
Security News
Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
@zerodust/mcp-server
Advanced tools
MCP server that lets an AI agent sweep its own wallet to exactly zero on 25+ EVM chains, with no gas left stranded.
Model Context Protocol (MCP) server for ZeroDust - sweep native gas tokens to exactly zero.
npm install -g @zerodust/mcp-server
Or run directly with npx:
npx @zerodust/mcp-server
Add to your ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"zerodust": {
"command": "npx",
"args": ["@zerodust/mcp-server"]
}
}
}
Add to your .claude/settings.json:
{
"mcpServers": {
"zerodust": {
"command": "npx",
"args": ["@zerodust/mcp-server"]
}
}
}
| Variable | Description | Default |
|---|---|---|
ZERODUST_API_URL | Custom API URL | https://api.zerodust.xyz |
ZERODUST_API_KEY | API key for higher rate limits | - |
ZERODUST_ALLOW_EXECUTE | Set to true to enable sweeping | false |
ZERODUST_PRIVATE_KEY | Signing key for the agent's wallet | - |
ZERODUST_ALLOWED_DESTINATIONS | Comma-separated destination allowlist | own address only |
Read-only by default:
| Tool | Description |
|---|---|
zerodust_info | Get information about ZeroDust service and fees |
zerodust_get_chains | List all supported blockchain chains |
zerodust_get_balances | Check native token balances across all chains |
zerodust_get_quote | Get a quote for sweeping a chain |
zerodust_get_sweep_status | Check status of a submitted sweep |
zerodust_list_sweeps | List past sweeps for an address |
Added when execution is enabled (see below):
| Tool | Description |
|---|---|
zerodust_get_agent_address | Show the signing address and permitted destinations |
zerodust_sweep | Sweep one chain to exactly zero |
zerodust_sweep_all | Sweep every chain with a balance to one destination |
Sweeping moves real funds, so it is off unless you turn it on. Set both:
{
"mcpServers": {
"zerodust": {
"command": "npx",
"args": ["@zerodust/mcp-server"],
"env": {
"ZERODUST_ALLOW_EXECUTE": "true",
"ZERODUST_PRIVATE_KEY": "0x..."
}
}
}
}
The key is used locally to sign an EIP-7702 authorization and an EIP-712 sweep intent. It is never transmitted — only signatures reach the ZeroDust API.
By default funds can only be swept to the agent's own address. This is the main protection against prompt injection: an agent talked into sweeping somewhere it shouldn't still cannot send funds to an address you never approved.
To permit other destinations, list them explicitly:
"ZERODUST_ALLOWED_DESTINATIONS": "0xYourColdWallet,0xYourExchangeDeposit"
Treat this like any other spending authority — anything listed here can receive the agent's entire balance across every supported chain.
Once configured, you can ask Claude:
With execution enabled:
MIT
FAQs
MCP server that lets an AI agent sweep its own wallet to exactly zero on 25+ EVM chains, with no gas left stranded.
The npm package @zerodust/mcp-server receives a total of 93 weekly downloads. As such, @zerodust/mcp-server popularity was classified as not popular.
We found that @zerodust/mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.