1inch MCP
Doc search, intent & cross-chain swaps, limit orders, portfolio, spot prices, gas & all APIs.
- 1.0.0
- Version
- remote
- Transport
- 10
- Tools
Security review
Review passedReviewed Jan 1, 2000.
- tools: 10 tools scanned
- metadata: scanned
No findings.
Tools (10)
search
Search 1inch documentation and API reference
list_examples
List all available SDK code examples. Returns example names that can be used with get_example tool.
get_example
Get the full source code of an SDK example. Use list_examples first to see available examples.
authenticate
Call this to start or confirm 1inch Business login. HTTP 401 means you are still anonymous (initialize 200 is not login). After OAuth, call again until the result is authenticated: true with organizationId. Then use swap, orderbook, product_api, or debug. Do not treat a PaymentRequired / x402 result as login.
swap
[Requires authentication] Call the authenticate tool first to start or confirm 1inch Business login (initialize 200 is still anonymous). If authenticate or this tool returns HTTP 401, complete OAuth, then retry. Swap tokens via 1inch. Supports classic (on-chain), Fusion (intent/gasless), and cross-chain swaps. Omit preferredType and the tool picks a type for you; set preferredType (classic, fusion, crosschain) to choose explicitly. When quoteOnly returns a `recommended` type and that type is available, present **only** that type to the user. Do not mention, compare, or suggest other swap types unless the user explicitly asks to compare alternatives. ERC-20 source tokens may require a one-time approval transaction before the swap can proceed; the approval costs native gas on the source chain even for gasless Fusion/cross-chain swaps. When a response includes an `approval` block, tell the user upfront (approval.estimatedCost holds the estimated cost in native units). Usage modes: 1. *
orderbook
[Requires authentication] Call the authenticate tool first to start or confirm 1inch Business login (initialize 200 is still anonymous). If authenticate or this tool returns HTTP 401, complete OAuth, then retry. Limit orders via the 1inch Orderbook API (v4.1). IMPORTANT: The "action" parameter is REQUIRED. Must be one of: "build", "create", "list", "cancel". Actions with example parameters: 1. build (recommended first step): { "action": "build", "chain": 1, "makerAsset": "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48", "takerAsset": "0xdAC17F958D2ee523a2206206994597C13D831ec7", "makingAmount": "1000000", "takingAmount": "990000", "makerAddress": "0x..." } Optional: expirationSeconds (default 604800 = 7 days). With an active WalletConnect session, the order is signed and submitted automatically (set execute=false to return typed data only). 2. create (after signing typedData from build): { "action": "create", "chain": 1, "orderHash": "0x...", "signature": "0x...", "orderData":
product_api
[Requires authentication] Call the authenticate tool first to start or confirm 1inch Business login (initialize 200 is still anonymous). If authenticate or this tool returns HTTP 401, complete OAuth, then retry. Call any 1inch product API endpoint using the authenticated user's credentials (base URL is the unified gateway, e.g. https://api.1inch.com). Call authenticate first. Anonymous sessions get HTTP 401 (OAuth), not x402. After a real org login, quota-exhausted routes may return a PaymentRequired tool result; retry with a signed payment in _meta["x402/payment"] (batch-settlement scheme only — see file://1inch-mcp/guides/x402-payments). Do not treat PaymentRequired as login. Optional: if your client can read MCP resources, file://1inch-mcp/guides/api-index has live Swagger links and extra gateway notes (mirrors business.1inch.com/portal/llms.txt). Common chain IDs: Ethereum=1, BNB=56, Polygon=137, Arbitrum=42161, Optimism=10, Base=8453, Avalanche=43114, Gnosis=100, zkSync=324, Li
aqua
1inch Aqua (shared-liquidity market making): position analytics plus maker position writes. Write actions (OAuth, or WalletConnect + signed 1inch ToS (pass walletSessionToken after MCP session rotation); non-custodial — the user's wallet signs): create_position (two-phase: call once for a preview + previewRef, then again with confirmed:true), close_position (confirmed:true; closing is permanent). Anonymous writes execute only via WalletConnect (execute=false is rejected). REQUIRED: "action" — read actions (no OAuth): maker_stats, list_maker_strategies, strategy_overview, strategy_activity, strategy_volume, list_opened. Read the resource file://1inch-mcp/guides/aqua-workflow for per-action examples, priceRange semantics, and maker position flows. Raw HTTP: product_api with path "/aqua/v1.0/strategies/...".
walletconnect
Pair and use an EVM and/or Solana wallet via WalletConnect v2. **No authentication required** — available to every user (including unauthenticated/anonymous). Non-custodial: the server never holds keys and the user approves every signature/transaction in their own wallet. **Pairing proposal** is controlled per request via optional `pairingTarget` on `action: "connect"`: `eth` (default, eip155 only), `solana`, or `both`. Many mobile wallets fail if eip155 and solana are proposed together; prefer `eth` or `solana` unless the user needs both in one session. **Every call must include `action`** (string). **Connect QR (critical for assistants):** On `action: "connect"`, successful responses return **(1) an MCP `type: "image"` PNG** of the pairing QR (render this even if the host has no `resources/read`), then **(2) optional `resource_link`**, then **(3) text JSON** with `pairingQrResourceUri`, `presentation`, `nextSteps`, `url`, optional `mobileDeeplinks`, etc. **Desktop / scan UX:** show
debug
[Requires authentication] Call the authenticate tool first to start or confirm 1inch Business login (initialize 200 is still anonymous). If authenticate or this tool returns HTTP 401, complete OAuth, then retry. Look up production API request logs for your 1inch Business organization to troubleshoot integration issues. Results are always scoped to your authenticated organization. Two modes: 1) By request id: pass requestId (the x-request-id header returned on 1inch API responses). Optionally narrow startTime/endTime (defaults: last 24 hours ending now). 2) Logs in a time window: omit requestId and pass both startTime and endTime (RFC3339). Optionally set logLevel ("info", "warn", or "error") to filter by severity; omit to return all levels. Limits: each call covers at most a 24-hour window; how far back you can query depends on your plan's log retention.