mcp-base-mcp-pibe

The server stores sensitive credentials (Coinbase API keys, wallet seed phrase, other API keys) in plain text JSON configuration files on the user's local filesystem via its initialization CLI, which is a significant local security risk. The `buy_openrouter_credits` tool relies on a third-party API (`openrouter.ai`) to provide transaction intent data (`call_data`) for on-chain transfers; a compromise of this third-party API could lead to malicious fund transfers. Additionally, client configurations use `npx -y base-mcp@latest`, dynamically pulling the latest package version, which could expose users to supply chain attacks if the npm package is compromised. While the core blockchain interaction logic uses robust libraries like AgentKit and Viem, these configuration and third-party dependencies introduce notable vulnerabilities.