The full upstream README, mirrored here for reference. Install config, tool schemas, adoption signals, and an original overview live on the Cryptoport Port listing page.
What crypto YouTube channels said, as a daily board — coin calls, stances, dated catalysts — served over MCP. Free, no API key.
https://cryptoport-mcp.cryptoport-port.workers.dev/mcpcom.thecryptoport/cryptoport-port (official MCP registry, registry.modelcontextprotocol.io)Claude Code:
Any MCP client that speaks streamable-HTTP remotes:
Free tools: latest_board, search. Everything served is commentary on public statements by
named channels; every payload carries stale / stale_days / built_from_brief_date — read
them. Not financial advice, not real-time.
MCP server + x402-payable HTTP endpoints over thecryptoport.com's daily board.
Network: Base Sepolia (eip155:84532) — testnet, throughout. No mainnet sign-off exists and
none is assumed. Nothing is charged in real money on any network this server talks to.
Master's ruling of record for this build is C+ (2026-08-24): build the paid-port mechanics
now on testnet only; the paid tier itself stays declined and the mainnet switch is the day-60
ruling. The prices below exist so the payment handshake is real, not because anyone is billed.
Runtime owner: Dex. Ward wrote the money, screening and licensing logic; Dex stands the process up and keeps it alive. See "Handoff to Dex" below.
| Tool | Price (testnet USDC) | HTTP twin |
|---|---|---|
latest_board | free | GET /api/v1/board |
search(q, limit) | free | GET /api/v1/search?q= |
coin(ticker) | 0.005 | GET /api/v1/coin/:ticker |
stance_history(ticker) | 0.01 | GET /api/v1/stance_history/:ticker |
catalysts(window) | 0.01 | GET /api/v1/catalysts?window= |
board_snapshot(date) | 0.02 — not charged today | GET /api/v1/board_snapshot/:date |
Free meta: GET /healthz, GET /x402/routes (the price table), GET /.well-known/mcp.json.
MCP: POST /mcp (streamable HTTP) and npm run mcp-stdio (stdio).
The MCP tools are thin proxies onto the HTTP twins inside the same process. One code path for pricing, screening, refusal and the published-field gate, so the two surfaces cannot disagree.
llms.txt says, in the site's own words: "there is no hidden paid tier of the same rows."
That sentence is a constraint on this build, and it holds: every paid payload names the free
static file the same facts live in (upstream). What is priced is form, not exclusivity —
a parsed dated series instead of an arc string, a windowed catalyst query instead of a full
file. If a future paid tool ever returns a fact the free tier does not, that llms.txt line
becomes false and has to change first. → flagged to Larry, not decided here.
Data comes from the rung-0 emitter: CRYPTOPORT_DATA_DIR, else
<repo>/../../Documents/Claude/myPKA/infra/cryptoport-site/dist, falling back to staging
when dist has no feed.json. It is read once at boot into memory — the request path never
touches the filesystem, which is what makes src/worker.js (Cloudflare Workers) a deployment
choice rather than a rewrite.
Streamable HTTP instead: point the client at http://localhost:8402/mcp.
Chosen: x402 v2 middleware in front of the paid routes + the free public testnet facilitator
| Rejected | Why |
|---|---|
| A bespoke access/subscription contract | Pure audit surface for something x402 does natively per call. |
| A self-hosted facilitator | Right idea, wrong scale. Buys decentralisation we do not need and adds a service to keep alive. |
| API keys + Stripe | Reintroduces accounts, PII and an operator in the loop; wrong shape for anonymous agents. |
| Any token, subscription NFT or fractionalised instrument | Pre-CLARITY securities exposure for zero benefit. Hard no. |
@x402/paywall (a peer dep of @x402/hono) | Installs 716 packages including WalletConnect, for a browser paywall UI no agent will ever see. @x402/hono works without it; verified. |
Header names are read out of @x402/core, not transcribed from a blog: request X-PAYMENT,
response X-PAYMENT-RESPONSE, and the 402 carries the terms in the payment-required header
(base64 JSON) — the terms are also repeated in the JSON body so an agent does not have to
base64-decode a header to learn a price. Package generation matters: the scoped @x402/* v2
packages are pinned in package.json and coexist on npm with the v1 x402-hono/x402-next.
No license is signed and no license hash is referenced here. This rung sells access to a
compilation of public statements; there is no geometry, no licensable work product, and no
EIP-712 typed-data license in the design. The license string in every payload is rung 0's own
attribution notice, passed through untouched.
src/inputs.js. Any argument named like portfolio / holdings /
position / allocation / balance / risk profile / cost basis / PnL / leverage / stop-loss /
"should I buy" is refused with 400 and a plain reason, on HTTP and MCP alike, before
payment is even considered. Values are never inspected — we refuse the shape, we do not read
the data. Every tool description says so.src/sdn.js. A local check of every
0x… address found anywhere in the decoded X-PAYMENT payload against OFAC's published SDN
digital-currency address list (991 addresses, 124 EVM, published 08/24/2026), fetched
read-only by scripts/sdn-refresh.js from OFAC's own endpoint and vendored as
data/sdn-addresses.json. A listed payer gets 403, is never settled and is never served.
Not KYT: it screens the paying address, it does not trace funds. No KYC, no accounts, no PII
— collecting identity for a $0.005 data call creates a worse surface than it mitigates.src/allowlist.js. quality, counterweight, rank and
presence never leave the process, however they are spelled, and any undeclared key raises
too. The held-back list has one source of truth —
infra/cryptoport-site/allowlist.py — and test/allowlist-parity.test.js fails if the two
drift. Upstream rows are projected on load, so a widened emitter cannot silently widen this
surface.Proof the gates can fail (the point of having them):
test/sdn.test.js refuses a genuinely OFAC-listed address end-to-end over HTTP, then removes
that one address from the list and asserts the same call is not refused — so the 403 is
demonstrably coming from the gate and not from somewhere else. test/b2-leak.test.js injects
each held-back column into the upstream JSON and asserts every tool either raises or projects it
away, and that the HTTP surface answers 500 with no leaked value in the body.
payTo. It signs nothing, holds no approvals, calls no
contract. The server does not need its key and refuses to start if any
*PRIVATE_KEY / *RECOVERY_KEY / MNEMONIC / SEED_PHRASE variable is present in its
environment (test/network-guard.test.js).~/projects/cad-on-chain/scripts/keygen.js pattern, with
one change: the key is written straight to .env.sepolia (mode 600) and never printed.
stdout ends up in terminals, transcripts and session logs, and "no private key in a repo, a
note or a log" has no testnet exemption.payTo is a CDP-managed Server Wallet or it does not exist.payTo is a CDP-managed account; no key material anywhere on disk; the throwaway-EOA
pattern retired.x402.org (testnet-only) to CDP with credentials held outside the
repo.Status against that list today: 5 and 6 are done and demonstrated. 1, 2, 3, 4, 7 and 8 are untouched. 9 holds — this build ships no bytecode, so no Slither/Foundry pass and no external audit is required; if that ever changes, item 9 applies in full.
X402_PAY_TO. It needs no key. Hold
it outside any repo. .env.sepolia / .env.buyer are mode-600 and git-ignored and the server
never reads them.src/worker.js (env.BOARD keys: feed, coins,
catalysts, sdn) and pushed by the 07:50 cron. No Cloudflare account was created for
this — the file exists so the runtime choice stays a deployment decision.https://x402.org/facilitator on every paid call (1–2 subrequests). The
datacenter-egress problem on this box is inbound reputation at YouTube, not outbound HTTPS.CRYPTOPORT_DATA_DIR at whatever the 07:50 job emits. The port re-reads only
at boot; restart it after the emit, or add a reload.npm run sdn-refresh (read-only fetch from OFAC, ~30 s).dist build
carries anchor.root = null while staging has real Merkle roots — the deployed build is
un-anchored. The server prints a warning at boot and serves the empty anchor faithfully. That
is Dex's to fix, not Ward's.com.thecryptoport/cryptoport-port on
registry.modelcontextprotocol.io via HTTP domain proof (root server.json,
scripts/registry-publish.sh).Expect ~$0. Free testnet facilitator, free registry listing, testnet USDC, existing hosting, no contract, no vendor. The only recurring cost that ever appears is CDP's $0.001 per settlement above 1,000/month at mainnet, which at any realistic volume for this board is zero. Revenue expectation is also ~$0: at the ecosystem median a thousand paid calls a month is about $28; at these prices, $5–10. This lane is a demo of the stack and an option on a rail.
x402.org facilitator's /supported advertises
['builder-code','eip2612GasSponsoring','erc20ApprovalGasSponsoring'] — no bazaar — and
GET /facilitator/discovery/resources returns 404. Our 402s carry a valid bazaar
declaration (registry/bazaar-mcp.json, and test/x402.test.js asserts it), but nothing
indexes it. A real Bazaar listing needs the CDP facilitator, which needs an account. This
contradicts the "Bazaar day one" line in the Lane C spec §C3 and is a mainnet-gate item.npm run demo again.server.json; it validates against the live registry
schema and is what scripts/registry-publish.sh publishes. (The earlier unused draft at
registry/server.json was removed 2026-08-30.)board_snapshot is a stub and is deliberately not charged while it is one: no anchored
historical board series exists yet.X-PAYMENT-RESPONSE header, not the response body,
because the SDK settles after the handler has already written the body. The MCP layer merges
it into the payload as settlement; HTTP callers read the header. Documented rather than
worked around.stance_history derives from the published arc string. If rung 0 ever stops publishing
arc, this tool has nothing to parse.disclaimer sentence in every payload is engineering
boilerplate about what an anchor does and does not prove — Rhea/Pax to ratify the wording.Unchanged from the Lane C spec §C5: (a) does charging for a summarised feed of named channels' calls change the attribution / derivative-work posture; (b) is a paid crypto-calls feed exposed to investment-adviser framing that the free board is not; (c) money-transmission characterization of receiving USDC for data; (d) may the seven channel names appear in a paid product. None of these are answered, and this build charges nobody.
Live: https://cryptoport-mcp.cryptoport-port.workers.dev/mcp — MCP over HTTP,
six tools, free, no key and no account.
Master ruled on 2026-08-27 that the free MCP server ships before the paid x402 port
is hosted: it is the "free front door onto a human budget" from the strategy memo,
it is the only thing that produces the visitor number the day-30 checkpoint needs,
and the descriptor the site publishes at /.well-known/mcp.json had been naming
tools with no server behind them.
Free by construction, not by policy. wrangler.jsonc sets no X402_PAY_TO, so
createApp never mounts the x402 middleware, isCharging() reports price_usdc: "0"
and paid: false on every response, and no tool description quotes a cost. Master's
ruling 4a — paid tier declined until the day-60 checkpoint — is therefore enforced by
the absence of a variable rather than by anyone remembering it.
⛔ Do not add X402_PAY_TO to this Worker. The paid port is a separate deployment
whose hosting was deferred; turning payments on here would flip a declined tier by
editing a config file.
Data path. scripts/kv-push.mjs reads the built dist/ and writes feed,
coins, catalysts and sdn into the BOARD KV namespace. The Worker reads KV; it
never touches a filesystem and never calls back to Bluehost — which also means machine
clients that Bluehost's mod_security rejects (python-requests gets a 406 there) can
reach the board here.
No zone, no DNS. It answers on the account's own *.workers.dev subdomain. No
record on thecryptoport.com or any other portfolio domain was created or changed, which
is what keeps this clear of the never-touch mail directive on those zones.
KV holds whatever was last pushed, so the push rides the end of the existing 07:50 chain — it runs only if the build, the allowlist gate and the deploy all succeeded.
Dry-run it under cron's environment before ever changing this line. wrangler's
shebang is #!/usr/bin/env node, and cron's minimal PATH has no node: the first
attempt died with exit 127, the same trap that killed the channel_intel pipeline on
2026-08-15. kv-push.mjs now extends PATH with its own process.execPath directory.
The check that catches it:
Run it by hand any time: node scripts/kv-push.mjs.