How do I install FibX?

Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does FibX need an API key?

The publisher lists these environment variables: FIBX_API_URL, FIBX_SESSION_SECRET, FIBX_WC_PROJECT_ID.

When was FibX last checked?

Last checked 2026-11-11. Swap, transfer, portfolio and Aave V3 on Base, HyperEVM and Monad, with the FibX app as MCP Apps UI.

FibX MCP server

FibX

A command-line tool and MCP server for DeFi operations on Base, HyperEVM, and Monad, powered by Fibrous aggregation. Sign with your own wallet over WalletConnect, with a Privy server wallet, or with an imported key — every path bounded by a signing policy that lives on your machine.

Features

Multi-Chain Support: Base, HyperEVM, and Monad
Portfolio: Cross-chain portfolio overview with USD valuations and DeFi positions
Token Swaps: Optimal routing via Fibrous aggregation with auto-slippage
Transfers: Send ETH or any ERC-20 token
Aave V3: Supply, borrow, repay, withdraw, and browse markets on Base
MCP Server: Built-in AI agent integration for Cursor, Claude Desktop, and Antigravity (19 tools)
The FibX app, in the chat: in hosts that render MCP Apps UI such as Claude Desktop, open_fibx shows the wallet, balances, signing policy and a swap form with the Fibrous route inline — the model opens it, and you press Simulate and Swap
Agent Skills: Prompt-based AI skills via fibx-skills
Your own wallet: Pair over WalletConnect and approve every transaction on your phone
Privy Server Wallets: Server-side signing — the CLI receives signed transaction payloads or signatures, not Privy app credentials or raw keys
Private Key Import: Use an existing wallet with AES-256-GCM encrypted local storage
Local signing policy: A file you own — native value cap per chain, allowed chains, allowed destinations, expiry — enforced before every signature on all three paths (Privy adds its own server-side policy on top)
Preflight Checks: Transaction flows validate or estimate execution where the underlying RPC supports it
Dry‑Run Mode: --simulate previews write operations without broadcasting; gas estimates are included where available
JSON Output: --json flag for scripting and pipelines
Zero-Dependency Install: Single-file bundle via tsup — npx fibx runs near-instantly

Supported Chains

Chain	Native Token	Aave V3
Base	ETH	✅
HyperEVM	HYPE	—
Monad	MON	—

Installation

Run directly with npx (no install needed):

npx fibx status

Or install globally:

npm install -g fibx

Requirements

Node.js >= 18
A running fibx-server instance (required for Privy wallet operations; not needed for private key imports)

Quick Start — First Swap in 3 Minutes

Step 1: Get a Price Quote (no auth needed)

Try FibX instantly — no sign-up, no wallet, no keys:

npx fibx quote 0.01 ETH USDC              # Check price on Base
npx fibx quote 100 USDC DAI --chain base   # Compare pairs
npx fibx quote 0.5 MON USDC --chain monad  # Check Monad prices

Step 2: Authenticate (pick one)

Option A — Email Login (Privy Server Wallet, no keys to manage):

npx fibx auth login [email protected]          # Sends OTP to your email
npx fibx auth verify [email protected] 123456  # Verify & create wallet

Option B — Import Private Key (use an existing wallet):

npx fibx auth import                       # Paste your key (encrypted at rest)

Step 3: Execute

npx fibx trade 0.01 ETH USDC               # Execute the swap
npx fibx balance                            # Check your balances

That's it. Three steps from zero to first swap.

Usage

Choosing how FibX signs

Run fibx auth setup and it will ask. The three paths differ on one thing:

Path	Key held by	Runs while you are away	Bounded by
`auth connect`	your own wallet	no	you, on your phone
`auth login`	Privy	yes	Privy's signing policy
`auth import`	this machine	yes	the local policy you set

Keeping your own wallet and having FibX act unattended needs ERC-7715, which wallets do not yet expose over WalletConnect. fibx auth setup explains the closest options.

Security: When using auth import, your private key is encrypted at rest with AES-256-GCM. The encryption key is auto-generated per machine and stored in the OS config directory (e.g. ~/.config/fibx-nodejs/encryption-key on Linux). You can also set the FIBX_SESSION_SECRET environment variable for CI/Docker environments.

Connect your own wallet

npx fibx auth connect

Pairs FibX with a wallet you already have — MetaMask, Rabby, Rainbow, Phantom — over WalletConnect. A QR code appears in the terminal; scan it with your phone. Every transaction is then approved in your wallet, so the keys never leave it.

The chain you trade on must already be in your wallet, and it is approved when you pair. If you try to sign on a chain the session does not carry, FibX stops before contacting the wallet and names the chain: add it in your wallet, then run npx fibx auth connect again so the new chain is included.

With --json, output is NDJSON — one JSON document per line, not one document for the whole run: the pairing URI prints first as {"uri":"wc:..."} so a script can act on it while it waits, then the result prints as its own compact JSON line once the wallet approves.

npx fibx auth logout ends the connection on both sides: it tells your wallet to drop the session, so FibX stops appearing in its connected-apps list, and removes the pairing keys from disk along with the session.

A shared WalletConnect project id ships in the published bundle, so this works with no setup. It is public by necessity — a CLI has no origin to allowlist — so its only real exposure is quota consumed by third parties. If pairing starts failing on quota, create a free project at cloud.reown.com and set FIBX_WC_PROJECT_ID to your own id.

auth login (email OTP) and auth import (private key) are unchanged and remain available.

Signing policy

fibx policy bounds what FibX is allowed to sign, on top of whichever path from the table above holds the key — a client-side cap evaluated before every local-key, Privy, or WalletConnect transaction:

npx fibx policy show                    # Print the active policy

npx fibx policy set base.maxValue 0.05
npx fibx policy set allowedChains base,monad
npx fibx policy set base.allowedDestinations 0xYourColdWallet,0xTheRouter
npx fibx policy set expiry 2026-12-31   # UTC midnight starting that day

npx fibx policy clear base.maxValue     # Remove one rule
npx fibx policy clear                   # Remove the whole policy (asks first)

A local policy guarding a local key is advisory: anything that can read the key can edit the policy, so this is worth nothing against malware. What it does bound is the agent — a model that misbehaves, or a prompt injection telling it to.

Know what each rule bounds, because they are not the same:

maxValue caps the native value of a single transaction — ETH on Base, HYPE on HyperEVM, MON on Monad. It does not bound tokens. An ERC-20 transfer reaches the policy as a call to the token's contract carrying value: 0, so the amount is invisible to it: base.maxValue 0.05 places no limit on fibx send 50000 USDC 0xsomewhere, on the token side of a trade, or on an Aave borrow. A token-value cap needs decimals and a token registry, and is not in this release.
allowedDestinations is the rule that bounds tokens, by bounding where anything may go. It is the one to set if the worry is an agent moving your holdings somewhere. Note that allowlisting a token's contract so a trade can approve it also permits transfers of that token.
allowedChains and expiry do exactly what they say. A lapsed or unparseable policy refuses everything rather than permitting it.

Global Options

Option	Description	Default
`-c, --chain <name>`	Target chain (`base`, `hyperevm`, `monad`)	`base`
`--json`	Output results as JSON	`false`

Balance

npx fibx balance
npx fibx balance --chain hyperevm

Portfolio

Consolidated cross-chain portfolio view with USD valuations:

npx fibx portfolio           # Table output across all chains
npx fibx portfolio --json    # Structured JSON for scripting

Shows all token holdings across Base, HyperEVM, and Monad with USD values. Includes DeFi positions (Aave V3 collateral/debt) and total portfolio net worth. Token prices are sourced live from Fibrous.

Send

npx fibx send 0.001 0xRecipient           # Send native token on Base (ETH)
npx fibx send 10 0xRecipient USDC         # Send ERC-20 on Base
npx fibx send 1 0xRecipient --chain monad # Send MON on Monad
npx fibx send 0.1 0xRecipient --simulate  # Preview without sending

Quote

Get swap prices without authentication:

npx fibx quote 0.01 ETH USDC                  # Price check on Base
npx fibx quote 1 MON USDC --chain monad         # Check Monad prices
npx fibx quote 0.1 ETH USDC --json             # JSON output for scripts

No wallet or authentication required. Use quote to explore prices, then trade to execute.

Swap

npx fibx trade <amount> <from> <to>
npx fibx trade 0.0001 ETH USDC
npx fibx trade 20 USDC DAI
npx fibx trade 1 MON USDC --chain monad
npx fibx trade 0.1 ETH USDC --simulate   # Preview without broadcasting

Options: --slippage <n> (default: 0.5%), --approve-max, --simulate, --json

Note: The trade command automatically detects Wrap (Native -> Wrapped) and Unwrap (Wrapped -> Native) operations and executes them directly via contract calls, bypassing aggregator routing to save gas.

Transaction Status

npx fibx tx-status <hash>
npx fibx tx-status 0x123...abc --chain monad

Wallet Info

npx fibx address    # Print active wallet address
npx fibx wallets    # Show active wallet details

Aave V3 (Base)

npx fibx aave status               # Account health
npx fibx aave markets              # List all active reserves with APY & TVL
npx fibx aave supply 1 ETH         # Auto-wraps ETH -> WETH and supplies
npx fibx aave supply 100 USDC      # Supply ERC-20
npx fibx aave borrow 50 USDC       # Borrow
npx fibx aave repay 50 USDC        # Repay
npx fibx aave repay max ETH        # Auto-wraps ETH and repays full WETH debt
npx fibx aave withdraw max ETH     # Withdraws WETH and auto-unwraps to ETH
npx fibx aave supply 1 ETH --simulate  # Preview without broadcasting

Note: supply, repay, and withdraw support automatic ETH <-> WETH wrapping/unwrapping on Base.

Configuration

Set custom RPC URLs to avoid rate limits on public endpoints:

npx fibx config set-rpc base https://mainnet.base.org
npx fibx config get-rpc base
npx fibx config reset-rpc base   # Reset single chain to default
npx fibx config reset-rpc        # Reset all chains to default
npx fibx config list

Hot-reload: Config changes are picked up automatically — no need to restart the CLI or MCP server.

AI Agent Integration

MCP Server

fibx includes a built-in MCP server for AI editors like Cursor, Claude Desktop, and Antigravity. See MCP.md for setup and available tools.

npx fibx mcp-start

The MCP server exposes 19 tools: the FibX app (open_fibx, list_tokens), read-only queries, three transactional tools, and session and policy management. All write operations support a simulate=true preview that does not broadcast; gas estimates are returned only where available.

In a host that renders MCP Apps UI — Claude Desktop today — open_fibx is the entry point: ask about your wallet, a balance, a price or a swap and the whole app opens inline, pre-filled from the conversation. It executes nothing on its own; Simulate and Swap are buttons you press. In a text-only host the same call returns a JSON snapshot the model can summarise, and the headless tools do the rest.

Agent Skills

For prompt-based agent integration (Claude Code, Cursor, etc.), see the fibx-skills repository.

Security

Letting an AI agent operate a wallet requires controls outside the model. fibx combines signing-layer policies, server-side validation, client hints, and explicit previews. These controls reduce risk, but the server credentials, MCP client configuration, and deployment policy remain part of the trust boundary:

Layer	What it does
Privy signing policy	The default policy allowlists configured chains, caps each transaction's native-token `value`, and denies key export. Privy evaluates the policy at signing time; fibx-server credentials and any custom policy remain critical trust boundaries.
fibx-server schemas	`/sign/*` accepts only the exact transaction shape the CLI produces — unknown fields, contract creation, and unserved chains are rejected before reaching Privy.
MCP tool annotations	Every transactional tool advertises `destructiveHint: true`; compatible clients may use that hint to request confirmation, depending on client behavior and configuration.
Simulation	`--simulate` previews write operations without broadcasting. Some paths also return a gas estimate; others return operation metadata only.
Local key storage	Imported private keys are encrypted at rest with AES-256-GCM using a per-machine key stored `0600` in the OS config directory.

Wallet policy limits are configured per deployment — see the fibx-server wallet policy docs.

Note: policies are attached when a wallet is created. Wallets provisioned before policies were introduced keep signing without them until migrated.

Architecture

This repository is the CLI and MCP server. Three sibling repositories complete the stack:

Repository	Role
fibx (this repo)	CLI + stdio MCP server, shipped as a single dependency-free bundle
fibx-server	Hono backend that proxies Privy — holds the app secret so the CLI never does, and owns the wallet signing policy
fibx-skills	Prompt-based Agent Skills for Claude Code, Cursor, and other skill-aware agents
fibx-telegram-bot	Telegram bot that drives this CLI over MCP, with one process and separate config paths per active user

src/
├── commands/           # CLI commands (auth, policy, trade, send, aave, config)
├── mcp/                # Modular MCP server
│   ├── server.ts       # Entry point + MCP_INSTRUCTIONS
│   ├── ui.ts           # The ui://fibx/app.html resource (the built widget, inlined)
│   ├── tools/          # Tool registrations (app, auth, wallet, trade, defi, policy)
│   └── handlers/       # Tool implementations
├── services/           # Business logic (chain, fibrous, auth, policy, walletconnect, defi, portfolio)
└── lib/                # Shared utilities (errors, fetch, format, crypto)
ui/
├── src/                # The FibX app widget — Preact, one document, no network
└── dev-host/           # A local MCP Apps host for the widget: fixtures, or a bridge to the real server

The widget is built by Vite into a single HTML document and embedded in dist/index.js by tsup, so the published package is still one file with no runtime dependencies.

Development

pnpm install
pnpm dev          # run the CLI from source
pnpm test         # vitest unit tests
pnpm typecheck    # tsc --noEmit
pnpm lint         # eslint
pnpm format:check # prettier
pnpm build        # vite (the app widget) then tsup, to dist/
pnpm dev:ui       # the app widget in a local host, against fixtures — no wallet needed

pnpm dev:ui:bridge runs the same host against the real MCP server; a Swap there is a real swap.

License

MIT