Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
satstream
Source: mcp.so
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
address_getGet detailed information about a specific Bitcoin address, including transaction history and UTXO details. Use this when you need comprehensive data about an address.
block_getGet detailed information about a specific Bitcoin block by its hash or height. Use this to retrieve block header data, transaction IDs, and mining details.
blockchain_infoGet current blockchain information including chain height, latest block details, and network status. Use this for obtaining overall Bitcoin network statistics.
address_balance_getGet the total Bitcoin balance (in satoshis) of an address by summing all its deltas. Use this when you only need the balance information without the full address details.
address_deltas_getGet transaction deltas (inputs and outputs) for a specific Bitcoin address with pagination. Use this to analyze the transaction history of an address with filtering by block height.
transaction_getGet detailed information about a specific Bitcoin transaction by its transaction ID (txid). Use this to retrieve comprehensive data about inputs, outputs, fees, and confirmation status.
ordinals_inscription_getGet information about a specific Bitcoin Ordinals inscription by its ID. Use this to retrieve metadata about NFT-like inscriptions on Bitcoin, including content type and ownership details.
mempool_info_getGet current Bitcoin mempool statistics including size, transaction count, and fee estimates. Use this to understand the current state of unconfirmed transactions.
mempool_transactions_getList unconfirmed transactions in the Bitcoin mempool with pagination. Use this to monitor incoming transactions before they are included in a block.
address_validateValidate a Bitcoin address and retrieve information about its format, type, and validity. Use this to check if an address is valid before sending or receiving transactions.
address_outputs_getRetrieve UTXOs (unspent transaction outputs) held by a specific Bitcoin address with optional type filtering. Use this to get detailed information about available UTXOs for spending or analysis.
address_rune_deltas_getGet rune deltas (changes in rune balances) for a specific Bitcoin address with pagination. Use this to analyze the history of rune token transfers for an address.
rune_getRetrieve information about a specific Bitcoin Rune by name or ID (e.g., "UNCOMMON•GOODS" or "1:0"). Use this to get details about a specific rune token, including supply, minting status, and transactions.
runes_latest_getRetrieve information about the last 100 inscribed Bitcoin Runes (first page). Use this to get an overview of the most recently created rune tokens on the Bitcoin blockchain.
runes_page_getRetrieve a specific page of 100 inscribed Bitcoin Runes. Use this for paginated access to the complete list of rune tokens on the blockchain.
blocks_getGet information about the last 100 Bitcoin blocks. Use this for obtaining an overview of recent blockchain activity including block heights, hashes, and timestamps.
block_raw_hex_getGet the raw hexadecimal representation of a specific Bitcoin block by its hash or height. This provides the complete serialized block data in hexadecimal format.
block_raw_decoded_getGet the full decoded (verbose) representation of a specific Bitcoin block by its hash or height. This provides extensive details about the block structure and contained transactions.
inscriptions_latest_getGet the latest Bitcoin Ordinals inscriptions. Use this to retrieve recently created NFT-like inscriptions on the Bitcoin blockchain.
inscriptions_page_getGet a specific page of Bitcoin Ordinals inscriptions. Use this for paginated access to the complete list of inscriptions on the blockchain.
inscriptions_block_getGet all Bitcoin Ordinals inscriptions in a specific block. Use this to analyze the inscriptions created in a particular block height.
inscriptions_block_page_getGet a specific page of Bitcoin Ordinals inscriptions in a particular block. Use this for paginated access to the inscriptions created in a specific block height.
output_getGet detailed information about a specific Bitcoin UTXO (unspent transaction output) by its outpoint in the format 'txid:vout'. Use this to retrieve spend status, value, and script details of an output.
tx_inscriptions_getGet all Bitcoin Ordinals inscriptions contained in a specific transaction. Use this to analyze the inscriptions created or transferred in a particular transaction.
sat_getGet information about a specific satoshi by its absolute number (index). Use this to retrieve details about a particular satoshi, including its rarity, block of creation, and inscription status.
status_getGet the current status of the Satstream API server, including uptime, version information, and performance metrics. Use this to check if the API is functioning properly.
block_count_getGet the current block height of the Bitcoin blockchain. This returns the height of the latest block that has been processed.
latest_blockhash_getGet the hash of the latest block in the Bitcoin blockchain. Use this to retrieve the most recent block hash.
blockhash_by_height_getGet the hash of a specific Bitcoin block by its height. Use this to convert a block height to its corresponding block hash.
latest_block_height_getGet the current height of the Bitcoin blockchain. This returns the height of the latest block that has been processed.
latest_blocktime_getGet the timestamp of the latest block in the Bitcoin blockchain. This returns the UNIX timestamp of when the latest block was mined.
block_raw_prevout_getGet the full decoded representation of a specific Bitcoin block with prevout information by its hash or height. This provides extensive details about the block including input and output data.
block_raw_summary_getGet a summary of a specific Bitcoin block by its hash or height. This provides a condensed view of block data without full transaction details.
inscription_child_getGet information about a specific child of a Bitcoin Ordinals inscription. Use this to retrieve metadata about nested or child inscriptions.
tx_raw_decode_getGet a raw Bitcoin transaction with basic decoded information by its transaction ID. This provides the transaction structure and decoded script data.
tx_raw_hex_getGet the raw hexadecimal representation of a Bitcoin transaction by its transaction ID. This provides the complete serialized transaction data in hexadecimal format.
tx_raw_prevout_getGet a raw Bitcoin transaction with prevout information by its transaction ID. This provides the transaction with details about the previous outputs being spent.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
When Vitest UI server is listening, arbitrary file can be read and executed
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
SATSTREAM_API_KEYTool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
37/37 tools missing one or more hints — address_get (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); block_get (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); blockchain_info (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +34 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tests exist
No test files found
Add tests that exercise each declared tool.
Production dependencies are patched
0 critical, 15 high severity in production deps — @modelcontextprotocol/sdk@1.10.1 (high), @modelcontextprotocol/sdk@1.10.1 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dev dependencies
1 critical/high in dev-only deps (does not ship to users)
Upgrade dev dependencies when convenient.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/satstream/ss-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check