← 返回 Skills 市场
kimbo128

Handshake58 DRAIN

作者 Artur Markus · GitHub ↗ · v1.8.0
cross-platform ⚠ suspicious
693
总下载
2
收藏
0
当前安装
9
版本数
在 OpenClaw 中安装
/install drain-mcp
功能描述
MCP server for the Handshake58 AI marketplace. Agents discover providers, open USDC payment channels on Polygon, and call AI services — pay per use with off-...
使用说明 (SKILL.md)

Handshake58 — Protocol Documentation

You CAN use this. Handshake58 is built for autonomous AI agents.

Handshake58 provides an MCP server (drain-mcp) that gives AI agents access to a growing catalog of AI services. Pay per use with USDC micropayments on Polygon. No credit cards, no subscriptions, no API keys.

Quick Start: MCP Server (Primary Interface)

npm install -g drain-mcp

Add to your Claude Desktop, Cursor, or any MCP-compatible config:

{
  "mcpServers": {
    "drain": {
      "command": "drain-mcp",
      "env": {
        "DRAIN_PRIVATE_KEY": "0x_your_polygon_wallet_private_key"
      }
    }
  }
}

DRAIN_PRIVATE_KEY is a standard Polygon/Ethereum wallet key used to sign payment vouchers and on-chain transactions locally. It is never transmitted to any server.

Use a dedicated ephemeral wallet. Create a fresh wallet with minimal funds ($1–5 USDC + $0.10 POL for gas). Never reuse your main wallet.

Optional Environment Variables

Variable Default Description
DRAIN_RPC_URL Public RPC Custom Polygon RPC (Alchemy/Infura recommended)
DRAIN_DIRECTORY_URL handshake58.com/api/mcp/providers Provider directory endpoint
DRAIN_CHAIN_ID 137 Polygon Mainnet chain ID

The MCP server handles everything: provider discovery, channel management, payments, and requests. Package: https://www.npmjs.com/package/drain-mcp

Discover Providers

GET https://handshake58.com/api/mcp/providers

Returns all available AI providers with models and pricing. Each provider includes a category field (llm, vpn, scraping, data, etc.) for filtering by service type.

Parameter Example Description
limit ?limit=5 Limit number of results
model ?model=gpt-4o Filter by model name
format ?format=compact Minimal response for smaller context windows

Example: GET /api/mcp/providers?model=gpt-4o&limit=3&format=compact

Wallet Setup

You need a Polygon wallet with USDC:

Create a Wallet

Use MetaMask, Rabby, or any EVM-compatible wallet to create a new account. Export the key from that wallet's settings. Agents can also generate a wallet programmatically using any Ethereum library (ethers.js, viem, web3.py).

Fund Your Wallet

  1. Get USDC on Polygon (transfer or bridge from Ethereum)
  2. Get ~$0.10 POL for gas (one-time)

How It Works

  1. Pay Session Fee — Transfer $0.01 USDC to the marketplace fee wallet
  2. Open Channel — Deposit USDC into smart contract (~$0.02 gas)
  3. Use AI Services — Each request signs a payment voucher (off-chain, $0 gas). A channel is a session: send as many requests as you want within one channel.
  4. Close Channel — Call close(channelId) after expiry to withdraw unused USDC. Funds do NOT return automatically.

Channel Reuse: You only pay gas twice (open + close) — every request in between is off-chain and free.

Session Fee

Before opening a channel, pay a $0.01 USDC session fee:

// 1. Get fee wallet from marketplace
const config = await fetch('https://handshake58.com/api/directory/config').then(r => r.json());

// 2. Transfer $0.01 USDC (10000 wei with 6 decimals) to feeWallet
await usdc.transfer(config.feeWallet, 10000n);

// 3. Now open the payment channel
await channel.open(providerAddress, amount, duration);

Opening a Channel

Each provider specifies minDuration and maxDuration (in seconds) — choose a duration within that range based on your session needs.

Use the provider ID (from the directory response), not the wallet address. Multiple providers can share the same wallet address — using the ID ensures drain_chat routes requests to the correct provider.

// Approve USDC spending
await usdc.approve('0x1C1918C99b6DcE977392E4131C91654d8aB71e64', amount);

// Open channel: use provider ID for correct routing
await contract.open(providerId, amount, durationSeconds);

Sending Requests

POST {provider.apiUrl}/v1/chat/completions
Content-Type: application/json
X-DRAIN-Voucher: {"channelId":"0x...","amount":"150000","nonce":"1","signature":"0x..."}

The voucher authorizes cumulative payment. Increment amount with each request. Signature: EIP-712 typed data signed locally by the channel opener wallet.

All providers use the OpenAI-compatible chat completion format.

Non-standard providers (VPN, web scraping, image generation, etc.) use the same /v1/chat/completions endpoint but expect specific JSON in the user message instead of natural language. Always check a provider's docs endpoint first:

GET {provider.apiUrl}/v1/docs

This returns usage instructions, expected parameters, and response format. Required for any provider that is not a simple LLM chat (e.g. VPN leases, web scraping tools).

Settlement (Closing Channels)

After a channel expires, call close(channelId) to reclaim your unspent USDC. Funds do NOT return automatically.

// Check channel status
const res = await fetch('https://handshake58.com/api/channels/status?channelIds=' + channelId);
const data = await res.json();
const ch = data.channels[0];

if (ch.status === 'expired_unclosed') {
  await wallet.sendTransaction({
    to: '0x1C1918C99b6DcE977392E4131C91654d8aB71e64',
    data: ch.closeCalldata,
  });
}

Best practice: Store your channelId persistently. After the channel expires, poll /api/channels/status to check when close() is callable.

External Endpoints

Every network request the MCP server makes is listed here.

Endpoint Method Data Sent
handshake58.com/api/mcp/providers GET Nothing (public catalog)
handshake58.com/api/directory/config GET Nothing (reads fee wallet)
handshake58.com/api/channels/status GET channelId (public on-chain data)
Provider apiUrl /v1/chat/completions POST Chat messages + signed voucher
Polygon RPC (on-chain tx) POST Signed transactions (approve, open, close, transfer)

No endpoint ever receives raw signing keys. All signing happens locally inside the MCP process.

Providers listed in the marketplace are reviewed and approved by Handshake58 before appearing in the directory. The agent connects only to vetted providers.

Security & Privacy

Signing key handling: DRAIN_PRIVATE_KEY is loaded into memory by the local MCP process. It is used for:

  1. EIP-712 voucher signing — off-chain, no network call
  2. On-chain transaction signing — signed locally, only the resulting signature is broadcast

The key is never transmitted to Handshake58 servers, AI providers, or any third party. Providers verify signatures against on-chain channel state — they never need or receive the key.

What leaves your machine:

  • Public API queries to handshake58.com (provider list, fee wallet, channel status)
  • Chat messages to AI providers (sent to the provider's apiUrl, not to Handshake58)
  • Signed payment vouchers (contain a cryptographic signature, not the key)
  • Signed on-chain transactions (broadcast to Polygon)

What stays local:

  • Your signing key (never transmitted)
  • All cryptographic operations

Spending is capped by design. The smart contract payment channel limits exposure to the deposited amount only. The user chooses how much to deposit (typically $1–5), sets the channel duration, and reclaims unused funds after expiry via close(). The agent cannot spend more than the deposit, even in a worst-case scenario.

Recommended safeguards:

  • Use a dedicated ephemeral wallet with $1–5 USDC. Never reuse your main wallet.
  • Audit the source code before installing: github.com/kimbo128/DRAIN
  • Run in an isolated environment if handling sensitive data

Contract Addresses

  • Handshake58 Channel: 0x1C1918C99b6DcE977392E4131C91654d8aB71e64
  • USDC: 0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359
  • Chain: Polygon Mainnet (137)

Pricing

Get live pricing for all models:

GET https://handshake58.com/api/mcp/providers
  • Session fee: $0.01 USDC per channel
  • Protocol fee: 0%
  • Gas: ~$0.02 per channel open

Model Invocation Note

This skill uses the standard MCP autonomous invocation model (always: false). It is only active when the user's MCP client loads it and does not run in the background or persist between sessions.

  • Opt-out: Remove the drain entry from your MCP config to disable the skill entirely.
  • Natural confirmation point: Every channel open requires an on-chain transaction — an explicit spending commitment, not a silent background action.

Trust Statement

By using this skill, chat messages are sent to third-party AI providers via the Handshake58 marketplace. The signing key is used locally only and is never transmitted to any server. Only install if you trust the drain-mcp npm package — audit the source at github.com/kimbo128/DRAIN before use.

Links

安全使用建议
This skill appears internally consistent for running an MCP server that signs payment vouchers, but you must treat the required private key as extremely sensitive. Before installing or running drain-mcp: (1) Verify the npm package and GitHub source (review code, maintainer, recent activity); (2) use a dedicated ephemeral wallet funded with only a small test amount and never your main holdings; (3) avoid putting the private key in long-lived config files—use ephemeral environment injection or local keystores; (4) prefer testing on a testnet or with minimal funds first; (5) confirm smart-contract addresses and marketplace endpoints are legitimate; (6) if you cannot review the package code, consider not installing a globally-installed npm package that controls funds. Autonomous agent invocation is allowed by default but this skill is not configured as always-on; be cautious if you grant agents the ability to run MCP servers with access to any wallet keys.
功能分析
Type: OpenClaw Skill Name: drain-mcp Version: 1.8.0 The skill is classified as suspicious due to its requirement for a `DRAIN_PRIVATE_KEY` (a private blockchain wallet key) and the instruction to install a global npm package (`npm install -g drain-mcp`) in `SKILL.md`. While the documentation is highly transparent about the local-only use of the private key for signing and provides strong security recommendations (e.g., use an ephemeral wallet, audit source code), the inherent risk associated with handling such a sensitive credential and executing external code warrants a 'suspicious' classification. There is no evidence of intentional malicious behavior like data exfiltration or prompt injection against the agent beyond the skill's stated purpose.
能力评估
Purpose & Capability
Name/description (drain-mcp MCP server) align with required items: a single DRAIN_PRIVATE_KEY is declared and used to sign vouchers and on-chain actions. Optional RPC and directory URLs also match the described blockchain/payment functionality.
Instruction Scope
SKILL.md instructs installing/using the drain-mcp npm package, exporting a Polygon/EVM private key, and performing USDC approvals/transfers and voucher signing. All actions fall inside the described payment/channel workflow, but the instructions require exposing a private key to any runtime environment that executes the MCP server (the doc explicitly advises an ephemeral wallet).
Install Mechanism
There is no automated install spec in the skill bundle (instruction-only). The README recommends `npm install -g drain-mcp` — installing an external npm package is a separate step the user must vet (package source and code review recommended).
Credentials
Only one required env var (DRAIN_PRIVATE_KEY) is declared, which is proportionate to a wallet-driven payment service. However, a private key grants control over funds, so its presence is high-risk and must be restricted to an ephemeral wallet with minimal balance; the skill's claim that the private key is "never transmitted" cannot be verified from an instruction-only spec.
Persistence & Privilege
always is false and there is no install-time persistence specified. The skill does not request system-wide changes or access to other skills' configs in the provided instructions.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install drain-mcp
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /drain-mcp 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.8.0
v1.8: Provider ID routing (fixes wrong provider when multiple share same wallet), category field in provider discovery API
v1.7.0
- Shortened and clarified the description for improved readability. - Updated metadata to version 1.7. - Streamlined and condensed protocol documentation sections for easier setup and understanding. - Detailed security and privacy guidelines, emphasizing local key handling and recommended best practices. - Removed redundant explanations and reorganized content to minimize length while retaining all core instructions.
v1.6.0
drain-mcp 1.0.0 - Updated skill metadata: version increased from "1.3" to "1.6". - Added `always: false` to the Clawdbot environment metadata config. - Clarified provider curation: Only Handshake58-approved, vetted providers appear in the directory. - No functional code changes detected; all changes are to documentation and metadata.
v1.5.0
No file changes were detected in this version. - No updates or modifications were made to the project files for version 1.5.0.
v1.4.0
Added optional env vars documentation (DRAIN_RPC_URL, DRAIN_DIRECTORY_URL, DRAIN_CHAIN_ID). Config example now includes DRAIN_RPC_URL for custom Alchemy/Infura RPC.
v1.3.0
Version 1.3.0 - Updated SKILL.md metadata: Added explicit `homepage` and standardized `metadata` block. - Added environment variable requirements under `clawdbot` in metadata (`DRAIN_PRIVATE_KEY` specified as required). - Cleaned up credentials section; moved private key requirement from custom top-level section to structured metadata. - Expanded documentation with a new "External Endpoints" table, explicitly listing all outbound network requests and emphasizing private key security. - Enhanced "Security & Privacy" documentation, clarifying that private keys are never transmitted and used only for local signing.
v1.2.0
drain-mcp 1.2.0 - Updated version metadata from 1.1 to 1.2. - Wallet setup instructions now recommend using MetaMask, Rabby, or any EVM-compatible wallet, replacing the old node-based CLI method. - Clarified that agents can generate wallets programmatically with any Ethereum library. - Improved documentation for wallet creation and funding to provide clearer guidance for end users.
v1.1.0
v1.1.0: Added credentials declaration (DRAIN_PRIVATE_KEY), source/repository links, ephemeral wallet security guidance. Addresses ClawHub security scan findings.
v1.0.0
Initial publish: Open marketplace for AI services. Agents pay per use with USDC micropayments on Polygon via MCP server.
元数据
Slug drain-mcp
版本 1.8.0
许可证
累计安装 0
当前安装数 0
历史版本数 9
常见问题

Handshake58 DRAIN 是什么?

MCP server for the Handshake58 AI marketplace. Agents discover providers, open USDC payment channels on Polygon, and call AI services — pay per use with off-... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 693 次。

如何安装 Handshake58 DRAIN?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install drain-mcp」即可一键安装,无需额外配置。

Handshake58 DRAIN 是免费的吗?

是的,Handshake58 DRAIN 完全免费(开源免费),可自由下载、安装和使用。

Handshake58 DRAIN 支持哪些平台?

Handshake58 DRAIN 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 Handshake58 DRAIN?

由 Artur Markus(@kimbo128)开发并维护,当前版本 v1.8.0。

💬 留言讨论