Changelog

All notable changes to @blockchainacademics/mcp on npm and its Python sibling bca-mcp on PyPI, which move in lockstep. Follows Semantic Versioning and Keep a Changelog. Source of truth: CHANGELOG.md in the package repository.

The tool catalog on this site was generated from {SOURCE.package} 0.6.2.

0.6.3 (2026-10-29)

Every link the package shows people now points at blockchainacademics.com/crypto-api (signup, pricing, docs); the former marketing and docs subdomains redirect here permanently since the one-domain consolidation.
server.json: websiteUrl and docs_url on the main site, display name "BCA Crypto Brain", and category examples that list every tool.
tools.json ships in the package: tool names and counts per category, generated from the registry, for sites that must never type a count by hand.

0.6.2 (2026-10-19)

Added: live crypto jobs (1 new tool, 104 to 105)

list_jobs now returns real data: 1,300+ open roles at 50+ crypto companies, collected every 6 hours from the companies' own job boards, with apply links to the company's own page. Both job tools are available on the demo tier.

list_jobs: inputs now match the API (keyword, role category, remote, location, employment type, company); the old seniority and chain filters were never supported upstream and are removed. Descriptions are opt-in.
get_job: one role in full, with apply link and the job page URL on this site.

0.6.1 (2026-10-19)

Added: grants (2 new tools, 102 to 104)

The live grants directory behind blockchainacademics.com/grants: 200+ crypto, web3, AI and public-funding programs, each checked against the funder's page weekly. Expired rounds are never returned.

search_grants: filter by keyword, ecosystem (web3, ai, web2_cloud, gov, edu), country, minimum award, application complexity and deadline. Soonest deadline first.
get_grant: one program in full, with apply link and last verified date.

0.6.0 (2026-10-09)

Added: crypto Twitter intelligence (3 new tools, 99 to 102)

Our read of what crypto Twitter is saying, as analysis in our own words with X post URLs as citations (never reposted post text). Pro tier.

get_ct_pulse: last-24h takeaway, top stories, narratives heating or cooling, sourced numbers, notable posts. No topic means the latest scheduled market snapshot.
get_x_signals: breaking stories surfaced on X before news outlets, by lane (security for hacks and exploits, news for exchanges, regulators and ETF data, or a keyword), with confidence and on-chain evidence flags.
get_kol_consensus: where credible CT voices stand on the most-covered tokens (stance, bull and bear account counts, key points, links).

Changed

get_social_pulse is now live (it returned integration_pending before): CT sentiment score, label, mention trend, bull and bear points, narratives, notable posts.
get_article works without an API key (rate-limited per IP), so agents can read any article link.

0.5.1 (2026-06-04)

Fixed: entry-point guard under npx symlinks

The 0.5.0 entry-point guard compared process.argv[1] to the module path literally. That worked for node dist/index.js but not for the launch-day path: npx -y @blockchainacademics/mcp invokes the bin through a symlink, the two paths never matched, main() never ran, and the server appeared to start with zero tools. Both paths now go through realpathSync before the comparison. Verified against a published 0.5.1 symlink invocation. Python sibling bumped to 0.5.1 in lockstep with no functional change.

0.5.0 (2026-06-04)

Added: public demo tier (zero-config first run)

When BCA_API_KEY is unset the client falls back to a baked-in public demo key. The backend recognises it, applies a 10-tool allowlist (price, trending, fear and greed, market overview, news search, sentiment, entity, explainer, recent stories, topic) and rate-limits at 100 a day globally plus 20 a day per IP. npx -y @blockchainacademics/mcp is a true zero-config demo instead of a BCA_AUTH wall on every tool call.

EnvelopeMeta gains optional tier and upgrade_url.
BcaErrorCode extends with BCA_TIER_LOCKED. The 401/403 handler surfaces the signup URL from the upstream body verbatim.
A one-time stderr banner after the stdio handshake says the demo mode is active; byte-identical in the Python sibling.
The demo key is generated into the source at build time, wired into the build, dev and test scripts.

Fixed

test/security_v031.test.ts imported the entry module, which started main() on load and blocked on stdio forever in CI. An entry-point guard now runs main() only when the file is the entry script (see 0.5.1 for the symlink follow-up).

0.4.2 (2026-06-02)

Added: MCP Registry submission prep

package.json declares mcpName: "io.github.blockchainacademics/mcp", required by the official MCP Registry so the npm artifact can be verified against the server metadata.
server.json migrated to the 2025-12-11 schema: camelCase field names, PyPI bca-mcp as a second packages[] entry so the registry surfaces both install paths (npx @blockchainacademics/mcp and uvx bca-mcp), and format: "string" on env vars.

No source change. Lockstep with bca-mcp 0.4.2 on PyPI.

0.4.1 (2026-06-02)

Fixed (lockstep with bca-mcp 0.4.1 on PyPI)

The Python sibling 0.4.0 failed to import on Python 3.10. The TypeScript package has no functional change; the bump keeps the two in lockstep on npm and PyPI.

0.4.0 (2026-06-02)

Distribution release for the Anthropic MCP directory submission.

Added: hybrid citations

attribution.citations[] ships two entries when a real upstream source exists. citations[0] is the upstream URL (the outlet's article, the CoinGecko coin page, the Etherscan transaction, the SEC filing) with the upstream as_of and source_hash; citations[1] is the Blockchain Academics editorial deep link. Consumers get true provenance first, and our attribution rides along second. The contract already allowed multi-entry citations[] since 0.3.0; handlers now populate it.
44 API handlers wired to emit upstream URLs: news and articles, market (CoinGecko, DexScreener), on-chain (Etherscan, Solscan, BscScan, Snowtrace, Basescan, Arbiscan, Polygonscan, Mempool), sentiment (alternative.me Fear and Greed), history (CoinGecko OHLC), narrative (DefiLlama, DePIN Ninja, RWA.xyz, Polymarket), regulatory (SEC, ESMA, FCA, FSA, MAS, IRS, CRA, gov.uk), security (rekt.news, Chainabuse, Immunefi), memes (pump.fun, Solscan), microstructure (Coinglass, Deribit), compute (Akash, io.net, taostats), directories (DefiLlama stablecoins and yields), entities, stories and academy.
A defensive X-BCA-Cite-Upstream guard drops javascript:, data: and file: URLs before they can reach citations[0].
Proprietary tools (indicators, memos, theses, curated directories) intentionally stay single-citation: Blockchain Academics is the upstream for those.

Fixed

get_article 500 on every slug. The ORM query pulled the Postgres search_vector column, which SQLAlchemy cannot materialise. Switched to raw SQL with an explicit column list.
translate_contract 422 rejections. The input field source_code is now code, matching the API schema. Backwards-incompatible only for callers that passed source_code explicitly.
Empty-data handlers no longer return a misleading status="complete". search_articles (zero rows with non-trivial filters), get_sentiment, get_kol_influence and social_signals now return the integration_pending contract, mapped to meta.status="unseeded" with a structured meta.diagnostic.
build_custom_indicator 400 on formulas that reference values not computed yet now returns the integration_pending contract instead; real syntax errors still return 400.
Defensive header serialisation in the articles and news handlers, so a bad annotation value can never crash a handler.

Verified

1,820 calls across 91 live tools at concurrency 5 against production in 479 seconds: 83 of 91 with zero errors under sustained load, zero citation-count drift across calls, 56 of 91 inside the per-category p95 target. The slower tools are vendor-bound (CoinGecko free-tier rate limits, DefiLlama and Etherscan intermittent 5xx), and meta.status="partial" already reports vendor degradation honestly.

0.3.2 (2026-04-22)

Security

X-API-Key redirect hardening. All upstream requests set redirect: "manual" and reject 3xx responses rather than following them, so a compromised or misconfigured upstream cannot redirect the client, and the key, to another host. The BCA_API_BASE allowlist (0.3.1) bounds the initial host; this closes the redirect-based escape.

0.3.1 (2026-04-22)

Security

BCA_API_BASE allowlist. The loose https:// prefix check became a strict allowlist: https://api.blockchainacademics.com (default), https://staging-api.blockchainacademics.com, http://localhost[:port] and http://127.0.0.1[:port]. The BCA_ALLOW_INSECURE_BASE=1 escape hatch is gone from the server; local development over HTTP goes through the allowlisted loopback prefixes.
Prompt-injection fencing on tool responses. The data field of every envelope is wrapped in <untrusted_content source="bca-api">…</untrusted_content> before it is serialised into the MCP text block; attribution and meta stay structured. The fence bytes match the Python sibling exactly. See Parse the envelope.
Webhook SSRF guard on monitor_keyword. webhook_url is validated before the request leaves: HTTPS only, no bare IP literals, and every address the hostname resolves to must be public (RFC 1918, loopback, link-local including the cloud metadata address, CGNAT, multicast and IPv6 ULA or link-local are rejected). The schema pattern tightened from ^https?:// to ^https://.

0.3.0 (2026-04-22)

Changed: canonical response envelope (breaking)

Blockchain Academics locked a single JSON:API-inspired response envelope across every surface (REST, MCP, CLI, SDK). The MCP server now emits that shape verbatim; callers that parse envelope fields must migrate. Full field reference: Response envelope.

Before (0.2.x):

json

{
  "data": { "...": "..." },
  "status": "complete",
  "attribution": {
    "cite_url": "https://...",
    "as_of": "2026-04-21T...",
    "source_hash": "sha256:..."
  },
  "meta": null
}

After (0.3.0):

json

{
  "data": { "...": "..." },
  "attribution": {
    "citations": [
      { "cite_url": "https://...", "as_of": "2026-04-22T...", "source_hash": "sha256:..." }
    ]
  },
  "meta": {
    "status": "complete",
    "request_id": "req_...",
    "pageInfo": { "hasNextPage": false, "hasPreviousPage": false, "startCursor": null, "endCursor": null }
  }
}

Migration, field by field:

status moved from the envelope root to meta.status.
attribution.cite_url, attribution.as_of and attribution.source_hash became attribution.citations[]; the primary citation is always at index 0, so read envelope.attribution.citations[0].cite_url.
meta is always a structured object (never null) with status, request_id and pageInfo; a diagnostic sub-object appears only on unseeded or partial responses.
meta.status is one of complete | unseeded | partial | stale. The old "error" value is gone: errors are HTTP 4xx/5xx and propagate through the MCP error channel (isError: true), never as an envelope status.
Rate-limit hints (X-RateLimit-Remaining, Retry-After) are HTTP headers only; the server does not echo them into the body.

During the rolling REST deploy the HTTP client accepted an upstream that briefly emitted the legacy flat shape and lifted it into the canonical envelope, with a one-time warning. New exported types: Citation, PageInfo, EnvelopeMeta, and a tightened EnvelopeStatus; normalizeEnvelope<T>() in the client is the single parser for canonical, flat and raw upstream responses.

0.2.2 (2026-04-21)

Fixed: 10 tool input schemas surfaced by a live production audit

A live audit of every tool against api.blockchainacademics.com found 10 whose MCP-side schema disagreed with the backend contract. Each fix resolves an HTTP 422 that agents previously hit:

generate_due_diligence: depth enum is light|standard|deep (was brief|standard|deep)
translate_contract: source_lang and target_lang renamed to source_language and target_language
monitor_keyword: webhook_url now required (was optional)
list_aggregators: kind enum is dex|bridge|yield (was swap|bridge|all), now required
check_rugpull_risk: contract plus chain replaced by entity_slug
check_memecoin_risk: contract plus chain replaced by mint (Solana token mint)
scan_contract: contract plus chain replaced by address (0x EVM, regex-validated)
book_kol_campaign: added required contact_email
request_custom_research: added required contact_email; depth enum aligned to light|standard|deep
submit_listing: added required listing_name

Tool descriptions now document required fields and enum values inline so LLM callers can self-correct before an API round trip.

0.2.1 (2026-04-21)

Fixed

get_editorial_premium and get_kol_influence default window to 30d instead of 7d. The backend only rolls these two indicators at 30d and 90d, so the previous default caused a 404 for any agent that did not pass window. Supported windows are noted in each tool's description.
Live-verified against api.blockchainacademics.com: schema parse, runtime call, envelope data.

0.2.0 (2026-04-21)

Verified against production before publishing

All five agent-job skills smoke-tested against api.blockchainacademics.com: summarize_whitepaper, due_diligence, monitor_keyword and translate_contract succeed; tokenomics_model returns a clean SkillError envelope until the fundamentals ingester lands.
Stub endpoints (Twitter social, DEXTools, bonk.fun, Bittensor) return {status: "integration_pending", reason, eta} with an X-BCA-Integration-Status: pending header instead of 501.

Added: 96 new tools (total surface at this release: 99 tools in 19 categories)

The expansion wires every live /v1/* endpoint the backend exposes as an MCP tool. Category breakdown at the time:

Content and corpus (7), Market data (4), On-chain (4), Sentiment (3)
Proprietary indicators (6), Agent-backed generation, async (6)
Directories (13), Fundamentals (6), Chain-specific (4)
Microstructure (5), Narrative and meta (5), Regulatory (4), Security (4)
Memes and degen (4), Compute and AI crypto (2), Services (3)
History time series (4), Corpus meta (7), Memos, theses, social and currencies (8)

Added: core surface

Unified response envelope: every tool returns {data, cite_url, as_of, source_hash}; cite_url carries UTM attribution (src=, utm_medium=mcp, utm_campaign={tool_name}).
Integration-pending status: tools whose upstream is still being wired return {data: null, status: "integration_pending"} plus the X-BCA-Integration-Status header. No raw 501s.
Live smoke tests: BCA_API_KEY=... npm run test:live pings one tool per category against production.

Changed

Minimum Node version is 18.17 (previously 18.0).
search_news supports a topic filter and a since (ISO 8601) filter.
Error taxonomy refined to BCA_AUTH, BCA_RATE_LIMIT, BCA_UPSTREAM, BCA_NETWORK, BCA_BAD_REQUEST, BCA_NOT_IMPLEMENTED.

Docs

The developer docs launched.

0.1.0 (2026-04-19)

Added

Initial release with stdio transport.
search_news: full-text search over the editorial corpus.
get_entity: canonical entity dossiers by slug or ticker.
get_explainer: canonical academy lessons by slug or topic.
Typed HTTPS client with BCA_API_KEY header injection and a 20s timeout.
Structured error taxonomy (BCA_AUTH, BCA_RATE_LIMIT, BCA_UPSTREAM, BCA_NETWORK, BCA_BAD_REQUEST).
Attribution surfacing (cite_url, as_of, source_hash) on every tool response.
Smoke test suite using node:test with mocked fetch.