bitcoin-mcp

The server uses `superagent` to interact with the public mempool.space API, and `zod` for input validation on tool arguments, which are good practices. There are no direct uses of `eval`, obfuscated code, or hardcoded sensitive secrets. Setup scripts (setup.js, postinstall.js) modify known configuration files for specific MCP clients (Claude Desktop) but do not perform operations that suggest malicious intent or severe vulnerabilities. The primary security consideration is the reliance on the external `mempool.space` API for data integrity and availability, which is generally a trusted public service.