Aibtc MCP Server
@aibtc/mcp-server
npm
v1.69.0
Source verified
Published by aibtcdev — publish provenance cryptographically ties this package to that repository. That is proof of origin, not an official vendor package.
Bitcoin-native MCP server for AI agents: BTC/STX wallets, DeFi yield, sBTC peg, NFTs, and x402 payments.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 10 = 90. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −10 | capability blast radius (critical) — client exposure if the model is manipulated |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 7
critical Completed toxic-flow trifecta across toolsMTC-FLOW-002
This server (without client built-ins) exposes a complete data-exfiltration chain: arxiv_search → bitflow_get_swap_targets → identity_transfer. Untrusted input is ingested, private data is read, and it can be sent to an external sink via the agent composing the tools (→). Static analysis proves the primitive exists, not that a specific run will occur.
Fix: Remove one leg of the trifecta: isolate untrusted-input tools from secret-reading tools and from egress tools, or require human approval between them.
Location: flow arxiv_search → bitflow_get_swap_targets → identity_transfer
high Shell/command execution in server code (dist/tools/pillar.tools.js)MTC-SRC-002
In the server's implementation (`dist/tools/pillar.tools.js:5`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: ; import { exec } from "child_process"; import * as fs from "fs/promises"; import * as path from "path"; import * as os
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/tools/pillar.tools.js
medium Hardcoded egress to an external endpoint (dist/services/defi.service.js)MTC-SRC-003
In the server's implementation (`dist/services/defi.service.js:265`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: const res = await fetch(`https://hermes.pyth.network/v2/updates/price/latest?ids[]=${id}&encoding=hex`);
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/services/defi.service.js
medium Hardcoded egress to an external endpoint (dist/services/scaffold.service.js)MTC-SRC-003
In the server's implementation (`dist/services/scaffold.service.js:1029`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: const response = await fetch('https://openrouter.ai/api/v1/chat/completions', { method: 'POST', headers: {
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/services/scaffold.service.js
medium Hardcoded egress to an external endpoint (dist/tools/openrouter.tools.js)MTC-SRC-003
In the server's implementation (`dist/tools/openrouter.tools.js:112`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: const response = await fetch('https://openrouter.ai/api/v1/chat/completions', { method: 'POST', headers: {
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/tools/openrouter.tools.js
medium Hardcoded egress to an external endpoint (dist/tools/pillar.tools.js)MTC-SRC-003
In the server's implementation (`dist/tools/pillar.tools.js:544`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: onst balanceRes = await fetch(`https://api.hiro.so/extended/v1/address/${walletAddress}/balances`); let sbtc
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/tools/pillar.tools.js
medium Hardcoded egress to an external endpoint (dist/tools/settings.tools.js)MTC-SRC-003
In the server's implementation (`dist/tools/settings.tools.js:209`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: const response = await fetch("https://registry.npmjs.org/@aibtc/mcp-server/latest"); if (response.ok) {
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/tools/settings.tools.js
Tools 200
Each tool and what it can reach — statically extracted from the published source.
arxiv_searchingests untrusted inputbitflow_get_swap_targetsreads sensitive databitflow_get_tokensreads sensitive databounty_my_postedingests untrusted inputidentity_transfernetwork egressnews_list_signalsingests untrusted inputordinals_get_listingsingests untrusted inputordinals_p2p_get_tradeingests untrusted inputordinals_p2p_list_tradesingests untrusted inputtransfer_btcnetwork egress
Show 190 more tools ↓
transfer_nftnetwork egressalex_get_pool_infono sensitive capabilityalex_get_swap_quoteno sensitive capabilityalex_list_poolsno sensitive capabilityalex_swapno sensitive capabilityarxiv_compile_digestno sensitive capabilityarxiv_list_digestsno sensitive capabilitybitflow_cancel_orderno sensitive capabilitybitflow_create_orderno sensitive capabilitybitflow_get_keeper_contractno sensitive capabilitybitflow_get_keeper_userno sensitive capabilitybitflow_get_orderno sensitive capabilitybitflow_get_quoteno sensitive capabilitybitflow_get_routesno sensitive capabilitybitflow_get_tickerno sensitive capabilitybitflow_swapno sensitive capabilitybounty_acceptno sensitive capabilitybounty_cancelno sensitive capabilitybounty_createno sensitive capabilitybounty_getno sensitive capabilitybounty_listno sensitive capabilitybounty_my_submissionsno sensitive capabilitybounty_paidno sensitive capabilitybounty_submissionsno sensitive capabilitybounty_submitno sensitive capabilitycall_contractno sensitive capabilitycall_read_only_functionno sensitive capabilitycheck_bns_availabilityno sensitive capabilityclaim_bns_name_fastno sensitive capabilitycompetition_allowlistno sensitive capabilitycompetition_list_tradesno sensitive capabilitycompetition_statusno sensitive capabilitycompetition_submit_tradeno sensitive capabilitycredentials_deleteno sensitive capabilitycredentials_getno sensitive capabilitycredentials_listno sensitive capabilitycredentials_setno sensitive capabilitycredentials_unlockno sensitive capabilitydeploy_contractno sensitive capabilitydual_stacking_enrollno sensitive capabilitydual_stacking_get_rewardsno sensitive capabilitydual_stacking_opt_outno sensitive capabilitydual_stacking_statusno sensitive capabilityearning_opportunitiesno sensitive capabilityestimate_child_inscription_feeno sensitive capabilityestimate_inscription_feeno sensitive capabilityexecute_x402_endpointno sensitive capabilityget_bns_infono sensitive capabilityget_bns_priceno sensitive capabilityget_btc_address_txsno sensitive capabilityget_btc_balanceno sensitive capabilityget_btc_feesno sensitive capabilityget_btc_mempool_infono sensitive capabilityget_btc_transaction_statusno sensitive capabilityget_btc_utxosno sensitive capabilityget_cardinal_utxosno sensitive capabilityget_collection_infono sensitive capabilityget_identityno sensitive capabilityget_inscriptionno sensitive capabilityget_inscriptions_by_addressno sensitive capabilityget_nft_historyno sensitive capabilityget_nft_holdingsno sensitive capabilityget_nft_metadatano sensitive capabilityget_nft_ownerno sensitive capabilityget_ordinal_utxosno sensitive capabilityget_reputationno sensitive capabilityget_taproot_addressno sensitive capabilityget_transaction_statusno sensitive capabilityget_validation_statusno sensitive capabilityget_validation_summaryno sensitive capabilitygive_feedbackno sensitive capabilityidentity_getno sensitive capabilityidentity_get_last_idno sensitive capabilityidentity_get_metadatano sensitive capabilityidentity_registerno sensitive capabilityidentity_set_approvalno sensitive capabilityidentity_set_metadatano sensitive capabilityidentity_set_urino sensitive capabilityidentity_set_walletno sensitive capabilityidentity_unset_walletno sensitive capabilityinference_check_providerno sensitive capabilityinference_list_providersno sensitive capabilityinference_register_providerno sensitive capabilityinference_reveal_keyno sensitive capabilityinference_update_providerno sensitive capabilityinscribeno sensitive capabilityinscribe_childno sensitive capabilityinscribe_child_revealno sensitive capabilityinscribe_revealno sensitive capabilityjingswap_cancel_cycleno sensitive capabilityjingswap_cancel_sbtcno sensitive capabilityjingswap_cancel_stxno sensitive capabilityjingswap_close_depositsno sensitive capabilityjingswap_deposit_sbtcno sensitive capabilityjingswap_deposit_stxno sensitive capabilityjingswap_get_cycle_stateno sensitive capabilityjingswap_get_cycles_historyno sensitive capabilityjingswap_get_depositorsno sensitive capabilityjingswap_get_pricesno sensitive capabilityjingswap_get_settlementno sensitive capabilityjingswap_get_user_activityno sensitive capabilityjingswap_get_user_depositno sensitive capabilityjingswap_settleno sensitive capabilityjingswap_settle_with_refreshno sensitive capabilitylegion_concludeno sensitive capabilitylegion_contributeno sensitive capabilitylegion_get_storyno sensitive capabilitylegion_inscribe_revealno sensitive capabilitylegion_inscribe_storyno sensitive capabilitylegion_list_storiesno sensitive capabilitylegion_my_positionno sensitive capabilitylegion_propose_storyno sensitive capabilitylegion_sponsorno sensitive capabilitylegion_statusno sensitive capabilitylegion_voteno sensitive capabilitylightning_claim_depositno sensitive capabilitylightning_createno sensitive capabilitylightning_create_invoiceno sensitive capabilitylightning_fund_from_btcno sensitive capabilitylightning_importno sensitive capabilitylightning_lockno sensitive capabilitylightning_pay_invoiceno sensitive capabilitylightning_statusno sensitive capabilitylightning_unlockno sensitive capabilitylist_user_domainsno sensitive capabilitylist_x402_endpointsno sensitive capabilitylookup_bns_nameno sensitive capabilitynews_check_statusno sensitive capabilitynews_claim_beatno sensitive capabilitynews_deactivate_editorno sensitive capabilitynews_editor_check_earningsno sensitive capabilitynews_editor_file_reviewno sensitive capabilitynews_editor_review_signalno sensitive capabilitynews_file_correctionno sensitive capabilitynews_file_signalno sensitive capabilitynews_front_pageno sensitive capabilitynews_leaderboardno sensitive capabilitynews_list_beatsno sensitive capabilitynews_list_editorsno sensitive capabilitynews_publisher_compile_briefno sensitive capabilitynews_publisher_set_beat_configno sensitive capabilitynews_record_editor_payoutno sensitive capabilitynews_register_editorno sensitive capabilitynonce_fill_gapno sensitive capabilitynonce_healno sensitive capabilitynonce_healthno sensitive capabilitynostr_get_profileno sensitive capabilitynostr_get_pubkeyno sensitive capabilitynostr_postno sensitive capabilitynostr_read_feedno sensitive capabilitynostr_relay_listno sensitive capabilitynostr_search_tagsno sensitive capabilitynostr_set_profileno sensitive capabilityopenrouter_integration_guideno sensitive capabilityopenrouter_modelsno sensitive capabilityordinals_buyno sensitive capabilityordinals_cancel_listingno sensitive capabilityordinals_list_for_saleno sensitive capabilityordinals_list_for_sale_submitno sensitive capabilityordinals_p2p_agentsno sensitive capabilityordinals_p2p_cancelno sensitive capabilityordinals_p2p_counterno sensitive capabilityordinals_p2p_create_offerno sensitive capabilityordinals_p2p_my_tradesno sensitive capabilityordinals_p2p_psbt_swapno sensitive capabilityordinals_p2p_transferno sensitive capabilitypillar_direct_boostno sensitive capabilitypillar_direct_sendno sensitive capabilitypillar_direct_supplyno sensitive capabilitypillar_direct_unwindno sensitive capabilitypillar_key_generateno sensitive capabilitypillar_key_infono sensitive capabilitypillar_key_lockno sensitive capabilitypillar_key_unlockno sensitive capabilitypreorder_bns_nameno sensitive capabilityprobe_x402_endpointno sensitive capabilityregister_bns_nameno sensitive capabilityregister_identityno sensitive capabilityrequest_validationno sensitive capabilityreverse_bns_lookupno sensitive capabilitysend_inbox_messageno sensitive capabilitysend_inbox_message_directno sensitive capabilitytx_status_deepno sensitive capabilityzest_borrowno sensitive capabilityzest_enable_collateralno sensitive capabilityzest_get_positionno sensitive capabilityzest_list_assetsno sensitive capabilityzest_repayno sensitive capabilityzest_supplyno sensitive capabilityzest_withdrawno sensitive capability
Toxic flows 1
Cross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).
What this scan could not see
- Tools were statically extracted from the published source (200 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 6
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v1.69.0 latest |
A 90/100 | 7 | 1.13.0 | 2026-09-07 |
v1.68.0 |
A 90/100 | 7 | 1.13.0 | 2026-09-01 |
v1.67.0 |
A 90/100 | 7 | 1.12.1 | 2026-08-16 |
v1.66.0 |
A 90/100 | 7 | 1.12.1 | 2026-08-06 |
v1.65.1 |
A 90/100 | 7 | 1.12.1 | 2026-08-03 |
Show 1 more version ↓
v1.65.0 |
A 90/100 | 7 | 1.12.1 | 2026-07-29 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan @aibtc/mcp-server --onlineMore in Files & Storage
Safe bulk Meta ads: launch 150+ campaigns from Drive folders with spend guardrails and validation.
CLI tool to add MCP servers to various AI coding clients
MCP compatibility adapter for Agent Tool Protocol
MCP server for multi-tenant DuckDB management with R2/S3 storage
A stdio-to-HTTP MCP proxy that transparently intercepts file parameters, reading local files and base64-encoding them before forwarding to the remote server.
Free buyer-side outcome verification and provider comparison for supplied agent receipts.