infura-mcp-server

The server demonstrates strong security practices: comprehensive input validation (`lib/validators.js`) prevents common injection attacks for addresses, hashes, and network names. Operations are explicitly read-only, preventing any blockchain state modification. API keys are strictly managed via environment variables. The HTTP mode implements robust security headers (Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) and disables server fingerprinting. CORS is also properly configured. No `eval` or obvious malicious patterns were found. The primary security risk lies in the secure management of the `INFURA_API_KEY` by the user outside of the application's code.