DUAL MCP Server (ro-ro-b/dual-mcp-server) is an MCP server listed on the M8ven Trust Index. It scores 50 out of 100, grade D. It declares 115 tools. No publisher has claimed this listing.

D
Caution
50/100

DUAL MCP Server

Enables AI agents to interact directly with the DUAL Web3 Operating System for minting tokens, managing templates, and executing blockchain actions. It provides over 60 tools for handling wallets, organizations, and ZK-rollup infrastructure natively via the Model Context Protocol.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

ro-ro-b

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 14 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
115 tools verified — handlers match their declared behaviour
60 read-only tools verified — handlers contain no write/delete/exec
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
🔐
You'll be asked for 4 credentials: DUAL_ACCESS_TOKEN, DUAL_API_KEY, DUAL_REFRESH_TOKEN, MCP_SERVER_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes115 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

dual_execute_action

Execute an action on a tokenized object via the Event Bus. Actions are the primary way to change object state. Examples: mint tokens, transfer ownership, redeem rewards, update status. The action_type must match a registered action type, and the object must belong to a template that allows it.

dual_batch_actions

Execute multiple actions atomically in a single batch. All actions succeed or all fail. Useful for complex operations like: mint + transfer + configure in one transaction.

dual_list_actions

List executed actions. Filter by action ID or template.

dual_get_action

Get full details of a specific executed action.

dual_list_action_types

List all registered action types. Action types define what operations can be performed on objects.

dual_create_action_type

Register a new action type with an optional JSON schema for payload validation.

dual_update_action_type

Update an action type's name, description, or payload schema.

dual_list_api_keys

List all API keys for the authenticated wallet.

dual_create_api_key

Create a new API key for server-to-server integration. The key value is only shown once — save it immediately.

dual_delete_api_key

Permanently revoke and delete an API key.

dual_creative_design_generate

Generate a complete token template design from a natural language description.

dual_creative_design_list

List all generated token designs with optional use case filter.

dual_creative_design_get

Get a specific token design by ID with full template specification.

dual_creative_design_refine

Refine an existing token design — add/remove fields, adjust properties.

dual_creative_design_delete

Delete a token design by ID.

dual_creative_face_create

Create a face template with SVG base and data bindings for dynamic token rendering.

dual_creative_face_list

List all face templates.

dual_creative_face_render

Render a face template with token data, producing HTML output.

dual_list_faces

List face definitions. Faces are visual representations (images, 3D models, web views) attached to templates.

dual_create_face

Create a visual face for a template. Types: image, image_progress, image_policy, image_layered, 3d, web.

dual_get_face

Get details of a specific face.

dual_update_face

Update a face's display URL or type.

dual_delete_face

Delete a face definition.

dual_get_template_faces

Get all faces associated with a specific template.

dual_compliance_evaluate

Evaluate a token action against all enabled compliance rules. Returns pass/fail with violation details.

dual_compliance_rule_create

Create a new compliance rule (AML threshold, transfer limit, restricted wallet, or geographic).

dual_compliance_rule_list

List all compliance rules with optional filters.

dual_compliance_rule_update

Update a compliance rule by ID.

dual_compliance_rule_delete

Delete a compliance rule by ID.

dual_compliance_audit

Retrieve compliance audit log entries.

dual_compliance_stats

Get compliance statistics: evaluations, pass rate, violations by type.

dual_policy_parse

Parse a natural language policy description into structured compliance rules.

dual_policy_get

Get a parsed policy document by ID.

dual_policy_validate

Validate a parsed policy for internal consistency.

dual_provenance_create

Record the provenance of AI-generated content with SHA-256 hashing.

dual_provenance_get

Retrieve a provenance record by ID.

dual_provenance_verify

Verify AI-generated content by re-hashing and comparing to the stored provenance record.

dual_provenance_badge

Generate a verification badge (certificate, seal, or QR) for a provenance record.

dual_ai_agent_create

Create a new autonomous agent with condition/action rules for the DUAL Intelligence Service.

dual_ai_agent_list

List all autonomous agents in the DUAL Intelligence Service.

dual_ai_agent_get

Get details of a specific autonomous agent by ID.

dual_ai_agent_execute

Execute an agent, evaluating its rules against the provided context. Supports dry-run mode.

dual_ai_history_ingest

Bulk ingest action history records for lifecycle prediction analysis.

dual_ai_predict

Get transfer likelihood, abandonment risk, and spike probability predictions for a specific object.

dual_ai_trending

List objects ranked by recent activity score.

dual_ai_anomalies

Detect anomalous activity patterns across all tracked objects.

dual_ai_graph_ingest

Ingest template or token metadata into the knowledge graph.

dual_ai_graph_similar

Find nodes similar to a given node using metadata overlap, Jaccard, or cosine similarity.

dual_ai_graph_connected

Find all nodes connected to a given node within N hops using BFS.

dual_ai_graph_analytics

Get ecosystem-wide analytics: topology, concentration, velocity, top hubs.

dual_list_messages

List notification messages sent through the platform.

dual_send_notification

Send a notification message to one or more wallets using a message template.

dual_list_message_templates

List all notification message templates.

dual_create_message_template

Create a notification template with subject, body (with placeholders), and delivery channels.

dual_delete_message_template

Delete a message template.

dual_list_objects

List tokenized objects (asset instances). Objects are created from templates and owned by wallets. Filter by template, owner, FQDN, or geographic hash. Supports pagination.

dual_get_object

Get full details of a tokenized object — its properties, ownership, faces, actions, and metadata.

dual_update_object

Update the properties of a tokenized object. Only mutable properties can be changed.

dual_get_object_children

Get child objects in a hierarchical object tree.

dual_get_object_parents

Get parent objects in a hierarchical object tree.

dual_get_object_activity

Get the full activity/audit log for an object — all state changes, transfers, and action executions.

dual_search_objects

Search tokenized objects with filter criteria. Supports complex queries across all object properties. Example filters: { "template_id": "abc123", "properties.status": "active" }

dual_count_objects

Count objects matching filter criteria without returning the full objects.

dual_list_organizations

List all organizations the authenticated wallet belongs to. Supports pagination and role filtering.

dual_create_organization

Create a new organization (multi-tenant workspace). Returns the org with its ID and FQDN.

dual_get_organization

Get organization details including members, roles, and account info.

dual_update_organization

Update an organization's name, description, or image.

dual_get_org_balance

Get the current balance and currency for an organization.

dual_list_org_members

List all members of an organization with their roles.

dual_add_org_member

Add a wallet as a member to an organization with a specific role.

dual_remove_org_member

Remove a member from an organization.

dual_list_org_roles

List all roles defined for an organization.

dual_create_org_role

Create a new role with specific permissions for an organization.

dual_get_payment_config

Get the platform's payment configuration — deposit addresses, supported tokens, and fee structure.

dual_list_deposits

List deposit transactions. Filter by transaction hash, token, or token address.

dual_public_list_templates

List publicly accessible templates. No authentication required.

dual_public_get_template

Get a public template's details. No authentication required.

dual_public_get_object

Get a public object's details. No authentication required.

dual_public_search_objects

Search publicly accessible objects. No authentication required.

dual_public_get_stats

Get public platform statistics — total objects, templates, and wallets. No authentication required.

dual_list_batches

List sequencer batches. Batches group multiple transactions for efficient on-chain anchoring via ZK-rollup.

dual_get_batch

Get details of a sequencer batch including all contained transactions.

dual_list_checkpoints

List ZK-rollup checkpoints. Each checkpoint contains a state root and proof that anchors batches to L1.

dual_get_checkpoint

Get a specific ZK-rollup checkpoint with its proof data and state roots.

dual_upload_file

Upload a file to DUAL storage. Returns a public URL. Useful for template assets, face images, and attachments.

dual_get_file

Get a file's URL or content by its storage ID.

dual_delete_file

Delete a file from DUAL storage.

dual_get_template_assets

List all storage assets associated with a template.

dual_request_access

Request access to a gated platform feature.

dual_list_support_messages

List support messages.

dual_send_support_message

Send a support message to the DUAL team.

dual_list_templates

List token templates. Templates define the structure, properties, and actions of tokenized objects. Filter by prefix or FQDN.

dual_create_template

Create a new token template that defines the structure of tokenized objects. Specify the property schema, allowed actions, and access rules. Example: Create a "Reward Token" template with properties like points, expiry_date, and redeemable status.

dual_get_template

Get full details of a template including its property schema, actions, and factory config.

dual_update_template

Update a template's name, property schema, or access rules.

dual_delete_template

Permanently delete a template. This cannot be undone.

dual_list_template_variations

List all variations of a template. Variations are alternative configurations of the same template.

dual_create_template_variation

Create a variation of an existing template with overridden properties.

dual_login

Authenticate with email/phone and password. Returns JWT tokens for subsequent API calls. Sets auth automatically for this session.

dual_login_guest

Create a guest session with limited permissions. No credentials required.

15 further tools are not listed here. The complete surface is in the source.

// known CVEs in dependencies14 high12 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highaxios@1.7.9GHSA-35jp-ww65-95wh

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

highaxios@1.7.9GHSA-3g43-6gmg-66jw

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

highaxios@1.7.9GHSA-43fc-jf86-j433

Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

highaxios@1.7.9GHSA-4hjh-wcwx-xvwj

Axios is vulnerable to DoS attack through lack of data size check

highaxios@1.7.9GHSA-6chq-wfr3-2hj9

Axios: Header Injection via Prototype Pollution

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configCORS_ORIGINComma-separated allowed origins (e.g. https://app.example.com) No
configCREATIVE_URL
🔐 secretDUAL_ACCESS_TOKENexport =your-jwt-token
🔐 secretDUAL_API_KEYexport =your-api-key
configDUAL_API_URLAPI base URL (default: https://api.blockv-labs.io/v3) No
🔐 secretDUAL_REFRESH_TOKENJWT refresh token No
configGOVERNANCE_URL
configHOSTHTTP bind address (default: 127.0.0.1) No
configINTELLIGENCE_URL
🔐 secretMCP_SERVER_API_KEYis REQUIRED for HTTP mode
configRATE_LIMIT_MAXMax requests per minute per IP (default: 100) No
configTRANSPORTMCP_SERVER_API_KEY=your-secret =http PORT=3100 node dist/index.js
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deployPORT
// quality suggestions

Tool inputs are validated

72/115 tool handlers declare input schemas (63%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool handlers catch errors

114/115 tool handlers wrap calls in try/catch (99%)

Wrap each tool handler body in try/catch and return a structured error response.

License file

No license file

Add a LICENSE file (MIT, Apache-2.0, etc.).

Tests exist

No test files found

Add tests that exercise each declared tool.

Secrets not logged

2 secret values sent to console.log

Redact or omit secret values from log output.

Production dependencies are patched

0 critical, 14 high severity in production deps — axios@1.7.9 (high), axios@1.7.9 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/ro-ro-b/dual-mcp-server?variant=verified)](https://m8ven.ai/mcp/ro-ro-b/dual-mcp-server)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 4a398508a2f3afea8fc0099f5d1e57ee44896458
code hash: c2d32fc039f9b53797cd3b9905cba3dca529264dc292cb0df3f9d2f58b0127ea
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client