The Crypto Port — MCP server

What crypto YouTube channels said, as a daily board — coin calls, stances, dated catalysts — served over MCP. Free, no API key.

• Live endpoint (streamable HTTP): https://cryptoport-mcp.cryptoport-port.workers.dev/mcp
• Registry name: com.thecryptoport/cryptoport-port (official MCP registry, registry.modelcontextprotocol.io)
• Website (the human board): https://thecryptoport.com

Add to your client

Claude Code:

claude mcp add --transport http cryptoport https://cryptoport-mcp.cryptoport-port.workers.dev/mcp

Any MCP client that speaks streamable-HTTP remotes:

{
  "mcpServers": {
    "cryptoport": {
      "type": "streamable-http",
      "url": "https://cryptoport-mcp.cryptoport-port.workers.dev/mcp"
    }
  }
}

Free tools: latest_board, search. Everything served is commentary on public statements by named channels; every payload carries stale / stale_days / built_from_brief_date — read them. Not financial advice, not real-time.

Build context — the rung-3 machine port

MCP server + x402-payable HTTP endpoints over thecryptoport.com's daily board.

Network: Base Sepolia (eip155:84532) — testnet, throughout. No mainnet sign-off exists and none is assumed. Nothing is charged in real money on any network this server talks to. Master's ruling of record for this build is C+ (2026-08-24): build the paid-port mechanics now on testnet only; the paid tier itself stays declined and the mainnet switch is the day-60 ruling. The prices below exist so the payment handshake is real, not because anyone is billed.

Runtime owner: Dex. Ward wrote the money, screening and licensing logic; Dex stands the process up and keeps it alive. See "Handoff to Dex" below.

What it is

Free meta: GET /healthz, GET /x402/routes (the price table), GET /.well-known/mcp.json. MCP: POST /mcp (streamable HTTP) and npm run mcp-stdio (stdio).

The MCP tools are thin proxies onto the HTTP twins inside the same process. One code path for pricing, screening, refusal and the published-field gate, so the two surfaces cannot disagree.

What the paid tier actually sells — read this before pricing anything

llms.txt says, in the site's own words: "there is no hidden paid tier of the same rows." That sentence is a constraint on this build, and it holds: every paid payload names the free static file the same facts live in (upstream). What is priced is form, not exclusivity — a parsed dated series instead of an arc string, a windowed catalyst query instead of a full file. If a future paid tool ever returns a fact the free tier does not, that llms.txt line becomes false and has to change first. → flagged to Larry, not decided here.

Run it

npm install
npm run sdn-refresh          # refresh the OFAC list (vendored copy already present)
node scripts/keygen.js       # writes .env.sepolia (mode 600); prints only the address
X402_PAY_TO=0x… npm start    # http://localhost:8402
npm test                     # 50 tests
npm run demo                 # free call -> 402 -> (pay) -> data + receipt

Data comes from the rung-0 emitter: CRYPTOPORT_DATA_DIR, else <repo>/../../Documents/Claude/myPKA/infra/cryptoport-site/dist, falling back to staging when dist has no feed.json. It is read once at boot into memory — the request path never touches the filesystem, which is what makes src/worker.js (Cloudflare Workers) a deployment choice rather than a rewrite.

Claude Code MCP config (stdio)

{ "mcpServers": { "thecryptoport": {
  "command": "node",
  "args": ["/home/ops/projects/cryptoport-port/src/mcp-stdio.js"],
  "env": { "X402_PAY_TO": "0x…" }
} } }

Streamable HTTP instead: point the client at http://localhost:8402/mcp.

Mechanism chosen, and what was rejected

Chosen: x402 v2 middleware in front of the paid routes + the free public testnet facilitator

• USDC on Base Sepolia. No smart contract, no bytecode of any kind. A price, a receive address and a verifier are the whole mechanism, and fewer contracts is a security property.

Header names are read out of @x402/core, not transcribed from a blog: request X-PAYMENT, response X-PAYMENT-RESPONSE, and the 402 carries the terms in the payment-required header (base64 JSON) — the terms are also repeated in the JSON body so an agent does not have to base64-decode a header to learn a price. Package generation matters: the scoped @x402/* v2 packages are pinned in package.json and coexist on npm with the v1 x402-hono/x402-next.

No license is signed and no license hash is referenced here. This rung sells access to a compilation of public statements; there is no geometry, no licensable work product, and no EIP-712 typed-data license in the design. The license string in every payload is rung 0's own attribution notice, passed through untouched.

Gates (all three run before anything is served)

1. Advisory-input refusal — src/inputs.js. Any argument named like portfolio / holdings / position / allocation / balance / risk profile / cost basis / PnL / leverage / stop-loss / "should I buy" is refused with 400 and a plain reason, on HTTP and MCP alike, before payment is even considered. Values are never inspected — we refuse the shape, we do not read the data. Every tool description says so.
2. OFAC SDN denied-party screening on the payer — src/sdn.js. A local check of every 0x… address found anywhere in the decoded X-PAYMENT payload against OFAC's published SDN digital-currency address list (991 addresses, 124 EVM, published 08/24/2026), fetched read-only by scripts/sdn-refresh.js from OFAC's own endpoint and vendored as data/sdn-addresses.json. A listed payer gets 403, is never settled and is never served. Not KYT: it screens the paying address, it does not trace funds. No KYC, no accounts, no PII — collecting identity for a $0.005 data call creates a worse surface than it mitigates.
3. B-2 published-field gate — src/allowlist.js. quality, counterweight, rank and presence never leave the process, however they are spelled, and any undeclared key raises too. The held-back list has one source of truth — infra/cryptoport-site/allowlist.py — and test/allowlist-parity.test.js fails if the two drift. Upstream rows are projected on load, so a widened emitter cannot silently widen this surface.

Proof the gates can fail (the point of having them): test/sdn.test.js refuses a genuinely OFAC-listed address end-to-end over HTTP, then removes that one address from the list and asserts the same call is not refused — so the 403 is demonstrably coming from the gate and not from somewhere else. test/b2-leak.test.js injects each held-back column into the upstream JSON and asserts every tool either raises or projects it away, and that the HTTP surface answers 500 with no leaked value in the body.

Wallet surface

• One receive-only address as payTo. It signs nothing, holds no approvals, calls no contract. The server does not need its key and refuses to start if any *PRIVATE_KEY / *RECOVERY_KEY / MNEMONIC / SEED_PHRASE variable is present in its environment (test/network-guard.test.js).
• Testnet throwaway EOA, per the ~/projects/cad-on-chain/scripts/keygen.js pattern, with one change: the key is written straight to .env.sepolia (mode 600) and never printed. stdout ends up in terminals, transcripts and session logs, and "no private key in a repo, a note or a log" has no testnet exemption.
• It does not graduate. A mainnet payTo is a CDP-managed Server Wallet or it does not exist.
• Chain id 84532 is hard-guarded and every mainnet id is denylisted by name.
• Non-custodial by construction: no buyer funds, no buyer keys, no buyer files, no refunds (settlement precedes delivery), and no file custody, ever.

Mainnet gate list (verbatim from the Lane C spec §C7 — all must be true, none inferred)