74
/ 100
1 month ago
glama

Flashbank

P2P Crypto and Flashloans. Lets AI agents browse, quote and (optionally) transact with the FlashBank contracts — the P2P term-loan escrow and the flash-loan router — on Ethereum, Base, Arbitrum and the Sepolia playground.

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 12 credentials: ANKR_API_KEY, ARBITRUM_LIQUIDITY_TOKEN, BASESCAN_API_KEY, BASE_LIQUIDITY_TOKEN, COINMARKETCAP_API_KEY, ETHERSCAN_API_KEY, FLASHBANK_LIQUIDITY_TOKEN, FLASHBANK_MCP_PRIVATE_KEY, MAINNET_LIQUIDITY_TOKEN, PRIVATE_KEY, SEPOLIA_LIQUIDITY_TOKEN, TESTNET_ADMIN_PRIVATE_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies2 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

low@openzeppelin/contracts@4.9.3GHSA-9vx6-7xxf-x967

OpenZeppelin Contracts base64 encoding may read from potentially dirty memory

low@openzeppelin/contracts-upgradeable@4.9.3GHSA-9vx6-7xxf-x967

OpenZeppelin Contracts base64 encoding may read from potentially dirty memory

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configACTION
configADMIN_ADDRESS(set / TESTNET_ADMIN_ADDRESS in the repository-root .env). Per-network addresses are read
configAMOUNT
🔐 secretANKR_API_KEY
configARBITRUM_HTTP_URL
🔐 secretARBITRUM_LIQUIDITY_TOKEN
configARBITRUM_ROUTER_ADDRESS
🔐 secretBASESCAN_API_KEY
configBASE_HTTP_URL
🔐 secretBASE_LIQUIDITY_TOKEN
configBASE_ROUTER_ADDRESS
🔐 secretCOINMARKETCAP_API_KEY
configDEMO_COUNTER_ADDRESS
configDEPLOYER_ADDRESS
configENABLED
configETHEREUM_HTTP_URL
🔐 secretETHERSCAN_API_KEY
configFEE_BPS
configFLASHBANK_FEE_BPS
🔐 secretFLASHBANK_LIQUIDITY_TOKEN
configFLASHBANK_MAX_BORROW_BPS
configFLASHBANK_MAX_LOAN
🔐 secretFLASHBANK_MCP_PRIVATE_KEYno configuration; mainnet writes are double-gated behind and
configFLASHBANK_MCP_RPC_BASE
configFLASHBANK_OWNER_FEE_BPS
configFLASHBANK_ROUTER_ADDRESS
configFLASHBANK_SUPPORTS_PERMIT
configL2_FLASH_POOL_ADDRESS
🔐 secretMAINNET_LIQUIDITY_TOKEN
configMAINNET_ROUTER_ADDRESS
configMAX_BORROW_BPS
configMAX_FEE_GWEIwith pinned low.) Per-chain records in loans/deployments/-p2p.json.
configMEV_RECEIVER_ADDRESS
configNEW_ADMIN
configNEW_OWNER
configNEXT_PUBLIC_ARBITRUM_DEMO_BORROWER_ADDRESS
configNEXT_PUBLIC_ARBITRUM_DEMO_COUNTER_ADDRESS
configNEXT_PUBLIC_ARBITRUM_P2P_LOAN_ADDRESS
configNEXT_PUBLIC_ARBITRUM_PROOF_SINK_ADDRESS
configNEXT_PUBLIC_ARBITRUM_ROUTER_ADDRESS
configNEXT_PUBLIC_ARBITRUM_RPC_URL
configNEXT_PUBLIC_ARBITRUM_WETH_ADDRESS
configNEXT_PUBLIC_BASE_DEMO_BORROWER_ADDRESS
configNEXT_PUBLIC_BASE_DEMO_COUNTER_ADDRESS
configNEXT_PUBLIC_BASE_P2P_LOAN_ADDRESS
configNEXT_PUBLIC_BASE_PROOF_SINK_ADDRESS
configNEXT_PUBLIC_BASE_ROUTER_ADDRESS
configNEXT_PUBLIC_BASE_RPC_URL
configNEXT_PUBLIC_BASE_WETH_ADDRESS
configNEXT_PUBLIC_MAINNET_DEMO_BORROWER_ADDRESS
configNEXT_PUBLIC_MAINNET_DEMO_COUNTER_ADDRESS
configNEXT_PUBLIC_MAINNET_P2P_LOAN_ADDRESS
configNEXT_PUBLIC_MAINNET_PROOF_SINK_ADDRESS
configNEXT_PUBLIC_MAINNET_ROUTER_ADDRESS
configNEXT_PUBLIC_MAINNET_RPC_URL
configNEXT_PUBLIC_MAINNET_WETH_ADDRESS
configNEXT_PUBLIC_SEPOLIA_DEMO_BORROWER_ADDRESS
configNEXT_PUBLIC_SEPOLIA_DEMO_COUNTER_ADDRESS
configNEXT_PUBLIC_SEPOLIA_FPETH_ADDRESS
configNEXT_PUBLIC_SEPOLIA_FPUSD_ADDRESS
configNEXT_PUBLIC_SEPOLIA_P2P_LOAN_ADDRESS
configNEXT_PUBLIC_SEPOLIA_PROOF_SINK_ADDRESS
configNEXT_PUBLIC_SEPOLIA_ROUTER_ADDRESS
configNEXT_PUBLIC_SEPOLIA_RPC_URL
configNEXT_PUBLIC_SEPOLIA_WETH_ADDRESS
configNEXT_PUBLIC_WALLET_CONNECT_PROJECT_ID
configOWNER_FEE_BPS
configP2P_PROTOCOL_FEE_BPS
configP2P_PROTOCOL_FEE_RECIPIENT
configPRIORITY_FEE_GWEI
🔐 secretPRIVATE_KEY
configPROOF_SINK_ADDRESS
configRECIPIENT
configREDEPLOY_TOKENS
configREPORT_GAS
configROUTER_ADDRESS
configSEPOLIA_HTTP_URL
🔐 secretSEPOLIA_LIQUIDITY_TOKEN
configSEPOLIA_ROUTER_ADDRESS
configTESTNET_ADMIN_ADDRESS(set ADMIN_ADDRESS / in the repository-root .env). Per-network addresses are read
🔐 secretTESTNET_ADMIN_PRIVATE_KEY
configTEST_PRIVATE_KEY_1
configTEST_PRIVATE_KEY_2
configTEST_PRIVATE_KEY_3
configTEST_PRIVATE_KEY_4
configTOKEN_ADDRESS
configV3_DEMO_COUNTER
configV3_PROOF_SINK
configV3_ROUTER_ADDRESS
configV3_TEST_LOAN
configV3_WETH_ADDRESS
configWATCH_INTERVAL_SEC
configWATCH_MAX_BASE_GWEI
configWATCH_MAX_HOURS
configWATCH_MIN_BALANCE_ETH
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/rotwang9000-flashbank-net-1eerms)](https://m8ven.ai/mcp/rotwang9000-flashbank-net-1eerms)
commit: bc359b9040b4dc2841a2b83b393393fd7a2b2592
code hash: 21551df0bf2672df9dfdb7cefcdc63324e3b178bc7b633142fb13d1cb6134c16
verified: 6/11/2026, 10:54:51 AM
view raw JSON →