MCP.Market

Xstocks MCP server

by evidai·io.github.evidai/xstocks·v0.1.4·3 stars
No reviews yet

Buy tokenized US stocks (xStocks) on Solana via Jupiter DEX in USDC. Daily cap. Dry-run default.

C65/100grade C
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
C65/100

full report

Adoption
New

3 stars

Reviews

Write one

Nobody has reviewed Xstocks yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Xstocks tools (6)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • find_xstock

    Look up a tokenized US stock by ticker (e.g. AAPL or AAPLx \u2192 returns the verified Backed-issued mint with current price + holder count). Read-only.

  • get_quote

    Get a Jupiter swap quote for USDC \u2192 xStock at a given USD amount. Returns expected output token amount + price impact %. Does not execute.

  • guard_set_limit

    Set the daily USD cap. The agent cannot raise its own cap silently \u2014 calling this is logged.

  • guard_status

    Daily cap ledger: limit / used / remaining / lifetime swaps / last 10 trades. Read-only.

  • setup

    Show xstocks-mcp setup state: mode, env vars, daily cap, ledger file, LemonCake fee. Read-only.

  • wallet_status

    Return the configured Solana wallet's public key, SOL balance (for gas), and USDC balance. Read-only.

Public scan report

scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it

1 medium
  • Code scan2 source files scanned20/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 102 days ago8/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Findings (1)

  • mediumeval / new Function usedexec.eval
    dist/index.mjs: …ode, sch); const makeValidate = new Function(`${names_1.default.self}`, `${names_1.de…
Overall 65/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Xstocks compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
65/100
higher than 20% of 48,255 servers
Tools
6
the typical server has 7
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
3
more than 80% of 28,688 servers

What its tools let an agent do: 5 read · 1 change

Install Xstocks in Claude Code, Cursor or VS Code

Runs npx -y xstocks-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add xstocks -- npx -y xstocks-mcp
Add to Cursor

What the publisher says

From the Xstocks repository's README, as published. We do not edit it. Read it on GitHub

🍋 LemonCake

The billing, budget & identity layer for software for agents. Private Beta · Open core

Monetize any MCP/API in minutes, and let AI agents pay for it safely — each agent gets a spend-capped identity (budget, usage, pause/revoke). Buyers pay by card; no crypto wallet. First 3,000 calls free (lifetime). Then 3% only when your API earns.

-green.svg)

🚀 Get started · 💲 Pricing · 📚 Docs · 🌐 Live

☝️ A real AI agent buys API calls by itself ($0.01 each), stops at its cap, and the API owner earns — no human, no crypto. · demo source

🚀 Get started

Monetizing an MCP/API? Start here — one command:

npx create-lemon-mcp my-paid-mcp     # a paid MCP server, running in sandbox now
# then add a Seller Key in /app and set LEMONCAKE_SELLER_KEY → it charges for real (no code change)

Pick your path:

Buyer-side MCP — try in 30 seconds

npx -y agent-payment-mcp
{ "mcpServers": { "lemon": { "command": "npx", "args": ["-y", "agent-payment-mcp"] } } }

Ask your agent to run listdemos / calldemo. To call paid APIs, set LCPAYTOKEN (get one at lemoncake.xyz/app).

What is LemonCake?

LemonCake is an x402 payment rail for monetizing MCP servers and HTTP APIs. Sellers register an endpoint and set a price per call. Buyers prepay by card and receive a spend-capped Pay Token. Agents call the gateway with that token, and LemonCake verifies, meters, forwards, and records usage.

sequenceDiagram
    participant A as 🤖 AI Agent
    participant G as 🍋 LemonCake Gateway
    participant API as Your API
    A->>G: POST /g/:id (no token)
    G-->>A: 402 + accepts[] (price, mintUrl)
    A->>G: mint Pay Token (off-session, capped)
    A->>G: Bearer :jwt
    G->>API: forward (upstream key hidden)
    API-->>A: 200 + result
    Note over A,G: budget exhausted → 402 → agent self-funds → continues

Sellers register any HTTP API and set a price per call. Buyers / agents prepay with a card → Pay Token issued automatically → agent calls the API within budget. Budget exhausted → 402 challenge → agent self-funds → continues. No humans.

🧱 Open core

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Xstocks: common questions

Is Xstocks MCP server safe?
With care: it is graded C, so read the findings first (65/100). Read the Xstocks safety report
How do I install Xstocks?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Xstocks need an API key?
Yes. The registry entry asks for SOLANA_WALLET_PRIVATE_KEY.
Is Xstocks maintained?
The last commit was 140 days ago (2026-06-17). The latest release is v0.1.4.
How does Xstocks compare with other MCP servers?
safety score 65/100 (higher than 20% of 48,255 servers); tools 6 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

More from evidai →