
Research
/Security News
737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection
The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.
@bolthub/mcp
Advanced tools
The bolthub MCP server — the whole marketplace, specific L402 gateways, and your other MCP servers behind one config entry with one shared Lightning budget
The bolthub MCP server. One entry in your MCP client config; behind it, three kinds of tool source sharing one wallet and one Lightning budget:
search_apis, get_api_details, preview_cost, call_api, buy_bundle, mint_scoped_token, revoke_token, plus the Node Launcher tools).Replaces @bolthub/mcp-registry and @bolthub/mcp-bridge (both deprecated — migration below).
Source: signaltech-org/bolthub-sdk · Docs: docs.bolthub.ai
Add to your MCP client config (Cursor, Claude Desktop, OpenClaw, etc.):
{
"mcpServers": {
"bolthub": {
"command": "npx",
"args": ["-y", "@bolthub/mcp"],
"env": { "NWC_URI": "<your-nwc-connection-string>" }
}
}
}
With no config file this runs in marketplace mode: every listed bolthub API is available to your agent through the meta-tools. New listings appear automatically; no config changes, ever.
~/.bolthub/mcp.json — the mcpServers block is the exact shape your MCP client already uses, so paste your existing entries in wholesale:
{
"marketplace": true,
"gateways": ["https://btc-intel.gw.bolthub.ai"],
"mcpServers": {
"filesystem": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-filesystem", "/Users/me/notes"]
},
"remote-tools": {
"url": "https://tools.example.com/mcp",
"headers": { "Authorization": "Bearer …" }
}
},
"budget": { "sat": 10000 }, // lifetime ceiling for this run, ALL sources combined
"maxPerCall": { "sat": 500 }, // per-call ceiling
"namespace": "prefix", // "prefix" (default) or "flat"
"telemetry": false // reserved; v1 sends nothing anywhere
}
Then point the client at it:
{
"mcpServers": {
"bolthub": {
"command": "npx",
"args": ["-y", "@bolthub/mcp", "--config", "~/.bolthub/mcp.json"],
"env": { "LND_REST_HOST": "…", "LND_MACAROON": "…" }
}
}
}
search_apis, get_api_details, preview_cost, call_api, buy_bundle, mint_scoped_token, revoke_token, deploy_node, node_status.btc-intel__get_v1_history_candles, ….filesystem__read_file, ….Two servers can both expose a search tool — prefixing keeps them apart. namespace: "flat" passes bare names through instead and fails at startup on any collision (a tool is never silently shadowed).
Set ONE of these in the server's env:
LND_REST_HOST + LND_MACAROON (recommended, fastest <200ms)
NWC_URI (easiest setup, slower 1-3s)
LNBITS_URL + LNBITS_ADMIN_KEY (alternative, <300ms)
PHOENIXD_URL + PHOENIXD_PASSWORD (alternative, <200ms)
No wallet is not an error: free tools and marketplace search keep working; paid calls return their payment challenge with a setup hint.
budget.sat caps what the server can spend over its lifetime — across gateway calls, call_api, and paid downstream MCP tools combined. Reservations are synchronous, so concurrent calls on different sources can't jointly overspend. budget.sat: 0 is valid and means "free tools only". The agent can never lift the ceiling; refusals come back as clean "Payment refused" results.
Every payment logs one line to stderr (your local audit trail). The telemetry flag is reserved: v1 sends nothing anywhere, on or off; if a future version adds an opt-in ingest it will carry { scheme, asset, amount } only — no tool arguments, no resource identity.
| Before | After |
|---|---|
npx @bolthub/mcp-registry | npx @bolthub/mcp (zero config = same behavior) |
npx @bolthub/mcp-registry --api-url <url> | npx @bolthub/mcp --api-url <url> |
npx @bolthub/mcp-bridge --gateway <url> | npx @bolthub/mcp --gateway <url> |
--budget / BUDGET_SATS | unchanged (now a single pool across all sources) |
gateway tool btc-intel_get_v1_x | btc-intel__get_v1_x (double-underscore namespace) |
Remove the old entries from your client config rather than stacking them next to this one — a nested bolthub bin inside mcpServers would pay from its own wallet env, invisible to the shared budget (the server warns at startup if it spots this).
MIT
FAQs
The bolthub MCP server — the whole marketplace, specific L402 gateways, and your other MCP servers behind one config entry with one shared Lightning budget
The npm package @bolthub/mcp receives a total of 102 weekly downloads. As such, @bolthub/mcp popularity was classified as not popular.
We found that @bolthub/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.

Company News
Open source maintainers are under more pressure than ever. We're raising our open source program from the Team plan to the Business plan, free.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.