ada-agent-wallet (loveaihq/ada-agent-wallet) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 8 tools. No publisher has claimed this listing.

Emerging

74/100

ada-agent-wallet

Item: ada-agent-wallet
Rating: 74
Author: M8ven

Policy-gated Cardano wallet for AI agents: spend caps, payee allowlist, human approval, and a hash-chained audit log — enforced in a separate daemon that holds the key. MCP tool for paying x402 endpoints on Cardano.

→ loveaihq/ada-agent-wallet · listed on github_repo_search

Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

loveaihq

Source: github_repo_search

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

GitHub

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

🚨

Secret credentials may flow to a network call

25 flows detected: SIGNERD_TOKEN, KOIOS_TOKEN. We can’t prove the destination matches the brand the credential belongs to.

🔐

You'll be asked for 2 credentials: KOIOS_TOKEN, SIGNERD_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes8 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

ping

Free. Says the server is up.

quote

A price quote. Costs 1.5 tADA.

report

A full report. Costs 4 tADA.

premium

Premium data. Costs 6 tADA.

wallet_status

Wallet address, per-agent remaining budget (rolling 24h), pending approvals.

x402_fetch

Fetch a URL that may require x402 payment on Cardano. If it returns 402, the wallet pays within policy and retries. Always give a concrete reason — it goes in the audit log.

x402_mcp_tools

List the tools a remote MCP server offers, and what each one charges. Free: this asks, it does not buy.

x402_mcp_call

Call a tool on a remote MCP server that may charge for it. If it asks for payment, the wallet pays within policy and retries. Always give a concrete reason — it goes in the audit log.

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configAGENT_ID

configAGENT_TOKENS_FILEnpm run identity: with , an agent cannot sign as another or read another's

configALLOW_UNVERIFIED_AUDIT1 is the way past a refused startup when the audit log was rotated on

configAPPROVALS_PORT

configASSETS_PORT

configAUDIT_FILEpurpose; it waives the check, not the ledger. LEDGER_FILE and say where both live.

configBLOCKFROST_PROJECT_IDare not yours to fix and that the error does not explain. Set before

configBUYER_ADDRESS

configCARDANO_NETWORK

configFACILITATOR_PORT

configFACILITATOR_TIMEOUT_MS

configFACILITATOR_URL

configIDENTITY_PORT

configINTEGRITY_PORT

configKOIOS_BASE_URL

🔐 secretKOIOS_TOKEN

configL1_CONFIRMATIONSBLOCKFROST_PROJECT_ID (or ) to ask for more.

configLEDGER_FILEpurpose; it waives the check, not the ledger. and AUDIT_FILE say where both live.

configMASUMI_MAX_COLLATERAL_LOVELACE

configMCP_RESOURCE_PORT

configMCP_RESOURCE_URL

configNONCE_HOLD_SECONDSThe in-flight hold is not what keeps an agent inside its cap; the ledger is.

configPOLICY_FILE

configPROVIDER_TIMEOUT_MS

configRACE_CONCURRENCY

configRACE_PORT

configRESOURCE_PORT

configRESOURCE_URL

configSELLER_ADDRESS

configSIGNERD_PORT

🔐 secretSIGNERD_TOKEN

configSIGNERD_URL

configWALLET_KEYSTORE_FILEwritten. Point signerd at it with , then delete the plaintext mnemonic — once

configWALLET_MNEMONIC

configWALLET_MNEMONIC_FILE

configWALLET_PASSPHRASE_FILEThe passphrase comes from , or a terminal prompt when there is one.

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

8/8 tools missing one or more hints — ping (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); quote (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); report (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +5 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool test coverage

3/8 tools referenced in tests (38%)

Write tests that reference each tool by name so every tool has at least one test.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/loveaihq/ada-agent-wallet)](https://m8ven.ai/mcp/loveaihq/ada-agent-wallet)

Shows your grade and updates automatically. Prefer no grade? Append ?variant=verified to the badge URL.

commit: 7a8589376bcda10293307ba319233375018db5b2

code hash: 8d428dd41a7130fa1c9c20e616956072c5032a4656855fdc3b0cec45606c35be

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client