x402-fetch-mcp

Private keys are stored in `~/.x402/config.json` with `600` permissions, restricting access to the owner, which is a good security practice. The README explicitly discourages using environment variables for private keys to prevent exposure, though the code includes environment variables as a fallback for backward compatibility. There is no evidence of `eval` or dynamic code execution from untrusted sources. The core functionality involves blockchain transactions and fetching arbitrary URLs, inherent to its design, relying on the security of underlying libraries (`viem`, `@x402/fetch`).