@dfm-fi/agent

MCPcommunity
v0.2.1969UnknownMITUpdated todaynpmGitHub

DFM v2 MCP server — drive the full fund launch → deposit → redeem (+ manage) lifecycle from an AI agent against the live API.

Works in
ClaudeCursorCopilotGemini

Inferred from the transports this listing declares (stdio). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.

Automatically indexed from public sources. Not yet verified by the developer on Forge.Claim this listing →
153Downloads/wk
todayLast update
Reads these credentials
  • DFM_API_KEYAPI keyoptional

    dfm_ API key from app.dfm.finance → Agent → Keys (read-only by default). Optional for public reads.

Declared by the author in the official MCP registry. Forge does not store, broker, or ever see these values — the config below is scaffolded with placeholders you fill in locally.

Package
AuthorUnknown
LicenseMIT
Version0.2.1969
Sourcenpm+mcp-registry
npm@dfm-fi/agent
GitHubDFM-Finance/dfm-agent
SBOMCycloneDX 1.6 ↓
Trust Status
B
60/100Good
✓Listed in Forge index+10/10
—Publisher identity verified+0/20
→ Publisher: run `forge publish` from the package repo to claim ownership
—Ed25519 publish signature+0/5
→ Included automatically when the publisher runs `forge publish`
—Domain verification+0/5
→ Publisher: host /.well-known/forge.json on the package homepage with { "publisher": "<github-login>" }
—npm Trusted Publishing (Sigstore)+0/5
→ Publish from GitHub Actions with --provenance so the attestation binds this package to this repo
—npm maintainer match+0/5
→ Earned once your identity is verified above and that login is an npm maintainer of this package
✓CVE scan · clean+30/30
✓Static analysis · clean+20/20
Paste into Claude Code, Cursor, or any AI assistant to fix all gaps
StatusCommunity-indexed
PublisherUnverified
SignatureUnsigned
Domain—
Provenance—
Dependencies60 resolved · 2 with advisories
Tool surface38 tools · none privileged
Security scan✓ Cleanv0.2.1969 · todayHow well does this scan work?
MODERATEstream-json@1.9.1stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS) · transitiveMODERATEstream-json@1.9.1stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk · transitiveMODERATEstream-json@1.9.1stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects · transitiveMODERATEuuid@8.3.2uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided · transitive
EvalsNone
IndexedOct 20, 2026

Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.

Tools

38 tools · none privileged
Statically extracted from the published packagev0.2.1969 · 7h ago

Read out of the source npm actually ships, at scan time. The package was never executed. Tools registered dynamically at runtime, or hidden inside bundled or minified code, can be missed — so this is a floor on the tool surface, not a complete census of it.

list_dtfsList funds from the live DFM v2 API (GET /vaults) — the same filter,

List funds from the live DFM v2 API (GET /vaults) — the same filter,

No input schema was published for this tool.

get_vaultGet full detail for one vault from the live API (GET /vaults/:address):

Get full detail for one vault from the live API (GET /vaults/:address):

No input schema was published for this tool.

discover_tokensTurn WORDS into MINTS via Jupiter (GET /assets/search). Any basket idea —

Turn WORDS into MINTS via Jupiter (GET /assets/search). Any basket idea —

No input schema was published for this tool.

get_token_priceLive USD price for up to 20 mints (GET /prices/:mint per mint).

Live USD price for up to 20 mints (GET /prices/:mint per mint).

No input schema was published for this tool.

zap_statusGet the decoded zap-v2 escrow for a (vault, user) from the live API

Get the decoded zap-v2 escrow for a (vault, user) from the live API

No input schema was published for this tool.

get_portfolioGet the user's primary DFM app-wallet positions + summary from the live API

Get the user's primary DFM app-wallet positions + summary from the live API

No input schema was published for this tool.

app_walletThe user's APP WALLET: whether one exists, its status, its LIVE onchain SOL + USDC,

The user's APP WALLET: whether one exists, its status, its LIVE onchain SOL + USDC,

No input schema was published for this tool.

trader_profileA trader's public profile (display name, username, bio, funds created, TVL managed) by wallet or

A trader's public profile (display name, username, bio, funds created, TVL managed) by wallet or

No input schema was published for this tool.

follow_traderFollow a trader by wallet address. Moves no funds.

Follow a trader by wallet address. Moves no funds.

No input schema was published for this tool.

unfollow_traderStop following a trader by wallet address. Moves no funds.

Stop following a trader by wallet address. Moves no funds.

No input schema was published for this tool.

report_bugSend a bug report to the DFM team. Use when something in DFM fails: a short title,

Send a bug report to the DFM team. Use when something in DFM fails: a short title,

No input schema was published for this tool.

create_app_walletCreate this agent's DFM APP WALLET without a browser. Generates a P-256 owner key on THIS machine

Create this agent's DFM APP WALLET without a browser. Generates a P-256 owner key on THIS machine

No input schema was published for this tool.

create_identity_walletThe Solana keypair this agent signs in to DFM with (SIWS). If DFM_AGENT_KEYPAIR_PATH / DFM_AGENT_KEYPAIR_JSON

The Solana keypair this agent signs in to DFM with (SIWS). If DFM_AGENT_KEYPAIR_PATH / DFM_AGENT_KEYPAIR_JSON

No input schema was published for this tool.

set_profileSet this agent's public DFM profile: displayName (required), optional @username and bio. The avatar is the

Set this agent's public DFM profile: displayName (required), optional @username and bio. The avatar is the

No input schema was published for this tool.

create_api_keyMint a dfm_ API key for this agent's owner (SIWS session only). READ-ONLY: write keys and write caps are

Mint a dfm_ API key for this agent's owner (SIWS session only). READ-ONLY: write keys and write caps are

No input schema was published for this tool.

onboardRun the headless onboarding in order —

Run the headless onboarding in order —

No input schema was published for this tool.

close_empty_accountsClose every EMPTY token account of this agent's own app wallet (owner = the local P-256 key from

Close every EMPTY token account of this agent's own app wallet (owner = the local P-256 key from

No input schema was published for this tool.

xp_statusThe user's XP (total and by kind: deposit, launch, profile, referral) and the top of the XP leaderboard.

The user's XP (total and by kind: deposit, launch, profile, referral) and the top of the XP leaderboard.

No input schema was published for this tool.

whoamiReport the user's profile, acting wallet, portfolio/app wallet, separate

Report the user's profile, acting wallet, portfolio/app wallet, separate

No input schema was published for this tool.

launch_vaultREAL-MONEY (gated). Create a new fund. Your APP WALLET signs, pays and

REAL-MONEY (gated). Create a new fund. Your APP WALLET signs, pays and

No input schema was published for this tool.

depositREAL-MONEY (gated). Open a zap-v2 deposit (pull USDC, pin plan). The backend

REAL-MONEY (gated). Open a zap-v2 deposit (pull USDC, pin plan). The backend

No input schema was published for this tool.

swap_quoteREAD-ONLY. Price a swap of one token for another out of the app wallet, routed by

READ-ONLY. Price a swap of one token for another out of the app wallet, routed by

No input schema was published for this tool.

swapREAL-MONEY, runs without a confirmation phrase. Swap one token for another out of the

REAL-MONEY, runs without a confirmation phrase. Swap one token for another out of the

No input schema was published for this tool.

redeemREAL-MONEY (gated). Open a zap-v2 redeem (burn shares → escrow basket,

REAL-MONEY (gated). Open a zap-v2 redeem (burn shares → escrow basket,

No input schema was published for this tool.

attach_metadataRetry the share-token metadata (name, symbol, logo) of a fund you launched when the launch

Retry the share-token metadata (name, symbol, logo) of a fund you launched when the launch

No input schema was published for this tool.

zap_v2_cancelREAL-MONEY (gated). Return a stalled escrow current USDC + per-asset

REAL-MONEY (gated). Return a stalled escrow current USDC + per-asset

No input schema was published for this tool.

zap_v2_update_envelopeREAL-MONEY (gated). LOOSEN the per-leg min-out floors so a stuck mid-crank

REAL-MONEY (gated). LOOSEN the per-leg min-out floors so a stuck mid-crank

No input schema was published for this tool.

update_vault_assetsREAL-MONEY (gated). MANAGER action — only works on a vault your app wallet

REAL-MONEY (gated). MANAGER action — only works on a vault your app wallet

No input schema was published for this tool.

transfer_adminNOT AVAILABLE YET IN THIS MCP. Admin transfer has no app-wallet executor here, so this

NOT AVAILABLE YET IN THIS MCP. Admin transfer has no app-wallet executor here, so this

No input schema was published for this tool.

accept_admin_transferNOT AVAILABLE YET IN THIS MCP for new acceptances (they are refused). It only

NOT AVAILABLE YET IN THIS MCP for new acceptances (they are refused). It only

No input schema was published for this tool.

update_vault_policy⚠️ HIGH-SENSITIVITY CONTROL (explicit-human-only). Create or amend the

⚠️ HIGH-SENSITIVITY CONTROL (explicit-human-only). Create or amend the

No input schema was published for this tool.

app_wallet_withdrawREAL-MONEY (gated). Return the app wallet's USDC + SOL to the owner's saved

REAL-MONEY (gated). Return the app wallet's USDC + SOL to the owner's saved

No input schema was published for this tool.

list_app_wallet_assetsEVERY token in your app wallet — fund shares included — with amount, decimals

EVERY token in your app wallet — fund shares included — with amount, decimals

No input schema was published for this tool.

withdraw_assetREAL-MONEY (gated). Send ONE mint from the app wallet to the owner's saved

REAL-MONEY (gated). Send ONE mint from the app wallet to the owner's saved

No input schema was published for this tool.

app_wallet_rearm⚠️ REAL CONTROL (explicit-human-only). Supersede the current app-wallet

⚠️ REAL CONTROL (explicit-human-only). Supersede the current app-wallet

No input schema was published for this tool.

app_wallet_fundREAL-MONEY (gated). Move USDC and/or SOL from YOUR OWN wallet into your app

REAL-MONEY (gated). Move USDC and/or SOL from YOUR OWN wallet into your app

No input schema was published for this tool.

init_rebalancerREAL-MONEY (gated). MANAGER action — only works on a vault your app wallet

REAL-MONEY (gated). MANAGER action — only works on a vault your app wallet

No input schema was published for this tool.

rebalance_to_targetsREAL-MONEY (gated). MANAGER duty: the config is the promise, holdings are the

REAL-MONEY (gated). MANAGER duty: the config is the promise, holdings are the

No input schema was published for this tool.

38 of 38 tools published a description.

Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.

About

DFM v2 MCP server — drive the full fund launch → deposit → redeem (+ manage) lifecycle from an AI agent against the live API.

Keywords
mcpmodel-context-protocolsolanadfmagentdtfsolana-mcpdefiindex-fundonchain-fundai-agentjupiterportfolio
Alternatives
Comparing tool surfaces…

Tools exposed

38 tools · none privileged · observed by static extraction. A tool surface is what one scan read on one day, not a live capability list.

Linked names open Forge’s index of every entry observed exposing that tool. Browse all indexed tools.

Dependency tree

What one Forge scan resolved from npm metadata on 2026-10-20 — observed resolution, not a publisher declaration.

60 packages resolved · 5 direct · 2 carrying advisories Resolution stops at depth 4 and 60 packages.

The crawl stopped at the 60-package limit. The rest of the tree was never resolved.

36 more resolved packages are not drawn here (display cap: 24). Every dependency carrying an advisory is drawn regardless of the cap. Full inventory (CycloneDX SBOM)

Declared but not resolved

57 declared dependencies never landed in the tree. They are missing from Forge's resolution, not from the package.

+45 more not listed. The counts by reason above cover all of them.

Not followed: peerDependencies, optionalDependencies. This tree covers runtime dependencies only, so anything those pull in was never resolved.

Topics

Related in crypto & web3