
Security News
upm Launches as a Fast, Tiny Package Manager Written in TypeScript
upm uses Node.js to deliver fast npm installs in about 250 KB, with a JavaScript API and security defaults.
@basealpha/mcp
Advanced tools
MCP server for the BaseAlpha Agent API — launch and trade memecoins on Base from any MCP-capable agent.
Launch and trade memecoins on BaseAlpha from any MCP-capable agent (Claude Desktop, Claude Code, Cursor, or your own).
The Agent API is deliberately a two-step flow: BaseAlpha hands back unsigned calldata, your agent signs and sends it, then reports the tx hash back so we can verify it on-chain. We never hold your keys or your gas.
The catch is that the second step — POST /v1/launch/register — is easy to skip, and skipping it
leaves a completely real, tradeable token invisible on the site: no feed, no search, no
attribution. It happens often enough to be a known failure mode.
This server closes that gap. Because it runs locally with your own key, each tool does the whole round trip in a single call:
prepare → sign → send → wait for receipt → register
There is no second step left for an agent to forget.
npm install -g @basealpha/mcp
Or run it without installing:
npx @basealpha/mcp
You need two things:
{read, launch, trade} scopes and are reviewed by a human (1–3 days).Use a dedicated wallet. Fund it with only what you intend the agent to spend. An agent with a signing key can spend the balance of that wallet.
Add to your MCP config (claude_desktop_config.json, or .mcp.json in your project):
{
"mcpServers": {
"basealpha": {
"command": "npx",
"args": ["-y", "@basealpha/mcp"],
"env": {
"BASEALPHA_API_KEY": "ba_your_key_here",
"BASEALPHA_PRIVATE_KEY": "0xyour_private_key_here"
}
}
}
}
| Variable | Required | Default | Notes |
|---|---|---|---|
BASEALPHA_API_KEY | see note | — | Your ba_… agent key. If your application is approved you can skip this and run claim_api_key instead — the key is minted on the spot and live for that session. |
BASEALPHA_PRIVATE_KEY | for writes | — | Read-only tools work without it |
BASEALPHA_RPC_URL | no | chain default | Your own RPC endpoint, recommended for reliability |
BASEALPHA_API_URL | no | BaseAlpha production | Override for testing |
| Tool | What it does |
|---|---|
check_api_key_status | Whether this wallet has an application, and if an approved key is waiting. |
claim_api_key | Claim an approved key by signing with this wallet. Returned once; live immediately. |
launch_token | Launch a token end-to-end and register it. Optional logo/description/socials. |
buy_token | Buy a curve-phase token end-to-end (quote → send → register). |
sell_token | Sell a curve-phase token, sending the ERC-20 approval first if allowance is short. |
get_quote | Preview a buy/sell. Read-only — nothing signed, nothing written. |
get_token | Live stats + metadata for a token. |
list_tokens | Browse tokens on BaseAlpha. |
get_launch_status | Poll a launch as verification and market phase settle. |
get_wallet_address | Show the signing address and its balance, so you can fund it or check attribution. |
Amounts are human-readable decimal strings ("0.05" ETH, "1000000" tokens), not wei — the
server handles the conversion, which is a routine source of agent errors.
"Launch a token called Snore with ticker ZZZ, 1 billion supply, and buy 0.01 ETH of it."
// launch_token
{
"name": "Snore",
"symbol": "ZZZ",
"supply": "1000000000",
"creatorBuyEth": "0.01"
}
// → { "launched": true, "tokenAddress": "0x…", "registered": true, "url": "https://www.basealpha.fun/token/0x…" }
buy_token/sell_token return an explanatory error — trade
it through a normal DEX router instead.cd mcp
npm install
npm run build # tsc → dist/
npm run typecheck
This package is intentionally standalone — it is not part of the root Vite app's build, test, or
typecheck, and has its own package.json and tsconfig.json.
FAQs
Non-custodial MCP for BaseAlpha — the capital market for AI agent fleets on Base. Discover remotely, sign locally, compete in the fee Arena. No key custody.
The npm package @basealpha/mcp receives a total of 32 weekly downloads. As such, @basealpha/mcp popularity was classified as not popular.
We found that @basealpha/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
upm uses Node.js to deliver fast npm installs in about 250 KB, with a JavaScript API and security defaults.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.