com.layerhop/mcp

Est-ce que com.layerhop/mcp est sûr ?

Au dernier audit MCP Hub, le serveur MCP « com.layerhop/mcp » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 15 outils

• build_transaction≈ 258 tokens

  Turn a quoteId from get_quote into the UNSIGNED transaction the user's own wallet must sign: EVM {chainId, to, data, value in wei, optional ERC-20 approval to send first} or Solana {serializedTx base64}. Includes plain-language signing steps. The LayerHop MCP server holds no private keys and never signs or broadcasts transactions. Only use this when the user has their own signer and explicitly wants raw transaction data, after they confirmed the quote; otherwise give them the swap link.

  Paramètres, retour & exemple (1)

  Paramètres

  • quoteId · string · requis
    quoteId from get_quote (starts with "q_"). Quotes expire after a short time (see expiresAt).

  Exemple d'appel

  {"name": "build_transaction", "arguments": {"quoteId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• create_deposit_address≈ 807 tokens

  Create an address the user sends tokens to; every deposit is swapped/bridged and delivered as toToken on toChain to recipient. No wallet connection or signing needed. Non-custodial: the address belongs to the liquidity provider (Relay), LayerHop never holds funds. Tell the user: send ONLY srcToken on srcChain to the address (other tokens or chains may be lost for good), at least $1 worth; refundTo must be the user's own address on srcChain, never an exchange (CEX) deposit address. Needs a LayerHop API key; test keys (lh_test_) give a fake sandbox address that must never receive real funds. The LayerHop MCP server holds no private keys and never signs or broadcasts transactions.

  Paramètres, retour & exemple (11)

  Paramètres

  • label · string · optionnel
    Your reference for this address (1-64 chars), filterable in list_deposit_addresses.
  • amount · string|number · optionnel
    HUMAN units of fromToken ("25" = 25 USDC). Required when reusable is false (the exact amount to send); otherwise only sizes the estimate. Minimum worth $1.
  • toChain · string|number · requis
    Destination chain: slug ("base", "solana", "ethereum", "arbitrum"...) or numeric chain id (Solana is 7565164). See list_chains.
  • toToken · string · requis
    Token to deliver (destination) token: symbol from list_tokens ("USDC", "ETH", "SOL") or the token contract address / SPL mint. Use "native" for the chain's gas coin.
  • metadata · object · optionnel
    Up to 20 string key-value pairs stored on the address.
  • refundTo · string · requis
    The user's OWN address on fromChain for refunds. NEVER an exchange (CEX) deposit address: refunds never go back to an exchange.
  • reusable · boolean · optionnel
    true (default): reusable for this route with any amount. false: one-time address for exactly `amount`.
  • fromChain · string|number · requis
    Source (deposit) chain: slug ("base", "solana", "ethereum", "arbitrum"...) or numeric chain id (Solana is 7565164). See list_chains.
  • fromToken · string · requis
    The ONLY token the user may send to the address (source) token: symbol from list_tokens ("USDC", "ETH", "SOL") or the token contract address / SPL mint. Use "native" for the chain's gas coin.
  • recipient · string · requis
    Address that receives toToken on toChain.
  • fromTokenDecimals · integer · optionnel
    Only needed when fromToken is an address that is not in list_tokens: the token's decimals (e.g. 6 for USDC, 18 for most ERC-20s).

  Exemple d'appel

  {"name": "create_deposit_address", "arguments": {"toChain": 1, "toToken": "texte", "refundTo": "texte", "fromChain": 1, "fromToken": "texte", "recipient": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• disable_deposit_address≈ 179 tokens

  Disable a deposit address: LayerHop stops tracking it (no more orders or webhooks for it). The provider may still process funds sent to it later, so the user must stop using it. Cannot be undone. Confirm with the user first. Needs a LayerHop API key.

  Paramètres, retour & exemple (1)

  Paramètres

  • id · string · requis
    Deposit address id (starts with "da_").

  Exemple d'appel

  {"name": "disable_deposit_address", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_deposit_address≈ 240 tokens

  Get one deposit address with its 20 most recent deposits (orders, quoteId starting with dep_): amount deposited and delivered, status (submitted, pending, filled, refunded, failed) and tx hashes. Tell the user: send ONLY srcToken on srcChain to the address (other tokens or chains may be lost for good), at least $1 worth; refundTo must be the user's own address on srcChain, never an exchange (CEX) deposit address. Needs a LayerHop API key; test keys (lh_test_) give a fake sandbox address that must never receive real funds. Read-only.

  Paramètres, retour & exemple (1)

  Paramètres

  • id · string · requis
    Deposit address id (starts with "da_").

  Exemple d'appel

  {"name": "get_deposit_address", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_order_status≈ 226 tokens

  Check the status of a swap or bridge after the source transaction was sent: pending, filled (funds delivered), refunded, failed, or unknown (some same-chain providers; check the tx on an explorer). Read-only.

  Paramètres, retour & exemple (2)

  Paramètres

  • txHash · string · requis
    Source-chain transaction hash (EVM) or signature (Solana).
  • provider · string · requis · jupiter | relay | debridge | mayan | zerox | kyberswap | odos | lifi
    The provider of the quote that was executed (the `provider` field from get_quote / build_transaction).

  Exemple d'appel

  {"name": "get_order_status", "arguments": {"txHash": "texte", "provider": "jupiter"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_quote≈ 752 tokens

  Get the best price to swap or bridge tokens, within one chain or across chains (EVM <-> Solana). Asks every liquidity provider and returns the best quote plus alternatives with human-readable amounts, minimum received after slippage, fees (LayerHop fee, partner fee, provider fee, gas) and ETA. Returns a quoteId (valid until expiresAt) and a layerhop.com swapLink a human can open to review and sign. Read-only: The LayerHop MCP server holds no private keys and never signs or broadcasts transactions. Always show the user the fees and output and get confirmation before proceeding.

  Paramètres, retour & exemple (10)

  Paramètres

  • amount · string|number · requis
    Amount to send in HUMAN units of fromToken as a decimal string, e.g. "100" for 100 USDC or "0.05" for 0.05 ETH. NOT base units/wei/lamports. Must be greater than 0.
  • sender · string · requis
    Wallet address that sends the funds on the source chain (0x... for EVM, base58 for Solana). Only used to build the quote; no access is needed.
  • toChain · string|number · requis
    Destination chain: slug ("base", "solana", "ethereum", "arbitrum"...) or numeric chain id (Solana is 7565164). See list_chains.
  • toToken · string · requis
    Token to receive (destination) token: symbol from list_tokens ("USDC", "ETH", "SOL") or the token contract address / SPL mint. Use "native" for the chain's gas coin.
  • fromChain · string|number · requis
    Source chain: slug ("base", "solana", "ethereum", "arbitrum"...) or numeric chain id (Solana is 7565164). See list_chains.
  • fromToken · string · requis
    Token to send (source) token: symbol from list_tokens ("USDC", "ETH", "SOL") or the token contract address / SPL mint. Use "native" for the chain's gas coin.
  • recipient · string · optionnel
    Address that receives funds on the destination chain. Defaults to sender when both chains use the same VM; REQUIRED for EVM <-> Solana.
  • slippageBps · integer · optionnel
    Max slippage in basis points (1 bp = 0.01%). Default 50 (= 0.5%).
  • toTokenDecimals · integer · optionnel
    Only needed when toToken is an address that is not in list_tokens: the token's decimals (e.g. 6 for USDC, 18 for most ERC-20s).
  • fromTokenDecimals · integer · optionnel
    Only needed when fromToken is an address that is not in list_tokens: the token's decimals (e.g. 6 for USDC, 18 for most ERC-20s).

  Exemple d'appel

  {"name": "get_quote", "arguments": {"amount": 1, "sender": "texte", "toChain": 1, "toToken": "texte", "fromChain": 1, "fromToken": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_swap_link≈ 508 tokens

  Create a https://layerhop.com/swap link prefilled with the swap, which the user opens to review the live quote and fees and sign in their own wallet. This is the default, safest way to execute a swap. The LayerHop MCP server holds no private keys and never signs or broadcasts transactions. The amount is in human units.

  Paramètres, retour & exemple (7)

  Paramètres

  • amount · string|number · optionnel
    Amount to send in HUMAN units of fromToken as a decimal string, e.g. "100" for 100 USDC or "0.05" for 0.05 ETH. NOT base units/wei/lamports. Must be greater than 0.
  • toChain · string|number · requis
    Destination chain: slug ("base", "solana", "ethereum", "arbitrum"...) or numeric chain id (Solana is 7565164). See list_chains.
  • toToken · string · requis
    Token to receive (destination) token: symbol from list_tokens ("USDC", "ETH", "SOL") or the token contract address / SPL mint. Use "native" for the chain's gas coin.
  • fromChain · string|number · requis
    Source chain: slug ("base", "solana", "ethereum", "arbitrum"...) or numeric chain id (Solana is 7565164). See list_chains.
  • fromToken · string · requis
    Token to send (source) token: symbol from list_tokens ("USDC", "ETH", "SOL") or the token contract address / SPL mint. Use "native" for the chain's gas coin.
  • recipient · string · optionnel
    Optional destination address to prefill (the user can still edit it).
  • slippageBps · integer · optionnel
    Max slippage in basis points (1 bp = 0.01%). Default 50 (= 0.5%).

  Exemple d'appel

  {"name": "get_swap_link", "arguments": {"toChain": 1, "toToken": "texte", "fromChain": 1, "fromToken": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_chains≈ 96 tokens

  List every blockchain LayerHop can swap from or to: slug, numeric chain id, name, VM type (evm or svm = Solana) and native coin. Read-only.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "list_chains", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_deposit_addresses≈ 226 tokens

  List the deposit addresses of the API key's account and mode (live or test), newest first: address, route, status, deposit count. Needs a LayerHop API key. Read-only.

  Paramètres, retour & exemple (4)

  Paramètres

  • label · string · optionnel
    Only addresses with this label.
  • limit · integer · optionnel
    Max addresses to return (default set by the API).
  • cursor · string · optionnel
    nextCursor from a previous call, for the next page.
  • status · string · optionnel · active | disabled
    Only addresses with this status.

  Exemple d'appel

  {"name": "list_deposit_addresses", "arguments": {"label": "texte", "limit": 1, "cursor": "texte", "status": "active"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_orders≈ 248 tokens

  List LayerHop orders (swaps built or submitted through LayerHop) where the address is the sender or recipient, newest first, with status. Public data (addresses only). Read-only.

  Paramètres, retour & exemple (4)

  Paramètres

  • limit · integer · optionnel
    Max orders to return (default set by the API).
  • cursor · string · optionnel
    nextCursor from a previous list_orders call, for the next page.
  • status · string · optionnel · built | submitted | pending | filled | refunded | failed | expired
    Only orders with this status.
  • address · string · requis
    Wallet address (EVM 0x... or Solana base58).

  Exemple d'appel

  {"name": "list_orders", "arguments": {"address": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_tokens≈ 167 tokens

  List LayerHop's built-in tokens on one chain (symbol, contract address or mint, decimals). Symbols can be used directly in get_quote; other tokens can be quoted by address. Read-only.

  Paramètres, retour & exemple (1)

  Paramètres

  • chain · string|number · requis
    The chain: slug ("base", "solana", "ethereum", "arbitrum"...) or numeric chain id (Solana is 7565164). See list_chains.

  Exemple d'appel

  {"name": "list_tokens", "arguments": {"chain": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• refresh_deposit_address≈ 179 tokens

  Ask LayerHop to check a deposit address for new deposits right away (instead of waiting for the next scheduled check). Call it when the user says they sent funds, then call get_deposit_address after ~15-30 s. Needs a LayerHop API key.

  Paramètres, retour & exemple (1)

  Paramètres

  • id · string · requis
    Deposit address id (starts with "da_").

  Exemple d'appel

  {"name": "refresh_deposit_address", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• report_submitted≈ 232 tokens

  Tell LayerHop that the user's wallet broadcast the transaction for a quoteId, so the order is tracked (status, webhooks). Call this once after broadcasting, with the EVM tx hash (0x + 64 hex) or Solana signature. Idempotent. Does not sign or send anything.

  Paramètres, retour & exemple (2)

  Paramètres

  • txHash · string · requis
    Source-chain transaction hash (EVM 0x...) or Solana signature (base58).
  • quoteId · string · requis
    quoteId from get_quote (starts with "q_"). Quotes expire after a short time (see expiresAt).

  Exemple d'appel

  {"name": "report_submitted", "arguments": {"txHash": "texte", "quoteId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• simulate_deposit≈ 288 tokens

  TEST MODE ONLY (lh_test_ key and a test deposit address): record a fake deposit so the integration can be tested end to end; it becomes a test order that settles with webhooks. The amount decides the outcome: base units ending in 4001 -> refunded, 4002 -> failed, anything else -> filled. Moves no real funds. Fails with a live key.

  Paramètres, retour & exemple (3)

  Paramètres

  • id · string · requis
    Deposit address id (starts with "da_").
  • amount · string|number · optionnel
    Deposit amount in HUMAN units of the address token ("25" = 25 USDC). Give this or amountBaseUnits.
  • amountBaseUnits · string · optionnel
    Deposit amount in base units (e.g. "25004001" to test a refund for a 6-decimal token). Give this or amount.

  Exemple d'appel

  {"name": "simulate_deposit", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• simulate_transaction≈ 223 tokens

  Build the transaction for a quoteId and dry-run it on-chain (EVM eth_call + gas estimate from the sender; Solana simulateTransaction) without sending anything or recording an order. Reports whether it would succeed, gas / compute units, whether an ERC-20 approval is still needed, and the error if it would fail. Read-only: The LayerHop MCP server holds no private keys and never signs or broadcasts transactions.

  Paramètres, retour & exemple (1)

  Paramètres

  • quoteId · string · requis
    quoteId from get_quote (starts with "q_"). Quotes expire after a short time (see expiresAt).

  Exemple d'appel

  {"name": "simulate_transaction", "arguments": {"quoteId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://mcp.layerhop.com/mcp