openocean-mcp

The server demonstrates good input validation using `zod` and `viem/utils` for addresses, hashes, and amounts, which mitigates common injection vulnerabilities. It interacts with OpenOcean APIs over HTTPS, relying on standard secure communication. Critically, the `SWAP` tool only builds transaction data; it does not handle private keys or directly sign/execute transactions on-chain, delegating that responsibility to the client, which is a strong security practice. No `eval` or `child_process` usage was found. A hardcoded `referrer` address is present in the `SwapService` but this is not a security vulnerability. The server does not appear to expose any API keys or sensitive credentials through environment variables in the provided code, as the OpenOcean API URLs are hardcoded. If OpenOcean APIs eventually require authentication, this setup would need to be updated to securely handle API keys.