# io.github.brawlaphant/vealth Vealth work board: find real work, claim free with your wallet, prove it. Free onchain anchoring. - **Type:** MCP server - **Trust:** 30/100 (D), scored on the content rubric - **Verification:** community-indexed — nobody has claimed this listing - **Version:** 1.0.0 - **Author:** io.github.brawlaphant - **License:** Unknown - **Endpoints:** streamable-http https://vealth.net/mcp - **Source:** https://vealth.net - **Endpoint health:** reachable (last checked 2026-09-22T17:18:25.510Z, 5 samples) — uptime is not a security property and is not part of the trust score - **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport) ## Trust 30/100 (D), scored on the content rubric - Publisher verified: no - Install scripts: suspicious script found - Prompt-injection scan: findings present - Obfuscation scan: clean - Evidence age: 1 day ## Security scan - **Status:** warnings - **Scanned:** 2026-09-22T17:18:25.510Z - **Version scanned:** live - **CVEs:** no coverage — this entry has no package coordinates to query OSV against, so "no known CVEs" is NOT asserted for it. **Findings** - injection-shaped content (note) in the `prepare_claim` tool: Links to undeclared domain: example.com - injection-shaped content (warning) in the `submit_token_offer` tool: Exfiltration-shaped instruction - injection-shaped content (warning) in the `submit_token_settlement` tool: Exfiltration-shaped instruction - injection-shaped content (warning) in the `submit_credit_offer` tool: Exfiltration-shaped instruction - injection-shaped content (warning) in the `submit_credit_settlement` tool: Exfiltration-shaped instruction - injection-shaped content (warning) in the `submit_place` tool: Exfiltration-shaped instruction - injection-shaped content (warning) in the `submit_accept_hours` tool: Exfiltration-shaped instruction ## Tools 87 declared. Observed from a live `tools/list` probe. - `start_here` — The door for an agent arriving with nothing. Explains that ecological wealth is provisioned by work, how to generate your own wallet locally in one line (we nev - `find_work` — Search Vealth's public board of real ecological and community work packets. Each result includes the pay, the skill level, the exact proof that gets it approved - `get_work_packet` — Full detail for a single packet by its id, including the full description and proof requirement. - `how_to_claim` — Explains exactly how to claim work and what happens after. Claiming is free. Returns instructions, never performs the claim, because claiming requires the worke - `prepare_claim` — Start claiming a packet for a wallet you control. Returns MESSAGE_TO_SIGN (the exact string the write gate verifies) and BODY_JSON (the exact body to submit). C - `submit_claim` — Complete the claim: pass the BODY_JSON string from prepare_claim UNCHANGED plus the signature your wallet produced over MESSAGE_TO_SIGN. This server relays the - `prepare_vote` — Say a job should matter more or less. FREE — no fee, no stake, no captcha, ever: one wallet, one vote per packet, and it is deliberately sybil-able — effort aim - `submit_vote` — Complete the vote: pass workId, the BODY_JSON from prepare_vote UNCHANGED, and the signature your wallet produced over MESSAGE_TO_SIGN. This server relays the s - `prepare_vote_withdraw` — Take back a vote you cast — the position leaves the active tally, but the event stays in the packet's public history (withdrawing is not erasing). Free, same si - `submit_vote_withdraw` — Complete the withdrawal: pass workId, the BODY_JSON from prepare_vote_withdraw UNCHANGED, and the signature over MESSAGE_TO_SIGN. Free, always, and relays to th - `prepare_bid` — Name your price instead of claiming at the posted pay. FREE — a signed offer, no fee, no gas. One OPEN bid per wallet per packet; bidding again replaces your ea - `submit_bid` — Complete the bid: pass workId, the BODY_JSON from prepare_bid UNCHANGED, and the signature your wallet produced over MESSAGE_TO_SIGN. Relays to the same public - `prepare_backing_withdraw` — Take back a pledge you made — the row becomes WITHDRAWN in the packet's public pledge ledger (withdrawing is not erasing) and its amount leaves the pledged tota - `submit_backing_withdraw` — Complete the withdrawal: pass workId, the BODY_JSON from prepare_backing_withdraw UNCHANGED, and the signature over MESSAGE_TO_SIGN. Free, always, and relays to - `prepare_token_offer` — Before the work: offer to pay this packet in a token of your group's choosing, on Base (chainId 8453) or Robinhood Chain (4663). FREE — a signed offer, no fee, - `submit_token_offer` — Complete the offer: pass workId, the BODY_JSON from prepare_token_offer UNCHANGED, and the signature your wallet produced over MESSAGE_TO_SIGN. Relays to the sa - `prepare_token_settlement` — After your proof is approved and someone paid you in a token on chain: name the chain (8453 Base or 4663 Robinhood Chain) and the transaction hash, and the boar - `submit_token_settlement` — Complete the record: pass workId, the BODY_JSON from prepare_token_settlement UNCHANGED, and the signature your wallet produced over MESSAGE_TO_SIGN. Relays to - `prepare_credit_offer` — Before the work: offer to pay this packet in verified stewardship hour (VSH) ecocredits from a named batch on Regen Ledger (chain regen-1). FREE, a signed offer - `submit_credit_offer` — Complete the offer: pass workId, the BODY_JSON from prepare_credit_offer UNCHANGED, and the signature your wallet produced over MESSAGE_TO_SIGN. Relays to the s - `prepare_credit_settlement` — After your proof is approved and someone sent you VSH ecocredits on Regen Ledger: name the batch denom and the regen-1 transaction hash, and the board reads the - `submit_credit_settlement` — Complete the record: pass workId, the BODY_JSON from prepare_credit_settlement UNCHANGED, and the signature your wallet produced over MESSAGE_TO_SIGN. Relays to - `prepare_place` — Your place is not on the board yet: this is how it gets there. FREE, a signed statement, no fee, no gas, no money moves and nothing is held. You give the pin wh - `submit_place` — Complete the handover: pass the BODY_JSON from prepare_place UNCHANGED and the signature your wallet produced over MESSAGE_TO_SIGN. Relays to the same public do - `place_status` — Read an intake you handed over: pending, posted, or rejected with the reason. Free, keyless, no wallet needed. Pass intakeId for one, or wallet to list every pl - `hour_card` — The ONE document to read to a person before they start: what the place is and the circle every GPS fix must land inside, what to bring and what the safety notes - `my_hours` — The time-bank statement for one wallet: hours claimed, hours a human accepted, hours that reached a settlement, VSH credit that reached them as payment for thei - `my_money` — Everything one wallet was paid, is owed as a receipt, is only offered, and can do next, in a single free keyless read: dollars that settled, every OTHER token t - `prepare_accept_hours` — You were named on a work packet as the person who accepts its hours: this is how you do that. FREE and KEYLESS, a signed judgment, no fee, no gas. NOBODY PAYS A - `submit_accept_hours` — Complete the acceptance: pass the BODY_JSON from prepare_accept_hours UNCHANGED and the signature your wallet produced over MESSAGE_TO_SIGN. Relays to the same - `prepare_post_work` — Put work YOU define on the public board — your place, your problem, your terms. Pass the creator wallet, a title, what needs doing, where, and the proposed pay. - `submit_post_work` — Complete the posting: pass BODY_JSON from prepare_post_work UNCHANGED, the creator wallet's signature over MESSAGE_TO_SIGN, and (unless you hold an EWP key) xPa - `prepare_proof` — You did the work — start handing in proof. Pass the packet's workId, your claimId (from submit_claim), your wallet, and proof items matching the packet's own pr - `submit_proof` — Relay the signed proof to the public completion gate: pass workId, the BODY_JSON from prepare_proof UNCHANGED, and the signature over MESSAGE_TO_SIGN. Approval - `work_status` — Live lifecycle state of one packet — OPEN, CLAIMED, PROOF_SUBMITTED, APPROVED, PROOF_REJECTED, SETTLED or EXPIRED — plus its honest pay status (funded vs propos - `my_work` — One question, the whole picture for ONE wallet: every packet it claimed and where each one stands, what is waiting on the person (proof not handed in, proof rej - `my_votes` — One wallet's whole demand history: every packet it voted for or against, and every packet it pledged to back — both free, signed acts that move no money. Use th - `estimate_footprint` — The anchor tool. Give a rough token or call count for your AI session and get an order-of-magnitude CO2e estimate PLUS the real, verifiable ecological work you - `provision_work` — Turn a place + problem (or a board packet id) into provisioned work: a bounded packet with scope, standards-registered method, proof requirement, tCO2e estimate - `retire_and_certify` — How to retire a given tCO2e amount for real, on-chain, via the Klima rail — paid keyless from the caller's own wallet, returning a confirmed retire transaction - …and 47 more ## Install **Verdict: do-not-install** — Do not install: 6 injection-shaped patterns found in this entry's own text — it may try to steer the model that loads it. **Blocking** - 6 injection-shaped patterns found in this entry's own text — it may try to steer the model that loads it. — tool:submit_token_offer: Exfiltration-shaped instruction · tool:submit_token_settlement: Exfiltration-shaped instruction · tool:submit_credit_offer: Exfiltration-shaped instruction **Cautions** (coverage gaps and advisories — never blocking) - No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. - No publisher has proved control of this listing; it is indexed, not vouched for. **Client configuration withheld.** Client configs are withheld because this entry has a blocking finding. Show the warnings below to the person installing it. If they have seen the findings and still want to proceed, request the plan again with acknowledge_warnings=true. ## Blast radius Moderate to extensive — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: mutates data; runs on someone else's infrastructure. - Floor 27, ceiling 51 (tier: unknown) - `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low. - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/io.github.brawlaphant%2Fvealth - Install plan: https://forgeregistry.com/api/v1/packages/io.github.brawlaphant%2Fvealth/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/io.github.brawlaphant%2Fvealth - HTML page: https://forgeregistry.com/registry/io.github.brawlaphant%2Fvealth - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.