Loading…
Live cross-network DeFi API data and SDK docs for 17+ blockchain networks.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The builders-sodax-mcp-server MCP server exposes 40 tools, focused primarily on network capabilities. Its published description reads: "Live cross-network DeFi API data and SDK docs for 17+ blockchain networks". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates builders-sodax-mcp-server F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Data-exfiltration parameters" and "Data-exfiltration parameters". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check builders-sodax-mcp-server's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add builders-sodax-mcp-server to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://builders.sodax.com/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
List all blockchain networks supported by SODAX for cross-chain swaps and DeFi operations
Get available tokens for swapping on SODAX, optionally filtered by chain
Look up a specific transaction by its hash to see status, amounts, and details
Get intent/transaction history for a specific wallet address
Get solver volume data showing filled intents with filtering and pagination. Requires inputToken and outputToken. Optional filters: chain, solver, block range OR time range (don't mix both).
Get aggregate solver volume stats: the approximate total number of filled-intent records (fill documents, not distinct intents). Cached ~60s upstream.
Get current orderbook entries showing pending/open intents
List all assets available for lending and borrowing in the SODAX money market
Get a user's lending and borrowing position in the money market
List all SODAX integration partners including wallets, DEXs, and other protocols
Get SODA token supply information including total, circulating, and burned amounts
Get full SODAX configuration including all supported chains, swap tokens, and protocol settings in one call
Get mapping between chain IDs and intent relay chain IDs used by the SODAX relay network
Get detailed configuration for all spoke chains including contract addresses, RPCs, and token configs
Get assets representing spoke tokens on the hub (Sonic) chain, optionally filtered by source chain
Get tokens supported for money market lending/borrowing, optionally filtered by chain
Get money market reserve assets used as collateral backing
Get AMM liquidity provider NFT positions, optionally filtered by owner address
Get OHLCV candlestick chart data for an AMM pool
Look up a specific intent by its intent hash (different from transaction hash)
Get solver-side details for an intent including fill history. Use includeAll to see all solver documents.
Get detailed information for a specific money market asset by its reserve address
Get borrowers for a specific money market asset by its reserve address
Get suppliers (lenders) for a specific money market asset by its reserve address
Get all borrowers across all money market assets with pagination
Get volume and activity summary for a specific integration partner by their receiver address
Get SODA token total supply as a plain number
Get SODA token circulating supply as a plain number
Clear both the backend API cache and the solver oracle cache to force fresh fetches on next requests. Reports the number of entries cleared per cache.
Get the solver's oracle USD prices per (chain, token). For quoting with sodax_get_solver_quote, filter chainId='146': chainId-146 addresses pass the quote service's compatibility check, while spoke-ch
Get a swap quote from the SODAX solver. tokenSrc/tokenDst MUST be hub-chain (Sonic, chainId 146) asset addresses — look them up with sodax_get_solver_oracle (chainId='146'). Working example: tokenSrc=
Submit a confirmed spoke-chain transaction to the SODAX intent relay so it can be delivered to the destination chain. The tx must already be finalized on the source chain. Re-submitting the same tx is
List every cross-chain packet emitted by a given source transaction. Use this to track relay status — a packet is complete when status='executed' and dst_tx_hash is populated.
Fetch a single relay packet by its connection serial number (conn_sn). Returns the packet data on success or a `{success:false, message}` shape if the packet isn't found.
Check SDK documentation availability. Call this first if docs tools seem unavailable.
Reconnect to SDK documentation and refresh available tools. Use if docs seem stale or unavailable.
List all SDK documentation tools with parameters. Essential for discovering what's available.
[SDK Docs] Search across the documentation to find relevant information, code examples, API references, and guides. Use this tool when you need to answer questions about Docs, find specific documentat
[SDK Docs] Fetch the full markdown content of a specific documentation page from Docs. Use this when you have a page URL and want to read its content. Accepts full URLs (e.g. https://docs.sodax.com//g
[SDK Docs] Report an issue in the documentation of Docs so the team can fix it. Use it whenever, while helping a user, you come across content that is outdated, contradictory, missing information, or
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: sodax_get_volume
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
REQUIRED: Input token address"},"outputToken":{"type":"string","descrRecommendationRemove side-channel parameters; constrain tool inputs.
tool: sodax_get_solver_intent
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
including fill history. Use includeAll to see all solver documents. {"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: sodax_get_solver_intent
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: sodax_get_solver_oracle
A tool description tries to alter the model’s use of another tool.
or quoting with sodax_get_solver_quote, filter chainId='146': chainId-146 addresses paRecommendationDescriptions must describe only their own tool.
tool: sodax_get_solver_quote
A tool description tries to alter the model’s use of another tool.
ok them up with sodax_get_solver_oracle (chainId='146'). Working example: tokenSrc='0xeRecommendationDescriptions must describe only their own tool.
tool: docs_getPage
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: docs_sendFeedback
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ssue twice in a conversation. Do not use this tool to confirm that a page isRecommendationRemove side-channel parameters; constrain tool inputs.
tool: docs_sendFeedback
One tool reads private data, ingests untrusted content, AND can send data outbound — the three preconditions for autonomous data theft in a single call. A prompt injection reaching this tool can exfiltrate secrets with no further step.
exhaustively re-read the page. Send one call per distinct issue and do not reRecommendationSplit the capabilities across separate least-privilege tools so no single tool can read secrets, read untrusted input, and reach the network at once.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: sodax_get_supported_chains
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_get_swap_tokens
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_get_transaction
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_get_user_transactions
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_get_volume
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_get_volume_stats
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_get_orderbook
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_get_money_market_assets
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_get_user_position
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_get_partners
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_get_token_supply
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_get_all_config
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_get_relay_chain_id_map
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_get_all_chains_configs
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_get_hub_assets
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_get_money_market_tokens
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_get_money_market_reserve_assets
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_get_amm_positions
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_get_amm_pool_candles
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_get_intent
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_get_solver_intent
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_get_money_market_asset
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_get_asset_borrowers
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_get_asset_suppliers
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_get_all_borrowers
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_get_partner_summary
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_get_total_supply
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_get_circulating_supply
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_get_solver_oracle
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_get_solver_quote
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_relay_submit_tx
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_relay_get_transaction_packets
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sodax_relay_get_packet
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: docs_health
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: docs_list_tools
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: docs_searchDocumentation
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: docs_getPage
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: docs_getPage
The description pairs a fetch imperative with a hardcoded external URL, letting the server relocate its real instructions off-metadata and mutate them after review. Fires only when a fetch verb and a URL co-occur, so benign documentation links do not.
full URLs (e.g. https://docs.sodax.com//getting-started). Since `searchDocumentation` returns partial cRecommendationDo not direct the model to fetch and act on external URLs; treat linked content as untrusted.
tool: docs_sendFeedback
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.