← Back to search

ergo-agent-mcp

GitHub Actions Scanned 7d ago

MCP server exposing Ergo blockchain payment tools to AI agents

npm
C
72.2 / 100

Versions

0.3.2latest
May 24, 2026
0.3.1
May 15, 2026
0.3.0
May 14, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 1

summarise
annotations: none low

Pay 0.001 ERG to receive a one-line summary of `text`. Reject test: provide a Note

Permissions 4

network medium
Server uses network capabilities via: fetch(), http, requests, urllib
filesystem low
Server uses filesystem capabilities via: fs, fs sync ops, open(), os, path, pathlib
shell high
Server uses shell capabilities via: child_process, spawn(), spawnSync()
env_vars low
Server uses env_vars capabilities via: os.environ, os.getenv(), process.env

Scan Findings 49

medium
Excessive dependency count: 79 direct dependencies dependency_analyzer · 90%
medium
Vulnerable dependency: tsup@8.0.0 (GHSA-3mv9-4h5g-vhg3) dependency_analyzer · 95%
medium
Vulnerable dependency: ajv@8.12.0 (GHSA-2g4f-4pwh-qvx6) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.0.0 (GHSA-w48q-cv73-mx4w) dependency_analyzer · 95%
medium
Vulnerable dependency: express@4.19.0 (GHSA-qw6h-vgh9-j6wx) dependency_analyzer · 95%
medium
Vulnerable dependency: express@4.19.0 (GHSA-rv95-896h-c2vc) dependency_analyzer · 95%
medium
Vulnerable dependency: express@4.18.0 (GHSA-qw6h-vgh9-j6wx) dependency_analyzer · 95%
medium
Vulnerable dependency: express@4.18.0 (GHSA-rv95-896h-c2vc) dependency_analyzer · 95%
medium
Vulnerable dependency: requests@2.31.0 (GHSA-9hjg-9r4m-mvj7) dependency_analyzer · 95%
medium
Vulnerable dependency: requests@2.31.0 (GHSA-9wx4-h78v-vm56) dependency_analyzer · 95%
medium
Vulnerable dependency: requests@2.31.0 (GHSA-gc5v-m9x4-r6x2) dependency_analyzer · 95%
medium
Vulnerable dependency: requests@2.31.0 (PYSEC-2026-1872) dependency_analyzer · 95%
medium
Vulnerable dependency: requests@2.31.0 (PYSEC-2026-1873) dependency_analyzer · 95%
medium
Vulnerable dependency: requests@2.31.0 (PYSEC-2026-2275) dependency_analyzer · 95%
medium
Vulnerable dependency: langchain@0.1.0 (GHSA-3644-q5cj-c5c7) dependency_analyzer · 95%
medium
Vulnerable dependency: langchain@0.1.0 (GHSA-3hjh-jh2h-vrg6) dependency_analyzer · 95%
medium
Vulnerable dependency: langchain@0.1.0 (GHSA-45pg-36p6-83v9) dependency_analyzer · 95%
medium
Vulnerable dependency: langchain@0.1.0 (GHSA-gr75-jv2w-4656) dependency_analyzer · 95%
medium
Vulnerable dependency: langchain@0.1.0 (PYSEC-2024-118) dependency_analyzer · 95%
medium
Vulnerable dependency: langchain@0.1.0 (PYSEC-2024-323) dependency_analyzer · 95%
medium
Vulnerable dependency: langchain@0.1.0 (PYSEC-2024-43) dependency_analyzer · 95%
medium
Vulnerable dependency: langchain@0.1.0 (PYSEC-2026-1507) dependency_analyzer · 95%
low
Tool 'summarise' has no annotations annotation_checker · 100%
medium
OAuth implementation without PKCE auth_checker · 75%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: langchain@0.1.0 (PYSEC-2026-2192) dependency_analyzer · 95%
medium
Vulnerable dependency: langchain@0.1.0 (PYSEC-2026-2555) dependency_analyzer · 95%
medium
Vulnerable dependency: pydantic@2.0 (GHSA-mr82-8j83-vxmv) dependency_analyzer · 95%
medium
Vulnerable dependency: pydantic@2.0 (PYSEC-2026-1812) dependency_analyzer · 95%
medium
Hex string literal (>50 chars) in accord-protocol-accord-protocol-be694e9/packages/ergo-agent-pay/examples/02-note-payment.ts:33 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in accord-protocol-accord-protocol-be694e9/packages/ergo-agent-py/tests/test_bridge_client.py:153 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in accord-protocol-accord-protocol-be694e9/packages/ergo-agent-py/tests/test_bridge_client.py:181 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in accord-protocol-accord-protocol-be694e9/packages/ergo-agent-scripts/src/__tests__/registry.test.ts:137 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in accord-protocol-accord-protocol-be694e9/packages/ergo-agent-cli/src/__tests__/task-hash.test.ts:65 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in accord-protocol-accord-protocol-be694e9/packages/ergo-agent-cli/src/__tests__/task-hash.test.ts:100 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in accord-protocol-accord-protocol-be694e9/packages/ergo-agent-server/src/__tests__/router.test.ts:345 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in accord-protocol-accord-protocol-be694e9/packages/ergo-agent-server/src/__tests__/router.test.ts:354 entropy_analyzer · 70%
info
package.json metadata manifest_parser · 100%
info
pyproject.toml metadata manifest_parser · 100%
info
Tool: summarise manifest_parser · 75%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (28) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 90%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 259 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%