MCP, MCP server
io.github.MintwareDevelopers/mcp-server
Public repository mintwaredevelopers/mintware-beta.
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit e7d4f4c2bb76, unchanged since the check below.
OBFUSCATION_ENCODED_BLOB
Why this grade
- OBFUSCATION_ENCODED_BLOB Medium
Contains a long base64 shaped string in a file that should be readable.
pnpm-lock.yaml, line 1
lockfileVersion: '9.0'
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Pass
No shell or command execution found, and no extra permission was declared.
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address. can reach mintware.finance. The description does not name that host. can reach attacker.example. The description does not name that host. can reach li.quest. The description does not name that host. can reach api.dexscreener.com. The description does not name that host. can reach min-api.cryptocompare.com. The description does not name that host. can reach api.ensideas.com. The description does not name that host. can reach api.neynar.com.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST NETWORK_NAMED_HOST
app/page.tsx, line 323
const res = await fetch('/api/waitlist', {
app/(web3)/agent/[address]/page.tsx, line 57
fetch(`/api/agents/${address}`)
app/(web3)/agents/leaderboard/page.tsx, line 41
fetch('/api/agents/leaderboard')
Show more
app/agents/page.tsx, line 239
fetch('/api/agents/leaderboard?limit=8')
app/api/(admin)/oracle/rotation/route.ts, line 46
const res = await fetch(rpcUrl, {
app/api/(web2)/benchmarks/yields/route.ts, line 35
const res = await fetch(LLAMA_POOLS, { cache: 'no-store' })
app/api/(web2)/swap/quote/route.ts, line 65
const upstream = await fetch(`${LIFI_QUOTE_URL}?${qp.toString()}`, {
app/api/orgs/[id]/cards/route.ts, line 10
// signed-message auth needs a body and a browser fetch() GET can't carry one (same convention the
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
proxy.ts, line 64
token: process.env.UPSTASH_REDIS_REST_TOKEN!,
proxy.ts, line 149
if (process.env.UPSTASH_REDIS_REST_URL && process.env.UPSTASH_REDIS_REST_TOKEN) {
app/(web3)/agents/leaderboard/page.tsx, line 197
privateKey: process.env.KEY
Show more
app/agents/page.tsx, line 186
apiKeyName: process.env.CDP_API_KEY_NAME,
app/agents/page.tsx, line 187
apiKeyPrivKey: process.env.CDP_API_KEY_PRIVATE_KEY,
app/api/(rewards)/cron/card-buffer-refill/route.test.ts, line 36
process.env.CRON_SECRET = SECRET
app/api/(rewards)/cron/gateway-discover/route.test.ts, line 17
process.env.CRON_SECRET = '
app/api/(rewards)/cron/gateway-discover/route.test.ts, line 48
delete process.env.CRON_SECRET
.claude/rules/deployments.md, line 54
| `DECK_PASSWORD` | Server-only | Password for the private investor decks (`lib/deck/gate.ts`). Gates BOTH `/deck` (full deck) and `/angels` (plain-English "Angels" edition) - one
.claude/rules/deployments.md, line 55
| `DATAROOM_PASSWORD` | Server-only | Password for the private investor **data room** at `/dataroom` (`lib/deck/gate.ts`). SEPARATE gate from the decks - its own password and its o
.claude/rules/deployments.md, line 174
| `RWA_ORACLE_PRIVY_WALLET_ID` / `RWA_ORACLE_PRIVY_ADDRESS` | Server-only / scripts | The **dedicated `rwa` Privy seat** (`0xAF8E…d5ca`, created 2026-10-01) - deployer/owner/keeper
.claude/rules/lp-gateway.md, line 407
explicitly unresolved. Dry-run by default (`node --env-file=.env.local
.claude/rules/lp-gateway.md, line 457
non-zero - never silently treated as "present." `node --env-file=.env.local
.claude/rules/lp-gateway.md, line 465
transcript while checking `.env.local` for the credential's *presence* (2026-09-10); the key must be
.claude/rules/rwa-liquidity.md, line 31
(`RWA_ORACLE_PRIVY_WALLET_ID` / `_ADDRESS` in `.env.robinhood.local`, created 2026-10-01). **No fallback to the
.claude/rules/rwa-liquidity.md, line 82
- **Background activity**: `node --env-file=.env.robinhood.local scripts/rwa-demo-activity.mjs` - same sizing, one
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains an encoded blob in a file that should be readable.
OBFUSCATION_ENCODED_BLOB
pnpm-lock.yaml, line 1
lockfileVersion: '9.0'
contracts-ai/src/AIAttribution.sol, line 1
// SPDX-License-Identifier: MIT
lib/web3/artifacts/aaveAdapter.ts, line 362
export const AAVE_ADAPTER_BYTECODE = "0x60e0806040523461028c5760a0816112ee803803809161001f8285610364565b83398101031261028c5780516001600160a01b03811680820361028c57610048602084016103
Show more
lib/web3/artifacts/amAuction.ts, line 890
export const AM_AUCTION_BYTECODE = "0x6080346100e157601f6120a938819003918201601f19168301916001600160401b038311848410176100e5578084926020946040528339810103126100e157516001600160a01b
lib/web3/artifacts/hookCoordinator.ts, line 1544
export const HOOK_COORDINATOR_BYTECODE = "0x60a0604052346102f357604051601f6120a038819003918201601f19168301916001600160401b038311848410176102cc578084926060946040528339810103126102f3
lib/web3/artifacts/mintwarePaymentGateway.ts, line 1012
export const PAYMENT_GATEWAY_BYTECODE = '0x6101a08060405234610299576080816122738038038091610020828561029d565b83398101031261029957610033816102d4565b61003f602083016102d4565b916100586
lib/web3/artifacts/mintwareYieldVault.ts, line 562
export const YIELD_VAULT_BYTECODE = '0x60c03461019957601f61146e38819003918201601f19168301916001600160401b0383118484101761019d5780849260609460405283398101031261019957610047816101b15
lib/web3/artifacts/mockErc20.ts, line 127
"0x60806040523461033057610a518038038061001981610334565b9283398101906060818303126103305780516001600160401b0381116103305782610045918301610359565b60208201519092906001600160401b0381116
lib/web3/artifacts/mwIdleLib.ts, line 123
export const MW_IDLE_LIB_BYTECODE = "0x60808060405234601b57611b8d90816100208239308160080152f35b5f80fdfe608080604052307f0000000000000000000000000000000000000000000000000000000000000
lib/web3/artifacts/mwJitLib.ts, line 17
export const MW_JIT_LIB_BYTECODE = "0x60808060405234601b576121a690816100208239308160070152f35b5f80fdfe6080604052307f0000000000000000000000000000000000000000000000000000000000000000
Licence
Note
no licence file found.
LICENCE_MISSING
No file path was stored.
no licence file found.
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit e7d4f4c2bb76. can reach a host that is not written as a fixed address. can reach mintware.finance. The description does not name that host. can reach attacker.example. The description does not name that host. can reach li.quest. The description does not name that host. can reach api.dexscreener.com. The description does not name that host. can reach min-api.cryptocompare.com. The description does not name that host. can reach api.ensideas.com. The description does not name that host. can reach api.neynar.com. reads a credential or environment file. contains an encoded blob in a file that should be readable. no licence file found. Grades are a hygiene che
Date and source
Date checked:
github.com
Commit graded: e7d4f4c2bb76c34174ca4f1af57386812dfa2e27
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.