
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
honeycheck-mcp
Advanced tools
Before buying a token on Arc, check whether it can be sold back. An MCP server for the Honeycheck sell test, free or paid per call in USDC over x402.
Before buying a token on Arc, check whether it can be sold back.
An MCP server for Honeycheck, the sell test for every token that trades against USDC on Arc (chain 5042). A token can trade actively and still be unsellable for a new buyer: some Uniswap v4 hooks keep an allow-list, so the wallets already selling get full value and a fresh wallet gets almost nothing. Trading history does not show that. A simulation from a fresh address does.
| Tool | What it answers | |
|---|---|---|
check_token | Can this token be sold back? A verdict, what one USDC returns, and why. Call it first. | free |
hook_track_record | Every Uniswap v4 launch hook on Arc by what its tokens do to a fresh buyer. | free |
recent_traps | The latest tokens a fresh wallet cannot sell. | free |
new_launches | Everything that started trading against USDC on Arc in the last hour, already sell-tested. | paid |
liquidity_pulls | Tokens whose liquidity left in the last day. | paid |
verdict_changes | What was checked for the first time, and what stopped being true. | paid |
The three free tools work with no wallet. The three feeds are a reading of the chain every two minutes, which is the part that costs, so they are sold per call and say plainly what they need when no wallet is set.
{
"mcpServers": {
"honeycheck": { "command": "npx", "args": ["-y", "honeycheck-mcp"] }
}
}
With nothing else set it uses Honeycheck's free route, cached and rate-limited.
Give the tool a funded Circle Gateway
wallet and check_token pays a cent a call in USDC on Arc over x402, gas-free, for a
live uncached answer:
| Variable | What |
|---|---|
HONEYCHECK_WALLET_KEY | The agent's own key. Read from its own environment, used only to sign the payment authorisation locally, never sent anywhere. |
HONEYCHECK_MAX_USDC_PER_CALL | The most one call may cost. Default 0.05. The owner sets this. A price above it is refused before anything is signed. |
HONEYCHECK_URL | Another Honeycheck origin, for testing. |
Deposit once into Gateway with Circle's client (new GatewayClient({ chain: 'arc', … }).deposit('1.00'));
a dollar is a hundred checks.
You are never charged for an answer that was not produced. Honeycheck verifies
the payment, computes the answer, and only then settles. A token with no trades, or a
refused simulation, comes back paid: false.
The free path, all three tools and the spend cap are tested, including a real stdio session against the live service. The paid path is wired to Circle's published client and the live endpoint is verified against Circle's facilitator, which parses its requirements and refuses only a bad signature. A real paid call has not been made from this package yet: that needs a funded wallet, which is the owner's to supply.
FAQs
Before buying a token on Arc, check whether it can be sold back. An MCP server for the Honeycheck sell test, free or paid per call in USDC over x402.
We found that honeycheck-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.