
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
@unclaimed-sol/mcp
Advanced tools
Scan and reclaim dormant SOL from your Solana wallet. Powered by UnclaimedSOL.
MCP server for UnclaimedSOL — scan and reclaim dormant SOL from Solana wallets directly from AI assistants like Claude, ChatGPT, and others that support the Model Context Protocol.
Solana wallets accumulate rent-locked SOL in dormant token accounts (zero-balance ATAs) and program buffer accounts. This MCP server lets AI assistants:
scan_claimable_solCheck how much SOL a wallet can reclaim. Read-only — no transactions, no keypair needed.
Input: wallet_address (base58 public key; optional in claim-enabled mode, defaults to configured keypair wallet)
claim_solClaim reclaimable SOL. Requires a configured keypair. Uses a two-step flow:
execution_token valid for 60 seconds.dry_run: false and the execution_token to sign and broadcast.Inputs: wallet_address (optional in claim-enabled mode, defaults to configured keypair wallet), dry_run (default true), execution_token, max_transactions (default 10), exclude (optional token symbols/names to skip on execute)
This action is irreversible — closed accounts cannot be recovered.
claim_rewardsClaim uncollected DeFi rewards (cashback, creator fees, and more). Requires a configured keypair. Uses the same two-step dry-run/execute flow as claim_sol. A 15% service fee applies.
Inputs: wallet_address (optional in claim-enabled mode, defaults to configured keypair wallet), dry_run (default true), execution_token
claim_stakesClaim SOL from deactivated stake accounts. Requires a configured keypair. Uses the same two-step dry-run/execute flow. Optionally pass specific stake account addresses to claim.
Inputs: wallet_address (optional in claim-enabled mode, defaults to configured keypair wallet), dry_run (default true), execution_token, stake_accounts (optional array)
git clone https://github.com/unclaimed-sol/unclaimed-sol-mcp.git && cd unclaimed-sol-mcp
npm install
npm run build
Only the scan_claimable_sol tool is exposed. No transactions are signed or sent.
Add to your MCP client config (e.g. claude_desktop_config.json):
{
"mcpServers": {
"unclaimed-sol": {
"command": "node",
"args": ["/absolute/path/to/unclaimed-sol-mcp/dist/index.js"],
}
}
}
All tools are exposed (scan_claimable_sol, claim_sol, claim_rewards, claim_stakes). Transactions are signed locally with your keypair and broadcast to the Solana network.
{
"mcpServers": {
"unclaimed-sol": {
"command": "node",
"args": ["/absolute/path/to/unclaimed-sol-mcp/dist/index.js"],
"env": {
"SOLANA_KEYPAIR_PATH": "~/.config/solana/id.json",
"SOLANA_RPC_URL": "https://your-rpc-provider.com"
}
}
}
}
# Scan only
claude mcp add unclaimed-sol \
-- node /absolute/path/to/unclaimed-sol-mcp/dist/index.js
# Scan + Vibe Claiming
claude mcp add unclaimed-sol \
-e SOLANA_KEYPAIR_PATH=~/.config/solana/id.json \
-e SOLANA_RPC_URL=https://your-rpc-provider.com \
-- node /absolute/path/to/unclaimed-sol-mcp/dist/index.js
| Variable | Required | Description |
|---|---|---|
UNCLAIMED_SOL_API_URL | No | Backend API URL. Defaults to https://unclaimedsol.com. |
UNCLAIMED_SOL_API_KEY | No | API key sent as Authorization: Bearer header. |
SOLANA_KEYPAIR_PATH | No | Path to Solana keypair JSON file. Enables Vibe Claiming. |
SOLANA_PRIVATE_KEY | No | Private key as base58 string or JSON byte array. Use SOLANA_KEYPAIR_PATH instead when possible. |
SOLANA_RPC_URL | No | Solana RPC endpoint. Defaults to https://api.mainnet-beta.solana.com. A dedicated RPC is recommended for claiming. |
SOLANA_PRIORITY_FEE | No | Priority fee in microlamports per compute unit. Default: 1,000. Max: 200,000. |
unclaimedsol.com, localhost, or 127.0.0.1.maxClaimMode: false) to exclude valuable tokens and NFTs. Frozen accounts are skipped.claim_sol)@unclaimedsol/spl-burn-close-sdk — token balances are burned and accounts are closed via the UnclaimedSOL on-chain program.claim_rewards)claim_stakes)The pre-sign validator (validateTransactionPrograms) provides different levels of protection depending on the claim type:
claim_sol — Instructions are built locally using the SDK. The validator checks program IDs and fee vault presence.claim_stakes — Full value-level safety. Withdraw amounts are proven from Stake instruction data. The fee cap is locally derived and does not depend on any backend-reported value.claim_rewards — Structural safety. DeFi reward claim amounts are determined on-chain at execution time and are not encoded in instruction data. The fee cap is cross-checked against an independent /scan call, which protects against accidental drift between backend endpoints but not against a fully compromised backend.In all cases: instruction shapes are pinned exactly (every account position verified against locally-derived PDAs, exact account counts, known discriminators only).
src/
index.ts MCP server entry point (stdio transport)
constants.ts Program IDs, fee vault, fee caps, batching limits
config.ts Environment variable loading and validation
validation.ts Wallet address validation
formatter.ts SOL display formatting
cache.ts In-memory scan cache (60s TTL)
execution-token-store.ts Generic two-step dry-run/execute token management
tools/
scan.ts scan_claimable_sol tool handler
claim.ts claim_sol tool handler (tokens + buffers)
claim-rewards.ts claim_rewards tool handler (DeFi rewards)
claim-stakes.ts claim_stakes tool handler (deactivated stakes)
services/
scanner.ts Backend API client (scan, tokens, buffers, rewards, stakes)
transaction.ts Transaction building + pre-sign validation
signer.ts Batch sign, send, confirm with retry
MIT
FAQs
The first Vibe Claiming MCP server: let AI agents scan and reclaim dormant SOL on Solana — rent from token accounts and spam NFTs, program buffers, deactivated stakes, and DeFi rewards. Dry-run + execution-token safety, local signing, keypair never leaves
The npm package @unclaimed-sol/mcp receives a total of 24 weekly downloads. As such, @unclaimed-sol/mcp popularity was classified as not popular.
We found that @unclaimed-sol/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.