{"name":"com.imbawallet/agent","slug":"imbawallet-agent","title":"IMBA Agent Spend","description":"IMBA spend MCP: USDT TRC-20 deposit and catalog buy with your key. No withdraw.","url":"https://mcp.market/server/imbawallet-agent","rating":null,"grade":"B","score":74,"certified":false,"status":"active","category":"ai","tags":["ai"],"presence":{"score":18,"stars":null,"forks":null,"downloads_week":116,"last_push_at":null,"license":"MIT"},"uptime":{"percent":96,"checks":28,"ok":27,"last_checked_at":"2026-11-04T04:10:28.024Z","last_ok_at":"2026-11-04T04:10:28.024Z","latency_ms":974},"claimed":false,"transport":"mixed","callable_via_gateway":true,"default_price_micros":0,"repository":"https://github.com/IMBAwallet/IMBA_front","website":"https://imbawallet.com/agent_api_about_en.html","version":"0.1.4","remotes":[{"type":"streamable-http","url":"https://imbawallet.com/mcp/spend","headers":[{"description":"Decimal agent client_id","isRequired":true,"name":"X-IMBA-Agent-Client-Id"},{"description":"Operator Ed25519 private key, one HTTP header line (PEM with \\n or base64url). IMBA does not host a shared spend wallet.","isRequired":true,"isSecret":true,"name":"X-IMBA-Agent-Private-Key"}]}],"packages":[{"registryType":"npm","identifier":"@imba_wallet/agent-mcp","version":"0.1.4","transport":{"type":"stdio"},"environmentVariables":[{"description":"Decimal agent client_id from register","isRequired":true,"format":"string","name":"IMBA_AGENT_CLIENT_ID"},{"description":"Ed25519 private key (PKCS#8 PEM or base64). Never a shared IMBA key.","isRequired":true,"format":"string","isSecret":true,"name":"IMBA_AGENT_PRIVATE_KEY"}]}],"tools":[{"name":"create_card","description":"Issue a Visa/MasterCard prepaid from this agent 2401 USDT so the agent can pay merchants that require a card (airlines, hotels, SaaS, datacenter/GPU clouds). POST /api/pin/create_card. ext_id required. imba_product_id is core.card_product.id. Never payment_source=stars. Never pass client_id. IMBA does not create the booking.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"imba_product_id":{"type":"integer","exclusiveMinimum":0,"maximum":9007199254740991},"ext_id":{"type":"string","minLength":1,"maxLength":128,"description":"Idempotency key. Reuse the same id to retry the same order."},"email":{"description":"Cardholder KYC email, not the agent 3DS mailbox.","type":"string","maxLength":254},"phone":{"type":"string","maxLength":32},"first_name":{"type":"string","maxLength":64},"last_name":{"type":"string","maxLength":64},"birth_date":{"type":"string","maxLength":32},"country":{"type":"string","maxLength":8}},"required":["imba_product_id","ext_id"],"$schema":"https://json-schema.org/draft/2020-12/schema"}},{"name":"get_balance","description":"GET /api/balance. USDT is the spendable catalog currency.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{}}},{"name":"get_card_details","description":"POST /api/pin/get_card_details for a card this agent owns. Needed to present PAN at merchant checkout (airline, datacenter, SaaS). PAN/CVV arrive as card_encrypted JWE when jwe_public_key is registered (PATCH webhook). Without that key the number is masked. Never logs raw PAN. cvv defaults true. Never pass client_id.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"card_id":{"type":"string","minLength":1,"maxLength":256},"cvv":{"type":"boolean"}},"required":["card_id"],"$schema":"https://json-schema.org/draft/2020-12/schema"}},{"name":"get_deposit_address","description":"POST /api/deposit_address blockchain=tron. Address is issued for the authenticated agent only. Always re-fetch before send. Do not cache. USDT TRC-20 only. 24h unfunded hold.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{}}},{"name":"get_spend_policy","description":"Forbidden rails and tier rules. Allowed catalog: Visa prepaid, travel eSIM, gift cards, paid KYT address screen. Read-only.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{}}},{"name":"kyt_check","description":"Screen a crypto address for dirt (sanctions / mixer exposure). Use BEFORE you accept a TRC-20 send, or AFTER a wallet is blocked and the reason is unclear. POST /api/kyt_check. Body: network (tron_usdt | eth | btc) + address. Debits ~0.99 USDT from 2401. Returns a report — does not gate deposit, does not ban or unblock. TON is not in this catalog. Never pass client_id. Space ~1s.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"network":{"type":"string","minLength":2,"maxLength":32},"address":{"type":"string","minLength":8,"maxLength":128},"refresh":{"type":"boolean"}},"required":["network","address"],"$schema":"https://json-schema.org/draft/2020-12/schema"}},{"name":"kyt_check_get","description":"POST /api/kyt_check_get. Poll until the report is ready. Own check only (404 otherwise). Use after kyt_check when a wallet was blocked and you need the dirt report. Never pass client_id.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"id":{"type":"integer","exclusiveMinimum":0,"maximum":9007199254740991}},"required":["id"],"$schema":"https://json-schema.org/draft/2020-12/schema"}},{"name":"kyt_checks","description":"POST /api/kyt_checks. Own KYT history plus quote fields. Use to find a past address check. Space ~1s. Never pass client_id.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"limit":{"type":"integer","minimum":1,"maximum":100},"last_id":{"type":"integer","exclusiveMinimum":0,"maximum":9007199254740991}},"$schema":"https://json-schema.org/draft/2020-12/schema"}},{"name":"kyt_quote","description":"POST /api/kyt_quote. Price for a paid crypto-address screen (Didit). Debit is on kyt_check (~0.99 USDT from 2401), not on quote. Off unless didit.enabled and didit.agent_api. Does not gate TRON deposit. Not /api/client/kyt_* and not partner. Space ~1s.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{}}},{"name":"list_card_products","description":"POST /api/card_products. Use id as imba_product_id for create_card (Visa prepaid). Space catalog calls ~1s apart.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{}}},{"name":"list_cards","description":"POST /api/cards for the authenticated agent. No client_id argument.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{}}},{"name":"list_esim_plans","description":"POST /api/esim/plans. Travel/data eSIM. esim_provider=yesim. Optional country ISO2. Use plan id with purchase_esim. Space catalog calls ~1s apart (agent catalog_gap).","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"country":{"type":"string","maxLength":8},"esim_provider":{"type":"string","maxLength":32}},"$schema":"https://json-schema.org/draft/2020-12/schema"}},{"name":"list_gift_offers","description":"POST /api/offers. Live gift catalog (~20k positions / ~2k unique: Apple, Google Play, Steam, games, travel, retail). Optional query string. Then purchase_gift with offer_id + ext_id. Space catalog calls ~1s apart. Do not assume a SKU.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"query":{"type":"string","maxLength":64}},"$schema":"https://json-schema.org/draft/2020-12/schema"}},{"name":"list_notifications","description":"POST /api/notifications. Poll this when a Visa payment asks for 3-D Secure. Agents keep payload.code (never SMS, never Telegram). category=codes for 3-D Secure OTP. Also delivered on webhook field otp if callback_url is set, and optional email. Space catalog calls ~1s apart.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"category":{"type":"string","enum":["all","codes","support","tx"]},"limit":{"type":"integer","minimum":1,"maximum":100},"prev_ts":{"type":"number"},"prev_id":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991}},"$schema":"https://json-schema.org/draft/2020-12/schema"}},{"name":"purchase_esim","description":"POST /api/esim/new_plan5. Buy a travel/data eSIM plan from this agent 2401. Omit blank/null iccid so SQL takes the new-eSIM path. A set iccid must already belong to this agent. ext_id required. Never Stars.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"plan_id":{"type":"string","minLength":1,"maxLength":64},"ext_id":{"type":"string","minLength":1,"maxLength":128},"iccid":{"type":"string","maxLength":32},"payment_source":{"type":"string","maxLength":32}},"required":["plan_id","ext_id"],"$schema":"https://json-schema.org/draft/2020-12/schema"}},{"name":"purchase_gift","description":"POST /api/purchase. Buy a brand gift code (Apple, Steam, Google Play, … — live list). ext_id required. Never payment_source=stars.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"offer_id":{"type":"string","minLength":1,"maxLength":128},"ext_id":{"type":"string","minLength":1,"maxLength":128},"required_fields":{"type":"object","propertyNames":{"type":"string","maxLength":64},"additionalProperties":{"type":"string","maxLength":512}},"expected_price":{"type":"object","propertyNames":{"type":"string","maxLength":32},"additionalProperties":{"type":"number"}},"payment_source":{"type":"string","maxLength":32}},"required":["offer_id","ext_id"],"$schema":"https://json-schema.org/draft/2020-12/schema"}},{"name":"rotate_hmac","description":"POST /auth/v1/agent/hmac/rotate. Previous HMAC dies immediately. Requires an existing callback_url (400 callback_url required before rotate otherwise). Pass callback_url here to PATCH webhook first. Plaintext HMAC is returned once — store it; never a Wallet JWT.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"callback_url":{"type":"string","maxLength":512},"jwe_public_key":{"type":"string","maxLength":4096},"email":{"type":"string","maxLength":254}},"$schema":"https://json-schema.org/draft/2020-12/schema"}},{"name":"set_webhook","description":"PATCH /auth/v1/agent/webhook. Sets https callback_url (required before hmac/rotate), optional X25519 jwe_public_key for card_encrypted, optional email for 3DS OTP. Not SMS. HMAC plaintext is shown once when a URL is first accepted.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"callback_url":{"type":"string","maxLength":512},"jwe_public_key":{"type":"string","maxLength":4096},"email":{"type":"string","maxLength":254}},"$schema":"https://json-schema.org/draft/2020-12/schema"}},{"name":"topup_card","description":"POST /api/pin/topup_card from this agent 2401 USDT. card_id must belong to the same agent (SQL owner guard). ext_id required. Never Stars.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"card_id":{"type":"string","minLength":1,"maxLength":256},"amount":{"type":"number","exclusiveMinimum":0,"maximum":1000000},"ext_id":{"type":"string","minLength":1,"maxLength":128}},"required":["card_id","amount","ext_id"],"$schema":"https://json-schema.org/draft/2020-12/schema"}}],"scan":{"score":74,"grade":"B","scanned_at":"2026-10-29T18:47:32.564Z","report":{"scannerVersion":"0.1.10","scannedAt":"2026-10-29T18:47:32.468Z","components":{"code":{"score":20,"max":25,"notes":["5 source files scanned"]},"reliability":{"score":20,"max":20,"notes":["remote reachable in 1127ms"]},"poisoning":{"score":15,"max":15,"notes":["19 tool descriptions checked"]},"auth":{"score":8,"max":15,"notes":["API key sent as a header"]},"maintenance":{"score":3,"max":15,"notes":["repository not readable: repo not found"]},"identity":{"score":8,"max":10,"notes":["endpoint served from the registry-verified namespace domain"]}},"findings":[{"id":"exec.eval","severity":"medium","component":"code","title":"eval / new Function used","evidence":"dist/stdio.js: …ourceCode, sch); const validate = new Function(`${names_1.default.self}`, `${names_1.de…"}],"inputs":{"probes":[{"url":"https://imbawallet.com/mcp/spend","reachable":true,"authRequired":false,"latencyMs":1127,"serverInfo":{"name":"com.imbawallet/agent","version":"0.1.5"}}],"packages":[{"registryType":"npm","identifier":"@imba_wallet/agent-mcp","version":"0.1.4","found":true,"license":"MIT","hasInstallScripts":false,"dependencyCount":0,"publishedAt":"2026-08-27T19:37:59.887Z","repositoryUrl":"git+https://github.com/IMBAwallet/IMBA_front.git","weeklyDownloads":116}],"repo":{"found":false,"owner":"IMBAwallet","repo":"IMBA_front","error":"repo not found"},"icon":{"url":"https://imbawallet.com/favicon.png","source":"registry","width":192,"height":192},"presence":{"stars":null,"forks":null,"downloadsWeek":116,"license":"MIT","lastPushAt":null,"score":18}}}},"grade_history":[],"reviews":[]}