alchemy-mcp
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes live blockchain data, including NFT metadata and transaction traces, which are untrusted external sources. While this presents a surface for indirect prompt injection, it is a standard characteristic of blockchain data analysis tools.
- Ingestion points: Blockchain RPC and Data tools (e.g.,
getNFTMetadata,traceTransaction,solana_getAsset). - Boundary markers: Not explicitly defined in the provided markdown instructions.
- Capability inventory: Extensive account management tools (
create_app,update_allowlist) and network-connected blockchain queries. - Sanitization: Relies on the hosted Alchemy MCP server and the underlying model's safety guardrails.
- [EXTERNAL_DOWNLOADS]: The skill connects to the hosted Alchemy MCP server at
https://mcp.alchemy.com/mcpand references the vendor's official GitHub repository (github.com/alchemyplatform/alchemy-mcp-server). These are legitimate resources provided by the skill's author.
Audit Metadata