Rustchain
Sybil-resistant AI agent network with hardware-attested identity. Proof-of-Antiquity blockchain: physical machines across 15+ CPU architectures prove they are real silicon, not VM farms. Agent economy, micropayments, Solana bridge (wRTC). $0 VC.
Warning. Serious findings were identified. Review the full report before connecting. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
Scottcjn
Source: github_code
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
BASESCAN_API_KEYBASE_RPC_URLBASE_SEPOLIA_RPC_URLCOINMARKETCAP_API_KEYDISCORD_TOKENETHERSCAN_API_KEYEXPO_PUBLIC_NETWORKEXPO_PUBLIC_RUSTCHAIN_NODE_URLJEST_WORKER_IDKEYPAIR_PATHMINT_KEYPAIR_PATHPRIVATE_KEYREPORT_GASSOLANA_NETWORKWALLET_PUBLIC_KEYWALLET_SECRET_KEYRC_ADMIN_KEYDISCORD_WEBHOOK_URLTELEGRAM_BOT_TOKENTELEGRAM_CHAT_IDRENT_A_RELIC_BASE_URLRUSTCHAIN_API_BASERUSTCHAIN_NODE_URLBEACON_URLBOTTUBE_API_BASEBOTTUBE_API_KEYRUSTCHAIN_EXPLORER_DEBUGRUSTCHAIN_API_TIMEOUTRUSTCHAIN_NODEWEBHOOK_POLL_INTERVALLARGE_TX_THRESHOLDWEBHOOK_DBRUSTCHAIN_ADMIN_KEYRUSTCHAIN_BALANCES_PATHWEBHOOK_ADMIN_API_KEYBADGE_SECRET_KEYBCOS_BASE_REFGITHUB_BASE_REFNO_COLORTERMRUSTCHAIN_CHAIN_IDRUSTCHAIN_VERIFY_SSLRUSTCHAIN_DB_PATHDB_PATHFAUCET_DB_PATHFAUCET_ADMIN_TRANSFER_URLFAUCET_ADMIN_API_TOKENFAUCET_POOL_WALLETGITHUB_TOKENFAUCET_DRY_RUNFAUCET_TRUST_PROXYERGO_NODE_URLGEMINI_API_KEYGITHUB_OWNERGITHUB_REPOGITHUB_TARGET_USERRUSTCHAIN_ENABLEDDRY_RUNLOG_LEVELRUSTCHAIN_WALLETRUSTCHAIN_MINER_IDRUSTCHAIN_APIPOLL_INTERVALOFFLINE_THRESHOLDLARGE_TRANSFER_THRESHOLDTWILIO_ACCOUNT_SIDTWILIO_AUTH_TOKENTWILIO_FROM_NUMBERALERT_DB_PATHP2P_NODE_URLEXPORTER_PORTSCRAPE_INTERVALREQUEST_TIMEOUTSYNC_COMMITTEE_DBRUSTCHAIN_API_URLRATE_LIMIT_PER_MINUTERTC_PRICE_USDRATE_LIMIT_SECONDSPRICE_ALERT_INTERVALMINER_ALERT_INTERVALPRICE_CHANGE_THRESHOLDPRICE_CHANNEL_IDEXPLORER_PORTAPI_TIMEOUTSECRET_KEYWS_POLL_INTERVALWS_EXPLORER_PORTPASSPORT_DATA_DIRSTATUS_DATA_DIRRELATIONSHIPS_ADMIN_KEYBCOS_DIRECTORY_SECRET_KEYBCOS_DIRECTORY_DEBUGBCOS_DIRECTORY_HOSTBCOS_DIRECTORY_PORTCONTRIBUTOR_SECRET_KEYCONTRIBUTOR_REGISTRY_DEBUGCONTRIBUTOR_REGISTRATION_KEYCONTRIBUTOR_ADMIN_KEYPORTSMTP_HOSTSMTP_PORTSMTP_USERSMTP_PASSSMTP_FROMSMTP_USE_TLSTool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
28/28 tools missing one or more hints — get_miner_info (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_block_info (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_epoch_info (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +25 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Shell command execution
1 call in production code run through a shell (onboard/index.js:49)
Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.
Readable source code
1 file are minified or bundled, which is usually build output rather than concealment
Ship unminified, readable source.
Secrets not written to files
1 secret value written to files
Avoid persisting secrets to disk. Keep them in memory or your secret manager.
Secrets not logged
7 secret values sent to log
Redact or omit secret values from log output.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/scottcjn/rustchain)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check