Lightning Wallet MCP Server

Maintainer here. We just published v1.2.5 which updates @modelcontextprotocol/sdk to 1.27.1 and all transitive dependencies. npm audit now returns 0 vulnerabilities, so the 3 supply chain findings should clear on rescan. A few notes on the remaining findings: "Hardcoded Bearer token" is a false positive. There are no Bearer tokens, API keys, or credentials anywhere in the source. All authentication is done via environment variables (LIGHTNING_WALLET_API_KEY). "Global client state" is intentional and documented in the source code. MCP tools execute sequentially per the protocol spec, so there's no risk of credential leakage between concurrent requests. If MCP adds concurrent execution in the future, we'll refactor to per-request context. Happy to answer questions or address any other concerns.