Back to Browse

Token Verdict MCP Server

Developer ToolsUse Caution4.8MCP RegistryLocal
Free

Server data from the Official MCP Registry

MCP server for Token Verdict — pay-per-call token risk verdicts over x402 ($0.02 USDC on Base)

About

MCP server for Token Verdict — pay-per-call token risk verdicts over x402 ($0.02 USDC on Base)

Security Report

4.8
Use Caution4.8High Risk

This is a legitimate x402 payment client for the Token Verdict API. Its key handling is sound: the private key stays local, the spend guard caps each call at $0.02, and no hardcoded secrets or shell execution appear. The main concern is that the signer trusts the payTo address and token contract supplied in the remote 402 challenge, so a redirected or hostile endpoint could obtain a signed transfer authorization to an arbitrary recipient for up to the capped amount. Supply chain analysis found 5 known vulnerabilities in dependencies (0 critical, 5 high severity). Package verification found 1 issue.

9 files analyzed · 9 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

wallet_signing

Check that this permission is expected for this type of plugin.

What You'll Need

Set these up before or after installing:

EVM private key (0x...) of a wallet holding USDC on Base. Used locally to sign the x402 EIP-3009 authorization. For paid calls.Required

Environment variable: AGENT_PRIVATE_KEY

Path to a file containing that key (alternative to AGENT_PRIVATE_KEY).Optional

Environment variable: AGENT_KEY_FILE

Service base URL override (default: production).Optional

Environment variable: TOKEN_VERDICT_URL

Spend guard per call in USDC micro-units (default 20000 = $0.02, the known price). The client refuses to sign anything priced above it.Optional

Environment variable: TOKEN_VERDICT_MAX_AMOUNT_UNITS

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-quincygb-token-verdict-mcp": {
      "env": {
        "AGENT_KEY_FILE": "your-agent-key-file-here",
        "AGENT_PRIVATE_KEY": "your-agent-private-key-here",
        "TOKEN_VERDICT_URL": "your-token-verdict-url-here",
        "TOKEN_VERDICT_MAX_AMOUNT_UNITS": "your-token-verdict-max-amount-units-here"
      },
      "args": [
        "token-verdict-mcp"
      ],
      "command": "uvx"
    }
  }
}

Reviews

No reviews yet

Be the first to review this server!