Back to MCP Trust Indexm8ven
72
/ 100
17 days ago
glama

recon-crypto-mcp

Self-custodial crypto portfolio and DeFi MCP server. Read balances and positions (Aave, Compound, Morpho, Uniswap V3, Lido, EigenLayer) across Ethereum, Arbitrum, Polygon, and Base, and prepare transactions for approval on a Ledger via WalletConnect.

→ szhygulin/vaultpilot-mcp· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 2 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 5 credentials: ETHERSCAN_API_KEY, ONEINCH_API_KEY, RESERVOIR_API_KEY, RPC_API_KEY, TRON_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies2 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.0.4GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.0.4GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configARBITRUM_RPC_URL— ETHEREUM_RPC_URL, , POLYGON_RPC_URL, BASE_RPC_URL, SOLANA_RPC_URL — custom RPC endpoints
configBITCOIN_INDEXER_PARALLELISM
configBITCOIN_INDEXER_URL
configBITCOIN_RPC_URL
configETHEREUM_RPC_URL— , ARBITRUM_RPC_URL, POLYGON_RPC_URL, BASE_RPC_URL, SOLANA_RPC_URL — custom RPC endpoints
🔐 secretETHERSCAN_API_KEY— , ONEINCH_API_KEY, TRON_API_KEY, WALLETCONNECT_PROJECT_ID
configLITECOIN_INDEXER_PARALLELISM
configLITECOIN_INDEXER_URL
configLITECOIN_RPC_URL
configMORPHO_DISCOVERY_CHUNK
🔐 secretONEINCH_API_KEY— ETHERSCAN_API_KEY, , TRON_API_KEY, WALLETCONNECT_PROJECT_ID
configRECON_ALLOW_INSECURE_RPC
configRECON_FEEDBACK_ENDPOINT
configRECON_FEEDBACK_STATE_FILE
🔐 secretRESERVOIR_API_KEY
🔐 secretRPC_API_KEY— RPC_PROVIDER (infura alchemy) + — alternative to custom URLs
configRPC_BATCH— 1 — opt into JSON-RPC batching (off by default; many public endpoints mishandle batched POSTs)
configRPC_PROVIDER— (infura alchemy) + RPC_API_KEY — alternative to custom URLs
configSOLANA_INCIDENT_FEED_URL
configSOLANA_RPC_URL— ETHEREUM_RPC_URL, ARBITRUM_RPC_URL, POLYGON_RPC_URL, BASE_RPC_URL, — custom RPC endpoints
🔐 secretTRON_API_KEY— ETHERSCAN_API_KEY, ONEINCH_API_KEY, , WALLETCONNECT_PROJECT_ID
configTRON_RPC_URL_SECONDARY
configVAULTPILOT_ALLOW_INSECURE_RPC— 1 — opt out of https/private-IP RPC checks (local anvil/hardhat only)
configVAULTPILOT_CHAIN_FAMILIES
configVAULTPILOT_COMPOUND_FULL_READ
configVAULTPILOT_CONFIG_DIR
configVAULTPILOT_DEMO— claude mcp add vaultpilot-mcp --env =true -- npx -y vaultpilot-mcp
configVAULTPILOT_FEEDBACK_ENDPOINT— optional https proxy for request_capability direct POSTs. The client does not authenticate; the proxy MUST.
configVAULTPILOT_FEEDBACK_STATE_FILE
configVAULTPILOT_MORPHO_DISCOVERY
configVAULTPILOT_ORACLE_HISTORY_PATH
configVAULTPILOT_PROTOCOLS
configVAULTPILOT_RPC_CONCURRENCY
configVAULTPILOT_SKILL_MARKER_PATH— suppress the preflight-skill notice (read-only users opting in)
configVITEST
configWALLETCONNECT_PROJECT_ID— ETHERSCAN_API_KEY, ONEINCH_API_KEY, TRON_API_KEY,
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 1 concrete improvement we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/szhygulin-vaultpilot-mcp-m4krfr)](https://m8ven.ai/mcp/szhygulin-vaultpilot-mcp-m4krfr)
commit: b42bc895655bf3f2995243037f413e345d890f38
code hash: 0313656147d2e3f623ad246a95b014651e34b8b3288b8740e3f7fbae44209fd3
verified: 6/17/2026, 12:01:29 PM
view raw JSON →