
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
@hederatoolbox/platform
Advanced tools
Hedera blockchain intelligence for AI agents. 23 tools across 7 modules — HCS, compliance, governance, tokens, identity, contracts, Fixatum DID. Pay per call in HBAR. No registration required.
The intelligence layer for AI agents on Hedera.
23 tools. 7 modules. Pay per call in HBAR. No registration.
HederaToolbox is a production Model Context Protocol server. It gives AI agents structured, metered access to the full Hedera ecosystem — HCS topics, tokens, identity, smart contracts, governance, compliance, and Fixatum DID registration.
Built for agents that need to reason about Hedera, not just interact with it.
Claude Desktop — one business objective, no steps specified, agent decides everything:
Terminal agent — autonomous compliance workflow running headless:
Four production-ready agents in examples/. Clone the repo, fund once, run. Zero dependencies beyond Node.js 18+.
One-time setup for all agents:
git clone https://github.com/mountainmystic/hederatoolbox.git
cd hederatoolbox
# Send any HBAR to the platform wallet from your Hedera account.
# Your account ID becomes your API key automatically within 10 seconds.
# Platform wallet: 0.0.10309126
Windows users: set env vars before running:
set HEDERA_ACCOUNT_ID=0.0.YOUR_ID && set TOKEN_ID=0.0.731861 && node examples/whale-alert-agent.mjsOr edit the config constants directly at the top of each file.
examples/whale-alert-agent.mjs
Monitors any Hedera token for unusual whale concentration on a schedule. When top-10 holders exceed your threshold, writes a tamper-proof whale_alert record to HCS and prints the Hashscan proof URL.
HEDERA_ACCOUNT_ID=0.0.YOUR_ID TOKEN_ID=0.0.731861 node examples/whale-alert-agent.mjs
| Config | Default | Description |
|---|---|---|
TOKEN_ID | 0.0.731861 | Token to monitor |
THRESHOLD_PCT | 80 | Alert if top-10 holders exceed this % |
CHECK_INTERVAL_MS | 3600000 | Check every hour |
Cost: 0.2 ℏ per check · 5 ℏ only when anomaly fires
examples/compliance-onboarding-agent.mjs
Screens a Hedera account before doing business with them. Runs identity resolution, sanctions screening, and optional KYC verification in sequence — then writes a tamper-proof compliance record to HCS. Returns APPROVED, REJECTED, PENDING_REVIEW, or PENDING_KYC.
HEDERA_ACCOUNT_ID=0.0.YOUR_ID SUBJECT=0.0.999999 node examples/compliance-onboarding-agent.mjs
# With KYC check for your token:
HEDERA_ACCOUNT_ID=0.0.YOUR_ID SUBJECT=0.0.999999 KYC_TOKEN_ID=0.0.731861 node examples/compliance-onboarding-agent.mjs
Cost: ~1.7 ℏ per screening · add 0.5 ℏ for KYC check
examples/token-due-diligence-agent.mjs
Full investment and listing due diligence on any Hedera token in one run. Pulls price data, deep holder analysis, admin key risks, and treasury account identity — outputs a structured risk report with an overall verdict.
HEDERA_ACCOUNT_ID=0.0.YOUR_ID TOKEN_ID=0.0.731861 node examples/token-due-diligence-agent.mjs
Cost: ~1.0 ℏ per report (token_price + token_analyze + identity_resolve on treasury)
examples/dao-monitor-agent.mjs
Watches active governance proposals for a Hedera token on a schedule. Alerts when a proposal is closing within 24 hours. Pass --analyze with a PROPOSAL_ID for deep vote tally and outcome prediction.
# Monitor proposals
HEDERA_ACCOUNT_ID=0.0.YOUR_ID TOKEN_ID=0.0.731861 node examples/dao-monitor-agent.mjs
# Deep-analyze a specific proposal (requires HCS topic)
HEDERA_ACCOUNT_ID=0.0.YOUR_ID TOKEN_ID=0.0.731861 TOPIC_ID=0.0.999 PROPOSAL_ID=42 node examples/dao-monitor-agent.mjs --analyze
Cost: 0.2 ℏ per check · 1.0 ℏ for deep analysis · 10 ℏ covers ~12 days at 4 checks/day
MCP endpoint:
https://api.hederatoolbox.com/mcp
Claude.ai (web or mobile) Settings → Connectors → Add → paste the endpoint URL above.
Claude Desktop app
Step 1 — install the package globally (required, do this once):
npm install -g @hederatoolbox/platform
Step 2 — add to claude_desktop_config.json under mcpServers:
{
"mcpServers": {
"hederatoolbox": {
"command": "npx",
"args": ["-y", "@hederatoolbox/platform"]
}
}
}
Restart Claude Desktop after saving the config.
Windows users: if you see
npm error could not determine executable to run, your npm global directory may not exist yet. Run these first:mkdir %APPDATA%\npm npm config set prefix %APPDATA%\npm npm install -g @hederatoolbox/platform
OpenClaw / ClawHub
Install the HederaToolbox skill directly from ClawHub:
clawhub install mountainmystic/hederatoolbox
Then add your Hedera account ID to your OpenClaw environment:
HEDERA_ACCOUNT_ID=0.0.YOUR_ACCOUNT_ID
Skill listing: clawhub.ai/mountainmystic/hederatoolbox
Cursor / other MCP-compatible clients Use the endpoint URL directly in your MCP server config.
HederaToolbox uses agent-native HBAR payments. No accounts, no OAuth, no email.
1. get_terms -> read the Terms of Service (free)
2. confirm_terms -> record consent (free)
3. account_info -> get platform wallet + pricing (free)
4. send HBAR -> your account ID becomes your key (auto-provisioned)
5. call any tool -> pass your Hedera account ID as api_key
Platform wallet: 0.0.10309126 (mainnet)
Credits are persistent. Unused balance carries over indefinitely.
All safety controls run server-side and cannot be bypassed by modifying the npm package.
confirm_terms required before any paid tool executesTerms of Service: get_terms tool or /public/terms.json
| Tool | Description |
|---|---|
get_terms | Machine-readable Terms of Service. Call before anything else. |
confirm_terms | Record consent. Required before any paid tool. |
account_info | Platform wallet address, full pricing table, your balance. |
| Tool | Cost | Description |
|---|---|---|
hcs_monitor | 0.10 HBAR | Topic status, message count, recent activity |
hcs_query | 0.10 HBAR | Natural language Q&A over topic messages, AI-ranked |
hcs_understand | 1.00 HBAR | Anomaly detection, trend analysis, entity extraction |
| Tool | Cost | Description |
|---|---|---|
hcs_write_record | 5.00 HBAR | Write tamper-evident record to HCS |
hcs_verify_record | 1.00 HBAR | Verify a record has not been altered |
hcs_audit_trail | 2.00 HBAR | Full chronological audit history for an entity |
| Tool | Cost | Description |
|---|---|---|
governance_monitor | 0.20 HBAR | Active proposals, deadlines, current vote tallies |
governance_analyze | 1.00 HBAR | Voter sentiment, participation rate, outcome prediction |
| Tool | Cost | Description |
|---|---|---|
token_price | 0.10 HBAR | Spot price, 1h/24h/7d change, liquidity — via SaucerSwap |
token_monitor | 0.20 HBAR | Recent transfers, whale movements, unusual patterns |
token_analyze | 0.60 HBAR | Holder distribution, velocity, concentration, risk score |
| Tool | Cost | Description |
|---|---|---|
identity_resolve | 0.20 HBAR | Account profile: age, holdings, transaction history |
identity_verify_kyc | 0.50 HBAR | KYC grant status and verification history for a token |
identity_check_sanctions | 1.00 HBAR | On-chain risk screening, counterparty patterns |
| Tool | Cost | Description |
|---|---|---|
contract_read | 0.20 HBAR | Metadata, bytecode size, recent callers, gas stats |
contract_call | 1.00 HBAR | Read-only function call — no gas, no transaction |
contract_analyze | 1.50 HBAR | Activity patterns, caller distribution, risk classification |
Accepts both Hedera native IDs (0.0.123456) and EVM addresses (0x...).
Register agents on Fixatum — a W3C DID issuance and KYA (Know Your Agent) trust scoring platform built on Hedera.
| Tool | Cost | Description |
|---|---|---|
fixatum_register | 105 HBAR | Register for a permanent W3C DID anchored to Hedera HCS and a live KYA trust score |
fixatum_score | Free | Query live KYA score (0–100, grade A–F) and component breakdown for any registered agent |
fixatum_status | Free | Check registration status, current score, and whether provenance is actively building |
Call fixatum_register without ed25519_public_key to get key generation instructions first — no charge until registration proceeds.
v3.5.3 — Fixatum DID module added (fixatum_register, fixatum_score, fixatum_status) — 23 tools, 7 modules
v3.4.5 — Agent examples improved, xagent persona rewrite
v3.4.2 — X agent (Telegram-gated autonomous tweet drafting), agent examples added to repo
v3.4.0 — Repriced all tools across all 6 modules
v3.3.1 — Full security audit: SQLite-backed rate limiting, API key validation, 1MB body cap, separate BACKUP_SECRET, 90-day PII purge, HITL removed, legal pages deployed
Note: The old package
@hederaintel/platformis deprecated. Update your config to use@hederatoolbox/platform.
npm package — provided for integration use only.
Remote server and all backend logic — Proprietary. See LICENSE.md.
Enterprise licensing and SLA inquiries: open an issue titled [Enterprise].
HederaToolbox has a permanent platform identity record written to Hedera mainnet.
| Field | Value |
|---|---|
| HCS Topic | 0.0.10353855 |
| Record ID | c420c3b9-408e-4f87-a9e1-1dcbb54facfa |
| Transaction | 0.0.10309126@1773623419.733217779 |
| Written | 16 March 2026 |
| Verify | hashscan.io/mainnet/topic/0.0.10353855 |
FAQs
Hedera blockchain intelligence for AI agents. 23 tools across 7 modules — HCS, compliance, governance, tokens, identity, contracts, Fixatum DID. Pay per call in HBAR. No registration required.
We found that @hederatoolbox/platform demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.