
Research
/Security News
77 Firefox Extensions Linked to Crypto Wallet and Credential Theft
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.
@cryptoapis-io/mcp-hd-wallet
Advanced tools
MCP server for HD wallet management, balance, and sync on EVM, UTXO, XRP via Crypto APIs
MCP server for Crypto APIs HD Wallet (Wallet as a Service) product. Track and manage HD wallets by their extended public key (xPub/yPub/zPub) — no private keys ever leave your device.
API Version: Compatible with Crypto APIs version 2024-12-12
HD (Hierarchical Deterministic) wallets derive all addresses from a single extended public key (xPub). You sync your xPub with Crypto APIs, and the service tracks all derived addresses, balances, and transactions on your behalf.
@cryptoapis-io/mcp-signerYour private keys are never sent to or stored by Crypto APIs. Only the extended public key is used for address derivation and balance tracking.
npm install @cryptoapis-io/mcp-hd-wallet
Or install all Crypto APIs MCP servers: npm install @cryptoapis-io/mcp
# Run with API key
npx @cryptoapis-io/mcp-hd-wallet --api-key YOUR_API_KEY
# Or use environment variable
export CRYPTOAPIS_API_KEY=YOUR_API_KEY
npx @cryptoapis-io/mcp-hd-wallet
# HTTP transport
npx @cryptoapis-io/mcp-hd-wallet --transport http --port 3000 --api-key YOUR_API_KEY
Add to your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json on macOS, %APPDATA%\Claude\claude_desktop_config.json on Windows):
{
"mcpServers": {
"cryptoapis-hd-wallet": {
"command": "npx",
"args": ["-y", "@cryptoapis-io/mcp-hd-wallet"],
"env": {
"CRYPTOAPIS_API_KEY": "your_api_key_here"
}
}
}
}
Add to .cursor/mcp.json (project) or ~/.cursor/mcp.json (global):
{
"mcpServers": {
"cryptoapis-hd-wallet": {
"command": "npx",
"args": ["-y", "@cryptoapis-io/mcp-hd-wallet"],
"env": {
"CRYPTOAPIS_API_KEY": "your_api_key_here"
}
}
}
}
npx @modelcontextprotocol/inspector npx @cryptoapis-io/mcp-hd-wallet --api-key YOUR_API_KEY
npx @cryptoapis-io/mcp-hd-wallet --transport http --port 3000 --api-key YOUR_API_KEY
http://localhost:3000/mcpAll servers default to port 3000. Use
--portto assign different ports when running multiple servers.
manage_hd_walletManage HD wallets (sync, activate, delete, list, status).
| Action | Description |
|---|---|
sync-wallet | Sync an HD wallet by extended public key (xPub/yPub/zPub) |
list-wallets | List all synced HD wallets |
activate-wallet | Activate a previously synced wallet |
delete-wallet | Delete a synced wallet |
get-status | Get sync status of a wallet |
hd_wallet_data_utxoQuery UTXO HD wallet data (Bitcoin, Bitcoin Cash, Litecoin, Dogecoin, Dash, Zcash).
| Action | Description |
|---|---|
get-details | Get wallet balance and details |
derive-receiving-address | Derive next receiving address |
derive-change-address | Derive next change address |
list-addresses | List all derived addresses |
list-transactions | List wallet transactions |
list-utxos | List unspent transaction outputs |
list-assets | List assets held by wallet |
prepare-transaction | Prepare an unsigned transaction from wallet |
hd_wallet_data_evmQuery EVM HD wallet data (Ethereum, Ethereum Classic, BSC, Polygon, Avalanche (C-Chain), Arbitrum, Base, Optimism, Tron).
| Action | Description |
|---|---|
get-details | Get wallet balance and details |
derive-receiving-address | Derive next receiving address |
list-addresses | List all derived addresses |
list-transactions | List wallet transactions |
list-assets | List tokens held by wallet |
prepare-transaction | Prepare an unsigned transaction from wallet |
hd_wallet_data_xrpQuery XRP HD wallet data.
| Action | Description |
|---|---|
get-details | Get wallet balance and details |
derive-receiving-address | Derive next receiving address |
list-addresses | List all derived addresses |
list-transactions | List wallet transactions |
list-assets | List assets held by wallet |
| Argument | Description | Default |
|---|---|---|
--api-key | Crypto APIs API key | CRYPTOAPIS_API_KEY env var |
--transport | Transport type: stdio or http | stdio |
--host | HTTP host | 0.0.0.0 |
--port | HTTP port | 3000 |
--path | HTTP path | /mcp |
--stateless | Enable stateless HTTP mode | false |
When using HTTP transport, the server supports two API key modes:
--api-key: The key is used for all requests. x-api-key request headers are ignored.--api-key: Each request must include an x-api-key header with a valid Crypto APIs key. This enables hosting a public server where each user provides their own key.# Per-request key mode (multi-tenant)
npx @cryptoapis-io/mcp-hd-wallet --transport http --port 3000
# Clients send x-api-key header with each request
Stdio transport always requires an API key at startup.
Warning: Making requests without a valid API key — or with an incorrect one — may result in your IP being banned from the Crypto APIs ecosystem. Always ensure a valid API key is configured before starting any server.
Crypto APIs provides an official remote MCP server with all tools available via HTTP Streamable transport at https://ai.cryptoapis.io/mcp. Pass your API key via the x-api-key header — no installation required.
MIT
FAQs
MCP server for HD wallet management, balance, and sync on EVM, UTXO, XRP via Crypto APIs
We found that @cryptoapis-io/mcp-hd-wallet demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.

Security News
NIST disclosed an unreleased AI tool called V-etalon and opened a broad inquiry into NVD modernization after years of automation plans produced no public enrichment system.

Security News
In his AI Council 2026 talk, Feross Aboukhadijeh covers recent package compromises, vulnerability discovery, and a more automated security model.