Crypto Quant Signal MCP Server

This is a legitimate cryptocurrency trading signal MCP server with appropriate authentication, reasonable permissions, and well-structured code. However, there are several moderate-risk findings: secrets (API keys, private keys) are stored in environment variables but the code accepts them from multiple sources without consistent validation; the server makes extensive network calls to external crypto exchanges which, while appropriate for its purpose, are not fully rate-limited on the client side; there is broad use of environment variables for configuration and the README mentions local SQLite with native binaries that may execute scripts. These are standard patterns for finance servers and do not constitute critical vulnerabilities, but users should be aware of the credential handling approach. Supply chain analysis found 4 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

3 files analyzed · 12 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.