// SCAN REPORT

HashPilot

126 tools. 62 can modify or destroy data without limits.

10 destructive tools with no built-in limits. Policy required.

Last updated: 1 Jul 2026

62 can modify or destroy data

64 read-only

126 tools total

Community server · catalogue entry verified 01/07/2026

How to control HashPilot ↓

TOOL MAP

What HashPilot exposes to your agents

Read (64) Write / Execute (52) Destructive / Financial (10)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous HashPilot tools

Financial · Critical token_transfer This tool directly moves cryptocurrency/tokens between accounts, which is a financial operation with permanent monetary consequences. Financial · Critical transfer_hbar This tool transfers cryptocurrency (HBAR) between accounts, which constitutes a financial transaction that moves monetary value. Financial · Critical stablecoin_manage This tool directly manages stablecoin supply and token movements on a blockchain. Financial · High account_create This tool creates a new Hedera blockchain account and transfers real HBAR cryptocurrency from the operator account to fund it.

62 of HashPilot's 126 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control HashPilot

PolicyLayer is an MCP gateway — it sits between your AI agents and HashPilot, and nothing reaches the server without passing your rules. These are the rules we recommend:

Block financial tools by default

{
  "account_create": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Requires human approval."
      }
    ]
  }
}

Financial tools should be explicitly enabled per use case, not open by default.

Deny destructive operations

{
  "addressbook_remove": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "account_import": {
    "limits": [
      {
        "counter": "account_import_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "account_balance": {
    "limits": [
      {
        "counter": "account_balance_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register HashPilot — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON HASHPILOT →

Instant setup, no code required.

FULL CATALOGUE

All 126 HashPilot tools

FINANCIAL 4 tools

Financial account_create Create a new Hedera account with customizable parameters. CREATES: New account with auto-generated ECDSA key Financial stablecoin_manage Enterprise-grade stablecoin management via Hedera Stablecoin Studio. OPERATIONS: - create: Create compliant s Financial token_transfer Transfer tokens from one account to another. Both accounts must be associated with the token first. The sender Financial transfer_hbar Transfer HBAR between Hedera accounts. EXECUTES: CryptoTransfer transaction from source to destination REQUIR

DESTRUCTIVE 6 tools

Destructive addressbook_remove Remove an account from the address book by its alias. Destructive foundry_remove Remove a dependency from the project. Destructive hardhat_clean Clean cache and artifacts directories. Useful before fresh compilation. Destructive token_burn Burn tokens from the treasury account, reducing total supply. Requires supply key to be enabled on the token. Destructive token_kyc_revoke Revoke KYC (Know Your Customer) status from an account for a token. Prevents further transfers. Operator must Destructive token_wipe Wipe tokens from an account, removing them from circulation. Requires wipe key to be enabled on the token. Doe

EXECUTE 32 tools

Execute deploy_contract Deploy smart contract to Hedera with unified interface. AUTO-DETECTS: Hardhat or Foundry project framework SU Execute deploy_multi_contract Deploy multiple contracts with automatic dependency resolution. Supports $ContractName placeholders in constru Execute foundry_anvil_start Start Anvil local Ethereum node for testing. Can fork from Hedera testnet/mainnet for realistic testing enviro Execute foundry_anvil_stop Stop the running Anvil local node. Execute foundry_build Compile all Solidity contracts in the project. Significantly faster than Hardhat (3-4x). Generates artifacts i Execute foundry_clean Clean build artifacts and cache directories. Useful before fresh compilation. Execute foundry_contract Manage Foundry contract testing, deployment, and interaction. OPERATIONS: - test: Run Forge tests with fuzzin Execute foundry_create Deploy a single contract to Hedera network using forge create. For complex multi-contract deployments, use fou Execute foundry_install Install a dependency via git submodule. Examples: forge-std, openzeppelin-contracts. Use format: org/repo (e.g Execute foundry_project Manage Foundry project lifecycle operations. OPERATIONS: - init: Initialize new Foundry project with template Execute foundry_script Run a Solidity deployment script. Scripts provide more control than forge create for complex deployments with Execute foundry_test Run Forge test suite with native fuzzing support. Tests are written in Solidity. Supports filtering, gas repor Execute foundry_update Update all git submodule dependencies to their latest versions. Execute hardhat_compile Compile all Solidity contracts in the project. Generates artifacts (ABI, bytecode) and build-info files for ve Execute hardhat_contract Manage Hardhat contract deployment and interaction. OPERATIONS: - deploy: Execute deployment script on target Execute hardhat_deploy Execute deployment script to deploy contracts to Hedera networks. Execute hardhat_deploy_ignition Deploy contracts using Hardhat Ignition (modern declarative deployment). Execute hardhat_execute_contract Execute state-changing contract function. Requires gas and sends transaction. Execute hardhat_project Manage Hardhat project lifecycle operations. OPERATIONS: - init: Initialize new Hardhat project with Hedera c Execute hardhat_run_task Execute any Hardhat task programmatically. Execute hardhat_test Run Mocha/Chai tests for smart contracts. Supports filtering by file or pattern. Execute hcs_message Hedera Consensus Service (HCS) message operations. OPERATIONS: - submit: Submit message to topic (auto-chunks Execute message_submit Submit a message to an HCS topic. Messages up to 1KB are sent as single chunk. Larger messages automatically s Execute mirror_call_contract Execute EVM call simulation (read-only, free). Call view/pure functions without gas cost. Execute network_switch Switch between Hedera networks seamlessly. NETWORKS: mainnet (production), testnet (testing), previewnet (pre Execute rpc_call Execute ANY JSON-RPC method on Hedera Execute rpc_deploy_contract Deploy smart contract to Hedera via JSON-RPC. HANDLES: Bytecode deployment, constructor encoding, gas estimat Execute rpc_execute_contract Execute state-changing contract function via eth_sendRawTransaction. EXECUTES: Transaction that modifies cont Execute token_freeze Freeze a token for a specific account, preventing transfers. Requires freeze key to be enabled on the token. O Execute token_manage Comprehensive Hedera Token Service (HTS) management. Execute ANY token operation through a single unified inte Execute token_pause Pause all operations for a token. No transfers, mints, or burns can occur while paused. Requires pause key to Execute verify_batch Batch verify multiple contracts on HashScan. Supports parallel or sequential verification with configurable fa

WRITE 20 tools

Write account_import Import an existing Hedera account into the address book by providing account ID, private key, and alias. This Write addressbook_add Add an existing Hedera account to the address book without storing private key. Useful for accounts you want t Write addressbook_manage Manage Hedera account address book for multi-account workflows. OPERATIONS: - add: Add account to address boo Write addressbook_update Update the nickname of an account in the address book. Write code_generate Generate context-aware Hedera SDK code from natural language. CREATES: Complete, runnable code with imports, Write foundry_init Initialize a new Foundry project with Hedera network configuration. Creates directory structure, config files, Write foundry_send Send a transaction to a contract (state-changing, requires gas). Uses cast send. Write hardhat_config_add_network Generate network configuration snippet for hardhat.config.js. Write hardhat_init Initialize a new Hardhat project with Hedera network configuration. Creates directory structure, config files, Write hcs_topic Hedera Consensus Service (HCS) topic management. OPERATIONS: - create: Create new public or private topic wit Write state_backup Backup MCP server state including address book and network configuration. By default, excludes private keys fo Write state_manage Manage HashPilot MCP server state through backup/restore/export operations. OPERATIONS: - backup: Create time Write state_restore Restore MCP server state from a backup file. This will overwrite current address book and network settings unl Write token_associate Associate a token with an account to enable receiving/holding tokens. Required before an account can receive t Write token_create Create a new fungible token on Hedera with customizable properties. Treasury defaults to operator account. IMP Write token_kyc_grant Grant KYC (Know Your Customer) status to an account for a token. Required when KYC key is enabled on token to Write token_mint Mint additional tokens and add them to the treasury account. Requires supply key to be enabled on the token. O Write topic_create Create a new HCS (Hedera Consensus Service) topic for publishing messages. Topics can be public (anyone can su Write topic_update Update an existing HCS topic. Requires admin key to be set on the topic during creation. Can update memo and a Write verify_contract Verify smart contract on HashScan block explorer. METHODS: Direct source upload, Hardhat build-info, Foundry

READ 64 tools

Read account_balance Query HBAR and token balances for any Hedera account. RETURNS: HBAR balance in ℏ format, list of all associat Read account_info Get comprehensive Hedera account information. RETURNS: Balance, EVM address, public key, memo, auto-renew per Read addressbook_list List all accounts stored in the address book. Returns account IDs, aliases, nicknames, and metadata (but not p Read contract_info Get comprehensive contract information including verification status, deployment details, ABI, and HashScan UR Read deployment_history View deployment history with filtering and export. FILTERS: By network, contract name, status EXPORTS: JSON, Read deployment_report Generate deployment documentation/summary in Markdown, JSON, or HTML. Include specific deployments or filter b Read deployment_status Get detailed status of a specific deployment by ID or contract address. Optionally fetch fresh verification da Read docs_ask Answer ANY knowledge question about Hedera using RAG. HANDLES: Conceptual (what is X?), how-to (how do I?), c Read docs_get_example Find working code examples for Hedera functionality. SEARCHES: SDK examples, tutorials, implementation patter Read docs_search Semantic search across complete Hedera documentation. INDEXED: Official docs, SDK references (JS/Java/Go/Rust Read docs_update_index Manually trigger documentation reindexing. Crawls Hedera documentation and updates the vector database. Read error_explain Explain Hedera error codes and provide debugging guidance. USE FOR: - Understanding cryptic Hedera error code Read foundry_call Call a contract function (read-only, no gas cost). Uses cast call. For state-changing transactions, use foundr Read foundry_fmt Format all Solidity code in the project according to Foundry style guide. Read foundry_get_artifacts Get compiled contract artifacts including ABI, bytecode, and metadata from out/ directory. Read foundry_inspect Inspect compiled contract artifacts. Can retrieve ABI, bytecode, storage layout, assembly, and more. Read foundry_snapshot Create or compare gas snapshots for all tests. Useful for tracking gas optimizations over time. Read get_verified_source Retrieve verified contract source code from HashScan. Returns source files, metadata, and optionally the file Read hardhat_call_contract Call read-only contract function (view/pure). No gas cost. Read hardhat_flatten Flatten contracts into single file for easier verification. Read hardhat_get_accounts Get list of available accounts with balances. Read hardhat_get_artifacts Get compiled contract artifacts (ABI, bytecode, etc.). Read hardhat_list_tasks List all available Hardhat tasks (built-in and custom). Read hardhat_verify Get verification metadata for HashScan contract verification. Returns build-info file path. Read health_check Check HashPilot MCP server health and status. Returns version, tool count, and optimization level. Read message_query Query historical messages from an HCS topic via Mirror Node REST API (FREE). Messages are base64 decoded autom Read mirror_get_account_nfts Get all NFTs owned by an account. Returns token IDs, serial numbers, and metadata. Read mirror_get_account_rewards Get staking reward history for an account. Returns rewards earned per staking period. Read mirror_get_account_tokens Get all token relationships for an account. Returns token associations, balances, freeze/KYC status. Read mirror_get_block Get single block by hash or number. Returns block details including transactions and gas usage. Read mirror_get_contract Get smart contract details. Returns bytecode, EVM address, file ID, and admin key. Read mirror_get_contract_actions Get contract call actions/trace. Returns internal calls, value transfers, and call hierarchy. Read mirror_get_contract_opcodes Get EVM opcode trace for debugging. Returns step-by-step execution with stack, memory, and storage. Read mirror_get_contract_results Get contract execution history. Returns transaction results, gas used, and error messages. Read mirror_get_contract_state Get contract storage state (key-value pairs). Query specific storage slots or get all state. Read mirror_get_network_info Get Hedera network information including exchange rates, fees, and supply from Mirror Node REST API. Also prov Read mirror_get_network_nodes Get list of consensus nodes on Hedera network. Returns node IDs, accounts, descriptions, and service endpoints Read mirror_get_network_stake Get network staking information including total stake, max stake per node, and staking period. Read mirror_get_nft Get single NFT info by serial number. Returns metadata, current owner, and creation timestamp. Read mirror_get_nft_history Get NFT transaction history. Returns all transfers and ownership changes for specific NFT. Read mirror_get_schedule Get scheduled transaction details. Returns signatories, expiration, and execution status. Read mirror_get_token_balances Get token balance distribution across all holders. Returns list of accounts holding the token with their balan Read mirror_get_topic_info Get HCS topic information (not messages). Returns topic memo, admin key, submit key, and auto-renew settings. Read mirror_get_transaction Get single transaction details by transaction ID. Returns full transaction info including transfers, fees, and Read mirror_list_accounts List Hedera accounts with filtering. Returns paginated list of accounts with balances and metadata. Read mirror_list_balances List network balance snapshots. Filter by account or timestamp for historical balance queries. Read mirror_list_blocks List Hedera blocks (record files). Returns block hashes, numbers, timestamps, and transaction counts. Read mirror_list_contracts List all smart contracts deployed on Hedera. Returns contract IDs, bytecode, and creation info. Read mirror_list_nfts List NFTs for a token collection. Returns serial numbers, metadata, and current owners. Read mirror_list_schedules List scheduled transactions. Filter by execution status or creator account. Read mirror_list_tokens List Hedera tokens with filtering. Filter by type (FUNGIBLE_COMMON or NON_FUNGIBLE_UNIQUE). Read mirror_query_account Query comprehensive account data from Hedera Mirror Node REST API. RETURNS: Balance, EVM address, creation ti Read mirror_query_contract_logs Query smart contract event logs from Hedera Mirror Node. Returns log data, topics, block info, and transaction Read mirror_query_token Get detailed token information from Hedera Mirror Node. Returns token properties, supply, keys, custom fees, a Read mirror_query_topic_messages Query HCS topic messages from Hedera Mirror Node. Returns message content, sequence numbers, timestamps, and h Read mirror_query_transactions Query transactions from Hedera Mirror Node with flexible filters. Returns transaction details, fees, transfers Read mirror_search_logs Search contract event logs globally by topic. Filter by event signature (topic0) or indexed parameters. Read network_info Get current Hedera network configuration. RETURNS: Network name, Mirror Node URL, JSON-RPC Relay endpoint USE Read rpc_call_contract Call read-only smart contract function via eth_call (FREE - no gas cost). EXECUTES: View/pure function on dep Read state_export Export current server state to JSON format for inspection or external use. Similar to backup but optimized for Read token_unfreeze Unfreeze a token for a specific account, allowing transfers again. Requires freeze key to be enabled on the to Read token_unpause Unpause a token, resuming all operations. Requires pause key to be enabled on the token. Operator must have th Read topic_subscribe Subscribe to real-time messages from an HCS topic. Returns a subscription acknowledgment. For actual message r Read verification_status Check verification status for one or more contracts on HashScan without re-verifying. Returns verification sta

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about HashPilot

Can an AI agent move money through the HashPilot MCP server? +

Yes. The HashPilot server exposes 4 financial tools including account_create, stablecoin_manage, token_transfer. Without a policy, an autonomous agent can call these with no spend caps, no rate limits, and no approval flow. PolicyLayer lets you block financial tools by default, require human approval, or set per-tool rate limits — enforced on every call.

Can an AI agent delete data through the HashPilot MCP server? +

Yes. The HashPilot server exposes 6 destructive tools including addressbook_remove, foundry_remove, hardhat_clean. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through HashPilot? +

The HashPilot server has 20 write tools including account_import, addressbook_add, addressbook_manage. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach HashPilot.

How many tools does the HashPilot MCP server expose? +

126 tools across 5 categories: Destructive, Execute, Financial, Read, Write. 64 are read-only. 62 can modify, create, or delete data.

How do I enforce a policy on HashPilot? +

Register the HashPilot MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every HashPilot tool call.

Deterministic rules across all 126 HashPilot tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON HASHPILOT →

Instant setup, no code required.

126 HashPilot tools catalogued and risk-classified — across an index of 43,000+ MCP servers.