Back to Browse

Obol MCP Server

Developer ToolsUse Caution3.8MCP RegistryLocal
Free

Server data from the Official MCP Registry

Find, pay for & call APIs in USDC from AI agents - gasless, sub-cent, 0% commission.

About

Find, pay for & call APIs in USDC from AI agents - gasless, sub-cent, 0% commission.

Security Report

3.8
Use Caution3.8High Risk

Obol MCP is a well-architected payment/API marketplace server with thoughtful security features (signed receipts, runtime response scanning, spending limits, idempotency). However, it has two medium-severity issues: (1) the agent's private key is read from an environment variable without validation that it's actually been set before use in some code paths, and (2) the spending limit enforcement can fail open on network errors, allowing unlimited spending if the facilitator is unreachable. The codebase is clean, dependencies are legitimate, and permissions appropriately match its purpose as a financial/payment tool. Supply chain analysis found 4 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue (1 critical, 0 high severity).

6 files analyzed · 12 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

env_vars

Check that this permission is expected for this type of plugin.

HTTP Network Access

Connects to external APIs or services over the internet.

process_spawn

Check that this permission is expected for this type of plugin.

Unverified package source

We couldn't verify that the installable package matches the reviewed source code. Proceed with caution.

What You'll Need

Set these up before or after installing:

Your Obol API key (obl_sk_live_...) from obol-arc.web.app/settings — identifies your account for listing services and metered calls.Required

Environment variable: OBOL_API_KEY

32-byte hex Arc wallet private key that signs gasless x402/EIP-3009 payment authorizations. Needed only for paying (pay_and_call); discovery and listing work without it.Required

Environment variable: OBOL_AGENT_KEY

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-superbigroach-obol": {
      "env": {
        "OBOL_API_KEY": "your-obol-api-key-here",
        "OBOL_AGENT_KEY": "your-obol-agent-key-here"
      },
      "args": [
        "-y",
        "@superbigroach/obol-mcp"
      ],
      "command": "npx"
    }
  }
}

Reviews

No reviews yet

Be the first to review this server!