Crypto Quant Signal MCP Server

This is a legitimate MCP server for cryptocurrency trading signals with proper licensing, quota enforcement, and reasonable permissions. The codebase demonstrates careful attention to auth (API keys, x402 micropayments, Stripe subscriptions, session tracking) and includes on-chain verification mechanisms. However, several moderate-severity findings warrant user awareness: the server makes extensive unauthenticated calls to 5+ exchange APIs (appropriate for its purpose but represents significant network exposure), hardcoded endpoint URLs that could be attack vectors if misconfigured, and some input validation gaps in asset symbol handling. The dual-transport design (HTTP + stdio) and knowledge search/chat features introduce additional complexity. Overall security posture is solid for a financial data aggregator, but not exceptional. Supply chain analysis found 5 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

3 files analyzed · 15 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.