The full upstream README, mirrored here for reference. Install config, tool schemas, adoption signals, and an original overview live on the Hyperevm MCP listing page.
Ask your AI assistant about the Hyperliquid ecosystem in plain English. It reads. There is nowhere to put a private key, and that is the whole security model.
Four of those cells read n/a. That is the point: stHYPE publishes no yield pool, and kHYPE's weekly delta came back from the source implying the pool paid nothing seven days ago, which its own daily history contradicts. A number we cannot stand behind is not printed.
The vault row shows the same rule twice over. HLP has no pool on DefiLlama at all, so a table built from that source alone silently omits the largest single place to deposit on the chain — it is read from Hyperliquid instead. And Hyperliquid's own APR field for it is not shown, because the same value means one thing as an annual rate and something 365 times larger as a daily one, and the vault's history does not settle which. What is shown is realised profit and loss per window, divided here, where the arithmetic is ours to defend.
Then ask whether to believe one of those rates:
Zero earned, every day, for a month.
Claude Code
Cursor, Claude Desktop, or any MCP client — add to the config file:
That is the whole setup. Nothing to fill in afterwards — there is no account to authenticate against.
Nine tools. Five report the present, three report how it got there, one reads an address.
| Tool | What it answers |
|---|---|
hyperevm_yields | Every yield on HYPE in one table: liquid staking, lending with supply/borrow/utilisation/max LTV, LP and looping, and the HLP vault — with earned yield separated from token emissions |
hyperevm_protocols | What is deployed on HyperEVM: chain TVL, per-protocol TVL, 1d/7d change, sortable by size or weekly growth; a detail card for any one protocol |
hyperevm_fees | Fees users actually paid, ranked over 24h/7d/30d. TVL says how much money sits somewhere; this says whether anyone is paying to use it |
hl_market | Perp mark price, funding hourly and annualised, open interest, 24h volume; spot pairs; predicted funding across Hyperliquid, Binance and Bybit |
hl_staking | HYPE validators ranked by predicted APR, with commission, uptime and stake share — what the network pays before any wrapper takes its cut |
hyperevm_pool_history | One pool's APY and TVL over weeks, split into earned versus emitted — so a headline rate can be checked against its own history |
hl_funding | How funding actually behaved over days: average, range, how much of the time it held its sign, and what the position would have paid |
hl_orderbook | Spread and resting depth, and whether a given trade size fills inside the visible book — or a plain statement that it does not |
hyperevm_wallet | Any public address: account value, open positions with entry, unrealised PnL and liquidation price, spot balances, HYPE staking |
The pairs are deliberate. hyperevm_yields and hl_market tell you what a number is now; hyperevm_pool_history and hl_funding tell you whether to believe it. A 47% pool that has been 100% emissions for a month and a 20% pool earning fees are not the same product, and only the second pair can tell them apart.
The server also ships MCP prompts, which appear as slash commands in Claude Code:
| Prompt | What it does |
|---|---|
yield-report | Staking, liquid staking, lending and LP in one pass, ranked with emissions called out |
protocol-brief | One protocol: size, mechanics, where its yield sits, how it compares |
wallet-review | A public address: exposure, funding cost per day, idle balances |
funding-scan | Where Hyperliquid funding diverges from Binance and Bybit |
It has no write path. Not "disabled by default" — the code to sign or send anything does not exist.
src/core/http.ts:
api.hyperliquid.xyz, api.llama.fi, yields.llama.fi, rpc.hyperliquid.xyz.
No tool takes a URL, host or chain as a parameter.None of that is a promise — it is a test. npm run audit checks every line above against the
source and exits non-zero if one stops being true; it runs in CI before publish. Adding a fs import
or a second network host fails the build rather than reaching you:
The whole server is a few thousand lines of TypeScript. It is meant to be read before you install it.
Lending rates are not where they look like they are. DefiLlama's /pools reports 0.00% for
collateral markets — truthfully, since their supply rate really is zero. The rate lives in a second
endpoint, /lendBorrow, joined on the pool id. A naive integration prints a table of zeros over a
$239M market. This one joins them and shows supply, borrow and utilisation separately.
Missing data is shown as missing. stHYPE ($172M) and beHYPE publish no yield pool on DefiLlama,
so their APY appears as n/a next to their real TVL, with the network staking APR printed above as a
reference. A zero standing in for "unknown" would be the most expensive thing this tool could print.
Emissions are not yield. The top pools by headline APY are often paying entirely in their own
token. The table carries a Base column next to APY, so 48.86% / base 0.00% reads as what it is,
and a note names the rows where most of the number is emissions. The 7d column shows the same
thing over time: that pool's APY fell 30 percentage points in a week.
This server is read-only and cannot act. But it carries text written by strangers into your agent's context, next to whatever else that agent can do — a wallet, a shell. Validator names on Hyperliquid are free text set by whoever runs the validator; DefiLlama protocol names come from pull requests. So the text is treated as hostile, in three layers.
1. Fields that are not needed are never read. description — 445 characters of free text on a
validator, 599 on a DefiLlama protocol — is not parsed anywhere in the code. The audit fails the build
if that changes.
2. An allowlist, not a blocklist. Everything printed passes a filter that keeps letters, digits,
currency signs and a short list of punctuation, and drops everything else. Not a list of bad
sequences to catch — a list of what may pass. So <|im_start|>, [INST], ###, {{, backticks and
table pipes cannot survive, because the characters that build them are not on the list. Input is
NFKC-normalised first, so full-width lookalikes fold to ASCII before the filter rather than after.
3. The type system, not discipline. Sanitised text has its own type. The renderers accept nothing else, so printing a raw upstream field is a compile error rather than a code-review miss. There is exactly one place where that type can be created from a plain string, and the audit fails the build if a second appears.
A test feeds a poisoned upstream response — chat-template markers, a javascript: URL, an injected
instruction, a fence in the slug — through a real tool and asserts that none of it reaches the output
in a form that can do anything.
What this does not do: it cannot stop plain English. A validator named "ignore previous instructions" still reads as those words. The answers to that are the field whitelist, the 24-character cap, and the fact that this server exposes no action for such a sentence to trigger — not a cleverer filter. Anyone claiming a filter solves prompt injection is selling something.
Details in SECURITY.md.
Node 20 or newer. Two direct dependencies: @modelcontextprotocol/sdk and zod.
(The SDK brings its own tree, as it does for every MCP server; nothing else is added on top.)
Individually:
The unit tests cover the parts that decide what a reader sees: that "unknown"
renders as n/a and never as 0, that percentage points and percentages stay
different units, that a cell cannot forge a table column, that a failed refresh
serves the previous answer and says so. The behaviour checks drive poisoned
upstream responses through whole tools.
Unofficial and community-built. Not affiliated with Hyperliquid or with any protocol listed. Data comes from public APIs and may be delayed or wrong; DefiLlama refreshes roughly every 30 minutes. When a refresh fails the previous answer is served with a visible "REFRESH FAILED, this is N min old" label rather than an error — old data is useful, old data pretending to be fresh is not. Not financial advice.
MIT © sand0vvv