
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
@d20dao/mcp
Advanced tools
MCP server for D20DAO verifiable randomness on Arc: dice, draws and shuffles with on-chain proofs, 0.05 USDC per call from a Circle Agent Wallet.
Verifiable randomness for AI agents: dice, coin flips, ranges, winners and shuffles, each one a VRF request on Arc with a proof anyone can replay. 0.05 USDC per draw, paid from your Circle Agent Wallet.
Wallet. Have your agent follow Circle's setup guide. It installs the Circle CLI, logs you in with an emailed code and creates an agent wallet. You accept Circle's terms yourself.
Funds. Fund the wallet with USDC and deposit some into Circle Gateway, for example on Arc:
circle gateway deposit --chain ARC --method direct --amount 1 --address <wallet>
Arc, Polygon, Avalanche, Base, Arbitrum, Optimism, Unichain and Ethereum balances all work.
Server. Add it to your client.
Claude Code:
claude mcp add d20dao -- npx -y @d20dao/mcp@0.1.0
Claude Desktop, Cursor and others (mcpServers in the client's MCP config):
{ "mcpServers": { "d20dao": { "command": "npx", "args": ["-y", "@d20dao/mcp@0.1.0"] } } }
On Windows, use "command": "cmd" with "args": ["/c", "npx", "-y", "@d20dao/mcp@0.1.0"] if the client cannot start npx directly. Pin the version, since the server runs with your Circle session.
Ask your agent to call setup_status; it names the next step until everything is ready.
| Tool | Cost | Does |
|---|---|---|
draw | 0.05 USDC | raw, coinFlip, dice (up to 128), range, chooseOne, chooseMany, shuffle (up to 256 items). Returns the result with request, fulfillment and proof links. |
get_result | free | Reads a draw by paymentId or a request by requestId. |
setup_status | free | Checks the CLI, login, wallet, Gateway balance and today's spending. |
An optional seed (up to 64 bytes) is bound on chain to the draw, so a raffle can name its round before the result exists. Give each separate draw its own seed: an identical draw within five minutes returns the earlier one without paying.
A draw usually answers in about ten seconds, but it can take longer. If your client's tool timeout is short (60 seconds is a common default), raise it; a retry after a timeout returns the same draw rather than paying twice.
| Variable | Default | |
|---|---|---|
D20_DAILY_LIMIT_USDC | 1 | Spending cap per UTC day, shared by every server process of the user. 0 turns paid draws off. |
D20_NETWORK | mainnet | testnet uses the Arc Testnet API and a testnet CLI login (circle wallet login <email> --testnet). |
D20_PAY_CHAIN | first funded | Circle CLI chain code to pay from, such as ARC or BASE. |
D20_WALLET_ADDRESS | first agent wallet | Agent wallet to pay from. |
D20_CIRCLE_CLI | circle on PATH | Path to the CLI's dist/index.js. |
D20_MCP_HOME | ~/.d20dao-mcp | Where the spending record is kept. |
CIRCLE_ACCEPT_TERMS is kept out of the CLI it runs, and DO_NOT_TRACK is set so your item labels stay out of the CLI's telemetry.api.d20dao.org (or api-testnet.d20dao.org) and never more than 0.05 USDC per draw. If the CLI ever reports another seller, that draw comes back with a warning and paid draws stop until you delete halt.json from the server's home folder.get_result. If the answer is lost after payment, the server resends the payment the CLI signed, which the API honours at most once.charged: false only when that is known. When it says unknown, do not draw again; check with get_result or the wallet.draw is marked as a tool with side effects, so clients ask before running it unless you allow it.Every result links its request and fulfillment transactions and a proof page. Replay the proof yourself with @d20dao/vrf-sdk; see verification and the agent API guide.
MIT
FAQs
MCP server for D20DAO verifiable randomness on Arc: dice, draws and shuffles with on-chain proofs, 0.05 USDC per call from a Circle Agent Wallet.
The npm package @d20dao/mcp receives a total of 123 weekly downloads. As such, @d20dao/mcp popularity was classified as not popular.
We found that @d20dao/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.