Back to MCP Trust Indexm8ven
D
Warning
45/100
4 days ago

xrpldashboard MCP

Read-only XRP Ledger analytics — signed snapshots, AMM pools, token volume, whale activity, NFT tracking. Proof-annotated. Public beta 2026-09.

→ Enkryptedx/xrpldashboard· listed on glama

Warning. Serious findings were identified. Review the full report before connecting. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

Enkryptedx

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Secret credentials may flow to a network call
2 flows detected: L1_TELEGRAM_BOT_TOKEN, L2_TELEGRAM_BOT_TOKEN. We can’t prove the destination matches the brand the credential belongs to.
🚨
Reads files from sensitive locations
Touches: ~/.config/xrpldashboard/env, ~/.config/xrpldashboard/env
🔐
You'll be asked for 5 credentials: FLASK_SECRET_KEY, INTERNAL_ADMIN_PASS, L1_TELEGRAM_BOT_TOKEN, L2_TELEGRAM_BOT_TOKEN, ETHERSCAN_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configBETTERSTACK_MCP_SERVER_HEARTBEAT_URL
configXRPL_LOCAL_NODE
configMCP_SESSION_MAX_CALLS
configMCP_SESSION_WINDOW_SECONDS
configMCP_HTTP_HOST
configFASTMCP_HOST
configMCP_HTTP_PORT
configFASTMCP_PORT
configMCP_ALLOWED_HOSTS
configMCP_ALLOWED_ORIGINS
configMCP_TRANSPORT
configSITE_URL
🔐 secretFLASK_SECRET_KEYcp .env.example .env # then fill in DATABASE_URL, , etc.
configANALYTICS_EXCLUDE_IPS
configMIRROR_DEGRADED_AGE_SEC
configMPT_ALLOW_LIVE_FETCH
configINTERNAL_ADMIN_USER
🔐 secretINTERNAL_ADMIN_PASS
configFLASK_DEBUG
configMCP_SESSION_LIMIT_UA_ALLOWLIST
🔐 secretL1_TELEGRAM_BOT_TOKEN
configL1_TELEGRAM_CHAT_ID
configL1_STATE_PATH
🔐 secretL2_TELEGRAM_BOT_TOKEN
configL2_TELEGRAM_CHAT_ID
configL2_STATE_PATH
configL2_SITE_URL
configAGENT_TIER_AI_RATE
configAGENT_TIER_ANON_RATE
configXRPL_NODE
configAMENDMENTS_CACHE_TTL
configSCAN_CACHE_TTL_SECONDS
configAMM_TVL_TOP_N
configCOLD_CACHE_TTL
configXRPL_CLIO_NODE
configCREDENTIALS_CUM_BUDGET
configCREDENTIALS_RECENT_BUDGET
configETH_RPC
configDATABASE_URL_DIRECT
configXRPL_RPC
configESCROW_SNAPSHOT_CACHE_TTL
configESCROW_CACHE_TTL
configLENDING_CACHE_TTL
configLENDING_SNAPSHOT_MAX_AGE
configLENDING_DATA_CACHE_TTL
configLENDING_ENRICH_TOP_N
configMPT_DATA_CACHE_TTL
configMPT_WALK_RETRY_BUDGET_SECS
configMPT_SNAPSHOT_MAX_AGE
configMPT_HOLDER_PAGE_CAP
configMPT_HOLDER_PAGE_LIMIT
configMPT_HOLDER_TOP_N
configMPT_HOLDER_RPC_PAUSE
configPULSE_CACHE_TTL_SECONDS
configNETWORK_CACHE_TTL
configORACLE_SNAPSHOT_CACHE_TTL
configPERMISSIONED_DOMAINS_BUDGET
configPRICE_TTL_SECONDS
configPRICE_AMM_TIMEOUT_SECONDS
configPRICE_NEGATIVE_TTL_SECONDS
configMIRROR_FAILURE_THRESHOLD
🔐 secretETHERSCAN_API_KEY
configRLUSD_REFRESH_INTERVAL_SECONDS
configXRPL_OPTION_A_RPC
configSIGNING_KEY_PASSPHRASE
configTOKEN_CACHE_TTL
configMIN_POOL_XRP_RESERVE
configTOTAL_SUPPLY_CACHE_TTL
configWALLET_CACHE_TTL
configPOOL_METRICS_TTL
configWALLET_CACHE_TTL_SECONDS
configPRICE_CACHE_TTL_SECONDS
configXRPL_PUBLIC_PRIMARY
configXRPL_PUBLIC_SECONDARY
configXRPL_LOCAL_WS_NODE
configWHALE_XRP_THRESHOLD_XRP
configBETTERSTACK_IS_BOT_CANARY_URL
configNEON_DATABASE_URL
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deploySMTP_HOST
deploySMTP_PORT
deploySMTP_USER
deploySMTP_PASS
deploySMTP_FROM
deploySMTP_TO
deployPORT
deployDATABASE_URL
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

15/15 tools missing one or more hints — get_ledger_stats (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_amendment_status (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_unl_status (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +12 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

No access to sensitive paths

Reads sensitive paths: ~/.config/xrpldashboard/env, ~/.config/xrpldashboard/env

Remove reads of sensitive system paths. If you genuinely need them, document why in the README.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/enkryptedx-xrpldashboard-v0gw89?variant=verified)](https://m8ven.ai/mcp/enkryptedx-xrpldashboard-v0gw89)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 06933042e07d17a428b7527035a80a3767d904c1
code hash: d394183b88605f50b328f2de255bd3a18f367f3204bd7499020d573649d42c8a
verified: 8/15/2026, 9:30:45 AM
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client