Stacks AI MCP Server (Stack-AI-MCP/stacks-mcp-server) is an MCP server listed on the M8ven Trust Index. It scores 46 out of 100, grade D. It declares 200 tools. No publisher has claimed this listing.

Back to MCP Trust IndexM8ven
D
Caution
46/100

Stacks AI MCP Server

A comprehensive MCP server providing unified access to over 144 tools for lending, trading, and staking across six major DeFi protocols on the Stacks Bitcoin Layer 2. It enables AI agents to perform complex blockchain operations and interact with the DeFi ecosystem using natural language commands.

→ Stack-AI-MCP/stacks-mcp-server· listed on glama

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

Stack-AI-MCP

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Known vulnerabilities in dependencies: 1 critical, 14 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 5 credentials: BITFLOW_API_KEY, HIRO_API_KEY, KEEPER_API_KEY, READONLY_CALL_API_KEY, WALLET_PRIVATE_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes200 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

alex_get_all_swaps

Get all available swap pairs with current volumes and prices in USD

alex_get_trading_pairs

Get all active trading pairs on ALEX AMM

alex_get_all_tickers

Get market statistics for all trading pairs (24h data)

alex_get_ticker

Get market statistics for specific trading pair

alex_get_historical_swaps

Get historical trades for specific pool token

alex_get_token_price

Get current price of a specific token

alex_get_token_price_history

Get historical price data for a token

alex_get_token_price_15min

Get 15-minute interval price history for a token

alex_get_all_token_prices

Get current prices for all tokens on ALEX

alex_get_pool_token_price

Get current price of a pool token

alex_get_all_pool_stats

Get statistics for all pool tokens

alex_get_pool_stats

Get detailed statistics for a specific pool including volume, fees, liquidity and APR

alex_get_pool_volume_24h

Get 24-hour pool volume history

alex_get_pool_volume_7d

Get 7-day pool volume history

alex_get_pool_liquidity

Get liquidity history for a specific pool

alex_get_pool_fees

Get fee rebate history for a specific pool

alex_get_all_pools

Get information about all pools on ALEX

alex_get_amm_pool_stats

Get AMM pool statistics including TVL and APY

alex_get_total_tvl

Get total value locked across all ALEX pools

alex_get_token_tvl

Get TVL time series for a specific token

alex_get_token_total_supply

Get total supply for a specific token

alex_get_circulating_supply

Get circulating supply of ALEX governance token

alex_get_token_mappings

Get token mappings (wrapped token relationships)

alex_get_contract_addresses

Get all ALEX contract addresses for current network

alex_get_contract_address

Get specific ALEX contract address

alex_get_flash_loan_contract_info

Get information about ALEX flash loan contract and requirements

alex_prepare_flash_loan_contract_call

Prepare flash loan contract call with requirements and estimated fees

alex_execute_swap

Execute 1-hop token swap on ALEX AMM via swap-helper

alex_execute_swap_2hop

Execute 2-hop token swap via swap-helper-a (token-x/token-y -> token-y/token-z)

alex_execute_swap_3hop

Execute 3-hop token swap via swap-helper-b (X->Y->Z->W)

alex_execute_swap_4hop

Execute 4-hop token swap via swap-helper-c (X->Y->Z->W->V)

arkadiko_create_vault

Create new Arkadiko vault for minting USDA stablecoin

arkadiko_update_vault

Update existing Arkadiko vault by adjusting collateral or debt

arkadiko_close_vault

Close Arkadiko vault and repay all debt

arkadiko_get_vault_info

Get detailed information about an Arkadiko vault

arkadiko_liquidate_vault

Liquidate under-collateralized Arkadiko vault

arkadiko_create_swap_pair

Create new liquidity pair on Arkadiko DEX

arkadiko_add_liquidity

Add liquidity to existing Arkadiko swap pair

arkadiko_swap_tokens

Swap tokens on Arkadiko DEX

arkadiko_get_swap_pair

Get detailed information about Arkadiko swap pair

arkadiko_get_swap_fees

Get trading fees for Arkadiko swap pair

arkadiko_create_proposal

Create new Arkadiko governance proposal

arkadiko_vote_on_proposal

Vote on Arkadiko governance proposal

arkadiko_get_proposal

Get detailed information about Arkadiko governance proposal

arkadiko_stake_diko

Stake DIKO tokens to earn rewards and voting power

arkadiko_unstake_diko

Unstake DIKO tokens

arkadiko_claim_staking_rewards

Claim pending staking rewards

arkadiko_get_stake_info

Get staking information for address

arkadiko_get_token_balance

Get token balance for address

arkadiko_get_token_total_supply

Get total supply of Arkadiko token

arkadiko_burn_usda

Burn USDA tokens to reduce total supply

arkadiko_get_token_price

Get token price from Arkadiko oracle

arkadiko_get_network_info

Get Arkadiko network configuration and contract addresses

arkadiko_complete_cdp_workflow

Complete CDP workflow: Create vault, mint USDA, and manage position

arkadiko_complete_liquidity_workflow

Complete liquidity provision workflow: Create pair and add liquidity

arkadiko_complete_governance_workflow

Complete governance workflow: Stake DIKO, create proposal, and vote

arkadiko_get_user_portfolio

Get complete user portfolio across all Arkadiko features

arkadiko_calculate_vault_health

Calculate vault health metrics and liquidation risks

arkadiko_optimize_vault_position

Get recommendations for optimizing vault position

bitflow_get_available_tokens

Get all available tokens on Bitflow using official SDK

bitflow_get_possible_swaps

Get all possible swap options for a given token using official SDK

bitflow_get_all_possible_token_y

Get all possible destination tokens for swapping using official SDK

bitflow_get_all_possible_token_y_routes

Get all possible routes between two tokens using official SDK

bitflow_get_quote_for_route

Get price quote for token swap using official SDK

bitflow_get_swap_params

Get swap parameters for transaction execution using official SDK

bitflow_prepare_swap_execution

Prepare swap execution with all parameters (requires StacksProvider for actual execution)

bitflow_get_or_create_keeper_contract

Get or create keeper contract for automated trading using official SDK

bitflow_create_keeper_order

Create keeper order for automated execution using official SDK

bitflow_get_keeper_order

Get keeper order details by ID using official SDK

bitflow_get_keeper_user

Get user information with keeper contracts and orders using official SDK

bitflow_get_keeper_quote

Get quote for keeper action using official SDK

bitflow_create_group_order

Create group order for scheduled execution using official SDK

bitflow_get_group_order

Get group order details by ID using official SDK

bitflow_cancel_keeper_order

Cancel keeper order using official SDK

bitflow_cancel_group_order

Cancel group order using official SDK

bitflow_get_keeper_tokens

Get available tokens for keeper operations using official SDK

bitflow_get_keeper_possible_swaps

Get possible keeper swaps for a token using official SDK

bitflow_get_all_keeper_possible_token_y

Get all possible keeper token Y options using official SDK

bitflow_get_all_keeper_possible_token_y_routes

Get all possible keeper token Y routes using official SDK

bitflow_get_keeper_quote_for_route

Get keeper quote for route using official SDK

bitflow_get_network_info

Get network configuration and SDK information

bitflow_get_token_formats

Get supported token formats and examples for SDK usage

bitflow_get_contract_addresses

Get all Bitflow contract addresses for current network

bitflow_get_stableswap_pools

Get all StableSwap pool contract addresses

bitflow_get_xyk_pools

Get all XYK pool contract addresses

bitflow_execute_btc_to_sbtc_keeper_order

Execute complete BTC to sBTC swap using Keeper system

bitflow_execute_token_swap_with_keeper

Execute token swap using Keeper system for automated execution

bitflow_setup_dca_orders

Setup Dollar Cost Averaging (DCA) orders using group orders

get_block_by_hash

Get block information by block hash

get_block_by_height

Get block information by block height

get_recent_blocks

Get list of recent blocks

get_block_transactions

Get transactions in a specific block

get_network_info

Get current network information and status

get_current_block_height

Get the current blockchain height

get_burn_block_info

Get information about burn blocks (Bitcoin blocks)

get_microblocks

Get microblocks for a specific block

charisma_get_quote

Get optimal swap quote via Charisma vault routing

charisma_list_orders

List all limit orders, optionally filtered by owner

charisma_get_order

Get detailed information about specific order

charisma_create_order

Create new limit or triggered order

100 further tools are not listed here. The complete surface is in the source.

// known CVEs in dependencies1 critical14 high5 medium11 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalvitest@3.2.4GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

high@modelcontextprotocol/sdk@1.19.1GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.19.1GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.19.1GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highaxios@1.12.2GHSA-35jp-ww65-95wh

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configBITFLOW_API_HOST
🔐 secretBITFLOW_API_KEYNo BitFlow protocol API key (contact BitFlow team)
configBITFLOW_PROVIDER_ADDRESS
configDISABLE_TELEMETRYDisable telemetry (true/false)
🔐 secretHIRO_API_KEY"": "your_hiro_api_key"
configKEEPER_API_HOST
🔐 secretKEEPER_API_KEY
configLOG_LEVELLogging level (info, debug, error)
configMCP_SERVER_HOSTServer host for HTTP mode (default: localhost)
configMCP_SERVER_PORTServer port for HTTP mode (default: 3000)
configREADONLY_CALL_API_HOST
🔐 secretREADONLY_CALL_API_KEY
configSTACKS_DEFAULT_NETWORK
configSTACKS_DEVNET_API_URLCustom devnet API endpoint
configSTACKS_EXPLORER_MAINNET_URL
configSTACKS_EXPLORER_TESTNET_URL
configSTACKS_MAINNET_API_URL"": "https://api.hiro.so",
configSTACKS_NETWORK"": "testnet",
configSTACKS_TESTNET_API_URL"": "https://api.testnet.hiro.so",
configTEST_ENV
configWALLET_MNEMONICEither Stacks wallet mnemonic phrase (12 or 24 words)
🔐 secretWALLET_PRIVATE_KEY"": "0x1234...",
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

200/200 tools missing one or more hints — alex_get_all_swaps (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); alex_get_trading_pairs (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); alex_get_all_tickers (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +197 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

License file

No license file

Add a LICENSE file (MIT, Apache-2.0, etc.).

Tool test coverage

Only 0/200 tools referenced in tests (0%)

Write tests that reference each tool by name so every tool has at least one test.

Secrets not logged

6 secret values sent to console.log

Redact or omit secret values from log output.

Production dependencies are patched

0 critical, 14 high severity in production deps — @modelcontextprotocol/sdk@1.19.1 (high), @modelcontextprotocol/sdk@1.19.1 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Dev dependencies

1 critical/high in dev-only deps (does not ship to users)

Upgrade dev dependencies when convenient.

Dependency freshness

1/18 production deps stale: reflect-metadata@2024-03-29 (2.4y)

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/stack-ai-mcp/stacks-mcp-server?variant=verified)](https://m8ven.ai/mcp/stack-ai-mcp/stacks-mcp-server)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 10b51f21fbf8b744253fc44d70fd86aa2213fe0c
code hash: 1a20625cc3e0026ad060d85a70e998d4eb5b3b2cb34241cbf018307d30391866
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client