← Back to search

@phantom/mcp-server

GitHub Actions Scanned 13d ago

MCP Server for Phantom Wallet

npm ↗
? Not scanned yet

Versions

1.2.7latest
Apr 28, 2026
1.2.6
Apr 27, 2026
1.2.5
Apr 21, 2026
1.2.4
Apr 21, 2026
1.2.3
Apr 20, 2026
+ show 24 moreshow less
1.2.2
Apr 17, 2026
1.2.1
Apr 17, 2026
1.2.0
Apr 17, 2026
1.1.0
Apr 17, 2026
1.0.4
Apr 9, 2026
1.0.3
Apr 9, 2026
1.0.2
Apr 8, 2026
1.0.1
Apr 8, 2026
1.0.0
Apr 7, 2026
1.0.0-beta.0
Apr 3, 2026
0.2.4
Mar 25, 2026
0.2.3
Mar 24, 2026
0.2.2
Mar 20, 2026
0.2.1
Mar 13, 2026
0.2.0
Mar 12, 2026
0.1.8
Mar 3, 2026
0.1.7
Feb 20, 2026
0.1.6
Feb 20, 2026
0.1.5
Feb 18, 2026
0.1.4
Feb 17, 2026
0.1.3
Feb 16, 2026
0.1.2
Feb 12, 2026
0.1.1
Feb 10, 2026
0.1.0
Feb 7, 2026

Tools 0

No tools indexed yet.

Permissions 4

network medium
Server uses network capabilities via: fetch()
filesystem low
Server uses filesystem capabilities via: fs, fs sync ops, fs.promises, path
shell high
Server uses shell capabilities via: child_process, execSync(), spawn()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 97

high
Hardcoded OAuth client secret in phantom-phantom-connect-sdk-872944c/packages/cli/src/session/manager.test.ts auth_checker · 95%
high
Hardcoded OAuth client ID in phantom-phantom-connect-sdk-872944c/packages/cli/src/auth/DeviceCodeAuthProvider.test.ts auth_checker · 85%
high
Hardcoded OAuth client secret in phantom-phantom-connect-sdk-872944c/packages/cli/src/auth/DeviceCodeAuthProvider.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in phantom-phantom-connect-sdk-872944c/packages/cli/src/auth/oauth.test.ts auth_checker · 95%
high
Hardcoded OAuth client ID in phantom-phantom-connect-sdk-872944c/packages/cli/src/auth/dcr.test.ts auth_checker · 85%
high
Hardcoded OAuth client secret in phantom-phantom-connect-sdk-872944c/packages/cli/src/auth/dcr.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in phantom-phantom-connect-sdk-872944c/packages/cli/packages/cli/src/session/manager.test.ts auth_checker · 95%
high
Hardcoded OAuth client ID in phantom-phantom-connect-sdk-872944c/packages/cli/packages/cli/src/auth/DeviceCodeAuthProvider.test.ts auth_checker · 85%
high
Hardcoded OAuth client secret in phantom-phantom-connect-sdk-872944c/packages/cli/packages/cli/src/auth/DeviceCodeAuthProvider.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in phantom-phantom-connect-sdk-872944c/packages/cli/packages/cli/src/auth/oauth.test.ts auth_checker · 95%
high
Hardcoded OAuth client ID in phantom-phantom-connect-sdk-872944c/packages/cli/packages/cli/src/auth/dcr.test.ts auth_checker · 85%
high
Hardcoded OAuth client secret in phantom-phantom-connect-sdk-872944c/packages/cli/packages/cli/src/auth/dcr.test.ts auth_checker · 95%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Excessive dependency count: 215 direct dependencies dependency_analyzer · 90%
medium
Suspicious package name: react-native dependency_analyzer · 60%
medium
Suspicious package name: react-dom dependency_analyzer · 60%
medium
Suspicious package name: react-scripts dependency_analyzer · 60%
medium
Vulnerable dependency: turbo@2.6.3 (GHSA-3qcw-2rhx-2726) dependency_analyzer · 95%
medium
Vulnerable dependency: turbo@2.6.3 (GHSA-hcf7-66rw-9f5r) dependency_analyzer · 95%
medium
Vulnerable dependency: tsup@6.7.0 (GHSA-3mv9-4h5g-vhg3) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.15.1 (GHSA-35jp-ww65-95wh) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.15.1 (GHSA-3g43-6gmg-66jw) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.15.1 (GHSA-3w6x-2g7m-8v23) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.15.1 (GHSA-42h9-826w-cgv3) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.15.1 (GHSA-777c-7fjr-54vf) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.15.1 (GHSA-7q8q-rj6j-mhjq) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.15.1 (GHSA-898c-q2cr-xwhg) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.15.1 (GHSA-f4gw-2p7v-4548) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.15.1 (GHSA-hcpx-6fm6-wx23) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.15.1 (GHSA-hfxv-24rg-xrqf) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.15.1 (GHSA-j5f8-grm9-p9fc) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.15.1 (GHSA-jqh4-m9w3-8hp9) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.15.1 (GHSA-mmx7-hfxf-jppx) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.15.1 (GHSA-mwf2-3pr3-8698) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.15.1 (GHSA-p92q-9vqr-4j8v) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.15.1 (GHSA-pjwm-pj3p-43mv) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.15.1 (GHSA-pmv8-rq9r-6j72) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.15.1 (GHSA-q8qp-cvcw-x6jj) dependency_analyzer · 95%
medium
Vulnerable dependency: tsup@7.2.0 (GHSA-3mv9-4h5g-vhg3) dependency_analyzer · 95%
medium
Vulnerable dependency: @babel/core@7.20.0 (GHSA-4x5r-pxfx-6jf8) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.2.4 (GHSA-267c-6grr-h53f) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.2.4 (GHSA-26hh-7cqf-hhc6) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.2.4 (GHSA-36qx-fr4f-26g5) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.2.4 (GHSA-3g8h-86w9-wvmq) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.2.4 (GHSA-4633-3j49-mh5q) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.2.4 (GHSA-492v-c6pp-mqqv) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.2.4 (GHSA-4c39-4ccg-62r3) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.2.4 (GHSA-68g3-v927-f742) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.2.4 (GHSA-6gpp-xcg3-4w24) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.2.4 (GHSA-89xv-2m56-2m9x) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.2.4 (GHSA-8h8q-6873-q5fj) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.2.4 (GHSA-955p-x3mx-jcvp) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.2.4 (GHSA-c4j6-fc7j-m34r) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.2.4 (GHSA-ffhc-5mcf-pf4q) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.2.4 (GHSA-gx5p-jg67-6x7h) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.2.4 (GHSA-h64f-5h5j-jqjh) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.2.4 (GHSA-m99w-x7hq-7vfj) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.2.4 (GHSA-mg66-mrh9-m8jx) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.2.4 (GHSA-p9j2-gv94-2wf4) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.2.4 (GHSA-q8wf-6r8g-63ch) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.2.4 (GHSA-vfv6-92ff-j949) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.2.4 (GHSA-wfc6-r584-vfw7) dependency_analyzer · 95%
medium
Vulnerable dependency: @solana/web3.js@1.87.6 (GHSA-8m45-2rjm-j347) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.3.6 (GHSA-4w7w-66w2-5vf9) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.3.6 (GHSA-93m4-6634-74q7) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.3.6 (GHSA-fx2h-pf6j-xcff) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.3.6 (GHSA-p9ff-h696-f583) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.3.6 (GHSA-v6wh-96g9-6wx3) dependency_analyzer · 95%
medium
Buffer.from base64 in phantom-phantom-connect-sdk-872944c/packages/parsers/src/index.ts:133 entropy_analyzer · 75%
medium
Buffer.from base64 in phantom-phantom-connect-sdk-872944c/packages/cli/src/index.ts:60 entropy_analyzer · 75%
medium
Buffer.from base64 in phantom-phantom-connect-sdk-872944c/packages/cli/src/utils/swap.ts:46 entropy_analyzer · 75%
medium
Buffer.from base64 in phantom-phantom-connect-sdk-872944c/packages/cli/src/utils/swap.ts:53 entropy_analyzer · 75%
medium
Buffer.from base64 in phantom-phantom-connect-sdk-872944c/packages/cli/src/actions/send-solana-transaction.ts:82 entropy_analyzer · 75%
medium
Buffer.from base64 in phantom-phantom-connect-sdk-872944c/packages/cli/src/actions/pay-api-access.ts:33 entropy_analyzer · 75%
medium
Buffer.from base64 in phantom-phantom-connect-sdk-872944c/packages/cli/src/actions/pay-api-access.ts:169 entropy_analyzer · 75%
medium
Buffer.from base64 in phantom-phantom-connect-sdk-872944c/packages/cli/src/auth/NodeFileAuth2StamperStorage.ts:62 entropy_analyzer · 75%
medium
Buffer.from base64 in phantom-phantom-connect-sdk-872944c/packages/cli/src/auth/NodeFileAuth2StamperStorage.ts:69 entropy_analyzer · 75%
medium
Buffer.from base64 in phantom-phantom-connect-sdk-872944c/packages/cli/src/auth/oauth.test.ts:500 entropy_analyzer · 75%
medium
Buffer.from base64 in phantom-phantom-connect-sdk-872944c/packages/cli/packages/cli/src/auth/oauth.test.ts:500 entropy_analyzer · 75%
medium
Buffer.from base64 in phantom-phantom-connect-sdk-872944c/packages/react-native-sdk/src/providers/embedded/SecureStoreAuth2StamperStorage.ts:89 entropy_analyzer · 75%
medium
Buffer.from base64 in phantom-phantom-connect-sdk-872944c/packages/perps-client/src/actions.ts:123 entropy_analyzer · 75%
medium
Buffer.from base64 in phantom-phantom-connect-sdk-872944c/packages/browser-sdk/src/providers/injected/chains/InjectedWalletSolanaChain.ts:137 entropy_analyzer · 75%
medium
Buffer.from base64 in phantom-phantom-connect-sdk-872944c/packages/base64url/src/index.ts:60 entropy_analyzer · 75%
medium
Buffer.from base64 in phantom-phantom-connect-sdk-872944c/examples/react-sdk-demo-app/src/SDKActions.tsx:423 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Required env vars (25) manifest_parser · 80%
medium
Hardcoded OAuth client ID in phantom-phantom-connect-sdk-872944c/packages/cli/src/auth/DeviceCodeAuthProvider.test.ts oauth_scope_analyzer · 80%
medium
Hardcoded OAuth client ID in phantom-phantom-connect-sdk-872944c/packages/cli/src/auth/dcr.test.ts oauth_scope_analyzer · 80%
medium
Hardcoded OAuth client ID in phantom-phantom-connect-sdk-872944c/packages/cli/packages/cli/src/auth/DeviceCodeAuthProvider.test.ts oauth_scope_analyzer · 80%
medium
Hardcoded OAuth client ID in phantom-phantom-connect-sdk-872944c/packages/cli/packages/cli/src/auth/dcr.test.ts oauth_scope_analyzer · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 165 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%