
Product
Socket Firewall Now Blocks Malicious VS Code and Open VSX Extensions
Socket Firewall blocks malicious VS Code and Open VSX extensions before install, protecting developers from compromised editor marketplaces.
spongewallet
Advanced tools
CLI for creating, claiming, and using Sponge agent wallets from the terminal.
spongewallet is the terminal entrypoint for Sponge Wallet. It wraps the SDK CLI and exposes the common flows for onboarding, wallet operations, swaps, bridges, and paid API requests.
Run it directly:
npx spongewallet --help
Or install it:
npm install -g spongewallet
Create an agent wallet:
npx spongewallet init
Restrict the later claim to one email:
npx spongewallet init --email alice@example.com
Claim a pending agent or log in with the browser auth flow:
npx spongewallet login
Inspect the current session:
npx spongewallet whoami
npx spongewallet version --check
Print MCP config for Claude Code or Cursor:
npx spongewallet mcp print
init creates an agent immediately, prints addresses and MCP config, and stores pending claim metadata locally.login claims that pending agent if claim metadata exists. Otherwise it falls back to the standard browser auth flow.balance, send, history, tokens, and onramp for day-to-day operations.# Session
npx spongewallet init
npx spongewallet login
npx spongewallet whoami
npx spongewallet logout
npx spongewallet mcp print
npx spongewallet version --check
# Wallets and transfers
npx spongewallet balance
npx spongewallet send base 0xabc... USDC 10
npx spongewallet history 20 --chain base
# Transactions, swaps, and bridges
npx spongewallet tx status base 0x123...
npx spongewallet swap quote SOL USDC 1
npx spongewallet swap tempo pathUSD USDC.e 1
npx spongewallet bridge base solana USDC 25
# Paid requests
npx spongewallet pay discover "web search"
npx spongewallet pay service <service-id>
npx spongewallet pay x402 --url https://api.example.com/premium
npx spongewallet pay mpp --url https://tempo.example.com/premium --chain tempo
npx spongewallet pay mpp-session start --chain tempo --max-deposit 1
npx spongewallet pay mpp-session request --session-id <session-id> --url https://tempo.example.com/session-endpoint
npx spongewallet pay mpp-session close --session-id <session-id> --reason done
# Cards
npx spongewallet card add --flow basis-theory
npx spongewallet card add --flow link
npx spongewallet card status
npx spongewallet card fund 100 --chain base
# Bank accounts and USD transfers
npx spongewallet bank onboard
npx spongewallet bank virtual-account create <wallet-id>
npx spongewallet bank external-accounts list
npx spongewallet bank send <wallet-id> <external-account-id> 100.00 --payment-rail ach
# Markets
npx spongewallet market polymarket search "Sixers Celtics"
npx spongewallet market polymarket order nba-phi-bos-2026-05-02 yes buy 3 --price 0.40
npx spongewallet market hyperliquid markets 10
npx spongewallet market hyperliquid chart BTC/USDC:USDC --interval 15m
init, login, logout, whoami, mcp: session setup and authenticationbalance, send, history, tokens, search-tokens, onramp, tx, swap, bridge, pay: balances, transfers, swaps, bridging, and paymentskeys, card, bank, plan, trade, auth: stored secrets, cards, bank accounts, USD transfers, and approval flowsmarket, advanced: Polymarket, Hyperliquid, and low-level commandsBy default, the CLI uses Sponge's browser auth flow. After login, credentials are stored at:
~/.spongewallet/credentials.json
For non-interactive usage, set an API key:
export SPONGE_API_KEY=<agent-api-key>
The CLI sends anonymous usage events to Sponge's PostHog project so we can understand command adoption and login success rates. It does not send raw command arguments, API keys, wallet addresses, or email values.
This package is a thin launcher around @paysponge/sdk. If you want the SDK and the CLI in one dependency, install:
npm install @paysponge/sdk
This is early access software. Command surface and flows may still change.
FAQs
CLI launcher for SpongeWallet onboarding and MCP setup
We found that spongewallet demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Product
Socket Firewall blocks malicious VS Code and Open VSX extensions before install, protecting developers from compromised editor marketplaces.

Research
More than 140 Mastra npm packages were compromised in a supply chain attack that used a typosquatted dependency to deliver a cross-platform infostealer during installation.

Research
/Security News
A new npm package tests AI malware scanners with prompt injection, safety-triggering comments, context flooding, and obfuscated JavaScript.