Agent Blast Radius MCP server

Agent Blast Radius

What could an agent running as you reach? blast scans the places a coding agent running as you can read — cloud profiles, dotfiles, project .env files, CI configs, MCP servers — and tells you what is exposed, scores it, and draws a card you can share. Offline, read-only, never prints a secret value. Optionally, blast verify checks which of those credentials are actually live, paid per check with your own wallet.

npx -y @kloudle/agent-blast-radius@0.3.0          # scan + share card (free, offline)
npx -y @kloudle/agent-blast-radius@0.3.0 verify   # which keys work? (paid, optional)

More at abr.kloudle.dev.

Install it where your agent runs

Release binaries and SHA256SUMS are on Releases: macOS and Linux, ARM64 and AMD64. They are not code-signed or notarized; verify the checksum. The npm launcher and install.sh verify it for you. Node.js 22+ for npx.

The scan

configured MCP reachability. Never values.

• Reports credential types, locations, SHA-256 fingerprints, local scope hints and

username, --no-card skips files). Existing files are never overwritten.

• Makes no network calls, executes no MCP servers, uploads nothing, no telemetry.
• Writes a 1080 × 1350 PNG card and share text by default (--anonymous drops your

• Scores are exposure estimates, not proof that a credential works or was compromised.

As an MCP server (blast mcp) it offers blastradius, explaincredential and blast_card (read-only, offline) plus the verify tools below.

Which ones are live? blast verify

The scan can't tell a dead key from a live one. blast verify:

the environment) and creates a claim at abr.kloudle.dev with class counts only, e.g. aws-sts-identity:2;

1. counts eligible findings (AWS profiles; OPENAIAPIKEY / ANTHROPICAPIKEY in

with your own wallet: your agent's x402 wallet tool (e.g. GoPlausible's algorand-mcp), or a browser link where you approve in Pera, Defly or Lute;

1. prints the price — $0.10 USDC per check on Algorand — a code, and two ways to pay

(aws sts get-caller-identity, provider model-list probes) with a minimal environment, and reports each finding as live, rejected or error.

1. once paid, fetches an Ed25519-signed manifest, runs the checks on your machine

blast verify --open            # open the pay page and wait
blast verify --claim <id>      # collect later (claims survive restarts for 30 days)
blast verify --list            # unfinished claims on this machine

MCP: blastverifyquote → pay → blast_collect. Payments are final. Need a wallet? abr.kloudle.dev/wallet.

Shortened. The full README is on GitHub.