
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@cryptoapis-io/mcp-utils
Advanced tools
MCP server for address derivation and encoding utilities across multiple blockchains via Crypto APIs
MCP server for Crypto APIs Utils product. Validate addresses, decode raw transactions, and XRP X-Address encode/decode.
API Version: Compatible with Crypto APIs version 2024-12-12
npm install @cryptoapis-io/mcp-utils
Or install all Crypto APIs MCP servers: npm install @cryptoapis-io/mcp
# Run with API key
npx @cryptoapis-io/mcp-utils --api-key YOUR_API_KEY
# Or use environment variable
export CRYPTOAPIS_API_KEY=YOUR_API_KEY
npx @cryptoapis-io/mcp-utils
# HTTP transport
npx @cryptoapis-io/mcp-utils --transport http --port 3000 --api-key YOUR_API_KEY
Add to your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json on macOS, %APPDATA%\Claude\claude_desktop_config.json on Windows):
{
"mcpServers": {
"cryptoapis-utils": {
"command": "npx",
"args": ["-y", "@cryptoapis-io/mcp-utils"],
"env": {
"CRYPTOAPIS_API_KEY": "your_api_key_here"
}
}
}
}
Add to .cursor/mcp.json (project) or ~/.cursor/mcp.json (global):
{
"mcpServers": {
"cryptoapis-utils": {
"command": "npx",
"args": ["-y", "@cryptoapis-io/mcp-utils"],
"env": {
"CRYPTOAPIS_API_KEY": "your_api_key_here"
}
}
}
}
npx @modelcontextprotocol/inspector npx @cryptoapis-io/mcp-utils --api-key YOUR_API_KEY
npx @cryptoapis-io/mcp-utils --transport http --port 3000 --api-key YOUR_API_KEY
http://localhost:3000/mcpAll servers default to port 3000. Use
--portto assign different ports when running multiple servers.
utxo_utils| Action | Description |
|---|---|
validate-address | Check if a UTXO address is valid. Requires blockchain, network, address |
decode-raw-transaction | Decode a raw transaction hex. Requires blockchain, network, rawTransactionHex |
convert-bitcoin-cash-address | Convert Bitcoin Cash address between legacy and CashAddr formats. Requires network, address (Bitcoin Cash only, no blockchain parameter) |
Supported Blockchains: bitcoin, bitcoin-cash, litecoin, dogecoin, dash, zcash
evm_utils| Action | Description |
|---|---|
validate-address | Check if an EVM address is valid. Requires blockchain, network, address |
decode-raw-transaction | Decode a raw transaction hex. Requires blockchain, network, rawTransactionHex |
xrp_utils| Action | Description |
|---|---|
validate-address | Check if an XRP address is valid. Requires network, address |
decode-x-address | Decode X-Address to classic address and tag. Requires network, xAddress |
encode-x-address | Encode classic address and tag to X-Address. Requires network, classicAddress, addressTag |
derive_addressesDerive HD wallet (xPub/yPub/zPub) change or receiving addresses without syncing. Derives up to 10 addresses per call.
| Parameter | Description |
|---|---|
blockchain | Target blockchain |
network | Network name |
extendedPublicKey | xPub/yPub/zPub for the HD wallet |
addressFormat | Address format (optional): p2pkh, p2sh, p2wpkh, standard, p2sh-cash, p2pkh-cash, classic, base58 |
addressesCount | Number of addresses to derive, up to 10 (optional) |
isChange | If true, derive change address(es); if false, derive receiving/deposit (optional, UTXO only) |
startIndex | Starting index for derivation (optional) |
Supported Blockchains: bitcoin, bitcoin-cash, litecoin, dogecoin, dash, zcash, ethereum, ethereum-classic, binance-smart-chain, xrp, tron
| Argument | Description | Default |
|---|---|---|
--api-key | Crypto APIs API key | CRYPTOAPIS_API_KEY env var |
--transport | Transport type: stdio or http | stdio |
--host | HTTP host | 0.0.0.0 |
--port | HTTP port | 3000 |
--path | HTTP path | /mcp |
--stateless | Enable stateless HTTP mode | false |
When using HTTP transport, the server supports two API key modes:
--api-key: The key is used for all requests. x-api-key request headers are ignored.--api-key: Each request must include an x-api-key header with a valid Crypto APIs key. This enables hosting a public server where each user provides their own key.# Per-request key mode (multi-tenant)
npx @cryptoapis-io/mcp-utils --transport http --port 3000
# Clients send x-api-key header with each request
Stdio transport always requires an API key at startup.
Warning: Making requests without a valid API key — or with an incorrect one — may result in your IP being banned from the Crypto APIs ecosystem. Always ensure a valid API key is configured before starting any server.
Crypto APIs provides an official remote MCP server with all tools available via HTTP Streamable transport at https://ai.cryptoapis.io/mcp. Pass your API key via the x-api-key header — no installation required.
MIT
FAQs
MCP server for address derivation and encoding utilities across multiple blockchains via Crypto APIs
The npm package @cryptoapis-io/mcp-utils receives a total of 0 weekly downloads. As such, @cryptoapis-io/mcp-utils popularity was classified as not popular.
We found that @cryptoapis-io/mcp-utils demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.