hyperevm-mcp is a read-only MCP server for the Hyperliquid / HyperEVM ecosystem, used to query yields, protocols, fees, markets, funding rates, and order book depth. Its core security model is: there is nowhere in the code to enter a private key—there is no write path, and no code exists to sign or send transactions. The server does not read any environment variables, so there is no configuration that could be leaked; it does not touch the file system, does not start processes, and does not send telemetry data. It communicates with exactly and only four hosts hardcoded in src/core/http.ts: api.hyperliquid.xyz, api.llama.fi, yields.llama.fi, rpc.hyperliquid.xyz. No tool accepts a URL, host, or chain as a parameter.
Purpose and main capabilities
Users can ask an AI assistant questions about the Hyperliquid ecosystem in natural language. The example questions given in the material include: what is the best HYPE yield right now, compare lending rates on HyperEVM, which HYPE pools are just token emissions and which actually generate yield, has that 40% APY held up or is it decaying, is the BTC funding rate stable or did it only last an hour, who is earning the most fees on this chain, can I actually exit from $500,000 of HYPE, which protocols grew this week, introduce HyperLend, what is in this wallet (0x…), where should I stake HYPE and what are the commission costs.
The server provides nine tools. Five report current state, three report historical evolution, and one reads an address. The material explains that the tools are intentionally designed in pairs: hyperevm_yields and hl_market tell the user what a number is now; hyperevm_pool_history and hl_funding tell the user whether it should be trusted. A 47% pool that has been 100% emissions for a month is not the same product as a 20% pool generating real fees, and only the second pair of tools can distinguish them.
The server also provides MCP prompts, which appear as slash commands in Claude Code.
Key data details
Lending rates are not where they appear on the surface. DefiLlama's /pools reports 0.00% for collateral markets—this is real, because their supply rate is indeed zero. The interestThe rate is at the second endpoint /lendBorrow, connected by pool ID. A simple integration would print a zero table on top of a $239 million market. This server connects them and shows supply, borrow, and utilization separately.
Missing data is shown as missing. stHYPE ($172 million) and beHYPE have no published yield pools on DefiLlama, so their APY is shown as n/a, next to real TVL, with the network staking APR printed above as a reference. Using a zero to represent "unknown" would be the most expensive thing this tool could print.
Emissions are not yield. The highest-ranked pool by headline APY often pays entirely in its own token. The table carries a Base column next to APY, so 48.86% / base 0.00% is read as what it is, and a note flags rows where the figure is mostly emissions. The 7d column shows the same thing over time: that pool's APY fell 30 percentage points in a week. The HLP row shows the same rule twice. HLP has no pool at all on DefiLlama, so a table built only from that source would silently omit the largest single deposit venue on the chain—it is read from Hyperliquid. Hyperliquid's own displayed APR field is not shown, because the same value as an annual rate and as a daily rate differs by a factor of 365, and the vault's history cannot determine which one it is. What is shown is the realized PnL for each window, divided here, arithmetic we can defend.
Third-party text and prompt injection
The server is read-only and cannot take actions. But it brings text written by strangers into the agent's context, alongside other things the agent can do (wallets, shells). Validator names on Hyperliquid are free text set by whoever runs the validator; DefiLlama protocol names come from pull requests. So text is treated as hostile, handled in three layers.
- Unneeded fields are never read. description—445 characters of free text on validators, 599 on DefiLlama protocols—is not parsed anywhere in the code. If that changes, the audit fails the build.
- Allowlist, not blocklist. Everything printed passes through a filter that keeps letters, digits, currency symbols, and a small set of punctuation, discarding everything else. It is not meant to catchblocklist of bad sequences — but a list of what can pass. So <|im_start|>, [INST], ###, {{, backticks and table pipes cannot survive, because the characters that build them are not on the list. Input is first NFKC-normalized, so full-width lookalikes collapse to ASCII before the filter, not after.
- A type system, not discipline. Sanitized text has its own type. The renderer accepts nothing else, so printing a raw upstream field is a compile error, not a code review miss. Only one place can create that type from a plain string, and if a second one ever appears, the audit fails the build.
A test feeds a poisoned upstream response — chat-template tokens, javascript: URLs, injected instructions, fences in a slug — into the real tool and asserts that nothing in it reaches the output in any form that could act.
What this cannot do: it cannot stop plain English. A validator named "ignore previous instructions" still reads as those words. The answer to that is a field allowlist, a 24-character cap, and the fact that this server exposes no action for such a sentence to trigger — not a smarter filter. Anyone claiming a filter solves prompt injection is selling something. The details are in SECURITY.md.
How to use it
In Cursor, Claude Desktop, or any MCP client, add it to the config file. The material says "That is the whole setup. Nothing to fill in afterwards — no account to authenticate."
Running requires Node 20 or higher. Two direct dependencies: @modelcontextprotocol/sdk and zod. (The SDK brings its own dependency tree, as every MCP server does; nothing else was added on top.)
When it is useful
Suitable for users who want to learn about the Hyperliquid / HyperEVM ecosystem yields, protocols, fees, markets, funding rates and order book depth in natural language, and for security-conscious users who want to review the code before installing. The whole server is a few thousand lines of TypeScript, meant to be read before installation. Unit tests cover the parts that determine what readers see: "unknown" renders as n/a and never as 0, percentage points and percent stay in different units, a cell cannot forge a table column, and when a refresh fails it provides the previous answer with an explanation.
Limitations and disclaimer
The server is read-only and cannot move funds — it willThe code that signs transactions is not in this package. npm run audit checks each of the above lines against the source and exits non-zero if one no longer holds, and runs in CI before release; adding an fs import or a second network host fails the build rather than reaching users.
This is unofficial and community-built. Not affiliated with Hyperliquid or any of the protocols listed. Data comes from public APIs and may be delayed or wrong; DefiLlama refreshes about every 30 minutes. When a refresh fails, it provides the previous answer with a visible "REFRESH FAILED, this is N min old" label instead of an error — old data is useful, old data pretending to be fresh is not. Not financial advice.
