
Security News
6 AppSec CTOs Debate Open Source Supply Chain Security at Black Hat
Socket CTO Ahmad Nassri joins AppSec leaders at Black Hat to discuss active malware, package manager risks, and software supply chain defense.
@one-source/api-mcp
Advanced tools
MCP server for OneSource blockchain data — 22 named tools for balances, NFTs, transactions, events, and live chain queries via x402
MCP server for OneSource blockchain data. 22 named tools for balances, NFTs, transactions, events, and live chain queries via x402 micropayments.
npx onesource-api-mcp
# Claude Code
claude mcp add onesource-api -- npx onesource-api-mcp
# Claude Desktop / Cursor — add to MCP config:
{
"mcpServers": {
"onesource-api": {
"command": "npx",
"args": ["-y", "onesource-api-mcp"]
}
}
}
| Tool | Description |
|---|---|
1s_allowance_live | ERC20 allowance check |
1s_contract_info_live | Contract type detection via ERC165 |
1s_erc1155_balance_live | ERC1155 balance via RPC |
1s_erc20_balance_live | ERC20 balance via balanceOf |
1s_erc20_transfers_live | ERC20 Transfer logs via eth_getLogs |
1s_erc721_tokens_live | ERC721 token enumeration |
1s_events_live | Event logs via eth_getLogs |
1s_multi_balance_live | ETH + multiple ERC20 balances |
1s_nft_metadata_live | NFT metadata via tokenURI |
1s_nft_owner_live | NFT owner via ownerOf |
1s_total_supply_live | Token total supply |
1s_tx_details_live | Transaction + receipt via RPC |
| Tool | Description |
|---|---|
1s_contract_code | Contract bytecode |
1s_ens_resolve | ENS name/address resolution |
1s_estimate_gas | Gas estimation |
1s_network_info | Chain ID, block number, gas price |
1s_nonce | Transaction count |
1s_pending_block | Pending block from mempool |
1s_proxy_detect | Proxy contract detection |
1s_simulate_call | Simulate eth_call |
1s_storage_read | Read storage slot |
1s_tx_receipt | Transaction receipt |
All tools accept an optional network parameter:
| Network | Description |
|---|---|
ethereum | Ethereum mainnet (default) |
sepolia | Ethereum Sepolia testnet |
avax | Avalanche C-Chain |
Endpoints are priced in USDC on Base via x402. When the backend has payments enabled, tool calls return a 402 with payment details.
Automatic payments: Set X402_PRIVATE_KEY to a funded EVM wallet key. The server will automatically sign and settle USDC payments for each tool call.
X402_PRIVATE_KEY=0x... npx onesource-api-mcp
Without this key, 402 responses are returned as tool errors with a descriptive message.
| Variable | Default | Description |
|---|---|---|
ONESOURCE_BASE_URL | https://skills.onesource.io | Skills API endpoint |
X402_PRIVATE_KEY | — | EVM private key (0x-prefixed hex) for automatic x402 USDC payments on Base |
MIT
FAQs
MCP server for OneSource blockchain data — named tools for balances, NFTs, transactions, events, live chain queries, with x402 (USDC on Base) and MPP (Tempo) pay-per-call payment rails
The npm package @one-source/api-mcp receives a total of 60 weekly downloads. As such, @one-source/api-mcp popularity was classified as not popular.
We found that @one-source/api-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.

Security News
Socket CTO Ahmad Nassri joins AppSec leaders at Black Hat to discuss active malware, package manager risks, and software supply chain defense.

Research
/Security News
Thirteen malicious Packagist themes expose visitors on unpatched iPhones to a WebKit-to-kernel exploit chain that steals device data and wallet seeds.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.