MCP server

io.github.zekebuilds-lab/captcha-mcp

mcp:zekebuilds-lab/captcha-mcp

Charge AI agents per-call without accounts. PoW solve = free tier, Lightning = paid tier.

awesome-mcp-servers Glama MCP Registry

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 26, 2026, 13:26 UTC at 25c4750

findings

high

highest severity

threat classes

files scanned

212/212

checks satisfied

package advisories

Why this verdict

suspicious: finding mcp-server:.:package.json:5:SUPPLY
suspicious: finding mcp-server:.:src/rune-etch.js:69:CRED
suspicious: finding mcp-server:.:src/rune-etch.js:75:CRED

Security findings 3

Credential access

highContextual riskmedium confidence

src/rune-etch.js hardcodes a Bitcoin RPC username and password for a LAN host (lightning.lan:8332) in source code, a leaked credential shipped in the package source, used to authenticate sendrawtransaction calls.

src/rune-etch.js:69

pass: 'lOb_sXqOc4oT5UScfDajB2fepQQhvxyf8s9LOQ8mydA',

vector:code

Counter-argument considered

A real-looking RPC password is hardcoded in shipped source and is used to build the Basic auth header, which is a leaked credential. It is undeclared for a captcha package. Nothing in the evidence neutralizes it.

Credential access

highContextual riskhigh confidence

src/rune-etch.js, shipped in the npm package of a captcha MCP wrapper, embeds a hardcoded Bitcoin RPC username and password for an internal host (lightning.lan), which is undeclared and unrelated to the captcha purpose.

src/rune-etch.js:75

pass: 'lOb_sXqOc4oT5UScfDajB2fepQQhvxyf8s9LOQ8mydA',

vector:code

Counter-argument considered

A hardcoded RPC username and password for an internal host ships in the package source. It is unrelated to the captcha purpose and is used to authenticate sendrawtransaction calls.

Supply chain

lowContextual riskmedium confidence

Package description claims 'stdlib only' while package.json declares third-party Bitcoin/Runestone dependencies (and rune-etch.js also requires @noble/secp256k1, which is not declared), contradicting the no-dependency claim.

package.json:5

Stdio + HTTP transports, stdlib only.

vector:metadata

Counter-argument considered

The description says 'stdlib only' but package.json declares runtime dependencies, and rune-etch.js also requires undeclared @noble/secp256k1 and @scure/base. The contradiction is real. No cited evidence shows that it is wrong or neutralized.

Refuted findings 2

Candidates the review stage examined and rejected, kept for transparency.

Data exfiltration

highRefutedmedium confidence

The undeclared Rune etch script makes network calls with Basic-auth to lightning.lan:8332 and to mempool.space, broadcasts signed mainnet transactions, and writes a state file outside the package dir; none of this is declared for a captcha wrapper.

src/rune-etch.js:115

const req = http.request({

Why it was refuted

The script only POSTs its own signed transaction hex to its own node or to mempool.space, which is the intended public broadcast. No secret or user data flows to a sink, so there is no exfiltration chain. The Basic auth is used only for its own RPC node.

Credential access

highRefutedmedium confidence

The undeclared Rune etch script reads a Bitcoin minting private key from ~/.config/powforge/rune-minting-key.hex (via the HOME env var) and uses it to sign transactions; the captcha purpose does not need this (not imported by server.js, so it only runs if invoked manually).

src/rune-etch.js:173

fs.readFileSync(KEY_PATH, 'utf8')

Why it was refuted

The script reads the user's own minting key and uses it only for local signing. The key is not sent anywhere, so there is no credential-to-sink chain. The behavior is stated in the script's header.