
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@furlpay/mcp-server
Advanced tools
Model Context Protocol server exposing Furlpay tools to AI coding assistants
Model Context Protocol server exposing Furlpay tools to AI assistants — let Claude, Cursor, and any MCP client check balances, quote swaps, place orders, and run compliance checks against your Furlpay account.
Self-contained: stdio transport, JSON-RPC 2.0, zero dependencies, no SDK required.
Add to claude_desktop_config.json (or .mcp.json in a Claude Code project):
{
"mcpServers": {
"furlpay": {
"command": "npx",
"args": ["-y", "@furlpay/mcp-server"],
"env": {
"FURLPAY_API_KEY": "sk_sandbox_...",
"FURLPAY_BASE_URL": "https://api.furlpay.app"
}
}
}
}
Settings → MCP → Add server, command: npx -y @furlpay/mcp-server.
| Tool | What it does |
|---|---|
get_wallet_balances | Safe smart-account stablecoin balances and active modules |
quote_swap | Cheapest cross-chain stablecoin swap route (Li.Fi / 1inch) |
place_investment_order | Fractional stock/ETF order (Alpaca) — symbol, side, notional |
screen_wallet_risk | AML-screen a wallet address (Chainalysis / TRM), returns a risk verdict |
verify_identity | KYC identity check (Persona / Sumsub) |
Ask your assistant:
"What's my Furlpay wallet balance?"
"Quote swapping 100 USDT on Base to USDC."
"Screen wallet
9x…for AML risk before I pay it."
sk_sandbox_...) while experimenting — the agent inherits every permission the key has.FURLPAY_BASE_URL defaults to http://localhost:3000 for local development; point it at production explicitly.furlpay-examples/ai-agent-mcp — full agent setup walkthrough · furlpay-x402 — per-request agent payments over HTTP 402.
Report vulnerabilities to hello@furlpay.com — please don't open public issues.
MIT
FAQs
Model Context Protocol server exposing Furlpay tools to AI coding assistants
The npm package @furlpay/mcp-server receives a total of 15 weekly downloads. As such, @furlpay/mcp-server popularity was classified as not popular.
We found that @furlpay/mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.