Debridge Mcp

Enable non-custodial cross-chain crypto swaps and transfers with optimized routing, fee estimation, and order tracking via the deBridge protocol.

Security Scan

The skill's stated purpose (connecting to deBridge MCP) is plausible, but there are multiple inconsistencies and missing details (repo origin mismatch, undeclared runtime requirements, unclear signing/credential handling, and hard-coded paths) that warrant caution before installing or running the code.

Purpose & Capability

The SKILL.md and setup.sh instruct cloning and running a Node-based MCP server (git clone, npm install, npm run build, node dist/index.js) but the skill metadata declares no required binaries or credentials. That is inconsistent: node/npm should be declared. Additionally, _meta.json points to a repo under aviclaw while the install instructions and setup.sh clone github.com/debridge-finance/debridge-mcp — the origin is ambiguous.

Instruction Scope

Instructions direct the agent/operator to download and run external code as a local adapter and to modify ~/.openclaw/openclaw.json to launch it via stdio. The SKILL.md does not explain how transaction signing or wallet/private-key access is handled (critical for cross-chain swaps). Running a third-party server locally can give the skill broad ability to initiate blockchain transactions if signing is available — but the workflow for signing/authentication is missing.

Install Mechanism

Installation is a simple git clone from GitHub and npm build (no packaged installer). The GitHub URL (debridge-finance) is an expected host for this project, which reduces risk versus a random URL, but it still results in arbitrary code being written and executed locally (npm install, npm run build, node). The skill registry did not provide an install spec, so setup.sh bundled with the skill is the only installer; that script performs cloning and building on the user's machine.

Credentials

No environment variables or credentials are declared, yet the feature (executing swaps/transfers) normally requires signing transactions or proxying through wallets or RPC endpoints. The SKILL.md gives no guidance on how keys are provided or how signing requests are routed, which is a material omission. The setup script reads and backs up ~/.openclaw/openclaw.json (expected) and references a hard-coded installation path (/home/ubuntu) in the example config — this is not proportional to the claimed zero-dependency footprint.

Persistence & Privilege

The skill does not request forced persistence (always: false) and setup.sh only suggests adding an adapter entry and backing up the OpenClaw config; it does not autonomously modify plugin-enabled flags or system-wide settings beyond the user's OpenClaw config backup step. Autonomous invocation remains possible by default (platform behavior) but is not elevated by the skill metadata.

What to consider before installing

Do not install or run this skill blindly. Before proceeding: 1) Verify the correct upstream repository (SKILL.md/setup.sh clone https://github.com/debridge-finance/debridge-mcp while _meta.json points to a different repo); confirm you trust that exact GitHub repo and the commit being cloned. 2) Inspect the upstream repository's code (especially any code that requests signing or holds private keys), and run npm audit and static checks. 3) Clarify how transaction signing is handled — never supply private keys to code unless you fully understand and trust its signing workflow (prefer external hardware wallets or explicit user signing prompts). 4) Run the MCP server in an isolated environment (container or VM) and avoid using hard-coded paths like /home/ubuntu; review and sanitize the adapter config before adding it to ~/.openclaw/openclaw.json. 5) If you need this functionality, contact the deBridge project directly or use an officially documented integration; if anything remains ambiguous (origin, signing, required node version), treat the package as untrusted and do not run it on a machine with sensitive keys or production assets.

deBridge MCP Skill

Enable AI agents to execute non-custodial cross-chain cryptocurrency swaps and transfers via the deBridge protocol.

What It Does

• Cross-chain swaps: Find optimal routes and execute trades across 20+ chains
• Transfer assets: Move tokens between chains with better rates than traditional bridges
• Fee estimation: Check fees and conditions before executing
• Non-custodial: Assets never leave user control

Installation

# Clone the MCP server
git clone https://github.com/debridge-finance/debridge-mcp.git ~/debridge-mcp
cd ~/debridge-mcp
npm install
npm run build

# Add to OpenClaw config
# See configuration below

Configuration

Add to ~/.openclaw/openclaw.json:

{
  "plugins": {
    "entries": {
      "mcp-adapter": {
        "enabled": true,
        "config": {
          "servers": [
            {
              "name": "debridge",
              "transport": "stdio",
              "command": "node",
              "args": ["/home/ubuntu/debridge-mcp/dist/index.js"]
            }
          ]
        }
      }
    }
  }
}

Then restart: openclaw gateway restart

Available Tools

When MCP is connected, agents can use:

• get_quote: Get swap quote for cross-chain trade
• create_order: Create cross-chain order
• get_status: Check order status
• get_supported_chains: List supported chains

Usage Example

Ask: "Swap 100 USDC from Ethereum to Arbitrum"

Agent uses MCP to:
1. Get quote for USDC → USDC on Arbitrum
2. Show estimated receive amount and fees
3. Create order if user confirms
4. Monitor until completion

Security Notes

• Always verify quoted rates before executing
• Check slippage tolerance settings
• deBridge uses DLN (Decentralized Liquidity Network) - not a bridge
• No liquidity pools - uses order-based matching

Chains Supported

Ethereum, Arbitrum, Optimism, Base, Polygon, Avalanche, BNB Chain, Solana, and 15+ more.

---

Skill by: Avi (github.com/aviclaw)