FibX
Swap, transfer, portfolio and Aave V3 on Base, HyperEVM and Monad, with the FibX app as MCP Apps UI.
Open source Open in the app JSON README (API)
About
Swap, transfer, portfolio and Aave V3 on Base, HyperEVM and Monad, with the FibX app as MCP Apps UI.
Details
- Kind
- MCP servers
- Topic
- Finance & crypto
- Publisher
- finance.fibrous
- Origin
- official
- Category
- ferramentas
- Transport
- local
- Version
- 0.10.1
- Forks
- 2
- Last push
- 2026-09-05T20:17:50Z
- Repository state
- ativo
- Language
- TypeScript
- License
- MIT
- Added
- 2026-08-29 03:01:35
- Updated
- 2026-09-05 21:00:45
- Origin id
finance.fibrous/fibx
README
# FibX
A command-line tool and MCP server for DeFi operations on **Base, HyperEVM, and Monad**, powered by [Fibrous](https://fibrous.finance) aggregation. Sign with your own wallet over WalletConnect, with a [Privy](https://privy.io) server wallet, or with an imported key — every path bounded by a signing policy that lives on your machine.
[](https://badge.fury.io/js/fibx)
## Features
- **Multi-Chain Support**: Base, HyperEVM, and Monad
- **Portfolio**: Cross-chain portfolio overview with USD valuations and DeFi positions
- **Token Swaps**: Optimal routing via Fibrous aggregation with auto-slippage
- **Transfers**: Send ETH or any ERC-20 token
- **Aave V3**: Supply, borrow, repay, withdraw, and browse markets on Base
- **MCP Server**: Built-in AI agent integration for Cursor, Claude Desktop, and Antigravity (19 tools)
- **The FibX app, in the chat**: in hosts that render [MCP Apps](https://modelcontextprotocol.io/docs/extensions/apps) UI such as Claude Desktop, `open_fibx` shows the wallet, balances, signing policy and a swap form with the Fibrous route inline — the model opens it, and you press Simulate and Swap
- **Agent Skills**: Prompt-based AI skills via [fibx-skills](https://github.com/Fibrous-Finance/fibx-skills)
- **Your own wallet**: Pair over WalletConnect and approve every transaction on your phone
- **Privy Server Wallets**: Server-side signing — the CLI receives signed transaction payloads or signatures, not Privy app credentials or raw keys
- **Private Key Import**: Use an existing wallet with AES-256-GCM encrypted local storage
- **Local signing policy**: A file you own — native value cap per chain, allowed chains, allowed destinations, expiry — enforced before every signature on all three paths (Privy adds its own server-side policy on top)
- **Preflight Checks**: Transaction flows validate or estimate execution where the underlying RPC supports it
- **Dry‑Run Mode**: `--simulate` previews write operations without broadcasting; gas estimates are included where available
- **JSON Output**: `--json` flag for scripting and pipelines
- **Zero-Dependency Install**: Single-file bundle via tsup — `npx fibx` runs near-instantly
## Supported Chains
| Chain | Native Token | Aave V3 |
| -------- | ------------ | ------- |
| Base | ETH | ✅ |
| HyperEVM | HYPE | — |
| Monad | MON | — |
## Installation
Run directly with `npx` (no install needed):
```bash
npx fibx status
```
Or install globally:
```bash
npm install -g fibx
```
## Requirements
- Node.js >= 18
- A running [fibx-server](https://github.com/Fibrous-Finance/fibx-server) instance (required for Privy wallet operations; not needed for private key imports)
## Quick Start — First Swap in 3 Minutes
### Step 1: Get a Price Quote (no auth needed)
Try FibX instantly — no sign-up, no wallet, no keys:
```bash
npx fibx quote 0.01 ETH USDC # Check price on Base
npx fibx quote 100 USDC DAI --chain base # Compare pairs
npx fibx quote 0.5 MON USDC --chain monad # Check Monad prices
```
### Step 2: Authenticate (pick one)
**Option A — Email Login** (Privy Server Wallet, no keys to manage):
```bash
npx fibx auth login you@email.com # Sends OTP to your email
npx fibx auth verify you@email.com 123456 # Verify & create wallet
```
**Option B — Import Private Key** (use an existing wallet):
```bash
npx fibx auth import # Paste your key (encrypted at rest)
```
### Step 3: Execute
```bash
npx fibx trade 0.01 ETH USDC # Execute the swap
npx fibx balance # Check your balances
```
That's it. Three steps from zero to first swap.
## Usage
### Choosing how FibX signs
Run `fibx auth setup` and it will ask. The three paths differ on one thing:
| Path | Key held by | Runs while you are away | Bounded by |
| -------------- | --------------- | ----------------------- | ------------------------ |
| `auth connect` | your own wallet | no | you, on your phone |
| `auth login` | Privy | yes | Privy's signing policy |
| `auth import` | this machine | yes | the local policy you set |
Keeping your own wallet _and_ having FibX act unattended needs ERC-7715, which
wallets do not yet expose over WalletConnect. `fibx auth setup` explains the
closest options.
> **Security:** When using `auth import`, your private key is encrypted at rest with AES-256-GCM. The encryption key is auto-generated per machine and stored in the OS config directory (e.g. `~/.config/fibx-nodejs/encryption-key` on Linux). You can also set the `FIBX_SESSION_SECRET` environment variable for CI/Docker environments.
### Connect your own wallet
```bash
npx fibx auth connect
```
Pairs FibX with a wallet you already have — MetaMask, Rabby, Rainbow, Phantom —
over WalletConnect. A QR code appears in the terminal; scan it with your phone.
Every transaction is then approved in your wallet, so the keys never leave it.
The chain you trade on must already be in your wallet, and it is approved when
you pair. If you try to sign on a chain the session does not carry, FibX stops
before contacting the wallet and names the chain: add it in your wallet, then run
`npx fibx auth connect` again so the new chain is included.
With `--json`, output is NDJSON — one JSON document per line, not one document
for the whole run: the pairing URI prints first as `{"uri":"wc:..."}` so a
script can act on it while it waits, then the result prints as its own compact
JSON line once the wallet approves.
`npx fibx auth logout` ends the connection on both sides: it tells your wallet to
drop the session, so FibX stops appearing in its connected-apps list, and removes
the pairing keys from disk along with the session.
A shared WalletConnect project id ships in the published bundle, so this works
with no setup. It is public by necessity — a CLI has no origin to allowlist — so
its only real exposure is quota consumed by third parties. If pairing starts
failing on quota, create a free project at
[cloud.reown.com](https://cloud.reown.com) and set `FIBX_WC_PROJECT_ID` to your
own id.
`auth login` (email OTP) and `auth import` (private key) are unchanged and remain
available.
### Signing policy
`fibx policy` bounds what FibX is allowed to sign, on top of whichever path
from the table above holds the key — a client-side cap evaluated before every
local-key, Privy, or WalletConnect transaction:
```bash
npx fibx policy show # Print the active policy
npx fibx policy set base.maxValue 0.05
npx fibx policy set allowedChains base,monad
npx fibx policy set base.allowedDestinations 0xYourColdWallet,0xTheRouter
npx fibx policy set expiry 2026-12-31 # UTC midnight starting that day
npx fibx policy clear base.maxValue # Remove one rule
npx fibx policy clear # Remove the whole policy (asks first)
```
A local policy guarding a local key is advisory: anything that can read the
key can edit the policy, so this is worth nothing against malware. What it
does bound is the agent — a model that misbehaves, or a prompt injection
telling it to.
Know what each rule bounds, because they are not the same:
- `maxValue` caps the **native** value of a single transaction — ETH on Base,
HYPE on HyperEVM, MON on Monad. It does not bound tokens. An ERC-20 transfer
reaches the policy as a call to the token's contract carrying `value: 0`, so
the amount is invisible to it: `base.maxValue 0.05` places no limit on
`fibx send 50000 USDC 0xsomewhere`, on the token side of a trade, or on an
Aave borrow. A token-value cap needs decimals and a token registry, and is
not in this release.
- `allowedDestinations` is the rule that bounds tokens, by bounding where
anything may go. It is the one to set if the worry is an agent moving your
holdings somewhere. Note that allowlisting a token's contract so a trade can
approve it also permits transfers of that token.
- `allowedChains` and `expiry` do exactly what they say. A lapsed or
unparseable policy refuses everything rather than permitting it.
### Global Options
| Option | Description | Default |
| -------------------- | ------------------------------------------ | ------- |
| `-c, --chain <name>` | Target chain (`base`, `hyperevm`, `monad`) | `base` |
| `--json` | Output results as JSON | `false` |
### Balance
```bash
npx fibx balance
npx fibx balance --chain hyperevm
```
### Portfolio
Consolidated cross-chain portfolio view with USD valuations:
```bash
npx fibx portfolio # Table output across all chains
npx fibx portfolio --json # Structured JSON for scripting
```
Shows all token holdings across Base, HyperEVM, and Monad with USD values. Includes DeFi positions (Aave V3 collateral/debt) and total portfolio net worth. Token prices are sourced live from Fibrous.
### Send
```bash
npx fibx send 0.001 0xRecipient # Send native token on Base (ETH)
npx fibx send 10 0xRecipient USDC # Send ERC-20 on Base
npx fibx send 1 0xRecipient --chain monad # Send MON on Monad
npx fibx send 0.1 0xRecipient --simulate # Preview without sending
```
### Quote
Get swap prices without authentication:
```bash
npx fibx quote 0.01 ETH USDC # Price check on Base
npx fibx quote 1 MON USDC --chain monad # Check Monad prices
npx fibx quote 0.1 ETH USDC --json # JSON output for scripts
```
> **No wallet or authentication required.** Use `quote` to explore prices, then `trade` to execute.
### Swap
```bash
npx fibx trade <amount> <from> <to>
npx fibx trade 0.0001 ETH USDC
npx fibx trade 20 USDC DAI
npx fibx trade 1 MON USDC --chain monad
npx fibx trade 0.1 ETH USDC --simulate # Preview without broadcasting
```
Options: `--slippage <n>` (default: 0.5%), `--approve-max`, `--simulate`, `--json`
> **Note:** The `trade` command automatically detects **Wrap** (Native -> Wrapped) and **Unwrap** (Wrapped -> Native) operations and executes them directly via contract calls, bypassing aggregator routing to save gas.
### Transaction Status
```bash
npx fibx tx-status <hash>
npx fibx tx-status 0x123...abc --chain monad
```
### Wallet Info
```bash
npx fibx address # Print active wallet address
npx fibx wallets # Show active wallet details
```
### Aave V3 (Base)
```bash
npx fibx aave status # Account health
npx fibx aave markets # List all active reserves with APY & TVL
npx fibx aave supply 1 ETH # Auto-wraps ETH -> WETH and supplies
npx fibx aave supply 100 USDC # Supply ERC-20
npx fibx aave borrow 50 USDC # Borrow
npx fibx aave repay 50 USDC # Repay
npx fibx aave repay max ETH # Auto-wraps ETH and repays full WETH debt
npx fibx aave withdraw max ETH # Withdraws WETH and auto-unwraps to ETH
npx fibx aave supply 1 ETH --simulate # Preview without broadcasting
```
> **Note:** `supply`, `repay`, and `withdraw` support automatic **ETH <-> WETH** wrapping/unwrapping on Base.
### Configuration
Set custom RPC URLs to avoid rate limits on public endpoints:
```bash
npx fibx config set-rpc base https://mainnet.base.org
npx fibx config get-rpc base
npx fibx config reset-rpc base # Reset single chain to default
npx fibx config reset-rpc # Reset all chains to default
npx fibx config list
```
> **Hot-reload:** Config changes are picked up automatically — no need to restart the CLI or MCP server.
## AI Agent Integration
### MCP Server
fibx includes a built-in [MCP](https://modelcontextprotocol.io) server for AI editors like Cursor, Claude Desktop, and Antigravity. See [MCP.md](https://github.com/Fibrous-Finance/fibx/blob/main/MCP.md) for setup and available tools.
```bash
npx fibx mcp-start
```
The MCP server exposes **19 tools**: the FibX app (`open_fibx`, `list_tokens`), read-only queries, three transactional tools, and session and policy management. All write operations support a `simulate=true` preview that does not broadcast; gas estimates are returned only where available.
In a host that renders MCP Apps UI — Claude Desktop today — `open_fibx` is the entry point: ask about your wallet, a balance, a price or a swap and the whole app opens inline, pre-filled from the conversation. It executes nothing on its own; Simulate and Swap are buttons you press. In a text-only host the same call returns a JSON snapshot the model can summarise, and the headless tools do the rest.
### Agent Skills
For prompt-based agent integration (Claude Code, Cursor, etc.), see the [fibx-skills](https://github.com/Fibrous-Finance/fibx-skills) repository.
## Security
Letting an AI agent operate a wallet requires controls outside the model.
fibx combines signing-layer policies, server-side validation, client hints, and
explicit previews. These controls reduce risk, but the server credentials, MCP
client configuration, and deployment policy remain part of the trust boundary:
| Layer | What it does |
| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Privy signing policy | The default policy allowlists configured chains, caps each transaction's native-token `value`, and denies key export. Privy evaluates the policy at signing time; fibx-server credentials and any custom policy remain critical trust boundaries. |
| fibx-server schemas | `/sign/*` accepts only the exact transaction shape the CLI produces — unknown fields, contract creation, and unserved chains are rejected before reaching Privy. |
| MCP tool annotations | Every transactional tool advertises `destructiveHint: true`; compatible clients may use that hint to request confirmation, depending on client behavior and configuration. |
| Simulation | `--simulate` previews write operations without broadcasting. Some paths also return a gas estimate; others return operation metadata only. |
| Local key storage | Imported private keys are encrypted at rest with AES-256-GCM using a per-machine key stored `0600` in the OS config directory. |
Wallet policy limits are configured per deployment — see the
[fibx-server wallet policy docs](https://github.com/Fibrous-Finance/fibx-server#wallet-policy-privy-signing-layer).
> **Note:** policies are attached when a wallet is created. Wallets provisioned
> before policies were introduced keep signing without them until migrated.
## Architecture
This repository is the CLI and MCP server. Three sibling repositories complete
the stack:
| Repository | Role |
| ------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
| **fibx** (this repo) | CLI + stdio MCP server, shipped as a single dependency-free bundle |
| [fibx-server](https://github.com/Fibrous-Finance/fibx-server) | Hono backend that proxies Privy — holds the app secret so the CLI never does, and owns the wallet signing policy |
| [fibx-skills](https://github.com/Fibrous-Finance/fibx-skills) | Prompt-based Agent Skills for Claude Code, Cursor, and other skill-aware agents |
| [fibx-telegram-bot](https://github.com/Fibrous-Finance/fibx-telegram-bot) | Telegram bot that drives this CLI over MCP, with one process and separate config paths per active user |
```
src/
├── commands/ # CLI commands (auth, policy, trade, send, aave, config)
├── mcp/ # Modular MCP server
│ ├── server.ts # Entry point + MCP_INSTRUCTIONS
│ ├── ui.ts # The ui://fibx/app.html resource (the built widget, inlined)
│ ├── tools/ # Tool registrations (app, auth, wallet, trade, defi, policy)
│ └── handlers/ # Tool implementations
├── services/ # Business logic (chain, fibrous, auth, policy, walletconnect, defi, portfolio)
└── lib/ # Shared utilities (errors, fetch, format, crypto)
ui/
├── src/ # The FibX app widget — Preact, one document, no network
└── dev-host/ # A local MCP Apps host for the widget: fixtures, or a bridge to the real server
```
The widget is built by Vite into a single HTML document and embedded in
`dist/index.js` by tsup, so the published package is still one file with no
runtime dependencies.
## Development
```bash
pnpm install
pnpm dev # run the CLI from source
pnpm test # vitest unit tests
pnpm typecheck # tsc --noEmit
pnpm lint # eslint
pnpm format:check # prettier
pnpm build # vite (the app widget) then tsup, to dist/
pnpm dev:ui # the app widget in a local host, against fixtures — no wallet needed
```
`pnpm dev:ui:bridge` runs the same host against the real MCP server; a Swap
there is a real swap.
## Related Links
- [Fibrous Finance](https://fibrous.finance) — DEX aggregator powering swaps
- [FibX agent docs](https://docs.fibrous.finance/fibx-agent)
- [npm package](https://www.npmjs.com/package/fibx)
- [MCP registry listing](https://registry.modelcontextprotocol.io) — `finance.fibrous/fibx`
## License
[MIT](https://opensource.org/licenses/MIT)