
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@sinai-standard/mcp-server
Advanced tools
MCP server for Sinai Standard — lets AI agents issue and manage regulated tokens on Solana
MCP (Model Context Protocol) server that lets AI agents issue and manage regulated tokens on Solana via Sinai Standard. Connect Claude, Cursor, or any MCP-compatible agent to create compliant Token-2022 tokens with transfer hooks — allowlists, transfer taxes, hold periods, and max balance caps — all through natural language tool calls.
npm install -g @sinai-standard/mcp-server
Or as a local dependency:
npm install @sinai-standard/mcp-server
| Variable | Description | Default |
|---|---|---|
SOLANA_RPC_URL | Solana RPC endpoint | https://api.devnet.solana.com |
WALLET_PATH | Path to Solana keypair JSON | ~/.config/solana/id.json |
Add to your claude_desktop_config.json:
{
"mcpServers": {
"sinai-standard": {
"command": "node",
"args": ["/path/to/sinai-standard/packages/mcp-server/dist/index.js"],
"env": {
"SOLANA_RPC_URL": "https://api.devnet.solana.com",
"WALLET_PATH": "/path/to/your/wallet.json"
}
}
}
}
Or if installed globally:
{
"mcpServers": {
"sinai-standard": {
"command": "sinai-mcp",
"env": {
"SOLANA_RPC_URL": "https://api.devnet.solana.com",
"WALLET_PATH": "/path/to/your/wallet.json"
}
}
}
}
| Tool | Description | Key Params |
|---|---|---|
create_token | Create a regulated token with compliance hooks | name, symbol, decimals, supply, hooks |
add_to_allowlist | Add wallets to a token's allowlist | mint, wallets[] |
remove_from_allowlist | Remove wallets from allowlist | mint, wallets[] |
configure_tax | Update transfer tax rate | mint, bps, vault |
set_hold_period | Set hold period lock duration | mint, seconds |
set_max_balance | Set max balance per wallet | mint, maxBalance |
get_token_config | Read all compliance config | mint |
check_wallet | Check wallet allowlist status + balance | mint, wallet |
transfer_tokens | Transfer tokens through compliance hooks | mint, from, to, amount |
get_compliance_summary | Full compliance overview | mint |
| URI | Description |
|---|---|
sinai://programs | All deployed Sinai Standard program IDs |
sinai://token/{mint} | Token details for a specific mint |
User: Create a regulated real estate token with a 1.5% transfer tax,
90-day hold period, and an allowlist. Supply should be 10 million tokens.
Agent: I'll create that token for you with all the compliance hooks.
→ calls create_token({
name: "Dubai Real Estate Fund I",
symbol: "DREF1",
decimals: 6,
supply: 10000000000000,
hooks: {
allowlist: { mode: "allowlist" },
tax: { bps: 150, maxBps: 500, vault: "TaxVau1t..." },
holdPeriod: { seconds: 7776000 }
}
})
← {
"mint": "DREFm1nt...",
"tokenRecordPDA": "TRec...",
"configuredHooks": ["allowlist", "tax", "holdPeriod"]
}
Agent: Done! Your token DREF1 is live at DREFm1nt... with:
- Allowlist enabled (allowlist mode)
- 1.5% transfer tax (max 5%)
- 90-day hold period
Now add investor wallets to the allowlist so they can receive tokens.
User: Add these three investors to the allowlist: Wa11et1..., Wa11et2..., Wa11et3...
→ calls add_to_allowlist({
mint: "DREFm1nt...",
wallets: ["Wa11et1...", "Wa11et2...", "Wa11et3..."]
})
← { "signature": "5xTx...", "walletsAdded": 3, "totalWallets": 3 }
Agent: Added 3 investors. They can now receive DREF1 tokens.
pnpm build
FAQs
MCP server for Sinai Standard — lets AI agents issue and manage regulated tokens on Solana
We found that @sinai-standard/mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.