
Research
/Security News
77 Firefox Extensions Linked to Crypto Wallet and Credential Theft
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.
apiosk-mcp-server
Advanced tools
Official MCP server for discovering, paying for, and publishing Apiosk APIs.
npx -y apiosk-mcp-server
APIOSK_PRIVATE_KEY=0x... npx -y apiosk-mcp-server
APIOSK_CONNECT_TOKEN=... npx -y apiosk-mcp-server
After the MCP server is installed in Claude, Codex, or another client, the fastest first-run path in local stdio mode is:
{ "wallet_label": "My Apiosk wallet" }
Call that through apiosk_get_started. It will create a local wallet when needed, or you can pass connect_string to save managed access locally and immediately run a discovery probe plus a small test call.
The local stdio package exposes wallet tools that let Claude or Codex:
The active wallet is mirrored to:
~/.apiosk/wallet.json~/.apiosk/wallet.txtso older Apiosk scripts can reuse it.
Add to ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"apiosk": {
"command": "npx",
"args": ["-y", "apiosk-mcp-server"]
}
}
}
{
"mcpServers": {
"apiosk": {
"command": "npx",
"args": ["-y", "apiosk-mcp-server"]
}
}
}
{
"mcpServers": {
"apiosk": {
"command": "npx",
"args": ["-y", "apiosk-mcp-server"]
}
}
}
Remote HTTP:
claude mcp add --transport http apiosk https://mcp.apiosk.com/mcp
Local stdio:
{
"mcpServers": {
"apiosk": {
"command": "npx",
"args": ["-y", "apiosk-mcp-server"]
}
}
}
{
"mcpServers": {
"apiosk": {
"command": "npx",
"args": ["-y", "apiosk-mcp-server"]
}
}
}
{
"mcpServers": {
"apiosk": {
"command": "node",
"args": ["/full/path/to/apiosk-mcp/index.mjs"]
}
}
}
Static tools:
apiosk_helpapiosk_exploreapiosk_searchapiosk_get_apiapiosk_executeLocal wallet tools in stdio mode:
apiosk_get_startedapiosk_wallet_listapiosk_wallet_createapiosk_configureapiosk_wallet_selectapiosk_wallet_updateapiosk_wallet_deleteapiosk_wallet_reveal_secretapiosk_wallet_save_secretPublish tools in stdio mode:
apiosk_publish_apiapiosk_list_my_apisapiosk_update_apiapiosk_delete_apiOptional dashboard-managed wallet tools:
apiosk_list_walletsapiosk_create_walletapiosk_update_walletapiosk_delete_walletapiosk_get_wallet_activityapiosk_create_wallet_connect_stringapiosk_list_wallet_api_keysapiosk_create_wallet_api_keyapiosk_update_wallet_api_keyapiosk_delete_wallet_api_keyDynamic tools:
{}
{ "listing_type": "dataset", "search": "weather", "limit": 5 }
{ "search": "diff", "limit": 5 }
{ "label": "Claude wallet" }
The create response includes:
Create a local wallet automatically, discover the catalog, and run a test call:
{
"wallet_label": "Starter wallet",
"test_slug": "agent-json-diff",
"test_input": {
"before": { "ok": true },
"after": { "ok": false }
}
}
Or save a dashboard-managed connect string locally and verify it:
{
"connect_string": "export APIO_GATEWAY_URL=https://gateway.apiosk.com\nexport APIO_CHAIN_ID=8453\nexport APIO_AGENT_WALLET_ADDRESS=0x...\nexport APIO_CONNECT_TOKEN=aw_...\nexport APIO_CONNECT_AUTHORIZATION=Bearer aw_...\nexport APIO_CONNECT_HEADER_NAME=X-Apiosk-Connect-Token",
"test_slug": "agent-json-diff",
"test_input": {
"before": { "ok": true },
"after": { "ok": false }
},
"create_wallet": false
}
{ "section": "funding" }
{ "wallet_id": "...", "section": "funding", "funding_provider": "onramper" }
{ "wallet_id": "..." }
{
"name": "My Weather API",
"slug": "my-weather-api",
"endpoint_url": "https://example.com",
"price_usd": 0.01,
"description": "Real-time weather data",
"listing_group": "datasets"
}
{
"slug": "agent-json-diff",
"input": {
"before": { "ok": true },
"after": { "ok": false }
}
}
If the server lists a dynamic tool named agent-json-diff, call it directly:
{
"before": { "ok": true },
"after": { "ok": false }
}
Run the safe default suite from a repo checkout:
cd /Users/olivierbrinkman/Development/Apiosk/subs/mcp
npm run test:macbook-air
Default coverage:
npm testAPIOSK_HOMEhealth, tools/list, apiosk_search, apiosk_explore, and apiosk_get_apiwallet.json and wallet.txtUseful options:
TARGET=local to skip hosted checksTARGET=hosted to skip local checksAPIOSK_RUN_REMOTE_WALLET_TEST=1 to create/configure/delete a wallet on the hosted serverAPIOSK_RUN_FUNDED_TESTS=1 APIOSK_TEST_PRIVATE_KEY=0x... to import a funded wallet and run a real paid execute testAPIOSK_RUN_FUNDED_TESTS=1 APIOSK_RUN_PUBLISH_TEST=1 APIOSK_TEST_PRIVATE_KEY=0x... to also test publish, list, update, and delete with a temporary listingExample funded run:
cd /Users/olivierbrinkman/Development/Apiosk/subs/mcp
APIOSK_RUN_FUNDED_TESTS=1 \
APIOSK_TEST_PRIVATE_KEY=0x... \
npm run test:macbook-air
Run a hosted-only test directly against the public MCP endpoint:
cd /Users/olivierbrinkman/Development/Apiosk/subs/mcp
npm run test:live
Default live coverage:
https://mcp.apiosk.com/healthapiosk_search, apiosk_explore, and apiosk_get_apiOptional live funded checks:
APIOSK_RUN_FUNDED_TESTS=1 APIOSK_TEST_PRIVATE_KEY=0x... npm run test:liveAPIOSK_RUN_FUNDED_TESTS=1 APIOSK_RUN_PUBLISH_TEST=1 APIOSK_TEST_PRIVATE_KEY=0x... npm run test:liveUse a throwaway funded wallet for the live funded mode, because the private key is sent to the hosted MCP when importing the wallet for autonomous pay/publish tests.
APIOSK_PRIVATE_KEY: enables automatic x402 settlement and signed publish requestsAPIOSK_CONNECT_TOKEN: attach a dashboard-managed connect tokenAPIOSK_CONNECT_AUTHORIZATION: attach a custom Authorization headerAPIOSK_CONNECT_HEADER_NAME: override the connect-token header nameAPIOSK_WALLET_ADDRESS: send a wallet address for wallet-aware flowsAPIOSK_X_PAYMENT: attach a pre-built x402 proof manuallyAPIOSK_GATEWAY: override the gateway base URLAPIOSK_CONTROL_PLANE_URL: override the MCP-owned control-plane API base URL used for account, credits, and managed-wallet routes. Defaults to https://mcp.apiosk.comAPIOSK_DASHBOARD_URL: override the human-facing dashboard/app URL stored in local config and used in confirmation flows. Defaults to https://apiosk.comAPIOSK_DASHBOARD_JWT or APIOSK_USER_JWT: unlock dashboard wallet routesAPIOSK_ENABLE_LOCAL_WALLETS=true: enable local wallet tools in HTTP server modeAPIOSK_HOME: override the default ~/.apiosk directoryAPIOSK_MCP_WALLET_STORE: override the local wallet store pathIn the local stdio package, MCP can now help a human top up Apiosk credits and then let the agent spend those credits later:
apiosk_create_account if the user needs a new Apiosk accountapiosk_sign_in to store a local dashboard session tokenapiosk_buy_credits to create an Adyen checkout linkapiosk_get_credits_status after payment to reconcile the top-up and confirm the balanceIf signup does not return a session immediately, tell the user to confirm their email first and then call apiosk_sign_in.
These calls now target the MCP-owned control-plane surface by default:
https://mcp.apiosk.com/api/auth/mcp-sign-uphttps://mcp.apiosk.com/api/auth/mcp-sign-inhttps://mcp.apiosk.com/api/credits/topuphttps://mcp.apiosk.com/api/credits/reconcileThe public HTTP deployment is safe-by-default: local wallet and publish tools are disabled unless APIOSK_ENABLE_LOCAL_WALLETS=true is set on that server.
Test it:
curl https://mcp.apiosk.com/health
curl https://mcp.apiosk.com/mcp \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
npm install
npm run dev # HTTP server on :3000
node index.mjs # stdio mode with local wallet tools enabled
Fresh-environment smoke test:
cd /Users/olivierbrinkman/Development/Apiosk/subs/mcp
npm run smoke:new-env
MIT
FAQs
Official MCP server for browsing, paying for, and publishing Apiosk APIs
We found that apiosk-mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.

Security News
NIST disclosed an unreleased AI tool called V-etalon and opened a broad inquiry into NVD modernization after years of automation plans produced no public enrichment system.

Security News
In his AI Council 2026 talk, Feross Aboukhadijeh covers recent package compromises, vulnerability discovery, and a more automated security model.