
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
Robyn MCP server — gasless cross-chain for AI agents. Quote and execute gasless moves across 22 EVM chains + Stellar, one signature, no native gas.
Integrate, don't replicate. This package is MIT — integrate Robyn into your app, agent, or product freely, no restrictions. The license covers only this client library; Robyn's relayer, smart contracts, and network are proprietary and are not licensed here. Don't use it (or the Robyn API) to run a competing gasless-relay service or to replicate Robyn. See NOTICE. Build with Robyn: yes. Clone Robyn to cut it out: no.
Gasless cross-chain for AI agents, as an MCP server.
Give any MCP-capable agent (Claude Desktop, Cursor, agent frameworks) the ability to move value across 22 EVM chains + Stellar with one signature and zero gas management — no native token, no per-chain balances, no bridge picking. Robyn's relayer fronts all gas on both chains and is reimbursed from the token being moved.
| Tool | Needs key | What it does |
|---|---|---|
robyn_mesh | no | List the gasless chains + cross-chain route graph (22 EVM nodes + Stellar). |
robyn_quote | no | Best gasless route for a move — estimated output, bridge, duration, fee. Read-only. |
robyn_route_status | no | Track an in-flight route (BRIDGING → DONE) with the destination tx. |
robyn_cross_chain | yes | Execute a gasless cross-chain move. Signs one Permit2 intent; the agent pays no gas. |
Read tools work with no credentials. robyn_cross_chain only activates when ROBYN_SIGNER_KEY is set — otherwise the server is safely read-only.
{
"mcpServers": {
"robyn": {
"command": "npx",
"args": ["-y", "anygas-mcp"],
"env": {
"ROBYN_SVC": "https://api.anygas.xyz/svc",
"ROBYN_SIGNER_KEY": "0x…" // optional — omit for read-only
}
}
}
}
Permit2 SignatureTransfer requires a single, standard approval per (token, chain) — done once by the signer:
await token.approve("0x000000000022D473030F116dDEE9F6B43aC78BA3", ethers.MaxUint256);
After that, every cross-chain move is a single gasless signature — the agent never holds native gas anywhere.
Agent: "Move 25 USDC from Base to Arbitrum." Calls
robyn_cross_chain({ fromChain: 8453, fromToken: "0x833589…", amount: "25000000", toChain: 42161, toToken: "0xaf88…" })→{ id: "rt_…", status: "BRIDGING", gasless: true }, thenrobyn_route_status→DONE.
Stellar is a first-class destination too — set toChain: "stellar" and toToken: "USDC".
ROBYN_SIGNER_KEY is a hot key. Fund it only with what an agent should be able to move; treat the MCP env as a secret.ROBYN_SIGNER_KEY unset to run a safe, read-only quoting/tracking server.MIT.
FAQs
Robyn MCP server — gasless cross-chain for AI agents. Quote and execute gasless moves across 22 EVM chains + Stellar, one signature, no native gas.
The npm package anygas-mcp receives a total of 21 weekly downloads. As such, anygas-mcp popularity was classified as not popular.
We found that anygas-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.