qortal-mcp-server

The project adheres to a robust and explicitly enforced read-only security model. It strictly whitelists GET endpoints, performs rigorous input validation (e.g., address formats, numeric ranges, list limits) before querying the Qortal Core node, and sanitizes/truncates outputs to prevent data leaks or excessive payloads. The Qortal Core API key is kept server-side and never exposed. Rate limiting is implemented per-tool. Error handling is standardized to prevent exposure of internal stack traces. There is no evidence of 'eval' or obfuscation. Deployment notes advise on external exposure for enhanced security.