
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
Developer-friendly & type-safe Typescript SDK specifically catered to leverage *icrcmcp* API.
Developer-friendly & type-safe Typescript SDK specifically catered to leverage icrcmcp API.
[!IMPORTANT] This SDK is not yet ready for production use. To complete setup please follow the steps outlined in your workspace. Delete this section before > publishing to a package manager.
ICRC: ICRC API
[!TIP] To finish publishing your SDK to npm and others you must run your first generation action.
The SDK can be installed with either npm, pnpm, bun or yarn package managers.
npm add <UNSET>
pnpm add <UNSET>
bun add <UNSET>
yarn add <UNSET> zod
# Note that Yarn does not install peer dependencies automatically. You will need
# to install zod as shown above.
[!NOTE] This package is published with CommonJS and ES Modules (ESM) support.
This SDK is also an installable MCP server where the various SDK methods are exposed as tools that can be invoked by AI applications.
Node.js v20 or greater is required to run the MCP server from npm.
Add the following server definition to your claude_desktop_config.json file:
{
"mcpServers": {
"Icrcmcp": {
"command": "npx",
"args": [
"-y", "--package", "icrcmcp",
"--",
"mcp", "start",
"--server-url", "..."
]
}
}
}
Create a .cursor/mcp.json file in your project root with the following content:
{
"mcpServers": {
"Icrcmcp": {
"command": "npx",
"args": [
"-y", "--package", "icrcmcp",
"--",
"mcp", "start",
"--server-url", "..."
]
}
}
}
You can also run MCP servers as a standalone binary with no additional dependencies. You must pull these binaries from available Github releases:
curl -L -o mcp-server \
https://github.com/{org}/{repo}/releases/download/{tag}/mcp-server-bun-darwin-arm64 && \
chmod +x mcp-server
If the repo is a private repo you must add your Github PAT to download a release -H "Authorization: Bearer {GITHUB_PAT}".
{
"mcpServers": {
"Todos": {
"command": "./DOWNLOAD/PATH/mcp-server",
"args": [
"start"
]
}
}
}
For a full list of server arguments, run:
npx -y --package icrcmcp -- mcp start --help
For supported JavaScript runtimes, please consult RUNTIMES.md.
import { Icrcmcp } from "icrcmcp";
const icrcmcp = new Icrcmcp({
serverURL: "https://api.example.com",
});
async function run() {
const result = await icrcmcp.accountBalances
.listAccountBalancesApiV1LedgersLedgerCanisterIdAccountsAccountIdBalanceHistoryGet(
{
accountId: "<id>",
ledgerCanisterId: "<id>",
},
);
console.log(result);
}
run();
All the methods listed above are available as standalone functions. These functions are ideal for use in applications running in the browser, serverless runtimes or other environments where application bundle size is a primary concern. When using a bundler to build your application, all unused functionality will be either excluded from the final bundle or tree-shaken away.
To read more about standalone functions, check FUNCTIONS.md.
accountBalancesListAccountBalancesApiV1LedgersLedgerCanisterIdAccountsAccountIdBalanceHistoryGet - List daily transaction balances for an accountaccountsCountAccountsApiV2LedgersLedgerCanisterIdAccountsCountGet - Get the total number of accounts that meet the criteriaaccountsCountTransactionsApiV2LedgersLedgerCanisterIdAccountsIdTransactionsCountGet - Get the total count of transactions matching the given criteriaaccountsGetAccountApiV1LedgersLedgerCanisterIdAccountsIdGet - Get owner's accountaccountsListAccountsApiV1LedgersLedgerCanisterIdAccountsGet - List accountsaccountsListAccountsApiV2LedgersLedgerCanisterIdAccountsGet - List accountsaccountsListAccountTransactionsApiV1LedgersLedgerCanisterIdAccountsIdTransactionsGet - List transactions for an accountaccountsListAccountTransactionsApiV2LedgersLedgerCanisterIdAccountsIdTransactionsGet - List transactions for an accountblocksGetTansactionApiV1LedgersLedgerCanisterIdBlocksBlockHashGet - Get blockblocksListBlocksApiV1LedgersLedgerCanisterIdBlocksGet - List blockscanistersListCanistersApiV1LedgersLedgerCanisterIdCanistersGet - List canisterscirculatingSupplyGetCirculatingSupplyApiV1LedgersLedgerCanisterIdCirculatingSupplyGet - Get a series of circulating supply values for a ledgercirculatingSupplyGetCirculatingSupplyTxtApiV1LedgersLedgerCanisterIdCirculatingSupplyTxtGet - Get the latest total supply value in plain text format.imagesGetLedgerImageApiV1ImagesLedgersLedgerCanisterIdPngGet - Get open graph image for ICRC ledgerimagesGetLedgerTransactionsImageApiV1ImagesLedgersLedgerCanisterIdTransactionsPngGet - Get open graph image for ICRC ledger transactionsimagesGetSnsAccountImageApiV1ImagesLedgersLedgerCanisterIdAccountsIdPngGet - Get open graph image for ICRC ledger accountimagesGetSnsTransactionImageApiV1ImagesLedgersLedgerCanisterIdTransactionsIndexPngGet - Get open graph image for ICRC ledger transactionledgersCountLedgersApiV2LedgersCountGet - Count ledgersledgersListApiV1LedgersGet - List ledgersledgersListApiV2LedgersGet - List ledgersledgersRetrieveApiV1LedgersLedgerCanisterIdGet - Get ledgerledgersRetrieveApiV2LedgersLedgerCanisterIdGet - Get ledgertotalBurnedPerDayListTotalBurnedPerDayApiV1LedgersLedgerCanisterIdTotalBurnedPerDayGet - List Total Burned Per DaytotalNewAccountsPerDayListTotalNewAccountsPerDayApiV1LedgersLedgerCanisterIdTotalNewAccountsPerDayGet - List Total New Accounts Got Created Per DaytotalNewAccountsPerDayListTotalNewAccountsTillDateApiV1LedgersLedgerCanisterIdTotalNewAccountsTillDateGet - List Total New Accounts Got Created Till DatetotalSupplyGetTotalSupplyApiV2LedgersLedgerCanisterIdTotalSupplyGet - Get a series of total supply values for a ledgertotalSupplyGetTotalSupplyTxtApiV2LedgersLedgerCanisterIdTotalSupplyTxtGet - Get the latest total supply value in plain text format.totalSupplySeriesApiV1LedgersLedgerCanisterIdTotalSupplyGet - Retrieve total supply series metrics for a tokentransactionCountListChainKeyTransactionCountApiV1ChainKeyLedgersTransactionCountGet - List aggregated transaction count for chain key ledgerstransactionCountListChainKeyTransactionCountApiV2TransactionCountGet - List aggregated transaction counttransactionsCountTransactionsApiV2LedgersLedgerCanisterIdTransactionsCountGet - Get the total count of transactions matching the given criteriatransactionsGetTansactionApiV1LedgersLedgerCanisterIdTransactionsIndexGet - Get transactiontransactionsListTransactionsApiV1LedgersLedgerCanisterIdTransactionsGet - List transactionstransactionsListTransactionsApiV2LedgersLedgerCanisterIdTransactionsGet - List transactionstransactionVolumeListTransactionVolumeApiV1LedgersLedgerCanisterIdTransactionVolumeGet - List transaction volumeSome of the endpoints in this SDK support retries. If you use the SDK without any configuration, it will fall back to the default retry strategy provided by the API. However, the default retry strategy can be overridden on a per-operation basis, or across the entire SDK.
To change the default retry strategy for a single API call, simply provide a retryConfig object to the call:
import { Icrcmcp } from "icrcmcp";
const icrcmcp = new Icrcmcp({
serverURL: "https://api.example.com",
});
async function run() {
const result = await icrcmcp.accountBalances
.listAccountBalancesApiV1LedgersLedgerCanisterIdAccountsAccountIdBalanceHistoryGet(
{
accountId: "<id>",
ledgerCanisterId: "<id>",
},
{
retries: {
strategy: "backoff",
backoff: {
initialInterval: 1,
maxInterval: 50,
exponent: 1.1,
maxElapsedTime: 100,
},
retryConnectionErrors: false,
},
},
);
console.log(result);
}
run();
If you'd like to override the default retry strategy for all operations that support retries, you can provide a retryConfig at SDK initialization:
import { Icrcmcp } from "icrcmcp";
const icrcmcp = new Icrcmcp({
serverURL: "https://api.example.com",
retryConfig: {
strategy: "backoff",
backoff: {
initialInterval: 1,
maxInterval: 50,
exponent: 1.1,
maxElapsedTime: 100,
},
retryConnectionErrors: false,
},
});
async function run() {
const result = await icrcmcp.accountBalances
.listAccountBalancesApiV1LedgersLedgerCanisterIdAccountsAccountIdBalanceHistoryGet(
{
accountId: "<id>",
ledgerCanisterId: "<id>",
},
);
console.log(result);
}
run();
IcrcmcpError is the base class for all HTTP error responses. It has the following properties:
| Property | Type | Description |
|---|---|---|
error.message | string | Error message |
error.statusCode | number | HTTP response status code eg 404 |
error.headers | Headers | HTTP response headers |
error.body | string | HTTP body. Can be empty string if no body is returned. |
error.rawResponse | Response | Raw HTTP response |
error.data$ | Optional. Some errors may contain structured data. See Error Classes. |
import { Icrcmcp } from "icrcmcp";
import * as errors from "icrcmcp/models/errors";
const icrcmcp = new Icrcmcp({
serverURL: "https://api.example.com",
});
async function run() {
try {
const result = await icrcmcp.accountBalances
.listAccountBalancesApiV1LedgersLedgerCanisterIdAccountsAccountIdBalanceHistoryGet(
{
accountId: "<id>",
ledgerCanisterId: "<id>",
},
);
console.log(result);
} catch (error) {
// The base class for HTTP error responses
if (error instanceof errors.IcrcmcpError) {
console.log(error.message);
console.log(error.statusCode);
console.log(error.body);
console.log(error.headers);
// Depending on the method different errors may be thrown
if (error instanceof errors.HTTPValidationError) {
console.log(error.data$.detail); // ValidationError[]
}
}
}
}
run();
Primary errors:
IcrcmcpError: The base class for HTTP error responses.
HTTPValidationError: Validation Error. Status code 422.Network errors:
ConnectionError: HTTP client was unable to make a request to a server.RequestTimeoutError: HTTP request timed out due to an AbortSignal signal.RequestAbortedError: HTTP request was aborted by the client.InvalidRequestError: Any input used to create a request is invalid.UnexpectedClientError: Unrecognised or unexpected error.Inherit from IcrcmcpError:
ResponseValidationError: Type mismatch between the data returned from the server and the structure expected by the SDK. See error.rawValue for the raw value and error.pretty() for a nicely formatted multi-line string.The TypeScript SDK makes API calls using an HTTPClient that wraps the native
Fetch API. This
client is a thin wrapper around fetch and provides the ability to attach hooks
around the request lifecycle that can be used to modify the request or handle
errors and response.
The HTTPClient constructor takes an optional fetcher argument that can be
used to integrate a third-party HTTP client or when writing tests to mock out
the HTTP client and feed in fixtures.
The following example shows how to use the "beforeRequest" hook to to add a
custom header and a timeout to requests and how to use the "requestError" hook
to log errors:
import { Icrcmcp } from "icrcmcp";
import { HTTPClient } from "icrcmcp/lib/http";
const httpClient = new HTTPClient({
// fetcher takes a function that has the same signature as native `fetch`.
fetcher: (request) => {
return fetch(request);
}
});
httpClient.addHook("beforeRequest", (request) => {
const nextRequest = new Request(request, {
signal: request.signal || AbortSignal.timeout(5000)
});
nextRequest.headers.set("x-custom-header", "custom value");
return nextRequest;
});
httpClient.addHook("requestError", (error, request) => {
console.group("Request Error");
console.log("Reason:", `${error}`);
console.log("Endpoint:", `${request.method} ${request.url}`);
console.groupEnd();
});
const sdk = new Icrcmcp({ httpClient });
You can setup your SDK to emit debug logs for SDK requests and responses.
You can pass a logger that matches console's interface as an SDK option.
[!WARNING] Beware that debug logging will reveal secrets, like API tokens in headers, in log messages printed to a console or files. It's recommended to use this feature only during local development and not in production.
import { Icrcmcp } from "icrcmcp";
const sdk = new Icrcmcp({ debugLogger: console });
You can also enable a default debug logger by setting an environment variable ICRCMCP_DEBUG to true.
This SDK is in beta, and there may be breaking changes between versions without a major version update. Therefore, we recommend pinning usage to a specific package version. This way, you can install the same version each time without breaking changes unless you are intentionally looking for the latest version.
While we value open-source contributions to this SDK, this library is generated programmatically. Any manual changes added to internal files will be overwritten on the next generation. We look forward to hearing your feedback. Feel free to open a PR or an issue with a proof of concept and we'll do our best to include it in a future release.
FAQs
Developer-friendly & type-safe Typescript SDK specifically catered to leverage *icrcmcp* API.
The npm package icrcmcp receives a total of 4 weekly downloads. As such, icrcmcp popularity was classified as not popular.
We found that icrcmcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.