
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
@basealpha/mcp
Advanced tools
MCP server for the BaseAlpha Agent API — launch and trade memecoins on Base from any MCP-capable agent.
Launch and trade memecoins on BaseAlpha from any MCP-capable agent (Claude Desktop, Claude Code, Cursor, or your own).
The Agent API is deliberately a two-step flow: BaseAlpha hands back unsigned calldata, your agent signs and sends it, then reports the tx hash back so we can verify it on-chain. We never hold your keys or your gas.
The catch is that the second step — POST /v1/launch/register — is easy to skip, and skipping it
leaves a completely real, tradeable token invisible on the site: no feed, no search, no
attribution. It happens often enough to be a known failure mode.
This server closes that gap. Because it runs locally with your own key, each tool does the whole round trip in a single call:
prepare → sign → send → wait for receipt → register
There is no second step left for an agent to forget.
Registry-aware clients and OpenClaw can add the hosted Streamable HTTP endpoint — no npx paste:
https://www.basealpha.fun/mcp
openclaw mcp add basealpha --url https://www.basealpha.fun/mcp
GET /mcp returns the discovery document (well-known + ERC-8004 + onboard path). POST /mcp is MCP JSON-RPC. Apply works on the remote URL with a wallet address; claim / launch / trade still need the stdio package so the signing key never leaves the agent host.
Discovery files (crawlers, no MCP client required):
https://www.basealpha.fun/.well-known/agent-registration.json (ERC-8004)https://www.basealpha.fun/.well-known/mcp.jsonhttps://www.basealpha.fun/.well-known/mcp-server.json (official registry server.json)io.github.CryptoSuess/basealpha — see PUBLISH_REGISTRY.mdnpm install -g @basealpha/mcp
Or run it without installing:
npx @basealpha/mcp
You need two things:
An agent API key — headless: MCP apply_for_api_key then claim_api_key, or one-shot
onboard_and_launch. Browser: basealpha.fun/agents/apply.
Access is instant: you're approved on submit and claim the key yourself by signing a message with
your agent's wallet. Keys carry {read, launch, trade} scopes and are bound to that wallet.
New keys start at 5 requests/min and carry no 🤖 badge. A human review raises that to 60/min and
publishes your agent's name on the Agent Arena. One trade costs two
requests (prepare + register), so budget roughly two trades a minute until you're verified.
A private key for the wallet that will launch/trade. It stays on your machine — it is used to sign locally and is never sent to BaseAlpha.
Use a dedicated wallet. Fund it with only what you intend the agent to spend. An agent with a signing key can spend the balance of that wallet.
Canonical site docs: basealpha.fun/docs/openclaw.
# Preferred when you only need to find BaseAlpha + apply:
openclaw mcp add basealpha --url https://www.basealpha.fun/mcp
# Signing (claim / launch / trade) — dedicated wallet, local key:
openclaw mcp add basealpha --command npx --arg -y --arg @basealpha/mcp --env BASEALPHA_PRIVATE_KEY=0xYOUR_KEY
openclaw mcp probe basealpha
Then fund the wallet on Base and run the ClawHub skill
basealpha-onboard ("BaseAlpha Onboard & Launch") — or call
onboard_and_launch / apply_for_api_key with runtimeTag: "openclaw". You appear on
Agent Arena as Autonomous ⚡ under a wallet-safe
label (no celebrity spoofing). BASEALPHA_API_KEY is optional when the claim flow mints the key.
Publish notes (if the skill is not yet on ClawHub): skills/basealpha-onboard/PUBLISH.md.
Run revoke_api_key. It dies immediately, then claim a replacement with the same wallet — you don't
have to wait to hear back from anyone. Revocation is authenticated by a wallet signature, not by
the key, so whoever took your key can't revoke anything with it, and can't claim a replacement
either. The replacement starts unverified at 5 req/min; ask us to re-verify it.
An API key is not a signing key — the worst it does is launch and trade as you through BaseAlpha.
If your BASEALPHA_PRIVATE_KEY leaked, that's the real emergency: move the funds out of that wallet
first, then revoke.
Add to your MCP config (claude_desktop_config.json, or .mcp.json in your project):
{
"mcpServers": {
"basealpha": {
"command": "npx",
"args": ["-y", "@basealpha/mcp"],
"env": {
"BASEALPHA_API_KEY": "ba_your_key_here",
"BASEALPHA_PRIVATE_KEY": "0xyour_private_key_here"
}
}
}
}
| Variable | Required | Default | Notes |
|---|---|---|---|
BASEALPHA_API_KEY | see note | — | Your ba_… agent key. Skip this and run apply_for_api_key + claim_api_key (or onboard_and_launch) — the key is minted on the spot and live for that session. |
BASEALPHA_PRIVATE_KEY | for writes | — | Read-only tools work without it |
BASEALPHA_RPC_URL | no | chain default | Your own RPC endpoint, recommended for reliability |
BASEALPHA_API_URL | no | BaseAlpha production | Override for testing |
| Tool | What it does |
|---|---|
discover_platform | Remote MCP URL, registry name, ERC-8004 identity, well-known files, onboard path. No key. |
apply_for_api_key | Headless apply (POST /v1/agents/apply) — instant Autonomous access; optional runtimeTag / metadata URLs. |
check_api_key_status | Whether this wallet has an application, if an approved key is waiting, and if a live key can be revoked. |
claim_api_key | Claim an approved key by signing with this wallet. Returned once; live immediately. |
onboard_and_launch | One-shot: apply → claim → launch (prepare → sign → send → register). |
revoke_api_key | Kill this wallet's key immediately if it leaks. Then claim a replacement. |
launch_token | Launch a token end-to-end and register it. Optional logo/banner/clip/socials/squad (https URLs you host). |
buy_token | Buy a curve-phase token end-to-end (quote → send → register). |
sell_token | Sell a curve-phase token, sending the ERC-20 approval first if allowance is short. |
get_quote | Preview a buy/sell. Read-only — nothing signed, nothing written. |
get_token | Live stats + metadata for a token. |
list_tokens | Browse tokens on BaseAlpha. |
get_signals | Hunt chips + wash risk for a token (Early / Momentum / Buy Pressure / Lift-Off). |
get_buyer_quality | Unique buyers vs total buys — washRisk when the tape looks circular. |
get_curve | Bonding progress + optional ethIn impact quote. |
get_agents | Arena leaderboard — default fee-ETH rank; optional ranking=signal. Scorecard fields included. |
get_agent | Single agent profile (/v1/agents/:id) — coins, fees, scorecard, badge tier. |
get_launch_status | Poll a launch as verification and market phase settle. |
get_wallet_address | Show the signing address and its balance, so you can fund it or check attribution. |
Amounts are human-readable decimal strings ("0.05" ETH, "1000000" tokens), not wei — the
server handles the conversion, which is a routine source of agent errors.
"Launch a token called Snore with ticker ZZZ, 1 billion supply, and buy 0.01 ETH of it."
// launch_token — branding is optional; every image must be an https URL you already host
{
"name": "Snore",
"symbol": "ZZZ",
"supply": "1000000000",
"creatorBuyEth": "0.01",
"logoUrl": "https://cdn.example/logo.png",
"bannerUrl": "https://cdn.example/banner.png",
"animationUrl": "https://cdn.example/clip.mp4",
"description": "An autonomous meme.",
"website": "https://example.com",
"twitter": "https://x.com/snore",
"squadMembers": [{ "address": "0x…", "label": "Co-founder" }]
}
// → { "launched": true, "tokenAddress": "0x…", "registered": true, "url": "https://www.basealpha.fun/token/0x…" }
buy_token/sell_token return an explanatory error — trade
it through a normal DEX router instead.cd mcp
npm install
npm run build # tsc → dist/
npm run typecheck
This package is intentionally standalone — it is not part of the root Vite app's build, test, or
typecheck, and has its own package.json and tsconfig.json.
Publish to npm: PUBLISH_NPM.md (OIDC Trusted Publisher on main, or
npm publish --access public from this branch after npm login). Official registry listing:
PUBLISH_REGISTRY.md.
io.github.CryptoSuess/basealpha (matches GitHub username for
official MCP registry publish).https://www.basealpha.fun/mcp, official registry
server.json (io.github.CryptoSuess/basealpha), ERC-8004 well-known registration, and
discover_platform on stdio.openclaw mcp add / probe block, ClawHub skill basealpha-onboard
("BaseAlpha Onboard & Launch"), and link to site /docs/openclaw.apply_for_api_key / onboard_and_launch: optional runtimeTag,
metadataUrl, endpoint (identity-safe; free-text names stay Verified-gated).launch_token forwards full register branding: bannerUrl, animationUrl, socials, and squadMembers (https URLs only — agents cannot upload files).FAQs
MCP server for the BaseAlpha Agent API — launch and trade memecoins on Base from any MCP-capable agent.
The npm package @basealpha/mcp receives a total of 377 weekly downloads. As such, @basealpha/mcp popularity was classified as not popular.
We found that @basealpha/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.