mcp-server

The server is designed as a wrapper for external Blockscout APIs. It implements several safety measures: no direct 'eval()' or obfuscation found; external API calls include timeouts and retries; API keys are expected via environment variables ('BLOCKSCOUT_BS_API_KEY'), preventing hardcoding. The 'direct_api_call' tool provides access to a curated list of Blockscout endpoints, not arbitrary URLs, mitigating SSRF risks, and enforces a response size limit for AI clients (with an explicit bypass header for REST clients). 'read_contract' uses web3.py for read-only 'eth_call' operations with input validation. Anonymous telemetry data (tool name, args, client info, IP for geolocation) is collected by default but offers an opt-out. No personal data, secrets, or private keys are collected. Overall, the design shows a proactive approach to security in an external API integration context.