre-filled GitHub issue URL — NO data is transmitted; the user must click through to submit. If the operator has configured VAULTPILOT_FEEDBACK_ENDPOINT, it posts directly to that proxy instead. Rate-limited per install (30s between calls, 3/hour, 10/day, 7-day dedupe on identical summaries). Write clear, actionable summaries — this lands in a real issue tracker read by humans.