moonpay-mcp
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides standard setup instructions for integrating the MoonPay CLI with MCP-compatible clients like Claude Desktop and Claude Code.
- [EXTERNAL_DOWNLOADS]: The instructions include installing the
@moonpay/clipackage from the NPM registry. This is a vendor-owned resource that matches the skill's stated purpose and author. - [COMMAND_EXECUTION]: The skill provides legitimate configuration commands to register the MoonPay CLI as an MCP server. It also references the standard local credential storage path used by the MoonPay CLI (
~/.config/moonpay/credentials.json). - [INDIRECT_PROMPT_INJECTION]: By adding financial, wallet management, and token swap capabilities to the agent, the skill expands the agent's action surface. This is the intended functionality of an MCP tool integration. User review of transaction details is recommended during runtime usage of these tools.
Audit Metadata