MCP, MCP server
ai.smithery/cuongpo-coti-mcp
Connect to the COTI blockchain to manage accounts, transfer native tokens, and deploy and operate…
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 4f6d47fa4dd6, unchanged since the check below.
OBFUSCATION_ENCODED_BLOB
Why this grade
- OBFUSCATION_ENCODED_BLOB Medium
Contains a long base64 shaped string in a file that should be readable.
tools/erc20/deployPrivateErc20Contract.ts, line 75
const bytecode = "0x60806040523480156200001157600080fd5b5060405162001bb838038062001bb8833981016040819052620000349162000148565b828260046200004483826200025c565b5060056200005382826200
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Pass
No shell or command execution found, and no extra permission was declared.
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Pass
No network call found.
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_UNCONFIRMED
index.ts, line 67
process.env.COTI_MCP_AES_KEY = config.cotiMcpAesKey;
index.ts, line 71
process.env.COTI_MCP_PRIVATE_KEY = config.cotiMcpPrivateKey;
index.ts, line 74
process.env.COTI_MCP_PUBLIC_KEY = derivedPublicKey;
Show more
index.ts, line 75
process.env.COTI_MCP_CURRENT_PUBLIC_KEY = derivedPublicKey;
tools/account/changeDefaultAccount.ts, line 41
process.env.COTI_MCP_CURRENT_PUBLIC_KEY = account_address;
tools/account/createAccount.ts, line 43
const publicKeys = (process.env.COTI_MCP_PUBLIC_KEY || '').split(',').filter(Boolean);
tools/account/createAccount.ts, line 44
const privateKeys = (process.env.COTI_MCP_PRIVATE_KEY || '').split(',').filter(Boolean);
tools/account/createAccount.ts, line 45
const aesKeys = (process.env.COTI_MCP_AES_KEY || '').split(',').filter(Boolean);
.gitignore, line 12
*.log
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains an encoded blob in a file that should be readable.
OBFUSCATION_ENCODED_BLOB
tools/erc20/deployPrivateErc20Contract.ts, line 75
const bytecode = "0x60806040523480156200001157600080fd5b5060405162001bb838038062001bb8833981016040819052620000349162000148565b828260046200004483826200025c565b5060056200005382826200
tools/erc721/deployPrivateErc721Contract.ts, line 71
const bytecode = "0x60806040523480156200001157600080fd5b5060405162001eeb38038062001eeb833981016040819052620000349162000123565b818160006200004483826200021c565b5060016200005382826200
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Note
the latest commit is more than 365 days old.
MAINTAINER_STALE
No file path was stored.
2025-09-26T19:17:43+07:00
Note
Hygiene check of commit 4f6d47fa4dd6. reads a credential or environment file. contains an encoded blob in a file that should be readable. the latest commit is more than 365 days old.
Date and source
Date checked:
github.com
Commit graded: 4f6d47fa4dd66c91ccc7a507048d6ba6613a43ea
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.