
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
arc-treasury-mcp
Advanced tools
What USDC and EURC really earn on Arc: Aave v4 and Morpho rates read from the contracts, and where a given size earns most after its own effect on the pool. MCP tools; paid ones settle per call in USDC over x402.
What USDC and EURC really earn on Arc (chain 5042), read from the lending contracts rather than from an index.
A quoted rate is what a pool pays as it stands. On 18 September 2026 the best
quoted USDC rate on Arc was 6.26 percent, in a market holding eleven thousand
dollars; ten million deposited into it earns 0.007 percent. arc_best_yield
answers for your size.
| Tool | What it answers | |
|---|---|---|
arc_best_yield | Where a given amount of USDC earns most once the deposit's own effect on the pool is counted. Call before moving treasury. | 5¢ |
arc_lending_rates | Supply and borrow rates, utilisation and pool size for every USDC and EURC market on Aave v4 and Morpho. | 1¢ |
gateway_activity_arc | Circle Gateway activity on Arc, measured at the contract. | free |
Aave on Arc is version 4, a Hub-and-Spoke design with no Pool and no aTokens; an address book written for version 3 will not find it. These tools read it directly.
{ "mcpServers": { "arc-treasury": { "command": "npx", "args": ["-y", "arc-treasury-mcp"] } } }
With nothing else set the free tool works and the paid ones say what they need.
| Variable | What |
|---|---|
PAY_WALLET_KEY | The agent's own key. Read from its own environment, used only to sign the payment authorisation locally, never sent anywhere. |
PAY_CHAIN | Where that wallet's USDC is: arc (default), base, arbitrum or hyperEvm. The payment need not be on the chain the data is about. |
PAY_MAX_USDC_PER_CALL | The most one call may cost. Default 0.05, which admits every tool here. The owner sets this. A price above it is refused before anything is signed. |
Payment is USDC over x402 through Circle Gateway, gas-free for the buyer.
You are never charged for an answer that was not produced. The service verifies the payment, produces the answer, and only then settles.
Audited on 18 September 2026 with Circle's own client and a real signature from
an unfunded wallet: on every route and on all four chains Circle verified the
signature, the answer was produced, and settlement was refused for one reason
only, insufficient_balance, with the answer withheld.
FAQs
What USDC and EURC really earn on Arc: Aave v4 and Morpho rates read from the contracts, and where a given size earns most after its own effect on the pool. MCP tools; paid ones settle per call in USDC over x402.
We found that arc-treasury-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.