Mmanthe37 Mcp Server Publish

• Risk level: Low
• Analyzed: Apr 13, 2026, 9:19 AM
• Findings: 0
• Version: 0.1.5
• Hash: 923a8b75e916c149a9e76b15937d18350a7eafc104a94c5046a5302a9d6f484e

Overview

The skill's code, runtime instructions, and requested resources are consistent with a read-only MCP analytics server; nothing in the bundle requests unrelated credentials or hidden installs, though deploying it will provision Azure resources and the runtime exposes some host metadata and external API calls.

This skill appears to be what it claims: a read-only MCP server for web3 analytics. Before installing or deploying, consider the following: - Deploying with azd will provision Azure resources (resource group, container registry, container apps environment, Log Analytics). You will need an Azure subscription and the permissions to create those resources. - Runtime logs are sent to an Azure Log Analytics workspace (the template retrieves workspace keys). If you deploy to a shared subscription, be aware logs/metrics will be stored in Azure and may contain request data. - The system_info tool returns host metadata (hostname, platform, memory, node version). If you are exposing this service publicly and want to minimize fingerprinting/leakage, remove or restrict this tool. - The web3 tools make outbound requests to public APIs (CoinGecko, DefiLlama, CoinCap) and public RPC endpoints for multiple chains. Running the server will cause outbound network calls to those services; review them if you need to restrict egress or have privacy requirements. - There are no requested environment variables or credentials in the skill itself, which reduces the risk of accidental credential exfiltration. Nevertheless, review any custom tool additions (src/tools.ts) before deploying. Recommended steps: run locally (npm run dev) to test; inspect/modify src/tools.ts to remove any tools you don't want (e.g., system_info); and deploy in a controlled subscription or resource group to verify logs and access control.