
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@agentutility/mcp-bestiary
Advanced tools
MCP server for the @agentutility bestiary cluster — pay-per-call x402 tools, no API keys, USDC on Base.
A creature compendium for every world.
Creatures from myth, folklore, novels, films, games, and song. Pull a creature's lore, stat it for the table, run a head-to-head matchup, identify one from a description, or render its portrait — any being, any universe.
Pricing: pay-per-call in USDC on Base. No subscriptions, no API keys. See per-tool prices below.
Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"agentutility-bestiary": {
"command": "npx",
"args": ["-y", "@agentutility/mcp-bestiary"],
"env": { "X402_PRIVATE_KEY": "0xYOUR_PRIVATE_KEY_HEX" }
}
}
}
Restart Claude Desktop. 6 tools appear in the tool palette.
Add to .cursor/mcp.json:
{
"mcpServers": {
"agentutility-bestiary": {
"command": "npx",
"args": ["-y", "@agentutility/mcp-bestiary"],
"env": { "X402_PRIVATE_KEY": "0x..." }
}
}
}
Send any amount of USDC on Base mainnet to the address derived from your X402_PRIVATE_KEY. The MCP server uses it to pay for tool calls automatically.
USDC on Base contract: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913
| Tool | Description |
|---|---|
bestiary-random | (0.01 USDC/call) Returns a random creature with a short encyclopedia entry and a fun fact. Optionally pick from a category (mythology, folklore, cryptid, literature, film, game, religion, sci-fi). Each call varies. For prompts, content feeds, and inspiration. Use it as a random creature API, monster of the day, or random mythical creature generator. |
creature-compare | (0.01 USDC/call) Compares any two creatures head-to-head and reasons out who would win. Weighs strengths and weaknesses of creatures from any source and returns a reasoned verdict with confidence and caveats. For agents, trivia, game shows, and content. Use it as a creature comparison API, who-would-win monster matchup, or versus analysis tool. |
creature-identify | (0.01 USDC/call) Identifies a creature from a description, set of clues, or half-remembered details. Returns ranked candidate creatures with each one's source and why it matches. For agents, trivia, and search. Use it as a creature identifier API or name-that-monster tool. |
creature-image | (0.08 USDC/call) Renders any creature as an image and returns a hosted PNG URL. Name a creature from myth, folklore, a novel, a film, a game, or your own description, and pick an art style (fantasy-art, realistic, anime, oil-painting, ink-sketch, watercolor, pixel-art, comic-book). Pairs with the bestiary lookups: read the lore or stat block, then picture the monster. Text-to-image via Venice, output hosted on fal. Use it as a creature image generator API, monster art source, or fantasy creature image maker. |
creature-lore | (0.01 USDC/call) An encyclopedia of creatures, monsters, spirits, and beings from any world or source. Covers world mythology and folklore, religion, cryptozoology, novels, films, games, comics, and song. Given a creature name (and optional source to disambiguate), returns a structured encyclopedia entry: origin, category, physical description, abilities, weaknesses, behavior, habitat, cultural significance, notable appearances, and a danger level. Reference and commentary in the model's own words. Use it as a creature lore API, monster encyclopedia, or mythical creature database. |
creature-statblock | (0.01 USDC/call) Turns any creature from any world, book, film, game, myth, or song into an original, playable 5e-style stat block. Returns AC, HP, ability scores, challenge rating, traits, and actions as original game statistics (not a copied published block). Optionally target a challenge rating. Bridges the bestiary and rollforge clusters. Use it as a creature stat block generator API or a source of homebrew monster stats for any being. |
bestiary-random).https://x402.agentutility.ai/bestiary-random.X402_PRIVATE_KEY and retries.The agent never sees the payment flow — it just gets the result.
Version: 0.1.2 · License: MIT
FAQs
MCP server for the @agentutility bestiary cluster — pay-per-call x402 tools, no API keys, USDC on Base.
We found that @agentutility/mcp-bestiary demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.