Teller MCP – Borrow USDC & Altcoins
PassAudited by ClawScan on May 10, 2026.
Overview
This is a coherent Teller MCP wrapper, but it can generate borrow/repay transaction payloads and send wallet query data to the configured Teller API, so users should review outputs before signing anything.
Install only if you intend to use Teller lending tooling through an MCP server. Use a trusted API base URL, review npm dependencies, and never auto-sign the generated borrow or repayment transactions without independent wallet review.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If you sign the returned transactions without checking them, you could approve tokens, create a loan, or repay a loan with unintended parameters.
The MCP tools generate encoded approval, borrow, and repayment transaction payloads. This is disclosed and purpose-aligned, but those payloads could affect funds if a downstream wallet or agent signs and submits them.
description: 'Return encoded transactions required to borrow from a Teller pool' ... 'Build repayment approval + repay transactions for a Teller loan'
Treat transaction-builder output as unsigned drafts. Verify the destination, calldata, value, chain, token addresses, and amounts in a wallet or block explorer before signing.
Wallet addresses, loan IDs, and requested borrow/repay amounts may be visible to the configured API endpoint.
The client sends API requests, including wallet/loan query parameters for some tools, to Teller's default API or to a user-configured base URL. This data flow is expected for the integration and is documented.
const DEFAULT_BASE_URL = process.env.TELLER_API_BASE_URL?.trim() || 'https://delta-neutral-api.teller.org'; ... const response = await fetch(url, {Use the default Teller endpoint or another endpoint you trust, and avoid entering wallet information you do not want queried through that service.
Installing dependencies runs normal npm supply-chain risk, especially because the registry listing has no homepage/source URL.
The skill asks the user to install and run a Node-based MCP server. This is central to the stated purpose and a package lock is included, but it still means local dependency installation is part of use.
cd scripts/tellermcp-server npm install npm start
Review the package-lock and package.json, prefer reproducible installs such as npm ci when possible, and install only in an environment appropriate for this DeFi tooling.