tools.schemasevery tool has an object input schema
pass
tools.annotations2 of 2 tools declare readOnlyHint or destructiveHint
pass
tools.directory_hintsevery tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
pass
tools.token_costabout 456 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump
stability100 · weight 15
pass
stability.changes2 tool changes in 30 days
pass
stability.rug_pullno tool changed its meaning under the same name
dependencies17 · weight 15
fail
deps.known_vulns3 advisories to act on (malicious, or rated high or critical with a fix available): GHSA-cjq9-62q9-8jv4 in [email protected] (direct, fixed in 16.3.8), GHSA-wq5f-xc86-pv6w in [email protected] (indirect, fixed in 0.35.5), GHSA-68fv-2mgg-jv7q in [email protected] (indirect, fixed in 1.2.2); 5 more of lower severity or without a fix
fail
deps.mcp_sdk_version@modelcontextprotocol/sdk 1.30.1 has 1 known advisory (GHSA-6qxp-vccf-f47h); update @modelcontextprotocol/sdk to 1.31.0 or later
warn
deps.resolvablethe dependency graph of @agentwares/[email protected] resolved with errors, so advisories may be missing
2 tools, about 456 tokens to load them all · tool set 966ae70f43c1 · tools last changed 2026-10-09 · checked 2026-10-19 23:18 UTC
Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.
Dependencies
@agentwares/[email protected]npm154 dependencies, resolved with errors, so advisories may be missing · MCP SDK @modelcontextprotocol/sdk 1.30.1 · advisories checked 2026-10-19
advisory
severity
package
fixed in
GHSA-6qxp-vccf-f47hMCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0. The graph is what a clean install of this version resolves today; nothing was installed or run. How it is checked.
Free. Lists every issuer in the registry with symbol, issuer, attestation type, attestor, cadence, source_url and which months are parsed. Call it first to pick a symbol for stablecoin_reserves.
stablecoin_reservesdestructive
Latest parsed reserve attestation for one stablecoin issuer as JSON: as_of date, total reserves, composition by asset category, attestor, source_url, current on-chain supply (DefiLlama) and the reserve ratio. Use it when an agent needs machine-readable backing data instead of reading the issuer's PDF. Pass symbol (USDC, USDT, ...) or issuer; period=YYYY-MM selects an earlier month. Issuers without a third-party attestation return supply only with confidence 'none'. Paid: $0.02 per call; without credit you get a PAYMENT_REQUIRED result. Set sample=true for a free example response.