MCP server for AI agents — Stacks, Celo, and Base in one npm package.
Risky behavior the analysis could not rule out.
. Suspicious.claude/skills/multichain-mcp-skill No issues foundUndeclared license-validation call: the server POSTs the user-supplied license key to api.lemonsqueezy.com, a third party not mentioned in the declared purpose; it only sends the key the user configured and is plausibly honest licensing.
body: new URLSearchParams({ license_key: licenseKey })deploy_token embeds an opaque, unverifiable hardcoded ERC-20 bytecode blob that is returned as unsigned deploy data for the user to sign, so its on-chain behavior (e.g. who receives the supply) cannot be confirmed from the source and appears not to match the 5-argument constructor ABI used.
0x60806040523480156200001157600080fd5b50
The blob is an opaque hardcoded bytecode returned as deploy data for the user to sign, and its behaviour cannot be confirmed from source. Nothing shown refutes the concern, so it stays unrefuted.
deploy_token embeds a large opaque hardcoded ERC-20 bytecode blob that cannot be reviewed in source; it is deployed on-chain from the user's own transaction and could hide a backdoor, though no malicious logic is shown.
0x60806040523480156200001157600080fd5b50
This is the same opaque bytecode blob as the previous finding. It cannot be reviewed in source and is deployed from the user's own transaction, so it is not refuted.
Undeclared monetization: tool metadata is computed at runtime and locked tools return tier-upsell text with hardcoded checkout URLs on wkalidev.com into the agent context; this is not hidden and looks like a commercial upsell rather than a hijack.
https://wkalidev.com/checkout/buy/74e9f10d-3806-413c-881d-761319ee535b
What the analysis could not settle from the code alone.
Candidates the review stage examined and rejected, kept for transparency.
Tool registration computes name and description at runtime, appending tier text, so metadata cannot be statically reviewed, though it appears to be a tier-gating upgrade nudge.
`${description} (requires ${tierLabel(requiredTier)} — you're on ${tierLabel(currentTier)})`The runtime part of the description is a fixed template that appends only tier labels. Name and description come from the server's own registration parameters, not remote or attacker-controlled content, so there is no poisoning chain.
The setup docs tell users to register the MCP server through `npx -y` with an unpinned package, so whatever version is latest on npm runs unreviewed on the host each launch; the declared install is `npm install`, so this launch method is not covered by the declaration.
"args": ["-y", "@wkalidev/multichain-mcp"]
The npx command launches the skill's own declared npm package, which is the documented way to run the server. It is openly shown in the setup docs and is not a third-party or concealed dependency.
Parts of the artifact the static analysis could not fully examine.
dynamic_metadata line 44: tool None description is computed: `${description} (requires ${tierLabel(requiredTier)} — you're on ${tierLabel(currentTier)})`request_unanswered request.0: behavior-chains.0/req-upgrade: resolved_clean: citation not shown or quote not in it