Announcing Beacon: Self-improving memory for coding agents

← All MCP servers

MCP server

Veyra

mcp:zapxlabs/veyra-mcp

Give AI agents a wallet with a spending limit. Non-custodial USDC on Base, server-enforced limits.

awesome-mcp-servers Glama MCP Registry

Verdict

Inconclusive

The analysis could not cover enough of the artifact to decide.

Analyzed Oct 26, 2026, 13:00 UTC at fcf3176

0

findings

—

highest severity

0

threat classes

27

files scanned

192/192

checks satisfied

0

package advisories

Why this verdict

inconclusive: gap dynamic_metadata at src/bridge.ts
inconclusive: gap no_tools_extracted at package.json

Security findings 0

No individual findings recorded

The inconclusive verdict rests on the coverage gaps below; 4 candidate findings were refuted on review.

Execution chain 155

What it calls, runs, installs, reads and writes, with the line that does it.

Environment variables 2

VEYRA_MCP_URL

src/bin.ts:39 · read

VEYRA_TOKEN

src/bin.ts:38 · read

GitHub repositories 3

zapxlabs/veyra-mcp

package.json:24 · url

zapxlabs/veyra-mcp

package.json:27 · url

zapxlabs/veyra-mcp

server.json:8 · url

Packages 1

npm:veyra-mcp@0.1.1

server.json:30 · launch:server.json

URLs 149

https://github.com/sponsors/colinhacks

package-lock.json:1235

https://github.com/sponsors/epoberezkin

package-lock.json:114

https://github.com/sponsors/express-rate-limit

package-lock.json:458

https://github.com/sponsors/fastify

package-lock.json:477

https://github.com/sponsors/ljharb

package-lock.json:206

https://github.com/sponsors/ljharb

package-lock.json:531

https://github.com/sponsors/ljharb

package-lock.json:555

https://github.com/sponsors/ljharb

package-lock.json:580

https://github.com/sponsors/ljharb

package-lock.json:592

https://github.com/sponsors/ljharb

package-lock.json:822

https://github.com/sponsors/ljharb

package-lock.json:913

https://github.com/sponsors/ljharb

package-lock.json:1063

https://github.com/sponsors/ljharb

package-lock.json:1079

https://github.com/sponsors/ljharb

package-lock.json:1097

https://github.com/sponsors/ljharb

package-lock.json:1116

https://github.com/sponsors/panva

package-lock.json:695

https://github.com/sponsors/sindresorhus

package-lock.json:741

https://github.com/zapxlabs/veyra-mcp

https://github.com/zapxlabs/veyra-mcp.git

package.json:27

https://github.com/zapxlabs/veyra-mcp/issues

package.json:24

https://opencollective.com/express

package-lock.json:155

https://opencollective.com/express

package-lock.json:168

https://opencollective.com/express

package-lock.json:219

https://opencollective.com/express

package-lock.json:263

https://opencollective.com/express

package-lock.json:442

https://opencollective.com/express

package-lock.json:504

https://opencollective.com/express

package-lock.json:634

https://opencollective.com/express

package-lock.json:650

https://opencollective.com/express

package-lock.json:729

https://opencollective.com/express

package-lock.json:766

https://opencollective.com/express

package-lock.json:788

https://opencollective.com/express

package-lock.json:801

https://opencollective.com/express

package-lock.json:871

https://opencollective.com/express

package-lock.json:897

https://opencollective.com/express

package-lock.json:926

https://opencollective.com/express

package-lock.json:998

https://opencollective.com/express

package-lock.json:1017

https://opencollective.com/express

package-lock.json:1152

https://opencollective.com/express

package-lock.json:1165

https://opencollective.com/fastify

package-lock.json:481

https://registry.npmjs.org

https://registry.npmjs.org/@hono/node-server/-/node-server-2.1.1.tgz

package-lock.json:28

https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.30.0.tgz

package-lock.json:40

https://registry.npmjs.org/@types/node/-/node-24.13.5.tgz

package-lock.json:80

https://registry.npmjs.org/accepts/-/accepts-2.0.0.tgz

package-lock.json:90

https://registry.npmjs.org/ajv-formats/-/ajv-formats-3.0.1.tgz

package-lock.json:119

https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz

package-lock.json:103

https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz

package-lock.json:136

https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz

package-lock.json:173

https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz

package-lock.json:182

https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz

package-lock.json:195

https://registry.npmjs.org/content-disposition/-/content-disposition-1.1.0.tgz

package-lock.json:211

https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz

package-lock.json:224

https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz

package-lock.json:160

https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz

package-lock.json:793

https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz

package-lock.json:1157

https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.2.2.tgz

package-lock.json:242

https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz

package-lock.json:233

https://registry.npmjs.org/cors/-/cors-2.8.6.tgz

package-lock.json:251

https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz

package-lock.json:268

https://registry.npmjs.org/debug/-/debug-4.4.3.tgz

package-lock.json:282

https://registry.npmjs.org/depd/-/depd-2.0.0.tgz

package-lock.json:299

https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz

package-lock.json:308

https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz

package-lock.json:322

https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz

package-lock.json:328

https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz

package-lock.json:337

https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz

package-lock.json:346

https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz

package-lock.json:355

https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz

package-lock.json:367

https://registry.npmjs.org/etag/-/etag-1.8.1.tgz

package-lock.json:373

https://registry.npmjs.org/eventsource-parser/-/eventsource-parser-3.1.1.tgz

package-lock.json:394

https://registry.npmjs.org/eventsource/-/eventsource-3.0.7.tgz

package-lock.json:382

https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.7.0.tgz

package-lock.json:447

https://registry.npmjs.org/express/-/express-5.2.1.tgz

package-lock.json:403

https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz

package-lock.json:466

https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz

package-lock.json:472

https://registry.npmjs.org/finalhandler/-/finalhandler-2.1.1.tgz

package-lock.json:488

https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz

package-lock.json:509

https://registry.npmjs.org/fresh/-/fresh-2.0.0.tgz

package-lock.json:518

https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz

package-lock.json:527

https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz

package-lock.json:536

https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz

package-lock.json:560

https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz

package-lock.json:573

https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz

package-lock.json:585

https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz

package-lock.json:597

https://registry.npmjs.org/hono/-/hono-4.13.8.tgz

package-lock.json:609

https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz

package-lock.json:619

https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.3.tgz

package-lock.json:639

https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz

package-lock.json:655

https://registry.npmjs.org/ip-address/-/ip-address-10.7.2.tgz

package-lock.json:661

https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz

package-lock.json:670

https://registry.npmjs.org/is-promise/-/is-promise-4.0.0.tgz

package-lock.json:679

https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz

package-lock.json:685

https://registry.npmjs.org/jose/-/jose-6.2.12.tgz

package-lock.json:691

https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz

package-lock.json:700

https://registry.npmjs.org/json-schema-typed/-/json-schema-typed-8.0.2.tgz

package-lock.json:706

https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz

package-lock.json:712

https://registry.npmjs.org/media-typer/-/media-typer-1.1.1.tgz

package-lock.json:721

https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-2.0.0.tgz

package-lock.json:734

https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz

package-lock.json:746

https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz

package-lock.json:755

https://registry.npmjs.org/ms/-/ms-2.1.3.tgz

package-lock.json:771

https://registry.npmjs.org/negotiator/-/negotiator-1.1.0.tgz

package-lock.json:777

https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz

package-lock.json:806

https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz

package-lock.json:815

https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz

package-lock.json:827

https://registry.npmjs.org/once/-/once-1.4.0.tgz

package-lock.json:839

https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz

package-lock.json:848

https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz

package-lock.json:857

https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.4.2.tgz

package-lock.json:866

https://registry.npmjs.org/pkce-challenge/-/pkce-challenge-5.0.1.tgz

package-lock.json:876

https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz

package-lock.json:885

https://registry.npmjs.org/qs/-/qs-6.16.0.tgz

package-lock.json:902

https://registry.npmjs.org/range-parser/-/range-parser-1.3.0.tgz

package-lock.json:918

https://registry.npmjs.org/raw-body/-/raw-body-3.0.2.tgz

package-lock.json:931

https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz

package-lock.json:946

https://registry.npmjs.org/router/-/router-2.2.0.tgz

package-lock.json:955

https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz

package-lock.json:971

https://registry.npmjs.org/send/-/send-1.2.1.tgz

package-lock.json:977

https://registry.npmjs.org/serve-static/-/serve-static-2.2.1.tgz

package-lock.json:1003

https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz

package-lock.json:1022

https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz

package-lock.json:1028

https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz

package-lock.json:1040

https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz

package-lock.json:1068

https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz

package-lock.json:1084

https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz

package-lock.json:1102

https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz

package-lock.json:1049

https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz

package-lock.json:1121

https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz

package-lock.json:1130

https://registry.npmjs.org/type-is/-/type-is-2.1.0.tgz

package-lock.json:1139

https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz

package-lock.json:1170

https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz

package-lock.json:1184

https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz

package-lock.json:1191

https://registry.npmjs.org/vary/-/vary-1.1.2.tgz

package-lock.json:1200

https://registry.npmjs.org/which/-/which-2.0.2.tgz

package-lock.json:1209

https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz

package-lock.json:1224

https://registry.npmjs.org/zod-to-json-schema/-/zod-to-json-schema-3.25.2.tgz

package-lock.json:1240

https://registry.npmjs.org/zod/-/zod-4.6.5.tgz

package-lock.json:1230

https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json

https://veyra.money

package.json:23

https://veyra.money

package.json:30

https://veyra.money

https://veyra.money/api/mcp

https://veyra.money/api/mcp

src/client.ts:3

https://veyra.money/api/mcp

https://veyra.money/dashboard

https://veyra.money/dashboard

https://veyra.money/dashboard

https://veyra.money/dashboard

src/client.ts:175

Refuted findings 4

Candidates the review stage examined and rejected, kept for transparency.

Credential access

criticalRefutedlow confidence

The bridge reads VEYRA_TOKEN from the environment or --token, and the endpoint from VEYRA_MCP_URL or --url, then sends the token as a Bearer header to that URL, so an overridden URL would receive the credential. This is documented, and the default is the vendor endpoint.

const url = arg("--url") ?? process.env.VEYRA_MCP_URL;

Why it was refuted

The token is the env API key for the wrapped Veyra service. The URL override is a documented, operator-set option for self-hosted or staging deployments, and the default is the vendor endpoint. Nothing is hidden or sent to an attacker-chosen destination.

Tool poisoning

criticalRefutedlow confidence

The bridge relays the remote server's live tools/list unfiltered to the host, so tool descriptions can be changed remotely at any time without any change to the shipped code.

src/bridge.ts:33

return { tools: await client.listTools() };

Why it was refuted

Relaying the vendor's live tools/list is the declared core function of the bridge. The shipped code documents this behavior, and falls back to bundled definitions on transport errors.

Tool poisoning

criticalRefutedlow confidence

The create_payment tool description tells the agent to initiate payments on its own whenever its task needs paying someone, not only when a human asked, steering agent spending behavior through tool metadata (server-side limits apply).

src/tools.ts:62

Use this whenever completing your task requires paying someone

Why it was refuted

The tool description openly states the payment tool's function and its constraints. Server-side policy and user approval limit spending, so this is the tool's core declared behavior rather than poisoned metadata.

Manipulation

highRefutedmedium confidence

The create_payment tool description instructs the agent to spend funds autonomously whenever a task could involve paying, not only when the user asked, which nudges the agent toward unrequested payments.

src/tools.ts:62

Use this whenever completing your task requires paying someone — a paywalled API, a dataset, a top-up, another agent — not only when a human has asked you to pay.

Why it was refuted

The description tells the agent to pay when its task requires paying, which is the declared purpose of an agent-payments tool. It is bounded by server-side limits and an approval flow, so it is not a hidden manipulation.

Coverage gaps 2

Parts of the artifact the static analysis could not fully examine.

dynamic_metadata line 31: tools list returned by ListToolsRequestSchema handler is computed

src/bridge.ts

no_tools_extracted MCP server target with no statically extractable tools/prompts/resources

package.json