Dexe MCP Server
dexe-mcp
npm
v0.33.0
Source verified
Published by edward-arinin-web-dev — publish provenance cryptographically ties this package to that repository. That is proof of origin, not an official vendor package.
MCP server for the DeXe Protocol — full DAO operations coverage: deploy DAOs, build every proposal type, IPFS metadata, stake/vote/delegate/execute/claim calldata. Plus dev tooling (build/test/introspect/decode).
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 6 = 94. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −6 | capability blast radius (high) — client exposure if the model is manipulated |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 5
high Shell/command execution in server code (dist/bootstrap.js)MTC-SRC-002
In the server's implementation (`dist/bootstrap.js:4`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: { execFile } from "node:child_process"; import { promisify } from "node:util"; import { envWithNodeBinDir, hasGit, npmCo
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/bootstrap.js
high Shell/command execution in server code (dist/runtime.js)MTC-SRC-002
In the server's implementation (`dist/runtime.js:4`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: { execFile } from "node:child_process"; import { redactUrlCredentials, safeErrorMessage } from "./lib/redact.js"; /** *
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/runtime.js
medium Untrusted input can drive an external actionMTC-FLOW-005
Untrusted-input tools ([dexe_ipfs_fetch, dexe_read_protocol_stats, dexe_read_privacy_policy_status]) co-exist with external-action tools ([dexe_ipfs_upload_file, dexe_proposal_build_offchain, dexe_proposal_build_token_transfer, dexe_auth_request_nonce, dexe_auth_login_request]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.
Evidence: untrusted [dexe_ipfs_fetch, dexe_read_protocol_stats, dexe_read_privacy_policy_status] → sinks [dexe_ipfs_upload_file, dexe_proposal_build_offchain, dexe_propos
Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.
Location: flow dexe_ipfs_fetch → dexe_ipfs_upload_file
medium Hardcoded egress to an external endpoint (dist/cli/init.js)MTC-SRC-003
In the server's implementation (`dist/cli/init.js:355`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: const r = await fetch("https://api.pinata.cloud/data/testAuthentication", { method: "GET",
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/cli/init.js
medium Hardcoded egress to an external endpoint (dist/tools/ipfs.js)MTC-SRC-003
In the server's implementation (`dist/tools/ipfs.js:99`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: const r = await fetch("https://api.dexe.io/integrations/ipfs-cache-svc/public/pool-info", { method:
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/tools/ipfs.js
Tools 168
Each tool and what it can reach — statically extracted from the published source.
dexe_auth_login_requestnetwork egressdexe_auth_request_noncenetwork egressdexe_ipfs_fetchingests untrusted inputdexe_ipfs_upload_filenetwork egressdexe_proposal_build_offchainnetwork egressdexe_proposal_build_token_transfernetwork egressdexe_read_privacy_policy_statusingests untrusted inputdexe_read_protocol_statsingests untrusted inputdexe_agents_fundno sensitive capabilitydexe_agents_ledgerno sensitive capability
Show 158 more tools ↓
dexe_agents_listno sensitive capabilitydexe_auth_loginno sensitive capabilitydexe_compileno sensitive capabilitydexe_contextno sensitive capabilitydexe_coverageno sensitive capabilitydexe_dao_build_deployno sensitive capabilitydexe_dao_createno sensitive capabilitydexe_dao_generate_avatarno sensitive capabilitydexe_dao_infono sensitive capabilitydexe_dao_predict_addressesno sensitive capabilitydexe_dao_registry_lookupno sensitive capabilitydexe_dao_reportno sensitive capabilitydexe_decode_calldatano sensitive capabilitydexe_decode_proposalno sensitive capabilitydexe_doctorno sensitive capabilitydexe_find_selectorno sensitive capabilitydexe_get_abino sensitive capabilitydexe_get_configno sensitive capabilitydexe_get_methodsno sensitive capabilitydexe_get_natspecno sensitive capabilitydexe_get_selectorsno sensitive capabilitydexe_get_sourceno sensitive capabilitydexe_gov_build_cancelno sensitive capabilitydexe_gov_build_delegateno sensitive capabilitydexe_gov_build_executeno sensitive capabilitydexe_gov_build_proposeno sensitive capabilitydexe_gov_build_queueno sensitive capabilitydexe_gov_build_vote_castno sensitive capabilitydexe_gov_decode_calldatano sensitive capabilitydexe_gov_get_proposalno sensitive capabilitydexe_gov_get_proposal_thresholdno sensitive capabilitydexe_gov_get_quorumno sensitive capabilitydexe_gov_get_stateno sensitive capabilitydexe_gov_get_voting_powerno sensitive capabilitydexe_gov_has_votedno sensitive capabilitydexe_gov_hash_descriptionno sensitive capabilitydexe_gov_hash_proposalno sensitive capabilitydexe_gov_list_governorsno sensitive capabilitydexe_gov_simulate_proposalno sensitive capabilitydexe_gov_simulate_vote_impactno sensitive capabilitydexe_graph_queryno sensitive capabilitydexe_graph_schemano sensitive capabilitydexe_guideno sensitive capabilitydexe_ipfs_cid_for_jsonno sensitive capabilitydexe_ipfs_cid_infono sensitive capabilitydexe_ipfs_update_dao_metadatano sensitive capabilitydexe_ipfs_upload_avatarno sensitive capabilitydexe_ipfs_upload_dao_metadatano sensitive capabilitydexe_ipfs_upload_proposal_metadatano sensitive capabilitydexe_lintno sensitive capabilitydexe_list_contractsno sensitive capabilitydexe_list_gov_contract_typesno sensitive capabilitydexe_merkle_buildno sensitive capabilitydexe_merkle_proofno sensitive capabilitydexe_offchain_build_cancel_voteno sensitive capabilitydexe_offchain_build_voteno sensitive capabilitydexe_otc_buyer_buyno sensitive capabilitydexe_otc_buyer_claim_allno sensitive capabilitydexe_otc_buyer_statusno sensitive capabilitydexe_otc_dao_open_saleno sensitive capabilitydexe_otc_list_sales_for_daono sensitive capabilitydexe_proposal_build_add_expertno sensitive capabilitydexe_proposal_build_apply_to_daono sensitive capabilitydexe_proposal_build_blacklistno sensitive capabilitydexe_proposal_build_change_math_modelno sensitive capabilitydexe_proposal_build_change_validator_balancesno sensitive capabilitydexe_proposal_build_change_validator_settingsno sensitive capabilitydexe_proposal_build_change_voting_settingsno sensitive capabilitydexe_proposal_build_create_staking_tierno sensitive capabilitydexe_proposal_build_custom_abino sensitive capabilitydexe_proposal_build_delegate_to_expertno sensitive capabilitydexe_proposal_build_externalno sensitive capabilitydexe_proposal_build_internalno sensitive capabilitydexe_proposal_build_manage_validatorsno sensitive capabilitydexe_proposal_build_modify_dao_profileno sensitive capabilitydexe_proposal_build_monthly_withdrawno sensitive capabilitydexe_proposal_build_new_proposal_typeno sensitive capabilitydexe_proposal_build_offchain_for_againstno sensitive capabilitydexe_proposal_build_offchain_internal_proposalno sensitive capabilitydexe_proposal_build_offchain_multi_optionno sensitive capabilitydexe_proposal_build_offchain_settingsno sensitive capabilitydexe_proposal_build_offchain_single_optionno sensitive capabilitydexe_proposal_build_remove_expertno sensitive capabilitydexe_proposal_build_revoke_from_expertno sensitive capabilitydexe_proposal_build_reward_multiplierno sensitive capabilitydexe_proposal_build_token_distributionno sensitive capabilitydexe_proposal_build_token_saleno sensitive capabilitydexe_proposal_build_token_sale_multino sensitive capabilitydexe_proposal_build_token_sale_recoverno sensitive capabilitydexe_proposal_build_token_sale_whitelistno sensitive capabilitydexe_proposal_build_withdraw_treasuryno sensitive capabilitydexe_proposal_catalogno sensitive capabilitydexe_proposal_createno sensitive capabilitydexe_proposal_forecastno sensitive capabilitydexe_proposal_listno sensitive capabilitydexe_proposal_risk_assessno sensitive capabilitydexe_proposal_stateno sensitive capabilitydexe_proposal_vote_and_executeno sensitive capabilitydexe_proposal_votersno sensitive capabilitydexe_read_dao_expertsno sensitive capabilitydexe_read_dao_listno sensitive capabilitydexe_read_dao_membersno sensitive capabilitydexe_read_dao_statsno sensitive capabilitydexe_read_delegation_mapno sensitive capabilitydexe_read_distribution_statusno sensitive capabilitydexe_read_expert_statusno sensitive capabilitydexe_read_gov_stateno sensitive capabilitydexe_read_multicallno sensitive capabilitydexe_read_nftsno sensitive capabilitydexe_read_settingsno sensitive capabilitydexe_read_staking_infono sensitive capabilitydexe_read_token_holdersno sensitive capabilitydexe_read_token_sale_tiersno sensitive capabilitydexe_read_token_sale_userno sensitive capabilitydexe_read_treasuryno sensitive capabilitydexe_read_user_activityno sensitive capabilitydexe_read_validator_listno sensitive capabilitydexe_read_validatorsno sensitive capabilitydexe_safe_infono sensitive capabilitydexe_safe_propose_txno sensitive capabilitydexe_sim_buyno sensitive capabilitydexe_sim_calldatano sensitive capabilitydexe_sim_proposalno sensitive capabilitydexe_testno sensitive capabilitydexe_tx_sendno sensitive capabilitydexe_tx_statusno sensitive capabilitydexe_user_inboxno sensitive capabilitydexe_vote_build_cancel_voteno sensitive capabilitydexe_vote_build_claim_micropool_rewardsno sensitive capabilitydexe_vote_build_claim_rewardsno sensitive capabilitydexe_vote_build_delegateno sensitive capabilitydexe_vote_build_depositno sensitive capabilitydexe_vote_build_distribution_claimno sensitive capabilitydexe_vote_build_erc20_approveno sensitive capabilitydexe_vote_build_executeno sensitive capabilitydexe_vote_build_move_to_validatorsno sensitive capabilitydexe_vote_build_multicallno sensitive capabilitydexe_vote_build_nft_multiplier_lockno sensitive capabilitydexe_vote_build_nft_multiplier_unlockno sensitive capabilitydexe_vote_build_privacy_policy_agreeno sensitive capabilitydexe_vote_build_privacy_policy_signno sensitive capabilitydexe_vote_build_staking_claimno sensitive capabilitydexe_vote_build_staking_claim_allno sensitive capabilitydexe_vote_build_staking_reclaimno sensitive capabilitydexe_vote_build_staking_stakeno sensitive capabilitydexe_vote_build_token_sale_buyno sensitive capabilitydexe_vote_build_token_sale_claimno sensitive capabilitydexe_vote_build_token_sale_vesting_withdrawno sensitive capabilitydexe_vote_build_undelegateno sensitive capabilitydexe_vote_build_validator_cancel_voteno sensitive capabilitydexe_vote_build_validator_voteno sensitive capabilitydexe_vote_build_voteno sensitive capabilitydexe_vote_build_withdrawno sensitive capabilitydexe_vote_get_votesno sensitive capabilitydexe_vote_user_powerno sensitive capabilitydexe_wc_connectno sensitive capabilitydexe_wc_disconnectno sensitive capabilitydexe_wc_statusno sensitive capability
Toxic flows 1
Cross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).
What this scan could not see
- Tools were statically extracted from the published source (168 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 4
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v0.33.0 latest |
A 94/100 | 5 | 1.13.0 | 2026-09-07 |
v0.29.0 |
A 94/100 | 5 | 1.12.1 | 2026-08-06 |
v0.24.1 |
A 100/100 | 4 | 1.5.0 | 2026-07-22 |
v0.24.0 |
A 100/100 | 4 | 1.4.2 | 2026-07-22 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan dexe-mcp --onlineMore in Business & CRM
Free public tax reference data — GST/VAT, income, company and capital-gains tax rules for 50+ countries.
The approval gate for unattended UCP buying agents — a policy/approval MCP proxy in front of a merchant's UCP checkout endpoint.
Autotask PSA MCP server. Generic entity query/get/create/update across the full REST API plus convenience tools for tickets, companies, contacts, projects, tasks and time entries. AI-safe with readonly mode and destructive-action confirmation. stdio + opt
MCP server for B2C Commerce developer experience tools
Search, compare and contact real-world companies through a public MCP business directory.
Norwegian business register (Brønnøysundregistrene) as an MCP server — companies, roles, subunits and annual accounts, with the register's silent traps encoded as guards.