Back to MCP Trust Indexm8ven
45
/ 100
1 month ago
glama

Dogeshit MCP

Enables AI agents to trigger on-chain minting of $SHIT tokens via EIP-7702 delegation and MCP, with the user retaining full custody and the contract ensuring tokens go to the caller's own wallet.

→ dogeshitmeme/dogeshit-mcp· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 1 credential: RELAYER_PRIVATE_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies4 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

lowhono@4.12.18GHSA-2gcr-mfcq-wcc3

Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

lowhono@4.12.18GHSA-3hrh-pfw6-9m5x

Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

lowhono@4.12.18GHSA-f577-qrjj-4474

Hono: JWT middleware accepts any Authorization scheme, not only Bearer

lowhono@4.12.18GHSA-xrhx-7g5j-rcj5

Hono: IP Restriction bypasses static deny rules for non-canonical IPv6

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configBASE_URL
configCHAIN— , RPC_URL — your chain + RPC endpoint(s)
configCHAIN_ID
configCORS_EXTRA
configFRONTEND_URL
configHOST— bind address (default 127.0.0.1; set 0.0.0.0 to expose directly without a reverse proxy)
configLOG_LEVEL
configMCP_ALLOWED_IP_CIDRS— =160.79.104.0/21 — gate /mcp to claude.ai egress
configMCP_DEV_AUTH— 1 bun run tests/integration/mcp-edges.ts # MCP/OAuth edge cases
configMCP_LOG_PATH— to /tmp before unit tests touch the logger
configMCP_URL
configMINT_DELEGATE_ADDRESS— TOKEN_ADDRESS, — deployed contract addresses
configOAUTH_DB_PATH
configPORT
configRELAYER_MAX_FEE_GWEI— — gas cap (e.g. 4.2069 mainnet, 0.42069 L2)
configRELAYER_MIN_BALANCE_ETH— =0.05 — alert before relayer runs dry
🔐 secretRELAYER_PRIVATE_KEY— — pre-funded wallet that signs mint txs
configRELAYER_QUEUE_MAX— (default 50) / RELAYER_QUEUE_PER_KEY_MAX (default 1) — global / per-caller in-flight pool sizing
configRELAYER_QUEUE_PER_KEY_MAX— RELAYER_QUEUE_MAX (default 50) / (default 1) — global / per-caller in-flight pool sizing
configRELAYER_TASK_TIMEOUT_MS— (default 120000) — receipt-wait budget per request
configRPC_URL— CHAIN, — your chain + RPC endpoint(s)
configSHUTDOWN_TIMEOUT_MS— (default 25000) — graceful drain budget on SIGTERM
configTOKEN_ADDRESS— , MINT_DELEGATE_ADDRESS — deployed contract addresses
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 0 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/dogeshitmeme-dogeshit-mcp-11iafa)](https://m8ven.ai/mcp/dogeshitmeme-dogeshit-mcp-11iafa)
commit: fa7584f001729be6889e02b3543d58a7513f6e42
code hash: 501deebd233f0b15e5dd8898973bb8408e70ad7b45dc79098deb73c4f94c86ee
verified: 6/12/2026, 10:26:20 AM
view raw JSON →