# MERX - TRON Resource Exchange

> TRON energy exchange for AI agents. 54 tools, 30 prompts, 21 resources. A2A + ACP.

- name: exchange.merx/mcp
- version: 1.0.5
- connection class: R0 (autonomous)
- trust: 82/100
- quality: 63/100 (needs work)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/exchange.merx%2Fmcp
- tools: https://api.protogrid.dev/v1/servers/exchange.merx%2Fmcp/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "merx": {
      "type": "http",
      "url": "https://merx.exchange/mcp/sse"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 100
- freshness: 45
- provenance: 75
- drivers: +repository +dns-namespace +reachable +uptime-100% -stale-201d
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 63/100 (needs work)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2024-11-05; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 79 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 60 of 66 tools declare readOnlyHint or destructiveHint
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: read_contract (openWorldHint); create_account (openWorldHint); list_standing_orders (openWorldHint); …
- warn `tools.token_cost`: about 9,198 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 25 (weight 15)

- warn `stability.changes`: 13 tool changes in 30 days
- fail `stability.rug_pull`: 5 tools kept their name but changed most of their description in 30 days; review before trusting them

### dependencies: 50 (weight 15)

- fail `deps.known_vulns`: 7 advisories to act on (malicious, or rated high or critical with a fix available): GHSA-3pq3-5fj3-cg6v in axios@1.18.0 (indirect, fixed in 1.20.0), GHSA-542g-h47m-68v8 in axios@1.18.0 (indirect, fixed in 1.20.0), GHSA-c29m-xwm3-cm6r in axios@1.18.0 (indirect, fixed in 1.20.0), ...; 5 more of lower severity or without a fix
- n/a `deps.mcp_sdk_version`: the official MCP SDK is not in the dependency graph
- pass `deps.resolvable`: merx-mcp@1.0.5 resolved: 52 packages

- tools: 66, about 9,198 tokens to load them all
- tool set hash: 2067856f8b4dfb61e6b9e5bb4fa05b2b
- tools last changed: 2026-10-20T10:56:32.851Z
- badge: [![protogrid quality](https://protogrid.dev/badge/exchange.merx/mcp.svg)](https://protogrid.dev/servers/exchange.merx/mcp)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-20 `create_order` changed (description)
  - before: Buy energy or bandwidth at the Merx market quote, fulfilled by PowerSun. Confirmed Merx funds and API key required; no commission.
  - after: Buy energy or bandwidth at the Merx market quote. Confirmed Merx funds and API key required; no commission.
- 2026-10-16 `create_paid_order` changed (description, inputSchema) **meaning changed**
  - before: Create a zero-registration order via x402 pay-per-use. Requires TRON_PRIVATE_KEY.
  - after: Unavailable legacy resource-invoice order. No transaction is sent. Fund your personal Merx account and use quoted resource orders instead.
- 2026-10-16 `pay_invoice` changed (description, inputSchema) **meaning changed**
  - before: Pay an x402 invoice by signing and broadcasting a TRX transfer to the invoice address, then verifying the payment with the facilitator. x402 (Coinbase + Cloudflare HTTP 402 standard) is the protocol AI agents use to pay APIs per call. Use this when you receive an invoice_id from a paywalled service or another agent. REQUIRES: TRON_PRIVATE_KEY in env (use set_private_key first) AND a valid invoice_id from create_invoice or x402 challenge response. The transfer is signed locally — your private key never leaves the MCP process.
  - after: Unavailable legacy resource-invoice payment. No transaction is sent. Fund your personal Merx account and use quoted resource orders instead.
- 2026-10-16 `enable_auto_deposit` changed (description)
  - before: Configure automatic top-up when balance drops below a threshold. The configuration lives ONLY in the current MCP session — it is held in memory by the MCP server process and is lost on server restart, MCP client reconnect, or server redeploy. Top-ups are signed locally with TRON_PRIVATE_KEY and sent to your Merx deposit address (memo-routed). For persistent auto-deposit you currently need to call this tool again at the start of each session.
  - after: Configure automatic top-up when balance drops below a threshold. The configuration lives ONLY in the current MCP session — it is held in memory by the MCP server process and is lost on server restart, MCP client reconnect, or server redeploy. Top-ups are signed locally with TRON_PRIVATE_KEY and sent as plain TRX transfers to your personal Merx deposit address, without a memo. For persistent auto-deposit you currently need to call this tool again at the start of each session.
- 2026-10-16 `deposit_trx` changed (description) **meaning changed**
  - before: Deposit TRX to your Merx account. Requires MERX_API_KEY + TRON_PRIVATE_KEY.
  - after: Send a plain TRX transfer to your personal Merx deposit address. No memo is required. Broadcast acceptance does not mean the deposit is credited. Requires MERX_API_KEY + TRON_PRIVATE_KEY.
- 2026-10-16 `get_deposit_info` changed (description) **meaning changed**
  - before: Get your Merx deposit address and memo. Requires MERX_API_KEY.
  - after: Get your personal TRON address for TRX deposits. No memo is required. Requires MERX_API_KEY.
- 2026-10-02 `execute_swap` changed (inputSchema)
- 2026-10-02 `call_contract` changed (inputSchema)
- 2026-10-02 `approve_trc20` changed (inputSchema)
- 2026-10-02 `transfer_trc20` changed (inputSchema)

Full history: https://api.protogrid.dev/v1/servers/exchange.merx%2Fmcp/changes

## Dependencies

- npm merx-mcp@1.0.5: resolved, 51 dependencies
  - GHSA-3pq3-5fj3-cg6v (high) in `` axios@1.18.0 ``, indirect, fixed in `` 1.20.0 ``, advisory summary: "Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls" https://osv.dev/vulnerability/GHSA-3pq3-5fj3-cg6v
  - GHSA-542g-h47m-68v8 (high) in `` axios@1.18.0 ``, indirect, fixed in `` 1.20.0 ``, advisory summary: "Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization" https://osv.dev/vulnerability/GHSA-542g-h47m-68v8
  - GHSA-c29m-xwm3-cm6r (high) in `` axios@1.18.0 ``, indirect, fixed in `` 1.20.0 ``, advisory summary: "Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)" https://osv.dev/vulnerability/GHSA-c29m-xwm3-cm6r
  - GHSA-m8m8-qj5v-23w3 (high) in `` axios@1.18.0 ``, indirect, fixed in `` 1.20.0 ``, advisory summary: "Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection" https://osv.dev/vulnerability/GHSA-m8m8-qj5v-23w3
  - GHSA-mghh-pgcx-3jjj (high) in `` axios@1.18.0 ``, indirect, fixed in `` 1.20.0 ``, advisory summary: "Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location" https://osv.dev/vulnerability/GHSA-mghh-pgcx-3jjj
  - GHSA-r4gj-5m52-g5wh (high) in `` axios@1.18.0 ``, indirect, fixed in `` 1.20.0 ``, advisory summary: "Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF" https://osv.dev/vulnerability/GHSA-r4gj-5m52-g5wh
  - GHSA-x97p-jq2g-jp4f (high) in `` axios@1.18.0 ``, indirect, fixed in `` 1.20.0 ``, advisory summary: "Axios: Prototype Pollution Gadget in axios toFormData Options" https://osv.dev/vulnerability/GHSA-x97p-jq2g-jp4f
  - GHSA-44g4-m2mj-wpvx (moderate) in `` axios@1.18.0 ``, indirect, fixed in `` 1.20.0 ``, advisory summary: "Axios: CIDR-form NO\_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges" https://osv.dev/vulnerability/GHSA-44g4-m2mj-wpvx
  - GHSA-4hqw-qxg8-jxx2 (moderate) in `` axios@1.18.0 ``, indirect, fixed in `` 1.20.0 ``, advisory summary: "Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders" https://osv.dev/vulnerability/GHSA-4hqw-qxg8-jxx2
  - GHSA-9fr6-4gfg-395g (moderate) in `` axios@1.18.0 ``, indirect, fixed in `` 1.20.0 ``, advisory summary: "Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method" https://osv.dev/vulnerability/GHSA-9fr6-4gfg-395g
  - GHSA-j8rh-479h-cp32 (moderate) in `` axios@1.18.0 ``, indirect, fixed in `` 1.20.0 ``, advisory summary: "Axios: Header Injection via Inherited headers After Minimal Interceptor" https://osv.dev/vulnerability/GHSA-j8rh-479h-cp32
  - GHSA-vh66-26gq-q6x8 (moderate) in `` axios@1.18.0 ``, indirect, fixed in `` 1.20.0 ``, advisory summary: "Axios: Prototype pollution gadget in fetch adapter can alter outbound requests" https://osv.dev/vulnerability/GHSA-vh66-26gq-q6x8

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

- https://merx.exchange/mcp/sse (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

- npm merx-mcp@1.0.5 secrets: MERX_API_KEY, TRON_PRIVATE_KEY

## Tools (66)

- `agent_status`: Get a snapshot of your agent payment service: registered TRON address, count of pending payment requests (request_payment), active address watches (watch_address), and outstanding invoices (create_invoice). Use this right after register_agent to confirm the agent is set up, or any time you want to see how much in-flight activity your agent has. Auth required (API key) and agent must be registered first via register_agent.
- `analyze_prices`: Market price analysis with trends and recommendations. No auth required.
- `approve_trc20`: Approve TRC-20 spending allowance. Signs and broadcasts on-chain. Requires TRON_PRIVATE_KEY.
- `calculate_savings`: Calculate savings from renting energy vs burning TRX. No authentication required.
- `call_contract`: Execute a state-changing smart contract function. Estimates resources, buys via Merx if needed. Requires TRON_PRIVATE_KEY and TRON_ADDRESS.
- `cancel_monitor`: Cancel an active monitor by its UUID. The monitor stops firing notifications. Auth required (API key).
- `cancel_standing_order`: Cancel a standing order by its UUID. The order is moved to CANCELLED status and will not trigger again. Already-executed actions are NOT reversed. Auth required (API key).
- `check_address_resources`: Check energy, bandwidth, and TRX balance for any TRON address. No auth required.
- `compare_providers`: Side-by-side provider comparison with prices and availability. No auth required.
- `compile_policy`: Convert a natural language energy management policy into MERX automation. Creates standing orders and monitors based on your instructions.

Examples:
- "Keep 500k energy on my wallet, buy when price is below 55 SUN, max 200 TRX/week"
- "Buy energy every day at 6 AM UTC, 1 million units, for 24 hours"
- "Alert me when my energy drops below 100k"

Returns a preview of what will be created. Set apply=true to execute.
- `convert_address`: Convert TRON address between base58 (T...) and hex (41...) formats. No auth required.
- `create_account`: Create a new Merx account, generate an API key, and get deposit info. No auth needed.
- `create_invoice`: Create an invoice for another agent or human to pay. Returns payment URL, address, and QR code. Payment is detected automatically via ZeroMQ (<3 seconds).
- `create_monitor`: Create a persistent server-side monitor that fires notifications when a condition is met. Four monitor types: delegation_expiry (warns when leased energy is about to expire so you can re-rent), balance_threshold (fires when an address goes below a TRX/USDT level), price_alert (fires when energy/bandwidth price crosses a SUN threshold), address_activity (fires on any incoming TX). Notification defaults to webhook=true if omitted. Auth required (API key).
- `create_order`: Buy energy or bandwidth at the Merx market quote. Confirmed Merx funds and API key required; no commission.
- `create_paid_order`: Unavailable legacy resource-invoice order. No transaction is sent. Fund your personal Merx account and use quoted resource orders instead.
- `create_standing_order`: Create a server-side standing order with trigger-based automation. Auth required.
- `deposit_trx`: Send a plain TRX transfer to your personal Merx deposit address. No memo is required. Broadcast acceptance does not mean the deposit is credited. Requires MERX_API_KEY + TRON_PRIVATE_KEY.
- `enable_auto_deposit`: Configure automatic top-up when balance drops below a threshold. The configuration lives ONLY in the current MCP session — it is held in memory by the MCP server process and is lost on server restart, MCP client reconnect, or server redeploy. Top-ups are signed locally with TRON_PRIVATE_KEY and sent as plain TRX transfers to your personal Merx deposit address, without a memo. For persistent auto-deposit you currently need to call this tool again at the start of each session.
- `ensure_resources`: Declarative resource provisioning. Checks current resources on target address and purchases only what is missing. Auth required.
- `estimate_contract_call`: Estimate energy and bandwidth cost for a smart contract call. Compares rental vs burn cost. No auth required.
- `estimate_transaction_cost`: Estimate cost of a TRON transaction BEFORE sending. Aliases: estimate_cost, calculate_cost, transaction_cost, energy_cost, transfer_cost. Calculate exactly how much energy, bandwidth, and TRX a TRON transaction will cost before sending it. Use this to answer questions like "how much does a USDT transfer cost?" or "what will it cost me to send 100 USDT to address X?". Returns: energy units needed, bandwidth needed, TRX cost if you burn directly, and TRX cost if you rent energy from Merx (typically 70-80% cheaper). Supports trc20_transfer (e.g. USDT/USDC), trc20_approve, trx_transfer, and custom contract calls. No auth required.
- `execute_intent`: Plan a multi-step operation (transfer, swap, buy resources, etc) and return a cost estimate, total energy/bandwidth needed, and the cheapest resource acquisition strategy. NOTE: actual on-chain execution of multi-step intents is not yet wired up — currently returns the same plan as simulate, regardless of dry_run. Use this for planning; for real execution call the underlying tools (create_order, transfer_trc20, execute_swap) yourself in sequence. Auth required.
- `execute_swap`: Execute a token swap on SunSwap V2. Requires TRON_PRIVATE_KEY.
- `explain_concept`: Explain a TRON or Merx concept in plain language. Hardcoded topics (exact match): energy, bandwidth, staking, delegation, sun_units, burn_vs_rent, merx_routing, provider_types. The lookup is fuzzy — substring matches also work, so "rent" finds "burn_vs_rent" and "providers" finds "provider_types". For topics outside this list (e.g. x402, stablecoins, gasfree), pick the closest hardcoded topic, or just answer the question yourself from the broader context — this tool only returns canned explanations of TRON resource economics.
- `get_account_info`: Inspect any TRON address. Aliases: check_address, get_address_info, get_wallet_info, address_info, account_status. Read the full on-chain state of ANY TRON address (does not have to be your own): TRX balance, free + delegated energy, free + delegated bandwidth, frozen TRX, account creation timestamp. Use this to check if an address has enough resources before sending a transaction, or to inspect any TRON wallet. No auth required, no API key needed.
- `get_balance`: Get your Merx account balance (TRX, USDT, locked). Requires MERX_API_KEY.
- `get_best_price`: Quick lookup of the single cheapest provider for a resource type, with optional minimum amount filter. CAVEAT: this returns a single representative price per provider, not broken down by duration tier — short rentals (5min) and long rentals (30 days) have very different per-unit prices and this tool does not distinguish between them. For an accurate per-tier comparison, use get_prices(duration=N) where N is the exact rental duration in seconds (e.g. 3600 for 1h, 86400 for 1d, 2592000 for 30d). Use get_best_price only when you need the absolute floor price as a quick sanity-check. No auth required.
- `get_block`: Get TRON block info by number (or latest if omitted). No auth required.
- `get_chain_parameters`: Get TRON network parameters (energy fee, bandwidth cost, etc.) with Merx price comparison. No auth required.
- `get_contract_info`: Get on-chain metadata for a TRON smart contract: existence check, owner address, energy origin, code hash, contract name (if set), ABI entries count. Use this to check whether an address is a contract before calling read_contract or estimate_contract_call. For TRC20-specific metadata (name, symbol, decimals, totalSupply) use get_token_info instead. No auth required.
- `get_deposit_info`: Get your personal TRON address for TRX deposits. No memo is required. Requires MERX_API_KEY.
- `get_order`: Get order status by UUID. Aliases: get_order_status, check_order, order_status, order_details, fetch_order. Check the status and fill details of an existing order by its UUID. Returns current status (PENDING/FILLING/FILLED/PARTIAL/FAILED/CANCELLED), fill amounts, provider used, on-chain delegation tx hash if delivered. Use this to poll order progress after creating an order. Auth required (API key).
- `get_price_history`: Historical price snapshots. No auth required.
- `get_prices`: Get current energy and bandwidth prices from all Merx providers, sorted by best (minimum) price across all duration tiers. Each provider lists ALL its duration tiers (5min/1h/1d/7d/30d etc) — short rentals are usually more expensive per unit than long ones, so always check tier-by-tier. Optionally filter by exact duration in seconds. No auth required.
- `get_standing_order`: Get full details of a single standing order by its UUID. Returns trigger config, action params, budget, executions count, and status. Auth required (API key).
- `get_swap_quote`: Get a real swap quote from SunSwap V2. No auth required.
- `get_token_info`: Get TRC-20 token metadata: name, symbol, decimals, total supply. No auth required.
- `get_token_price`: Get token price via SunSwap quote + CoinGecko USD rate. No auth required.
- `get_transaction`: Look up a transaction by ID on TRON. No auth required.
- `get_transaction_history`: Get your Merx account transaction history. Requires MERX_API_KEY.
- `get_trc20_balance`: Get TRC-20 token balance for an address. Supports symbol (USDT, USDC) or contract address. No auth required.
- `get_trx_balance`: Quick TRX balance for a TRON address. No auth required.
- `get_trx_price`: Get current TRX price from CoinGecko. No auth required.
- `list_monitors`: List all monitors you created with create_monitor, optionally filtered by status (ACTIVE/CANCELLED). Each row shows the full monitor UUID (pass to cancel_monitor), monitor type, target address, and status. Note: the Target column will be empty for monitor types that do not have a single watched address — specifically price_alert and balance_threshold (when watching the API key holder rather than a third-party address). For delegation_expiry and address_activity monitors, Target will always be set. Auth required (API key).
- `list_orders`: List recent orders with optional status filter. Auth required.
- `list_providers`: List all Merx providers with types, durations, and availability. No authentication required.
- `list_standing_orders`: List all standing orders with optional status filter. Auth required.
- `login`: Log in to an existing Merx account. No MERX_API_KEY needed.
- `lookup_invoice`: Look up a MERX invoice. Shows amount, recipient, token, and status. Agent must sign and broadcast the transfer separately (non-custodial).
- `pay_invoice`: Unavailable legacy resource-invoice payment. No transaction is sent. Fund your personal Merx account and use quoted resource orders instead.
- `read_contract`: Call a view/pure function on a TRON smart contract. No auth or private key required.
- `register_agent`: Register your TRON address as an agent on agent.merx.exchange. Required ONCE before using request_payment, create_invoice, watch_address, agent_status, or any other agent payment tool. Pass the TRON address you want to use as the on-chain identity for this API key. Idempotent — calling twice with the same key returns the existing registration. Auth required (API key).
- `request_payment`: Create a TRC20 payment request on TRON (USDT, USDC, USDD, or any TRC20). Returns a payment address. Fires webhook when payment arrives (<3 seconds). Use for receiving payments from other agents or humans. Requires agent registration first — call register_agent if you get AGENT_NOT_REGISTERED error.
- `resource_broadcast`: Broadcast a signed TRON transaction with automatic energy optimization.
If the target address lacks sufficient energy, MERX purchases the deficit at the best
market price before broadcasting. One call: estimate, buy energy, wait for delegation, broadcast.

Requires MERX_API_KEY with the "broadcast" scope, and a pre-signed transaction.
Returns txid on success, refunds on timeout.

NOTE: This endpoint is currently behind a feature flag and disabled by default in production.
If you get a 503 MAINTENANCE error, use the manual flow instead: call ensure_resources to
provision energy, then sign and broadcast the transaction with your own TronWeb client.
- `search_transaction_history`: Get on-chain transaction history for a TRON address. No auth required.
- `set_api_key`: Set your Merx API key for this session. Unlocks all authenticated tools (trading, balance, orders). Use this if you already have an API key.
- `set_private_key`: Set your TRON private key for this session. Address is derived automatically. Enables write tools: transfer_trx, transfer_trc20, approve_trc20, execute_swap, deposit_trx. Key stays local - never sent to Merx servers.
- `simulate`: Dry-run a multi-step operation (transfer, swap, buy resources, etc) without sending anything on-chain. Returns per-step energy and bandwidth estimates plus a total TRX cost. Use this to preview a plan before committing — for example, before transferring USDT to multiple recipients you can simulate to see the total energy cost. No auth required.
- `suggest_duration`: Recommend a rental duration based on your use case. No authentication required.
- `transfer_trc20`: Transfer TRC-20 tokens with automatic energy optimization. Signs and broadcasts on-chain. Requires TRON_PRIVATE_KEY.
- `transfer_trx`: Send TRX to an address. Checks bandwidth, buys via Merx if needed. Signs and broadcasts on-chain. Requires TRON_PRIVATE_KEY.
- `validate_address`: Validate a TRON address format and check on-chain status. No auth required.
- `wait_for_delegation`: Block until an order reaches a terminal state (FILLED, PARTIAL, FAILED, or CANCELLED) by polling get_order at fixed intervals. Use this right after create_order when you need to confirm the energy/bandwidth has actually been delegated on-chain before sending the next transaction. Returns the final order details including the on-chain delegation tx hash. Auth required.
- `watch_address`: Watch any TRON address for TRC20 transfers (USDT, USDC, USDD, or any token). Fires webhook on each matching transfer. Persistent - runs 24/7 even when conversation ends.
- `withdraw`: Withdraw TRX or USDT from your Merx account to an external TRON address. The "amount" parameter is interpreted in the currency specified by "currency" — i.e. for currency=TRX it is TRX units, for currency=USDT it is USDT units. (The legacy parameter "amount_trx" is still accepted as an alias for backwards compatibility, but is misleading when currency is USDT — prefer "amount" in new code.) Requires MERX_API_KEY.