universal-blockchain-mcp (ExpertVagabond/universal-blockchain-mcp) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 56 tools. No publisher has claimed this listing.

Warning

74/100

universal-blockchain-mcp

Item: universal-blockchain-mcp
Rating: 74
Author: M8ven

Model Context Protocol server for ZetaChain CLI - enables AI assistants to interact with ZetaChain blockchain development tools

→ ExpertVagabond/universal-blockchain-mcp · listed on github_repo_search

Warning. Serious findings were identified. Review the full report before connecting. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

ExpertVagabond

Source: github_repo_search

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

GitHub

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

🚨

Code appears obfuscated

2 files are unreadable to a human reviewer. Cannot audit what they do.

// tools this server exposes56 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

create_account

Create a new ZetaChain account with mnemonic phrase

import_account

Import existing account using private key or mnemonic

list_accounts

List all available ZetaChain accounts

show_account

Show details of a specific account

get_balances

Fetch native and ZETA token balances for an address

query_cctx

Query cross-chain transaction data in real-time

get_fees

Fetch omnichain and cross-chain messaging fees

call_contract

Call a contract on a connected chain from ZetaChain

withdraw_tokens

Withdraw tokens from ZetaChain to a connected chain

withdraw_and_call

Withdraw tokens from ZetaChain and call a contract on connected chain

list_tokens

List ZRC-20 tokens

list_chains

List all supported chains

request_faucet

Request testnet ZETA tokens from the faucet

create_project

Create a new universal contract project

get_network_info

Get live status and configuration for any supported network (chain ID, RPC, latest block, native currency, explorer)

check_foundry

Check if Foundry (forge, cast, anvil) is properly installed and working

forge_build

Compile smart contracts using Foundry Forge

forge_test

Run smart contract tests using Foundry Forge

forge_create

Deploy smart contracts using Foundry Forge

forge_verify

Verify smart contracts on block explorers

cast_call

Make a read-only call to a smart contract

cast_send

Send a transaction to a smart contract

cast_balance

Get ETH balance of an address

cast_nonce

Get transaction nonce for an address

cast_gas_price

Get current gas price

cast_block

Get block information

cast_tx

Get transaction information

anvil_start

Start a local Ethereum node using Anvil

anvil_snapshot

Create a snapshot of the current blockchain state

anvil_revert

Revert to a previous snapshot

zeta_validator_create

Create a ZetaChain validator

zeta_governance_vote

Vote on ZetaChain governance proposals

zeta_governance_proposals

List active governance proposals

zeta_staking_delegate

Delegate ZETA tokens to a validator

zeta_staking_rewards

Query staking rewards for a delegator

cross_chain_send

Send tokens across chains using ZetaChain

cross_chain_status

Check status of cross-chain transaction

contract_compile

Compile Solidity smart contracts

contract_deploy

Deploy compiled smart contracts

contract_interact

Interact with deployed smart contracts

defi_swap

Perform token swaps on DEX platforms

defi_liquidity_add

Add liquidity to DEX pools

defi_yield_farm

Stake tokens in yield farming protocols

nft_mint

Mint NFTs

nft_transfer

Transfer NFTs

nft_metadata

Get NFT metadata

block_explorer

Search and analyze blockchain data

gas_tracker

Track and analyze gas prices across chains

portfolio_tracker

Track portfolio value across multiple chains

security_audit

Perform basic security audit on smart contracts

wallet_export

Export wallet private key or mnemonic

wallet_backup

Create encrypted backup of wallet

transaction_history

Get transaction history for an address

gas_optimizer

Optimize gas usage for smart contract transactions

multisig_create

Create a multisig wallet

bridge_status

Check status of cross-chain bridge operations

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configRPC_URL

configZETACHAIN_CLI_PATH

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

56/56 tools missing one or more hints — create_account (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); import_account (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); list_accounts (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +53 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool test coverage

Only 6/56 tools referenced in tests (11%)

Write tests that reference each tool by name so every tool has at least one test.

Shell command execution

11 calls in production code run through a shell (src/index.ts:101, src/index.ts:106, src/index.ts:226)

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

Readable source code

2 files are minified or bundled, which is usually build output rather than concealment

Ship unminified, readable source.

No arbitrary install scripts

Has postinstall/preinstall script — runs arbitrary code on npm install

Remove postinstall/preinstall hooks unless they’re essential.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/expertvagabond/universal-blockchain-mcp?variant=verified)](https://m8ven.ai/mcp/expertvagabond/universal-blockchain-mcp)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: b2c2e6ba17e59b15fd09e52ebda7c1c4baa698c8

code hash: 15c881c1255e7a3ce9807f0a9bbdd516231599f4b681b3c71db310c009e60332

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client