bnbchain-mcp
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to run
npx @bnb-chain/mcp@latest. This downloads the MCP server from the official npm registry. The source code is associated with the official bnb-chain GitHub repository, which is a well-known and trusted vendor in the blockchain ecosystem. - [CREDENTIALS_SAFE]: While the skill mentions the use of a
PRIVATE_KEY, it follows security best practices by instructing users to set it only in the MCP server environment variables (env) and explicitly warns against logging or exposing private keys in chat or logs. It correctly identifies placeholders and environment variable usage rather than hardcoding secrets. - [COMMAND_EXECUTION]: The skill uses standard command-line instructions for connecting to the MCP server (e.g.,
npx,bun dev:sse). These are functional requirements for the skill's purpose and are not obfuscated or malicious. - [SAFE]: The skill implements safety checkpoints, requiring the agent to confirm transaction details (recipient, amount, network) with the user before performing state-changing write operations.
Audit Metadata