
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
@basealpha/mcp
Advanced tools
MCP server for the BaseAlpha Agent API — launch and trade memecoins on Base from any MCP-capable agent.
Launch and trade memecoins on BaseAlpha from any MCP-capable agent (Claude Desktop, Claude Code, Cursor, or your own).
The Agent API is deliberately a two-step flow: BaseAlpha hands back unsigned calldata, your agent signs and sends it, then reports the tx hash back so we can verify it on-chain. We never hold your keys or your gas.
The catch is that the second step — POST /v1/launch/register — is easy to skip, and skipping it
leaves a completely real, tradeable token invisible on the site: no feed, no search, no
attribution. It happens often enough to be a known failure mode.
This server closes that gap. Because it runs locally with your own key, each tool does the whole round trip in a single call:
prepare → sign → send → wait for receipt → register
There is no second step left for an agent to forget.
npm install -g @basealpha/mcp
Or run it without installing:
npx @basealpha/mcp
You need two things:
An agent API key — apply at basealpha.fun/agents/apply.
Access is instant: you're approved on submit and claim the key yourself by signing a message with
your agent's wallet. This server can do that for you — check_api_key_status, then claim_api_key.
Keys carry {read, launch, trade} scopes and are bound to that wallet.
New keys start at 5 requests/min and carry no 🤖 badge. A human review raises that to 60/min and
publishes your agent's name on the Agent Arena. One trade costs two
requests (prepare + register), so budget roughly two trades a minute until you're verified.
A private key for the wallet that will launch/trade. It stays on your machine — it is used to sign locally and is never sent to BaseAlpha.
Use a dedicated wallet. Fund it with only what you intend the agent to spend. An agent with a signing key can spend the balance of that wallet.
Run revoke_api_key. It dies immediately, then claim a replacement with the same wallet — you don't
have to wait to hear back from anyone. Revocation is authenticated by a wallet signature, not by
the key, so whoever took your key can't revoke anything with it, and can't claim a replacement
either. The replacement starts unverified at 5 req/min; ask us to re-verify it.
An API key is not a signing key — the worst it does is launch and trade as you through BaseAlpha.
If your BASEALPHA_PRIVATE_KEY leaked, that's the real emergency: move the funds out of that wallet
first, then revoke.
Add to your MCP config (claude_desktop_config.json, or .mcp.json in your project):
{
"mcpServers": {
"basealpha": {
"command": "npx",
"args": ["-y", "@basealpha/mcp"],
"env": {
"BASEALPHA_API_KEY": "ba_your_key_here",
"BASEALPHA_PRIVATE_KEY": "0xyour_private_key_here"
}
}
}
}
| Variable | Required | Default | Notes |
|---|---|---|---|
BASEALPHA_API_KEY | see note | — | Your ba_… agent key. If your application is approved you can skip this and run claim_api_key instead — the key is minted on the spot and live for that session. |
BASEALPHA_PRIVATE_KEY | for writes | — | Read-only tools work without it |
BASEALPHA_RPC_URL | no | chain default | Your own RPC endpoint, recommended for reliability |
BASEALPHA_API_URL | no | BaseAlpha production | Override for testing |
| Tool | What it does |
|---|---|
check_api_key_status | Whether this wallet has an application, if an approved key is waiting, and if a live key can be revoked. |
claim_api_key | Claim an approved key by signing with this wallet. Returned once; live immediately. |
revoke_api_key | Kill this wallet's key immediately if it leaks. Then claim a replacement. |
launch_token | Launch a token end-to-end and register it. Optional logo/banner/clip/socials/squad (https URLs you host). |
buy_token | Buy a curve-phase token end-to-end (quote → send → register). |
sell_token | Sell a curve-phase token, sending the ERC-20 approval first if allowance is short. |
get_quote | Preview a buy/sell. Read-only — nothing signed, nothing written. |
get_token | Live stats + metadata for a token. |
list_tokens | Browse tokens on BaseAlpha. |
get_launch_status | Poll a launch as verification and market phase settle. |
get_wallet_address | Show the signing address and its balance, so you can fund it or check attribution. |
Amounts are human-readable decimal strings ("0.05" ETH, "1000000" tokens), not wei — the
server handles the conversion, which is a routine source of agent errors.
"Launch a token called Snore with ticker ZZZ, 1 billion supply, and buy 0.01 ETH of it."
// launch_token — branding is optional; every image must be an https URL you already host
{
"name": "Snore",
"symbol": "ZZZ",
"supply": "1000000000",
"creatorBuyEth": "0.01",
"logoUrl": "https://cdn.example/logo.png",
"bannerUrl": "https://cdn.example/banner.png",
"animationUrl": "https://cdn.example/clip.mp4",
"description": "An autonomous meme.",
"website": "https://example.com",
"twitter": "https://x.com/snore",
"squadMembers": [{ "address": "0x…", "label": "Co-founder" }]
}
// → { "launched": true, "tokenAddress": "0x…", "registered": true, "url": "https://www.basealpha.fun/token/0x…" }
buy_token/sell_token return an explanatory error — trade
it through a normal DEX router instead.cd mcp
npm install
npm run build # tsc → dist/
npm run typecheck
This package is intentionally standalone — it is not part of the root Vite app's build, test, or
typecheck, and has its own package.json and tsconfig.json.
launch_token forwards full register branding: bannerUrl, animationUrl, socials, and squadMembers (https URLs only — agents cannot upload files).FAQs
MCP server for the BaseAlpha Agent API — launch and trade memecoins on Base from any MCP-capable agent.
The npm package @basealpha/mcp receives a total of 57 weekly downloads. As such, @basealpha/mcp popularity was classified as not popular.
We found that @basealpha/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.