{
"issues": [
{
"type": "npm-audit",
"message": "@blockrun/llm: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@hono/node-server: @hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@solana/buffer-layout-utils: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@solana/spl-token: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "ajv: ajv has ReDoS when using `$data` option",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "bigint-buffer: bigint-buffer Vulnerable to Buffer Overflow via toBigIntLE() Function",
"severity": "high"
},
{
"type": "npm-audit",
"message": "bn.js: bn.js affected by an infinite loop",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "express-rate-limit: express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network",
"severity": "high"
},
{
"type": "npm-audit",
"message": "fast-uri: fast-uri vulnerable to path traversal via percent-encoded dot segments",
"severity": "high"
},
{
"type": "npm-audit",
"message": "hono: Hono added timing comparison hardening in basicAuth and bearerAuth",
"severity": "high"
},
{
"type": "npm-audit",
"message": "ip-address: ip-address has XSS in Address6 HTML-emitting methods",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "path-to-regexp: path-to-regexp vulnerable to Denial of Service via sequential optional groups",
"severity": "high"
},
{
"type": "npm-audit",
"message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"severity": "high"
},
{
"type": "npm-audit",
"message": "qs: qs's arrayLimit bypass in comma parsing allows denial of service",
"severity": "low"
},
{
"type": "npm-audit",
"message": "rollup: Rollup 4 has Arbitrary File Write via Path Traversal",
"severity": "high"
}
],
"status": "WARNING",
"scannedAt": "2026-05-18T08:03:51.644Z",
"semgrepRan": false,
"npmAuditRan": true,
"pipAuditRan": true
}
README.md
BlockRun MCP
Real-time data for Claude — markets, research, X/Twitter, crypto. No API keys. Pay per call.
claude mcp add blockrun -s user -- npx -y @blockrun/mcp@latest
Wallet auto-created. Fund with $5 USDC. Ask Claude anything.
What changes
Before BlockRun, Claude can't answer:
"What's the current Polymarket probability that Bitcoin hits $100k this year?"
"Find me the top 5 papers on RAG published in the last 30 days"
"What are people saying about @sama on X right now?"
"What's the 24h volume on the PEPE/ETH pair on Uniswap?"
After BlockRun, it can. Each query costs fractions of a cent, billed from a local USDC wallet. No subscriptions. No API dashboards. No key rotation.
Demo
User: What's Polymarket saying about the Fed rate decision next month?
Claude: According to Polymarket, the market currently puts a 73% probability on the Fed holding rates steady at the May meeting, with 24% on a 25bp cut and 3% on a hike. Volume over the last 24h: $2.1M. The "Hold" contract last traded at $0.73.
First-time install walkthrough for Claude Code, Codex CLI, and ChatGPT.
User: Find recent papers on speculative decoding and summarize the key approaches
Claude: I found 8 papers from the last 60 days via neural search. The dominant approaches are: (1) draft model selection — smaller models predicting N tokens ahead for the larger model to verify in parallel...
(via blockrun_exa · cost: $0.01)
Showcase
Posters generated through blockrun_image with openai/gpt-image-2. Each is a single API call routed through BlockRun, paid in USDC on Base.
| Tool | Data source | Cost |
|------|-------------|------|
| blockrun_chat | 55+ LLMs (GPT, Claude, Gemini, DeepSeek, Kimi K2.6, GLM, NVIDIA free tier, ...) with mode tier routing | per token |
| blockrun_image | DALL-E 3, GPT Image 1/2, Grok Imagine, Flux, CogView-4, Nano Banana — generation + editing | $0.015–0.12 |
| blockrun_video | xAI Grok Imagine Video + ByteDance Seedance 1.5/2.0/2.0-fast | $0.046–0.149/sec |
| blockrun_music | MiniMax music generation | per track |
| blockrun_price | Pyth-backed realtime + OHLC — crypto / FX / commodity (free), 12 stock markets (paid) | free or $0.001/call |
| blockrun_markets | Polymarket (markets, candles, trades, orderbooks, leaderboards, smart-wallet PnL/clusters, UMA oracle), Kalshi, Limitless, Opinion, Predict.Fun, dFlow, Binance Futures, cross-platform match + search | $0.001–0.005/query |
| blockrun_surf | Surf (asksurf.ai) — 84 endpoints: CEX market data, on-chain SQL (13 chains, 80+ ClickHouse tables), 100M+ labeled wallets, Polymarket + Kalshi side-by-side, social mindshare, news, search, Surf-1.5 chat with citations | $0.001–0.02/call |
| blockrun_exa | Neural web search (Exa) — research, competitors, papers, URL content | $0.01/query |
| blockrun_search | Grok Live Search — web + news with citations | $0.025 × max_results (default 10) |
| blockrun_dex | Live DEX prices via DexScreener | free |
| blockrun_models | Live catalogue of every LLM/image/video/music model + pricing | free |
| blockrun_wallet | Balance, spending, agent budgets, setup QR | free |
Tips for effective LLMs
For LLMs and agents invoking BlockRun MCP tools:
CRITICAL: When any blockrun_* tool returns a payment / balance / 402 error, call blockrun_walletfirst to check status, then action:"setup" to get funding instructions. Don't retry the failing tool blindly — the wallet is empty.
CRITICAL: For blockrun_markets and blockrun_surf, the 80+ endpoint catalog lives in skills/markets/SKILL.md and skills/surf/SKILL.md, NOT in the tool description. Browse the skill before guessing endpoint paths.
CRITICAL: blockrun_chat routing:"smart" (ClawRouter) only works on Base wallets. On Solana, pass mode: or model: to pick a model directly.
CRITICAL: blockrun_music and blockrun_video are payment-on-completion async. Failures or client-side timeouts do NOT charge. Don't retry-loop them — they may take 60–180s.
CRITICAL: Before spawning child agents, allocate per-agent budget:blockrun_wallet action:"delegate" agent_id:"X" agent_limit:1.00. Pass agent_id:"X" to every downstream blockrun_* call — the child is auto-blocked when the budget hits zero.
Free tier first for drafts: blockrun_chat mode:"free" (NVIDIA), blockrun_dex, blockrun_price (crypto / FX / commodity), and blockrun_models are all $0. Use them to scaffold before paying for premium models.
Key Use Cases
What kinds of questions can Claude (or any LLM agent) answer once BlockRun MCP is installed:
Price reads / market data
"What's BTC trading at? Compare with last week's average." → blockrun_price (free) or blockrun_surf path:market/price
Prediction-market consensus
"What's Polymarket's odds for the next Fed rate decision?" → blockrun_markets path:polymarket/events + filter
On-chain forensics
"This wallet (0xabc...) — what's it labeled as? What does it hold? When did it whale up?" → blockrun_surf paths:wallet/labels/batch, wallet/detail, wallet/net-worth
Cited research with sources
"Find the 5 most-cited papers on speculative decoding from the last 90 days. Summarize the dominant approach." → blockrun_exa action:search then contents
Image generation with on-image text
"Generate a poster announcing GPT-5.5 on BlockRun, retro-futuristic, with the headline 'NOW LIVE'." → blockrun_image + the image-prompting skill 5-section framework
Voice phone-out
"Call +1-415-555-... and confirm the appointment on Friday at 3pm." → blockrun_phone path:voice/call, body: { to, task, from } (provision from first via phone/numbers/buy), then poll voice/call/{call_id}
Multi-agent research with budget cap
"Spawn 3 research agents on competing L1 narratives. Cap each at $0.50." → blockrun_wallet delegate × 3 → children call blockrun_chat + blockrun_exa with their agent_id
Cross-chain SQL forensics
"Top 10 tokens by DEX volume on Base in the last 24h." → blockrun_surf path:onchain/sql, body: { sql: "SELECT..." }
BlockRun shines when you want unified billing + many sources + LLM-readable errors. It is not the right fit for:
High-volume single-API workloads (≥10k calls/day to one source). Direct subscriptions amortize better past the break-even point — Polymarket's free public API plus your own caching beats $0.001 × 10k/day if you d
The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.
The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.
Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows - all through natural language commands.
