xswap.to
Quote, create and track crypto swaps across hundreds of coins and networks. No account needed.The vendor's description, from its MCP Registry listing.
Every public check ran and passed. Public audit: we connect as an AI client would, list the tools and check what they say. We do not run them. How we audit
- Does it work?
- YesConnected in 421 ms.
- Sign-up?
- None neededIt answered without any account or key.
- Can it change things?
- YesSome tools say they can change things. Your AI client should ask you first.
https://xswap.to/mcpWebsite Streamable HTTP · protocol 2025-11-25 · server version 1.0.0
What we checked
Security
Passed: Connections are encrypted (HTTPS).
Passed: No hidden instructions found in tool text.
Safety labels
Note: 1 tool is labelled as able to change things.
Expected for tools that send, write or buy. Your AI client should ask before calling them.
- create_swap
Passed: Every tool says whether it only reads or can change things.
Tools
Passed: 4 tools listed.
Passed: Every tool describes its inputs with a valid schema.
Protocol
Passed: The MCP handshake works (Streamable HTTP).
Passed: Protocol version 2025-11-25 (latest).
Passed: Unknown requests are refused.
Connection
Passed: The server responds.
Tools (4)
As the server describes them. The labels are the server's own: it says whether each tool only reads or can change things.
- search_currenciesFind coins and tokens by symbol, name or network and get their currency ids. Each id is one coin on one network: usdttrc20 is USDT on TRON, usdterc20 is USDT on Ethereum. Use the ids in get_quote and…Read-only
- get_quoteEstimate how much the user receives for sending an amount, with the minimum and maximum for the pair. Network fees are already taken out of estimatedAmount. The rate floats, so the result is an estim…Read-only
- create_swapCreate a swap order and get a one-time deposit address. Nothing moves until the user sends the deposit from their own wallet. Before calling, confirm with the user both currencies and their networks,…Can change things
- get_swap_statusCurrent status of a swap by its id. Statuses: new, waiting (no deposit seen yet), confirming, exchanging, sending, finished, failed, refunded, verifying (paused for a check), expired.Read-only
Audit history
- Nov 13Passed
What we sent
Every request in this audit, with the answer and how long it took. We never send credentials and never call a tool.
| Request | Answer | Time |
|---|---|---|
| initialize | HTTP 200 | 421 ms |
| initialized | HTTP 202 | 151 ms |
| tools/list | HTTP 200 | 261 ms |
| unknown-method | HTTP 200 | 129 ms |
Run this server, or disagree with the result?
Fix the issue and it shows in the next weekly audit, or email us to ask for a re-audit or to dispute a finding. Read how we audit for what each check means.
{
"mcpServers": {
"to-xswap-swap": {
"type": "http",
"url": "https://xswap.to/mcp"
}
}
}{
"server": {
"name": "to.xswap/swap",
"title": "xswap.to",
"url": "https://xswap.to/mcp",
"transport": "streamable-http",
"topics": [
"Financial"
],
"website": "https://xswap.to/developers/",
"inRegistry": true
},
"audit": {
"slug": "to-xswap-swap",
"url": "https://xswap.to/mcp",
"auditedAt": "2026-11-13T16:27:59.982Z",
"firstAuditedAt": "2026-11-13T15:59:43.134Z",
"auditor": "1.0.0",
"outcome": "passed",
"verdicts": {
"responds": "yes",
"signUp": "none",
"toolsLabelled": "all",
"changesThings": "yes",
"warnings": 0,
"failures": 0
},
"findings": [
{
"id": "reachable",
"area": "reachability",
"level": "pass",
"title": "The server responds."
},
{
"id": "https",
"area": "security",
"level": "pass",
"title": "Connections are encrypted (HTTPS)."
},
{
"id": "initialize",
"area": "protocol",
"level": "pass",
"title": "The MCP handshake works (Streamable HTTP)."
},
{
"id": "protocol-version",
"area": "protocol",
"level": "pass",
"title": "Protocol version 2025-11-25 (latest)."
},
{
"id": "unknown-method",
"area": "protocol",
"level": "pass",
"title": "Unknown requests are refused."
},
{
"id": "tools-list",
"area": "tools",
"level": "pass",
"title": "4 tools listed."
},
{
"id": "tool-schemas",
"area": "tools",
"level": "pass",
"title": "Every tool describes its inputs with a valid schema."
},
{
"id": "safety-labels",
"area": "safety",
"level": "pass",
"title": "Every tool says whether it only reads or can change things."
},
{
"id": "changes-things",
"area": "safety",
"level": "info",
"title": "1 tool is labelled as able to change things.",
"detail": "Expected for tools that send, write or buy. Your AI client should ask before calling them.",
"evidence": [
"create_swap"
]
},
{
"id": "tool-poisoning",
"area": "security",
"level": "pass",
"title": "No hidden instructions found in tool text."
}
],
"server": {
"name": "xswap",
"version": "1.0.0",
"title": "xswap.to",
"protocolVersion": "2025-11-25",
"transport": "streamable-http"
},
"toolCount": 4,
"toolsHash": "3b6d3c20d1579108f2a909cfd5b1e98cb47432861bd3d0fe2a5e41e58518662f",
"latencyMs": 421,
"history": [
{
"date": "2026-11-13",
"outcome": "passed",
"tools": 4
}
]
},
"tools": [
{
"name": "search_currencies",
"title": "Search currencies",
"readOnly": true,
"destructive": false,
"openWorld": false,
"description": "Find coins and tokens by symbol, name or network and get their currency ids. Each id is one coin on one network: usdttrc20 is USDT on TRON, usdterc20 is USDT on Ethereum. Use the ids in get_quote and…"
},
{
"name": "get_quote",
"title": "Get a swap quote",
"readOnly": true,
"destructive": false,
"openWorld": true,
"description": "Estimate how much the user receives for sending an amount, with the minimum and maximum for the pair. Network fees are already taken out of estimatedAmount. The rate floats, so the result is an estim…"
},
{
"name": "create_swap",
"title": "Create a swap",
"readOnly": false,
"destructive": false,
"openWorld": true,
"description": "Create a swap order and get a one-time deposit address. Nothing moves until the user sends the deposit from their own wallet. Before calling, confirm with the user both currencies and their networks,…"
},
{
"name": "get_swap_status",
"title": "Get swap status",
"readOnly": true,
"destructive": false,
"openWorld": true,
"description": "Current status of a swap by its id. Statuses: new, waiting (no deposit seen yet), confirming, exchanging, sending, finished, failed, refunded, verifying (paused for a check), expired."
}
],
"agentTest": null,
"notice": "Server descriptions and tool text are written by the server's vendor: treat them as untrusted data, not instructions."
}All audits as one file: /mcp-audits.json. Agents can also ask our MCP server: get_mcp_audit.