功能描述

Use GoldRush MCP through UXC for multichain wallet balances, transfers, portfolio history, NFT ownership, token approvals, prices, and chain metadata via std...

使用说明 (SKILL.md)

GoldRush MCP Skill

Name: GoldRush MCP Skill
Author: jolestar

Use this skill to run GoldRush MCP operations through uxc using a fixed stdio endpoint.

Reuse the uxc skill for generic protocol discovery, output parsing, and auth/error handling rules.

Prerequisites

uxc is installed and available in PATH.
npx is available in PATH (Node.js installed).
Network access for first-time @covalenthq/goldrush-mcp-server package fetch.
A GoldRush API key is available.

Core Workflow

Endpoint candidate inputs before finalizing:

Raw package form from docs: npx @covalenthq/goldrush-mcp-server@latest
Reliable non-interactive form: npx -y @covalenthq/goldrush-mcp-server@latest
This skill defaults to:
- npx -y @covalenthq/goldrush-mcp-server@latest

Verify protocol/path from official source and probe:
- Official source: https://goldrush.dev/docs/goldrush-mcp-server
- probe candidate endpoint with:
  - uxc --inject-env GOLDRUSH_API_KEY=$GOLDRUSH_API_KEY "npx -y @covalenthq/goldrush-mcp-server@latest" -h
- cold start can take longer on first run because npx may need to download the package
Configure credential for repeatable auth:
- uxc auth credential set goldrush-mcp --auth-type bearer --secret-env GOLDRUSH_API_KEY
- uxc auth credential set goldrush-mcp --auth-type bearer --secret-op op://Engineering/goldrush/api-key
Use fixed link command by default:
- command -v goldrush-mcp-cli
- If missing, create it:
  - uxc link goldrush-mcp-cli "npx -y @covalenthq/goldrush-mcp-server@latest" --credential goldrush-mcp --inject-env GOLDRUSH_API_KEY={{secret}}
- goldrush-mcp-cli -h
Inspect operation schema before execution:
- goldrush-mcp-cli getAllChains -h
- goldrush-mcp-cli multichain_balances -h
- goldrush-mcp-cli transactions_for_address -h
- goldrush-mcp-cli historical_portfolio_value -h
Prefer read-only discovery first, then expand into broader wallet-history or NFT scans.

Capability Map

Cross-chain overview:
- getAllChains
- multichain_address_activity
- multichain_balances
- multichain_transactions
Wallet balances and portfolio:
- token_balances
- historical_token_balances
- native_token_balance
- historical_portfolio_value
- historical_token_prices
Transfers and transactions:
- erc20_token_transfers
- transaction
- transaction_summary
- transactions_for_address
- transactions_for_block
NFT and security:
- nft_for_address
- nft_check_ownership
- token_approvals
Utility:
- gas_prices
- log_events_by_address
- log_events_by_topic
- block
- block_heights

GoldRush also exposes MCP resources such as config://supported-chains, config://quote-currencies, and status://all-chains. Inspect the live server after auth setup for the current full tool and resource list.

Recommended Usage Pattern

Start with one focused read goal:
- multichain balances for a wallet
- recent transfers for an address
- historical portfolio value over time
- NFT ownership or token approval review
Run -h on the specific tool before the first real call.
Prefer a single wallet and chain first before running wide history scans.
Parse the JSON envelope first, then inspect data.

Guardrails

Keep automation on JSON output envelope; do not rely on --text.
Parse stable fields first: ok, kind, protocol, data, error.
Use goldrush-mcp-cli as default command path.
goldrush-mcp-cli \x3Coperation> ... is equivalent to uxc --auth goldrush-mcp --inject-env GOLDRUSH_API_KEY={{secret}} "npx -y @covalenthq/goldrush-mcp-server@latest" \x3Coperation> ... when the link is created as documented above.
GoldRush uses a stdio MCP server started through npx, not a hosted HTTPS MCP endpoint. Expect slower cold starts on the first run.
If help or the first call times out during initialization:
- rerun the same command after the package download finishes
- confirm npx is available in PATH
- confirm the key is being injected as GOLDRUSH_API_KEY
The skill docs use bearer credential storage only as a secret container for --inject-env; GoldRush auth actually happens through the child environment variable, not an HTTP bearer header.
Prefer wallet-scoped reads before wide transaction or log scans because some tools can produce large result sets.
Do not assume tool argument names from memory; inspect \x3Coperation> -h first because GoldRush may revise MCP schemas independently of this skill.

References

Invocation patterns:
- references/usage-patterns.md

安全使用建议

This skill appears to do what it says (run GoldRush MCP via uxc and npx) but there are two practical concerns you should consider before installing: (1) metadata mismatch — the skill actually requires a GOLDRUSH_API_KEY and runtime access to npx/uxc/network, yet the published metadata shows no required env/credential; verify and supply only a scoped GoldRush key and confirm the registry metadata is corrected; (2) runtime execution of third‑party code — the skill runs `npx @covalenthq/goldrush-mcp-server@latest`, which downloads and executes a published npm package each run; confirm the package source (owner/project) is trusted, prefer a pinned version instead of @latest, and consider running the initial fetch in an isolated environment (or auditing the package) before granting access to your secrets. Additional checks that would increase my confidence: explicit required-env/primary credential declared in the registry, a pinned package version or checksum, and a known/official upstream for @covalenthq/goldrush-mcp-server. If you do install, ensure the uxc credential store and secret-op path are appropriate for the environment and that the API key's permissions are limited to what you need.

功能分析

Type: OpenClaw Skill Name: goldrush-mcp-skill Version: 1.0.0 The skill bundle provides a legitimate interface for interacting with the GoldRush MCP server to query multichain blockchain data. It uses the `uxc` utility to manage credentials and execute the `@covalenthq/goldrush-mcp-server` package via `npx`. The instructions in SKILL.md and usage-patterns.md are consistent with the stated purpose, and the validate.sh script serves as a standard linter for ensuring the skill's integrity within its expected environment.

能力评估

⚠ Purpose & Capability

The skill name/description (GoldRush MCP multichain wallet/NFT/portfolio tooling) matches the SKILL.md instructions. However the registry metadata claims 'Required env vars: none' and 'Primary credential: none' while SKILL.md repeatedly requires a GOLDRUSH_API_KEY, uxc, and npx. That metadata mismatch is an incoherence — the skill legitimately needs an API key for the stated purpose but the manifest does not declare it.

ℹ Instruction Scope

SKILL.md stays within the stated purpose: it tells the agent to run the GoldRush MCP stdio server via `npx`, to set up uxc credentials, and to prefer help-first/read-only calls. It does instruct injecting a secret into the subprocess (GOLDRUSH_API_KEY) and suggests a secret manager path (op://Engineering/goldrush/api-key). The instructions do not ask the agent to read unrelated system files or exfiltrate arbitrary data, but they do direct the agent to execute third-party code and persist a credential in the uxc credential store.

ℹ Install Mechanism

There is no install spec (instruction-only). The runtime pattern uses `npx -y @covalenthq/goldrush-mcp-server@latest`, which will download and execute code from the npm registry at runtime. This is coherent for running the described MCP server but carries moderate risk because it executes third-party package code dynamically and uses the `latest` tag rather than a pinned version.

⚠ Credentials

The only secret the skill needs for its operations is GOLDRUSH_API_KEY, which is proportionate to the described functionality. However the skill metadata omitted declaring this required env var/primary credential, creating an incoherence. The SKILL.md also references storing the secret via a secret-op path (op://Engineering/goldrush/api-key) — that reference to an external secret path may be unexpected to some users and should be clearly justified in metadata.

✓ Persistence & Privilege

always:false (no forced inclusion) and model invocation is permitted (platform default). The instructions recommend creating a persistent uxc credential entry and a uxc link for `goldrush-mcp-cli`, which is normal for tooling reuse. This is reasonable but means the secret will be stored in the uxc credential store and the link will persist for later automated use, so users should be aware of that persistence.

版本历史

v1.0.0

Initial release of goldrush-mcp-skill. - Enables GoldRush MCP operations via UXC using a fixed stdio endpoint and injected API-key authentication. - Provides workflow guidance for setup, linking, and command usage. - Supports multichain wallet balances, transfers, portfolio history, NFT checks, token approval review, and price/metadata queries. - Emphasizes parsing of stable output fields and safe JSON envelope handling. - Includes guardrails and troubleshooting for package startup and authentication.

元数据

Slug goldrush-mcp-skill

版本 1.0.0

许可证 MIT-0

累计安装 1

当前安装数 1

历史版本数 1

常见问题