circular-mcp

The server's tools make direct HTTP POST requests to `https://nag.circularlabs.io/NAG.php` for all blockchain interactions. A critical security concern is the discrepancy between the `README` and the actual source code: the `README` explicitly states that environment variables (e.g., `ACME_API_KEY`) are used for authentication within generated tools, but the provided tool code snippets (e.g., `get-domain.js`, `send-transaction.js`) do not incorporate `process.env` variables into their requests. This means sensitive operations like `send_transaction` are sent without any explicit API key in the headers from the client-side tool, which is a major functional and security gap if the `nag.circularlabs.io` API requires authentication. Additionally, some tools (`get-transaction-by-id`, `get-blockchains`, `get-transaction-by-node`) explicitly set a `timestamp` header to an empty string (`''`), which could cause API request failures if the backend expects a valid timestamp format for security or request validation. The entire system relies on a single external API endpoint (`nag.circularlabs.io`), introducing a single point of failure.